BPF size limitation

[strasharo]

Is there any size limitation for the maximum size of the bpf used for filtering? At 1291 characters it appears to work fine. At 1365 characters it fails with:

scan frequencies: frequency [channel] of Regulatory Domain: 00
2412 [ 1] 2437 [ 6] 2462 [ 11]
failed to open raw packet socket
[?25h1 ERROR(s) during runtime
Possible reasons:
driver is broken
driver is busy (misconfigured system, other services access the INTERFACE)
1 Packet(s) captured by kernel
0 Packet(s) dropped by kernel
Warning: too less packets received (monitor mode may not work as expected)
Possible reasons:
driver is broken (most likely)
no transmitter in range
frames are filtered out by BPF
1 SHB written to pcapng dumpfile
1 IDB written to pcapng dumpfile
1 ECB written to pcapng dumpfile
0 EPB written to pcapng dumpfile

It's not driver specific, fails on all with the same error. Took me a while to realize the reason, I thought I broke something with the drivers. That's on OpenWRT latest compiled from source.

[ZerBea]

The maximum number of instructions (BPF_MAXINSNS) that the unprivileged BPF program can have is limited to 4096.
Q: What are the verifier limits?

Both tools check the length:
https://github.com/ZerBea/hcxdumptool/blob/master/hcxdumptool.c#L4440
https://github.com/ZerBea/wifi_laboratory/blob/main/hcxlabtool.c#L4709

If that failed, both tools show an error:
fprintf(stderr, "failed to read BPF\n");

Instrucitons is not equal to characters. FIltereing a single MAC and setting the snaplen are 16 instructions:

$ hcxdumptool --bpfc="not wlan addr3 111111111111" | wc
     16      64     157

The more MAC to be filtered, the instructions increase:

$ hcxdumptool --bpfc="not wlan addr3 111111111111 and not wlan addr3 222222222222" | wc
     19      76     196

$ hcxdumptool --bpfc="not wlan addr3 111111111111 and not wlan addr1 222222222222" | wc
     20      80     204

$ hcxdumptool --bpfc="not wlan addr1 111111111111 and not wlan addr2 222222222222" | wc
     26     104     267

[ZerBea]

I just made an attempt.
This code generates a command line of 501 MACs to be filtered:

#define _GNU_SOURCE
#include <ctype.h>
#include <dirent.h>
#include <fcntl.h>
#include <ftw.h>
#include <libgen.h>
#include <stdarg.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <unistd.h>
#include <utime.h>
#include <inttypes.h>

/*===========================================================================*/
int main()
{
int a = 0;

uint64_t mac = 0x112233445566;

fprintf(stdout,"hcxdumptool --bpfc=\"not wlan addr3 112233445566");
for(a = 0; a < 500; a++)
	fprintf(stdout, " and not wlan addr3 %012" PRIx64, mac + a);
fprintf(stdout,"\"\n");
return EXIT_SUCCESS;
}

It compiles as expected (hcxdumptool/hcxlabtool) and the size of the BPF is 760 instructions:

$ wc test.bpf
  760  3040 11492 test.bpf

Driver is rtl8xxxu:

$ hcxdumptool -l
  10	 13	5ce931984b44	980ee4b8cd3b	+	wlp5s0f3u2      	rtl8xxxu	NETLINK

Everything is as expected:

$ sudo hcxdumptool -i wlp5s0f3u2 --rcascan=active --bpf=test.bpf
...
^C
265 Packet(s) captured by kernel
0 Packet(s) dropped by kernel
77 PROBERESPONSE(s) captured

How many instructions does your bpf contain?

