]>
Commit | Line | Data |
---|---|---|
fd981e3c DB |
1 | /* |
2 | * Minimal BPF debugger | |
3 | * | |
4 | * Minimal BPF debugger that mimics the kernel's engine (w/o extensions) | |
5 | * and allows for single stepping through selected packets from a pcap | |
6 | * with a provided user filter in order to facilitate verification of a | |
7 | * BPF program. Besides others, this is useful to verify BPF programs | |
8 | * before attaching to a live system, and can be used in socket filters, | |
9 | * cls_bpf, xt_bpf, team driver and e.g. PTP code; in particular when a | |
10 | * single more complex BPF program is being used. Reasons for a more | |
11 | * complex BPF program are likely primarily to optimize execution time | |
12 | * for making a verdict when multiple simple BPF programs are combined | |
13 | * into one in order to prevent parsing same headers multiple times. | |
14 | * | |
15 | * More on how to debug BPF opcodes see Documentation/networking/filter.txt | |
16 | * which is the main document on BPF. Mini howto for getting started: | |
17 | * | |
18 | * 1) `./bpf_dbg` to enter the shell (shell cmds denoted with '>'): | |
19 | * 2) > load bpf 6,40 0 0 12,21 0 3 20... (output from `bpf_asm` or | |
20 | * `tcpdump -iem1 -ddd port 22 | tr '\n' ','` to load as filter) | |
21 | * 3) > load pcap foo.pcap | |
22 | * 4) > run <n>/disassemble/dump/quit (self-explanatory) | |
23 | * 5) > breakpoint 2 (sets bp at loaded BPF insns 2, do `run` then; | |
24 | * multiple bps can be set, of course, a call to `breakpoint` | |
25 | * w/o args shows currently loaded bps, `breakpoint reset` for | |
26 | * resetting all breakpoints) | |
27 | * 6) > select 3 (`run` etc will start from the 3rd packet in the pcap) | |
28 | * 7) > step [-<n>, +<n>] (performs single stepping through the BPF) | |
29 | * | |
30 | * Copyright 2013 Daniel Borkmann <borkmann@redhat.com> | |
31 | * Licensed under the GNU General Public License, version 2.0 (GPLv2) | |
32 | */ | |
33 | ||
34 | #include <stdio.h> | |
35 | #include <unistd.h> | |
36 | #include <stdlib.h> | |
37 | #include <ctype.h> | |
38 | #include <stdbool.h> | |
39 | #include <stdarg.h> | |
40 | #include <setjmp.h> | |
41 | #include <linux/filter.h> | |
42 | #include <linux/if_packet.h> | |
43 | #include <readline/readline.h> | |
44 | #include <readline/history.h> | |
45 | #include <sys/types.h> | |
46 | #include <sys/socket.h> | |
47 | #include <sys/stat.h> | |
48 | #include <sys/mman.h> | |
49 | #include <fcntl.h> | |
50 | #include <errno.h> | |
51 | #include <signal.h> | |
52 | #include <arpa/inet.h> | |
53 | #include <net/ethernet.h> | |
54 | ||
55 | #define TCPDUMP_MAGIC 0xa1b2c3d4 | |
56 | ||
57 | #define BPF_LDX_B (BPF_LDX | BPF_B) | |
58 | #define BPF_LDX_W (BPF_LDX | BPF_W) | |
59 | #define BPF_JMP_JA (BPF_JMP | BPF_JA) | |
60 | #define BPF_JMP_JEQ (BPF_JMP | BPF_JEQ) | |
61 | #define BPF_JMP_JGT (BPF_JMP | BPF_JGT) | |
62 | #define BPF_JMP_JGE (BPF_JMP | BPF_JGE) | |
63 | #define BPF_JMP_JSET (BPF_JMP | BPF_JSET) | |
64 | #define BPF_ALU_ADD (BPF_ALU | BPF_ADD) | |
65 | #define BPF_ALU_SUB (BPF_ALU | BPF_SUB) | |
66 | #define BPF_ALU_MUL (BPF_ALU | BPF_MUL) | |
67 | #define BPF_ALU_DIV (BPF_ALU | BPF_DIV) | |
68 | #define BPF_ALU_MOD (BPF_ALU | BPF_MOD) | |
69 | #define BPF_ALU_NEG (BPF_ALU | BPF_NEG) | |
70 | #define BPF_ALU_AND (BPF_ALU | BPF_AND) | |
71 | #define BPF_ALU_OR (BPF_ALU | BPF_OR) | |
72 | #define BPF_ALU_XOR (BPF_ALU | BPF_XOR) | |
73 | #define BPF_ALU_LSH (BPF_ALU | BPF_LSH) | |
74 | #define BPF_ALU_RSH (BPF_ALU | BPF_RSH) | |
75 | #define BPF_MISC_TAX (BPF_MISC | BPF_TAX) | |
76 | #define BPF_MISC_TXA (BPF_MISC | BPF_TXA) | |
77 | #define BPF_LD_B (BPF_LD | BPF_B) | |
