#!/usr/bin/env python3
import ctypes
import socket

#bpf instruction
class bpf_inst(ctypes.Structure):
      _fields_=[
                ("code",ctypes.c_uint16),
                ("jt",ctypes.c_uint8),
                ("jf",ctypes.c_uint8),
                ("k",ctypes.c_uint32),
               ]

class bpf_fprog(ctypes.Structure):
       _fields_=[
                 ("length",ctypes.c_ushort),
                 ("filters",ctypes.POINTER(bpf_inst*5)),
                ]

class Constants(object):
  #bpf classes
  BPF_LD=0x00
  BPF_LDX=0x01
  BPF_ST=0x02
  BPF_STX=0x03
  BPF_ALU=0x04
  BPF_JMP=0x05
  BPF_RET=0x06
  BPF_MISC=0x07

  '''For jump and arithmetic instructions
  bpf sources
  For BPF_ALU or BPF_JMP'''
  BPF_K=0x00
  BPF_X=0x08
  '''bpf opcodes
  For BPF_ALU'''
  BPF_ADD=0x00
  BPF_SUB=0x10
  BPF_MUL=0x20
  BPF_DIV=0x30
  BPF_OR=0x40
  BPF_AND=0x50
  BPF_LSH=0x60
  BPF_RSH=0x70
  BPF_NEG=0x80
  BPF_MOD=0x90
  BPF_XOR=0xa0
  BPF_MOV=0xb0
  BPF_ARSH=0xc0
  BPF_END=0xd0
  #For BPF_JMP
  BPF_JA=0x00
  BPF_JEQ=0x10
  BPF_JGT=0x20
  BPF_JGE=0x30
  BPF_JSET=0x40
  BPF_JNE=0x50
  BPF_JSGT=0x60
  BPF_JSGE=0x70
  BPF_CALL=0x80
  BPF_EXIT=0x90
  BPF_JLT=0xa0
  BPF_JLE=0xb0
  BPF_JSLT=0xc0
  BPF_JSLE=0xd0

  '''For load and store instruction
  bpf size modifiers'''
  BPF_W=0x00
  BPF_H=0x08
  BPF_B=0x10
  BPF_DW=0x18
  #bpf mode modifiers
  BPF_IMM=0x00
  BPF_ABS=0x20
  BPF_IND=0x40
  BPF_MEM=0x60
  BPF_LEN=0x80
  BPF_MSH=0xa0
  BPF_XADD=0xc0

  BPF_A=0x10

  #Socket filter
  SO_ATTACH_FILTER = 26



filters=[(Constants.BPF_LD | Constants.BPF_H | Constants.BPF_ABS,0,0,12),
         (Constants.BPF_JMP | Constants.BPF_JEQ | Constants.BPF_K,0,2,0x800),
         (Constants.BPF_LD | Constants.BPF_W | Constants.BPF_ABS,0,0,4),
         (Constants.BPF_RET | Constants.BPF_A,0,0,0),
         (Constants.BPF_RET | Constants.BPF_K,0,0,0),
        ]

fprog=bpf_fprog(5,ctypes.pointer((bpf_inst*5)(*filters)))
s = socket.socket(socket.PF_PACKET, socket.SOCK_RAW)
s.setsockopt(socket.SOL_SOCKET,Constants.SO_ATTACH_FILTER, fprog)
s.bind(('eth0', 0x0800))

while True:
    data, addr = s.recvfrom(65565)
    print(data)