[strasharo]

This is the sample bpf which fails it for me when being ran (last three octets swapped with FF just for the sample):

not wlan addr1 D8:07:B6:FF:FF:FF and not wlan addr2 D8:07:B6:FF:FF:FF and not wlan addr3 D8:07:B6:FF:FF:FF and not wlan addr1 AC:8B:A9:FF:FF:FF and not wlan addr2 AC:8B:A9:FF:FF:FF and not wlan addr3 AC:8B:A9:FF:FF:FF and not wlan addr1 AC:8B:A9:FF:FF:FF and not wlan addr2 AC:8B:A9:FF:FF:FF and not wlan addr3 AC:8B:A9:FF:FF:FF and not wlan addr1 B2:8B:A9:FF:FF:FF and not wlan addr2 B2:8B:A9:FF:FF:FF and not wlan addr3 B2:8B:A9:FF:FF:FF and not wlan addr1 AC:15:A2:FF:FF:FF and not wlan addr2 AC:15:A2:FF:FF:FF and not wlan addr3 AC:15:A2:FF:FF:FF and not wlan addr1 F0:B4:29:FF:FF:FF and not wlan addr2 F0:B4:29:FF:FF:FF and not wlan addr3 F0:B4:29:FF:FF:FF and not wlan addr1 A4:7E:39:FF:FF:FF and not wlan addr2 A4:7E:39:FF:FF:FF and not wlan addr3 A4:7E:39:FF:FF:FF and not wlan addr1 30:05:05:FF:FF:FF and not wlan addr2 30:05:05:FF:FF:FF and not wlan addr1 DC:4F:22:FF:FF:FF and not wlan addr2 DC:4F:22:FF:FF:FF and not wlan addr1 5C:CF:7F:FF:FF:FF and not wlan addr2 5C:CF:7F:FF:FF:FF and not wlan addr1 64:90:C1:FF:FF:FF and not wlan addr2 64:90:C1:FF:FF:FF and not wlan addr1 5C:E5:0C:FF:FF:FF and not wlan addr2 5C:E5:0C:FF:FF:FF and not wlan addr1 8C:C8:4B:FF:FF:FF and not wlan addr2 8C:C8:4B:FF:FF:FF and not wlan addr1 70:03:9F:FF:FF:FF and not wlan addr2 70:03:9F:FF:FF:FF and not wlan addr1 00:E0:4C:FF:FF:FF and not wlan addr2 00:E0:4C:FF:FF:FF
That would be 37 instructions I guess.

[ZerBea]

The problem is located here:
https://github.com/ZerBea/hcxdumptool/blob/master/hcxdumptool.c#L4079

I'll add some debug code.

[strasharo]

Tried to run xargs --show-limits on OpenWRT, but it doesn't have that argument there.

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt 24.10-SNAPSHOT, r28218-45bf30e062
 -----------------------------------------------------
root@zerowrt:~# xargs --show-limits
xargs: unrecognized option: show-limits
BusyBox v1.36.1 (2024-12-24 10:25:39 UTC) multi-call binary.

Usage: xargs [OPTIONS] [PROG ARGS]

Run PROG on every item given by stdin

	-0	NUL terminated input
	-o	Reopen stdin as /dev/tty
	-r	Don't run command if input is empty
	-t	Print the command on stderr before execution
	-p	Ask user whether to run each command
	-E STR,-e[STR]	STR stops input processing
	-n N	Pass no more than N args to PROG
	-s N	Pass command line of no more than N bytes
	-x	Exit if size is exceeded
root@zerowrt:~# 

[ZerBea]

OK, its not compiled in. No problem.

This version included a debug output:
hcxdumptool.c.zip
replace hcxdumptool.c by this version and recompile.
Than run it to retrieve a detailed ERROR message (errno).

This are the changes:

if(bpf.len > 0)
	{
	int retdump = 0;
	retdump = setsockopt(fd_socket_rx, SOL_SOCKET, SO_ATTACH_FILTER, &bpf, sizeof(bpf));
	fprintf(stdout, "SO_ATTACH_FILTER failed: %s\n", strerror(errno));
	if(retdump < 0) return false;
	}

[ZerBea]

Improved the default debug mode of hcxdumptool and hcxlabtool by latest commits.
Now SO_ATTACH_FILTER has been added to the debug log, if something went wrong here.

[ZerBea]

Instead of switching the source code, you can enable it the debug log in Makefile::

# uncomment to enable DEBUG log
#DEFS		+= -DHCXDEBUG