78 | #define BPF_LD_H (BPF_LD | BPF_H) | |
79 | #define BPF_LD_W (BPF_LD | BPF_W) | |
80 | ||
81 | #ifndef array_size | |
82 | # define array_size(x) (sizeof(x) / sizeof((x)[0])) | |
83 | #endif | |
84 | ||
85 | #ifndef __check_format_printf | |
86 | # define __check_format_printf(pos_fmtstr, pos_fmtargs) \ | |
87 | __attribute__ ((format (printf, (pos_fmtstr), (pos_fmtargs)))) | |
88 | #endif | |
89 | ||
90 | #define CMD(_name, _func) { .name = _name, .func = _func, } | |
91 | #define OP(_op, _name) [_op] = _name | |
92 | ||
93 | enum { | |
94 | CMD_OK, | |
95 | CMD_ERR, | |
96 | CMD_EX, | |
97 | }; | |
98 | ||
99 | struct shell_cmd { | |
100 | const char *name; | |
101 | int (*func)(char *args); | |
102 | }; | |
103 | ||
104 | struct pcap_filehdr { | |
105 | uint32_t magic; | |
106 | uint16_t version_major; | |
107 | uint16_t version_minor; | |
108 | int32_t thiszone; | |
109 | uint32_t sigfigs; | |
110 | uint32_t snaplen; | |
111 | uint32_t linktype; | |
112 | }; | |
113 | ||
114 | struct pcap_timeval { | |
115 | int32_t tv_sec; | |
116 | int32_t tv_usec; | |
117 | }; | |
118 | ||
119 | struct pcap_pkthdr { | |
120 | struct pcap_timeval ts; | |
121 | uint32_t caplen; | |
122 | uint32_t len; | |
123 | }; | |
124 | ||
125 | struct bpf_regs { | |
126 | uint32_t A; | |
127 | uint32_t X; | |
128 | uint32_t M[BPF_MEMWORDS]; | |
129 | uint32_t R; | |
130 | bool Rs; | |
131 | uint16_t Pc; | |
132 | }; | |
133 | ||
134 | static struct sock_filter bpf_image[BPF_MAXINSNS + 1]; | |
135 | static unsigned int bpf_prog_len = 0; | |
136 | ||
137 | static int bpf_breakpoints[64]; | |
138 | static struct bpf_regs bpf_regs[BPF_MAXINSNS + 1]; | |
139 | static struct bpf_regs bpf_curr; | |
140 | static unsigned int bpf_regs_len = 0; | |
141 | ||
142 | static int pcap_fd = -1; | |
143 | static unsigned int pcap_packet = 0; | |
144 | static size_t pcap_map_size = 0; | |
145 | static char *pcap_ptr_va_start, *pcap_ptr_va_curr; | |
146 | ||
147 | static const char * const op_table[] = { | |
148 | OP(BPF_ST, "st"), | |
149 | OP(BPF_STX, "stx"), | |
150 | OP(BPF_LD_B, "ldb"), | |
151 | OP(BPF_LD_H, "ldh"), | |
152 | OP(BPF_LD_W, "ld"), | |
153 | OP(BPF_LDX, "ldx"), | |
154 | OP(BPF_LDX_B, "ldxb"), | |
155 | OP(BPF_JMP_JA, "ja"), | |
156 | OP(BPF_JMP_JEQ, "jeq"), | |
157 | OP(BPF_JMP_JGT, "jgt"), | |
158 | OP(BPF_JMP_JGE, "jge"), | |
159 | OP(BPF_JMP_JSET, "jset"), | |
160 | OP(BPF_ALU_ADD, "add"), | |
161 | OP(BPF_ALU_SUB, "sub"), | |
162 | OP(BPF_ALU_MUL, "mul"), | |
163 | OP(BPF_ALU_DIV, "div"), | |
164 | OP(BPF_ALU_MOD, "mod"), | |
165 | OP(BPF_ALU_NEG, "neg"), | |
166 | OP(BPF_ALU_AND, "and"), | |
167 | OP(BPF_ALU_OR, "or"), | |
168 | OP(BPF_ALU_XOR, "xor"), | |
169 | OP(BPF_ALU_LSH, "lsh"), | |
170 | OP(BPF_ALU_RSH, "rsh"), | |
171 | OP(BPF_MISC_TAX, "tax"), | |
172 | OP(BPF_MISC_TXA, "txa"), | |
173 | OP(BPF_RET, "ret"), | |
174 | }; | |
175 | ||
176 | static __check_format_printf(1, 2) int rl_printf(const char *fmt, ...) | |
177 | { | |
178 | int ret; | |
179 | va_list vl; | |
180 | ||
181 | va_start(vl, fmt); | |
182 | ret = vfprintf(rl_outstream, fmt, vl); | |
183 | va_end(vl); | |
184 | ||
185 | return ret; | |
186 | } | |
187 | ||
188 | static int matches(const char *cmd, const char *pattern) | |
189 | { | |
190 | int len = strlen(cmd); | |
191 | ||
192 | if (len > strlen(pattern)) | |
193 | return -1; | |
194 | ||
195 | return memcmp(pattern, cmd, len); | |
196 | } | |
197 | ||
198 | static void hex_dump(const uint8_t *buf, size_t len) | |
199 | { | |
200 | int i; | |
201 | ||
202 | rl_printf("%3u: ", 0); | |
203 | for (i = 0; i < len; i++) { | |
204 | if (i && !(i % 16)) | |
205 | rl_printf("\n%3u: ", i); | |
