Piffle, a Packet Filter Language

http://code.google.com/p/piffle/wiki/PiffleWiki

What is Piffle?

• "Piffle" is a pronounceable form of PFL, that is, Packet Filter Language. ("Piffle" is also an obscure word for "chatter".)

• Piffle is a programming language for writing network packet filters.

• The Piffle compiler is implemented in Haskell.

• The Piffle compiler accepts resource limits on the processor time and memory used for processing each packet of input; simply pass the -C or -M option, and it will check at compile time that your program cannot not exceed the limits you specify.

• Piffle is easy to learn, because it is built around the familiar abstractions of procedural languages such as C and Pascal.

• Piffle programs can be compiled with interchangeable back-ends called "boilerplates". The pcap boilerplate, which comes with the Piffle compiler, allows Piffle programs to read and write pcap/tcpdump dump files, to read packets from network devices, and to preprocess packets with Berkeley Packet Filters. You can write your own boilerplates to talk to other network monitoring interfaces, such as tun/tap.

• Piffle runs on GNU/Linux systems, and is designed to be portable to other POSIX-compliant systems that run the GNU C Compiler gcc and the Glasgow Haskell Compiler ghc.

• Hopefully, Piffle will in the future become available as an operation in Streamline, an advanced network monitoring framework, formerly known as FFPF, the fairly fast packet filter. Streamline is being developed at the VU Amsterdam Computer Systems Section. Within Streamline, Piffle will coexist with Ruler, a regular-expression based packet rewriting language.

To learn more

To learn more, please read the manual, which contains a general story about bounded packet filters, the language definition, the man page for the compiler, and an example of a packet filter written in Piffle.

The author

Piffle was designed and implemented by Jaap Weel as part of the Compiler Construction Practical course at the VU Amsterdam CS department. You can contact the author at weel at ugcs dot caltech dot edu , or visit his web site at http://www.ugcs.caltech.edu/~weel.

Contribute

I would very much appreciate if people could try to compile and run Piffle (in particular make test) on their own machines, and report any problems on the issues page or by e-mail.

Possible extensions

I think it is better to first make reasonably sure that the basic language as it now stands is correctly implemented, but I do have some possible PiffleImprovements in mind.