Mirror of strace – the linux syscall tracer
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

bpf_sock_filter.c 1.3KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556
  1. /*
  2. * Decoder of socket filter programs.
  3. *
  4. * Copyright (c) 2017 Dmitry V. Levin <ldv@altlinux.org>
  5. * Copyright (c) 2017-2019 The strace developers.
  6. * All rights reserved.
  7. *
  8. * SPDX-License-Identifier: LGPL-2.1-or-later
  9. */
  10. #include "defs.h"
  11. #include "bpf_filter.h"
  12. #include <linux/filter.h>
  13. #include "xlat/skf_ad.h"
  14. #define XLAT_MACROS_ONLY
  15. # include "xlat/skf_off.h"
  16. #undef XLAT_MACROS_ONLY
  17. static bool
  18. print_sock_filter_k(const struct bpf_filter_block *const fp)
  19. {
  20. if (BPF_CLASS(fp->code) == BPF_LD && BPF_MODE(fp->code) == BPF_ABS) {
  21. if (fp->k >= (unsigned int) SKF_AD_OFF) {
  22. print_xlat32(SKF_AD_OFF);
  23. tprints("+");
  24. printxval(skf_ad, fp->k - (unsigned int) SKF_AD_OFF,
  25. "SKF_AD_???");
  26. return true;
  27. } else if (fp->k >= (unsigned int) SKF_NET_OFF) {
  28. print_xlat32(SKF_NET_OFF);
  29. tprintf("+%u", fp->k - (unsigned int) SKF_NET_OFF);
  30. return true;
  31. } else if (fp->k >= (unsigned int) SKF_LL_OFF) {
  32. print_xlat32(SKF_LL_OFF);
  33. tprintf("+%u", fp->k - (unsigned int) SKF_LL_OFF);
  34. return true;
  35. }
  36. }
  37. return false;
  38. }
  39. void
  40. print_sock_fprog(struct tcb *const tcp, const kernel_ulong_t addr,
  41. const unsigned short len)
  42. {
  43. print_bpf_fprog(tcp, addr, len, print_sock_filter_k);
  44. }
  45. void
  46. decode_sock_fprog(struct tcb *const tcp, const kernel_ulong_t addr)
  47. {
  48. decode_bpf_fprog(tcp, addr, print_sock_filter_k);
  49. }