206 | rl_printf("%02x ", buf[i]); | |
207 | } | |
208 | rl_printf("\n"); | |
209 | } | |
210 | ||
211 | static bool bpf_prog_loaded(void) | |
212 | { | |
213 | if (bpf_prog_len == 0) | |
214 | rl_printf("no bpf program loaded!\n"); | |
215 | ||
216 | return bpf_prog_len > 0; | |
217 | } | |
218 | ||
219 | static void bpf_disasm(const struct sock_filter f, unsigned int i) | |
220 | { | |
221 | const char *op, *fmt; | |
222 | int val = f.k; | |
223 | char buf[256]; | |
224 | ||
225 | switch (f.code) { | |
226 | case BPF_RET | BPF_K: | |
227 | op = op_table[BPF_RET]; | |
228 | fmt = "#%#x"; | |
229 | break; | |
230 | case BPF_RET | BPF_A: | |
231 | op = op_table[BPF_RET]; | |
232 | fmt = "a"; | |
233 | break; | |
234 | case BPF_RET | BPF_X: | |
235 | op = op_table[BPF_RET]; | |
236 | fmt = "x"; | |
237 | break; | |
238 | case BPF_MISC_TAX: | |
239 | op = op_table[BPF_MISC_TAX]; | |
240 | fmt = ""; | |
241 | break; | |
242 | case BPF_MISC_TXA: | |
243 | op = op_table[BPF_MISC_TXA]; | |
244 | fmt = ""; | |
245 | break; | |
246 | case BPF_ST: | |
247 | op = op_table[BPF_ST]; | |
248 | fmt = "M[%d]"; | |
249 | break; | |
250 | case BPF_STX: | |
251 | op = op_table[BPF_STX]; | |
252 | fmt = "M[%d]"; | |
253 | break; | |
254 | case BPF_LD_W | BPF_ABS: | |
255 | op = op_table[BPF_LD_W]; | |
256 | fmt = "[%d]"; | |
257 | break; | |
258 | case BPF_LD_H | BPF_ABS: | |
259 | op = op_table[BPF_LD_H]; | |
260 | fmt = "[%d]"; | |
261 | break; | |
262 | case BPF_LD_B | BPF_ABS: | |
263 | op = op_table[BPF_LD_B]; | |
264 | fmt = "[%d]"; | |
265 | break; | |
266 | case BPF_LD_W | BPF_LEN: | |
267 | op = op_table[BPF_LD_W]; | |
268 | fmt = "#len"; | |
269 | break; | |
270 | case BPF_LD_W | BPF_IND: | |
271 | op = op_table[BPF_LD_W]; | |
272 | fmt = "[x+%d]"; | |
273 | break; | |
274 | case BPF_LD_H | BPF_IND: | |
275 | op = op_table[BPF_LD_H]; | |
276 | fmt = "[x+%d]"; | |
277 | break; | |
278 | case BPF_LD_B | BPF_IND: | |
279 | op = op_table[BPF_LD_B]; | |
280 | fmt = "[x+%d]"; | |
281 | break; | |
282 | case BPF_LD | BPF_IMM: | |
283 | op = op_table[BPF_LD_W]; | |
284 | fmt = "#%#x"; | |
285 | break; | |
286 | case BPF_LDX | BPF_IMM: | |
287 | op = op_table[BPF_LDX]; | |
288 | fmt = "#%#x"; | |
289 | break; | |
290 | case BPF_LDX_B | BPF_MSH: | |
291 | op = op_table[BPF_LDX_B]; | |
292 | fmt = "4*([%d]&0xf)"; | |
293 | break; | |
294 | case BPF_LD | BPF_MEM: | |
295 | op = op_table[BPF_LD_W]; | |
296 | fmt = "M[%d]"; | |
297 | break; | |
298 | case BPF_LDX | BPF_MEM: | |
299 | op = op_table[BPF_LDX]; | |
300 | fmt = "M[%d]"; | |
301 | break; | |
302 | case BPF_JMP_JA: | |
303 | op = op_table[BPF_JMP_JA]; | |
304 | fmt = "%d"; | |
305 | val = i + 1 + f.k; | |
306 | break; | |
307 | case BPF_JMP_JGT | BPF_X: | |
308 | op = op_table[BPF_JMP_JGT]; | |
309 | fmt = "x"; | |
310 | break; | |
311 | case BPF_JMP_JGT | BPF_K: | |
312 | op = op_table[BPF_JMP_JGT]; | |
313 | fmt = "#%#x"; | |
314 | break; | |
315 | case BPF_JMP_JGE | BPF_X: | |
316 | op = op_table[BPF_JMP_JGE]; | |
317 | fmt = "x"; | |
318 | break; | |
319 | case BPF_JMP_JGE | BPF_K: | |
320 | op = op_table[BPF_JMP_JGE]; | |
321 | fmt = "#%#x"; | |
322 | break; | |
323 | case BPF_JMP_JEQ | BPF_X: | |
324 | op = op_table[BPF_JMP_JEQ]; | |
325 | fmt = "x"; | |
326 | break; | |
327 | case BPF_JMP_JEQ | BPF_K: | |
328 | op = op_table[BPF_JMP_JEQ]; | |
329 | fmt = "#%#x"; | |
330 | break; | |
331 | case BPF_JMP_JSET | BPF_X: | |
332 | op = op_table[BPF_JMP_JSET]; | |
333 | fmt = "x"; | |
334 | break; | |
335 | case BPF_JMP_JSET | BPF_K: | |
336 | op = op_table[BPF_JMP_JSET]; | |
337 | fmt = "#%#x"; | |
338 | break; | |
339 | case BPF_ALU_NEG: | |
340 | op = op_table[BPF_ALU_NEG]; | |
341 | fmt = ""; | |
