Mirror of strace – the linux syscall tracer
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

bpf_sock_filter.c 1.3KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354
  1. /*
  2. * Decoder of socket filter programs.
  3. *
  4. * Copyright (c) 2017 Dmitry V. Levin <ldv@altlinux.org>
  5. * Copyright (c) 2017-2018 The strace developers.
  6. * All rights reserved.
  7. *
  8. * SPDX-License-Identifier: LGPL-2.1-or-later
  9. */
  10. #include "defs.h"
  11. #include "bpf_filter.h"
  12. #include <linux/filter.h>
  13. #include "xlat/skf_ad.h"
  14. #include "xlat/skf_off.h"
  15. static bool
  16. print_sock_filter_k(const struct bpf_filter_block *const fp)
  17. {
  18. if (BPF_CLASS(fp->code) == BPF_LD && BPF_MODE(fp->code) == BPF_ABS) {
  19. if (fp->k >= (unsigned int) SKF_AD_OFF) {
  20. print_xlat32(SKF_AD_OFF);
  21. tprints("+");
  22. printxval(skf_ad, fp->k - (unsigned int) SKF_AD_OFF,
  23. "SKF_AD_???");
  24. return true;
  25. } else if (fp->k >= (unsigned int) SKF_NET_OFF) {
  26. print_xlat32(SKF_NET_OFF);
  27. tprintf("+%u", fp->k - (unsigned int) SKF_NET_OFF);
  28. return true;
  29. } else if (fp->k >= (unsigned int) SKF_LL_OFF) {
  30. print_xlat32(SKF_LL_OFF);
  31. tprintf("+%u", fp->k - (unsigned int) SKF_LL_OFF);
  32. return true;
  33. }
  34. }
  35. return false;
  36. }
  37. void
  38. print_sock_fprog(struct tcb *const tcp, const kernel_ulong_t addr,
  39. const unsigned short len)
  40. {
  41. print_bpf_fprog(tcp, addr, len, print_sock_filter_k);
  42. }
  43. void
  44. decode_sock_fprog(struct tcb *const tcp, const kernel_ulong_t addr)
  45. {
  46. decode_bpf_fprog(tcp, addr, print_sock_filter_k);
  47. }