342 | break; | |
343 | case BPF_ALU_LSH | BPF_X: | |
344 | op = op_table[BPF_ALU_LSH]; | |
345 | fmt = "x"; | |
346 | break; | |
347 | case BPF_ALU_LSH | BPF_K: | |
348 | op = op_table[BPF_ALU_LSH]; | |
349 | fmt = "#%d"; | |
350 | break; | |
351 | case BPF_ALU_RSH | BPF_X: | |
352 | op = op_table[BPF_ALU_RSH]; | |
353 | fmt = "x"; | |
354 | break; | |
355 | case BPF_ALU_RSH | BPF_K: | |
356 | op = op_table[BPF_ALU_RSH]; | |
357 | fmt = "#%d"; | |
358 | break; | |
359 | case BPF_ALU_ADD | BPF_X: | |
360 | op = op_table[BPF_ALU_ADD]; | |
361 | fmt = "x"; | |
362 | break; | |
363 | case BPF_ALU_ADD | BPF_K: | |
364 | op = op_table[BPF_ALU_ADD]; | |
365 | fmt = "#%d"; | |
366 | break; | |
367 | case BPF_ALU_SUB | BPF_X: | |
368 | op = op_table[BPF_ALU_SUB]; | |
369 | fmt = "x"; | |
370 | break; | |
371 | case BPF_ALU_SUB | BPF_K: | |
372 | op = op_table[BPF_ALU_SUB]; | |
373 | fmt = "#%d"; | |
374 | break; | |
375 | case BPF_ALU_MUL | BPF_X: | |
376 | op = op_table[BPF_ALU_MUL]; | |
377 | fmt = "x"; | |
378 | break; | |
379 | case BPF_ALU_MUL | BPF_K: | |
380 | op = op_table[BPF_ALU_MUL]; | |
381 | fmt = "#%d"; | |
382 | break; | |
383 | case BPF_ALU_DIV | BPF_X: | |
384 | op = op_table[BPF_ALU_DIV]; | |
385 | fmt = "x"; | |
386 | break; | |
387 | case BPF_ALU_DIV | BPF_K: | |
388 | op = op_table[BPF_ALU_DIV]; | |
389 | fmt = "#%d"; | |
390 | break; | |
391 | case BPF_ALU_MOD | BPF_X: | |
392 | op = op_table[BPF_ALU_MOD]; | |
393 | fmt = "x"; | |
394 | break; | |
395 | case BPF_ALU_MOD | BPF_K: | |
396 | op = op_table[BPF_ALU_MOD]; | |
397 | fmt = "#%d"; | |
398 | break; | |
399 | case BPF_ALU_AND | BPF_X: | |
400 | op = op_table[BPF_ALU_AND]; | |
401 | fmt = "x"; | |
402 | break; | |
403 | case BPF_ALU_AND | BPF_K: | |
404 | op = op_table[BPF_ALU_AND]; | |
405 | fmt = "#%#x"; | |
406 | break; | |
407 | case BPF_ALU_OR | BPF_X: | |
408 | op = op_table[BPF_ALU_OR]; | |
409 | fmt = "x"; | |
410 | break; | |
411 | case BPF_ALU_OR | BPF_K: | |
412 | op = op_table[BPF_ALU_OR]; | |
413 | fmt = "#%#x"; | |
414 | break; | |
415 | case BPF_ALU_XOR | BPF_X: | |
416 | op = op_table[BPF_ALU_XOR]; | |
417 | fmt = "x"; | |
418 | break; | |
419 | case BPF_ALU_XOR | BPF_K: | |
420 | op = op_table[BPF_ALU_XOR]; | |
421 | fmt = "#%#x"; | |
422 | break; | |
423 | default: | |
424 | op = "nosup"; | |
425 | fmt = "%#x"; | |
426 | val = f.code; | |
427 | break; | |
428 | } | |
429 | ||
430 | memset(buf, 0, sizeof(buf)); | |
431 | snprintf(buf, sizeof(buf), fmt, val); | |
432 | buf[sizeof(buf) - 1] = 0; | |
433 | ||
434 | if ((BPF_CLASS(f.code) == BPF_JMP && BPF_OP(f.code) != BPF_JA)) | |
435 | rl_printf("l%d:\t%s %s, l%d, l%d\n", i, op, buf, | |
436 | i + 1 + f.jt, i + 1 + f.jf); | |
437 | else | |
438 | rl_printf("l%d:\t%s %s\n", i, op, buf); | |
439 | } | |
440 | ||
441 | static void bpf_dump_curr(struct bpf_regs *r, struct sock_filter *f) | |
442 | { | |
443 | int i, m = 0; | |
444 | ||
445 | rl_printf("pc: [%u]\n", r->Pc); | |
446 | rl_printf("code: [%u] jt[%u] jf[%u] k[%u]\n", | |
447 | f->code, f->jt, f->jf, f->k); | |
448 | rl_printf("curr: "); | |
449 | bpf_disasm(*f, r->Pc); | |
450 | ||
451 | if (f->jt || f->jf) { | |
452 | rl_printf("jt: "); | |
453 | bpf_disasm(*(f + f->jt + 1), r->Pc + f->jt + 1); | |
454 | rl_printf("jf: "); | |
455 | bpf_disasm(*(f + f->jf + 1), r->Pc + f->jf + 1); | |
456 | } | |
457 | ||
458 | rl_printf("A: [%#08x][%u]\n", r->A, r->A); | |
459 | rl_printf("X: [%#08x][%u]\n", r->X, r->X); | |
460 | if (r->Rs) | |
461 | rl_printf("ret: [%#08x][%u]!\n", r->R, r->R); | |
462 | ||
463 | for (i = 0; i < BPF_MEMWORDS; i++) { | |
464 | if (r->M[i]) { | |
465 | m++; | |
466 | rl_printf("M[%d]: [%#08x][%u]\n", i, r->M[i], r->M[i]); | |
467 | } | |
468 | } | |
469 | if (m == 0) | |
470 | rl_printf("M[0,%d]: [%#08x][%u]\n", BPF_MEMWORDS - 1, 0, 0); | |
471 | } | |
472 | ||
473 | static void bpf_dump_pkt(uint8_t *pkt, uint32_t pkt_caplen, uint32_t pkt_len) | |
474 | { | |
475 | if (pkt_caplen != pkt_len) | |
476 | rl_printf("cap: %u, len: %u\n", pkt_caplen, pkt_len); | |
477 | else | |
478 | rl_printf("len: %u\n", pkt_len); | |
479 | ||
480 | hex_dump(pkt, pkt_caplen); | |
481 | } | |
482 | ||
483 | static void bpf_disasm_all(const struct sock_filter *f, unsigned int len) | |
484 | { | |
485 | unsigned int i; | |
486 | ||
487 | for (i = 0; i < len; i++) | |
488 | bpf_disasm(f[i], i); | |
489 | } | |
490 | ||
491 | static void bpf_dump_all(const struct sock_filter *f, unsigned int len) | |
492 | { | |
493 | unsigned int i; | |
494 | ||
495 | rl_printf("/* { op, jt, jf, k }, */\n"); | |
496 | for (i = 0; i < len; i++) | |
497 | rl_printf("{ %#04x, %2u, %2u, %#010x },\n", | |
498 | f[i].code, f[i].jt, f[i].jf, f[i].k); | |
499 | } | |
500 | ||
501 | static bool bpf_runnable(struct sock_filter *f, unsigned int len) | |
502 | { | |
503 | int sock, ret, i; | |
504 | struct sock_fprog bpf = { | |
505 | .filter = f, | |
506 | .len = len, | |
507 | }; | |
508 | ||
509 | sock = socket(AF_INET, SOCK_DGRAM, 0); | |
510 | if (sock < 0) { | |
511 | rl_printf("cannot open socket!\n"); | |
512 | return false; | |
513 | } | |
514 | ret = setsockopt(sock, SOL_SOCKET, SO_ATTACH_FILTER, &bpf, sizeof(bpf)); | |
8b138da6 | 515 | close(sock); |
fd981e3c DB |
516 | if (ret < 0) { |
517 | rl_printf("program not allowed to run by kernel!\n"); | |
518 | return false; | |
519 | } | |
fd981e3c DB |
520 | for (i = 0; i < len; i++) { |
521 | if (BPF_CLASS(f[i].code) == BPF_LD && | |
522 | f[i].k > SKF_AD_OFF) { | |
523 | rl_printf("extensions currently not supported!\n"); | |
524 | return false; | |
525 | } | |
526 | } | |
527 | ||
528 | return true; | |
529 | } | |
530 | ||
531 | static void bpf_reset_breakpoints(void) | |
532 | { | |
533 | int i; | |
534 | ||
535 | for (i = 0; i < array_size(bpf_breakpoints); i++) | |
536 | bpf_breakpoints[i] = -1; | |
537 | } | |
538 | ||
539 | static void bpf_set_breakpoints(unsigned int where) | |
540 | { | |
541 | int i; | |
542 | bool set = false; | |
543 | ||
544 | for (i = 0; i < array_size(bpf_breakpoints); i++) { | |
545 | if (bpf_breakpoints[i] == (int) where) { | |
546 | rl_printf("breakpoint already set!\n"); | |
547 | set = true; | |
548 | break; | |
549 | } | |
550 | ||
551 | if (bpf_breakpoints[i] == -1 && set == false) { | |
552 | bpf_breakpoints[i] = where; | |
553 | set = true; | |
554 | } | |
555 | } | |
556 | ||
557 | if (!set) | |
558 | rl_printf("too many breakpoints set, reset first!\n"); | |
559 | } | |
560 | ||
561 | static void bpf_dump_breakpoints(void) | |
562 | { | |
563 | int i; | |
564 | ||
565 | rl_printf("breakpoints: "); | |
566 | ||
567 | for (i = 0; i < array_size(bpf_breakpoints); i++) { | |
568 | if (bpf_breakpoints[i] < 0) | |
569 | continue; | |
570 | rl_printf("%d ", bpf_breakpoints[i]); | |
571 | } | |
572 | ||
573 | rl_printf("\n"); | |
574 | } | |
575 | ||
576 | static void bpf_reset(void) | |
577 | { | |
578 | bpf_regs_len = 0; | |
579 | ||
580 | memset(bpf_regs, 0, sizeof(bpf_regs)); | |
581 | memset(&bpf_curr, 0, sizeof(bpf_curr)); | |
582 | } | |
583 | ||
584 | static void bpf_safe_regs(void) | |
585 | { | |
586 | memcpy(&bpf_regs[bpf_regs_len++], &bpf_curr, sizeof(bpf_curr)); | |
587 | } | |
588 | ||
589 | static bool bpf_restore_regs(int off) | |
590 | { | |
591 | unsigned int index = bpf_regs_len - 1 + off; | |
592 | ||
593 | if (index == 0) { | |
594 | bpf_reset(); | |
595 | return true; | |
596 | } else if (index < bpf_regs_len) { | |
597 | memcpy(&bpf_curr, &bpf_regs[index], sizeof(bpf_curr)); | |
598 | bpf_regs_len = index; | |
599 | return true; | |
600 | } else { | |
601 | rl_printf("reached bottom of register history stack!\n"); | |
602 | return false; | |
603 | } | |
604 | } | |
605 | ||
606 | static uint32_t extract_u32(uint8_t *pkt, uint32_t off) | |
607 | { | |
608 | uint32_t r; | |
609 | ||
610 | memcpy(&r, &pkt[off], sizeof(r)); | |
611 | ||
612 | return ntohl(r); | |
613 | } | |
614 | ||
615 | static uint16_t extract_u16(uint8_t *pkt, uint32_t off) | |
616 | { | |
617 | uint16_t r; | |
618 | ||
619 | memcpy(&r, &pkt[off], sizeof(r)); | |
620 | ||
621 | return ntohs(r); | |
622 | } | |
623 | ||
624 | static uint8_t extract_u8(uint8_t *pkt, uint32_t off) | |
625 | { | |
626 | return pkt[off]; | |
627 | } | |
628 | ||
629 | static void set_return(struct bpf_regs *r) | |
630 | { | |
631 | r->R = 0; | |
632 | r->Rs = true; | |
633 | } | |
634 | ||
635 | static void bpf_single_step(struct bpf_regs *r, struct sock_filter *f, | |
636 | uint8_t *pkt, uint32_t pkt_caplen, | |
637 | uint32_t pkt_len) | |
638 | { | |
639 | uint32_t K = f->k; | |
640 | int d; | |
641 | ||
642 | switch (f->code) { | |
643 | case BPF_RET | BPF_K: | |
644 | r->R = K; | |
645 | r->Rs = true; | |
646 | break; | |
647 | case BPF_RET | BPF_A: | |
648 | r->R = r->A; | |
649 | r->Rs = true; | |
650 | break; | |
651 | case BPF_RET | BPF_X: | |
652 | r->R = r->X; | |
653 | r->Rs = true; | |
654 | break; | |
655 | case BPF_MISC_TAX: | |
656 | r->X = r->A; | |
657 | break; | |
658 | case BPF_MISC_TXA: | |
659 | r->A = r->X; | |
660 | break; | |
661 | case BPF_ST: | |
662 | r->M[K] = r->A; | |
663 | break; | |
664 | case BPF_STX: | |
665 | r->M[K] = r->X; | |
666 | break; | |
667 | case BPF_LD_W | BPF_ABS: | |
668 | d = pkt_caplen - K; | |
669 | if (d >= sizeof(uint32_t)) | |
670 | r->A = extract_u32(pkt, K); | |
671 | else | |
672 | set_return(r); | |
673 | break; | |
674 | case BPF_LD_H | BPF_ABS: | |
675 | d = pkt_caplen - K; | |
676 | if (d >= sizeof(uint16_t)) | |
677 | r->A = extract_u16(pkt, K); | |
678 | else | |
679 | set_return(r); | |
680 | break; | |
681 | case BPF_LD_B | BPF_ABS: | |
682 | d = pkt_caplen - K; | |
683 | if (d >= sizeof(uint8_t)) | |
684 | r->A = extract_u8(pkt, K); | |
685 | else | |
686 | set_return(r); | |
687 | break; | |
688 | case BPF_LD_W | BPF_IND: | |
689 | d = pkt_caplen - (r->X + K); | |
690 | if (d >= sizeof(uint32_t)) | |
691 | r->A = extract_u32(pkt, r->X + K); | |
692 | break; | |
693 | case BPF_LD_H | BPF_IND: | |
694 | d = pkt_caplen - (r->X + K); | |
695 | if (d >= sizeof(uint16_t)) | |
696 | r->A = extract_u16(pkt, r->X + K); | |
697 | else | |
698 | set_return(r); | |
699 | break; | |
700 | case BPF_LD_B | BPF_IND: | |
701 | d = pkt_caplen - (r->X + K); | |
702 | if (d >= sizeof(uint8_t)) | |
703 | r->A = extract_u8(pkt, r->X + K); | |
704 | else | |
705 | set_return(r); | |
706 | break; | |
707 | case BPF_LDX_B | BPF_MSH: | |
708 | d = pkt_caplen - K; | |
709 | if (d >= sizeof(uint8_t)) { | |
710 | r->X = extract_u8(pkt, K); | |
711 | r->X = (r->X & 0xf) << 2; | |
712 | } else | |
713 | set_return(r); | |
714 | break; | |
715 | case BPF_LD_W | BPF_LEN: | |
716 | r->A = pkt_len; | |
717 | break; | |
718 | case BPF_LDX_W | BPF_LEN: | |
719 | r->A = pkt_len; | |
720 | break; | |
721 | case BPF_LD | BPF_IMM: | |
722 | r->A = K; | |
723 | break; | |
724 | case BPF_LDX | BPF_IMM: | |
725 | r->X = K; | |
726 | break; | |
727 | case BPF_LD | BPF_MEM: | |
728 | r->A = r->M[K]; | |
729 | break; | |
730 | case BPF_LDX | BPF_MEM: | |
731 | r->X = r->M[K]; | |
732 | break; | |
733 | case BPF_JMP_JA: | |
734 | r->Pc += K; | |
735 | break; | |
736 | case BPF_JMP_JGT | BPF_X: | |
737 | r->Pc += r->A > r->X ? f->jt : f->jf; | |
738 | break; | |
739 | case BPF_JMP_JGT | BPF_K: | |
740 | r->Pc += r->A > K ? f->jt : f->jf; | |
741 | break; | |
742 | case BPF_JMP_JGE | BPF_X: | |
743 | r->Pc += r->A >= r->X ? f->jt : f->jf; | |
744 | break; | |
745 | case BPF_JMP_JGE | BPF_K: | |
746 | r->Pc += r->A >= K ? f->jt : f->jf; | |
747 | break; | |
748 | case BPF_JMP_JEQ | BPF_X: | |
749 | r->Pc += r->A == r->X ? f->jt : f->jf; | |
750 | break; | |
751 | case BPF_JMP_JEQ | BPF_K: | |
752 | r->Pc += r->A == K ? f->jt : f->jf; | |
753 | break; | |
754 | case BPF_JMP_JSET | BPF_X: | |
755 | r->Pc += r->A & r->X ? f->jt : f->jf; | |
756 | break; | |
757 | case BPF_JMP_JSET | BPF_K: | |
758 | r->Pc += r->A & K ? f->jt : f->jf; | |
759 | break; | |
760 | case BPF_ALU_NEG: | |
761 | r->A = -r->A; | |
762 | break; | |
763 | case BPF_ALU_LSH | BPF_X: | |
764 | r->A <<= r->X; | |
765 | break; | |
766 | case BPF_ALU_LSH | BPF_K: | |
767 | r->A <<= K; | |
768 | break; | |
769 | case BPF_ALU_RSH | BPF_X: | |
770 | r->A >>= r->X; | |
771 | break; | |
772 | case BPF_ALU_RSH | BPF_K: | |
773 | r->A >>= K; | |
774 | break; | |
775 | case BPF_ALU_ADD | BPF_X: | |
776 | r->A += r->X; | |
777 | break; | |
778 | case BPF_ALU_ADD | BPF_K: | |
779 | r->A += K; | |
780 | break; | |
781 | case BPF_ALU_SUB | BPF_X: | |
782 | r->A -= r->X; | |
783 | break; | |
784 | case BPF_ALU_SUB | BPF_K: | |
785 | r->A -= K; | |
786 | break; | |
787 | case BPF_ALU_MUL | BPF_X: | |
788 | r->A *= r->X; | |
789 | break; | |
790 | case BPF_ALU_MUL | BPF_K: | |
791 | r->A *= K; | |
792 | break; | |
793 | case BPF_ALU_DIV | BPF_X: | |
794 | case BPF_ALU_MOD | BPF_X: | |
795 | if (r->X == 0) { | |
796 | set_return(r); | |
797 | break; | |
798 | } | |
799 | goto do_div; | |
800 | case BPF_ALU_DIV | BPF_K: | |
801 | case BPF_ALU_MOD | BPF_K: | |
802 | if (K == 0) { | |
803 | set_return(r); | |
804 | break; | |
805 | } | |
806 | do_div: | |
807 | switch (f->code) { | |
808 | case BPF_ALU_DIV | BPF_X: | |
809 | r->A /= r->X; | |
810 | break; | |
811 | case BPF_ALU_DIV | BPF_K: | |
812 | r->A /= K; | |
813 | break; | |
814 | case BPF_ALU_MOD | BPF_X: | |
815 | r->A %= r->X; | |
816 | break; | |
817 | case BPF_ALU_MOD | BPF_K: | |
818 | r->A %= K; | |
819 | break; | |
820 | } | |
821 | break; | |
822 | case BPF_ALU_AND | BPF_X: | |
823 | r->A &= r->X; | |
824 | break; | |
825 | case BPF_ALU_AND | BPF_K: | |
826 | r->A &= r->X; | |
827 | break; | |
828 | case BPF_ALU_OR | BPF_X: | |
829 | r->A |= r->X; | |
830 | break; | |
831 | case BPF_ALU_OR | BPF_K: | |
832 | r->A |= K; | |
833 | break; | |
834 | case BPF_ALU_XOR | BPF_X: | |
835 | r->A ^= r->X; | |
836 | break; | |
837 | case BPF_ALU_XOR | BPF_K: | |
838 | r->A ^= K; | |
839 | break; | |
840 | } | |
841 | } | |
842 | ||
843 | static bool bpf_pc_has_breakpoint(uint16_t pc) | |
844 | { | |
845 | int i; | |
846 | ||
847 | for (i = 0; i < array_size(bpf_breakpoints); i++) { | |
848 | if (bpf_breakpoints[i] < 0) | |
849 | continue; | |
850 | if (bpf_breakpoints[i] == pc) | |
851 | return true; | |
852 | } | |
853 | ||
854 | return false; | |
855 | } | |
856 | ||
857 | static bool bpf_handle_breakpoint(struct bpf_regs *r, struct sock_filter *f, | |
858 | uint8_t *pkt, uint32_t pkt_caplen, | |
859 | uint32_t pkt_len) | |
860 | { | |
861 | rl_printf("-- register dump --\n"); | |
862 | bpf_dump_curr(r, &f[r->Pc]); | |
863 | rl_printf("-- packet dump --\n"); | |
864 | bpf_dump_pkt(pkt, pkt_caplen, pkt_len); | |
865 | rl_printf("(breakpoint)\n"); | |
866 | return true; | |
867 | } | |
868 | ||
869 | static int bpf_run_all(struct sock_filter *f, uint16_t bpf_len, uint8_t *pkt, | |
870 | uint32_t pkt_caplen, uint32_t pkt_len) | |
871 | { | |
872 | bool stop = false; | |
873 | ||
874 | while (bpf_curr.Rs == false && stop == false) { | |
875 | bpf_safe_regs(); | |
876 | ||
877 | if (bpf_pc_has_breakpoint(bpf_curr.Pc)) | |
878 | stop = bpf_handle_breakpoint(&bpf_curr, f, pkt, | |
879 | pkt_caplen, pkt_len); | |
880 | ||
881 | bpf_single_step(&bpf_curr, &f[bpf_curr.Pc], pkt, pkt_caplen, | |
882 | pkt_len); | |
883 | bpf_curr.Pc++; | |
884 | } | |
885 | ||
886 | return stop ? -1 : bpf_curr.R; | |
887 | } | |
888 | ||
889 | static int bpf_run_stepping(struct sock_filter *f, uint16_t bpf_len, | |
890 | uint8_t *pkt, uint32_t pkt_caplen, | |
891 | uint32_t pkt_len, int next) | |
892 | { | |
893 | bool stop = false; | |
894 | int i = 1; | |
895 | ||
896 | while (bpf_curr.Rs == false && stop == false) { | |
897 | bpf_safe_regs(); | |
898 | ||
899 | if (i++ == next) | |
900 | stop = bpf_handle_breakpoint(&bpf_curr, f, pkt, | |
901 | pkt_caplen, pkt_len); | |
902 | ||
903 | bpf_single_step(&bpf_curr, &f[bpf_curr.Pc], pkt, pkt_caplen, | |
904 | pkt_len); | |
905 | bpf_curr.Pc++; | |
906 | } | |
907 | ||
908 | return stop ? -1 : bpf_curr.R; | |
909 | } | |
910 | ||
911 | static bool pcap_loaded(void) | |
912 | { | |
913 | if (pcap_fd < 0) | |
914 | rl_printf("no pcap file loaded!\n"); | |
915 | ||
916 | return pcap_fd >= 0; | |
917 | } | |
918 | ||
919 | static struct pcap_pkthdr *pcap_curr_pkt(void) | |
920 | { | |
921 | return (void *) pcap_ptr_va_curr; | |
922 | } | |
923 | ||
924 | static bool pcap_next_pkt(void) | |
925 | { | |
926 | struct pcap_pkthdr *hdr = pcap_curr_pkt(); | |
927 | ||
928 | if (pcap_ptr_va_curr + sizeof(*hdr) - | |
929 | pcap_ptr_va_start >= pcap_map_size) | |
930 | return false; | |
931 | if (hdr->caplen == 0 || hdr->len == 0 || hdr->caplen > hdr->len) | |
932 | return false; | |
933 | if (pcap_ptr_va_curr + sizeof(*hdr) + hdr->caplen - | |
934 | pcap_ptr_va_start >= pcap_map_size) | |
935 | return false; | |
936 | ||
937 | pcap_ptr_va_curr += (sizeof(*hdr) + hdr->caplen); | |
938 | return true; | |
939 | } | |
940 | ||
941 | static void pcap_reset_pkt(void) | |
942 | { | |
943 | pcap_ptr_va_curr = pcap_ptr_va_start + sizeof(struct pcap_filehdr); | |
944 | } | |
945 | ||
946 | static int try_load_pcap(const char *file) | |
947 | { | |
948 | struct pcap_filehdr *hdr; | |
949 | struct stat sb; | |
950 | int ret; | |
951 | ||
952 | pcap_fd = open(file, O_RDONLY); | |
953 | if (pcap_fd < 0) { | |
954 | rl_printf("cannot open pcap [%s]!\n", strerror(errno)); | |
955 | return CMD_ERR; | |
956 | } | |
957 | ||
958 | ret = fstat(pcap_fd, &sb); | |
959 | if (ret < 0) { | |
960 | rl_printf("cannot fstat pcap file!\n"); | |
961 | return CMD_ERR; | |
962 | } | |
963 | ||
964 | if (!S_ISREG(sb.st_mode)) { | |
965 | rl_printf("not a regular pcap file, duh!\n"); | |
966 | return CMD_ERR; | |
967 | } | |
968 | ||
969 | pcap_map_size = sb.st_size; | |
970 | if (pcap_map_size <= sizeof(struct pcap_filehdr)) { | |
971 | rl_printf("pcap file too small!\n"); | |
972 | return CMD_ERR; | |
973 | } | |
974 | ||
975 | pcap_ptr_va_start = mmap(NULL, pcap_map_size, PROT_READ, | |
976 | MAP_SHARED | MAP_LOCKED, pcap_fd, 0); | |
977 | if (pcap_ptr_va_start == MAP_FAILED) { | |
978 | rl_printf("mmap of file failed!"); | |
979 | return CMD_ERR; | |
980 | } | |
981 | ||
982 | hdr = (void *) pcap_ptr_va_start; | |
983 | if (hdr->magic != TCPDUMP_MAGIC) { | |
984 | rl_printf("wrong pcap magic!\n"); | |
985 | return CMD_ERR; | |
986 | } | |
987 | ||
988 | pcap_reset_pkt(); | |
989 | ||
990 | return CMD_OK; | |
991 | ||
992 | } | |
993 | ||
994 | static void try_close_pcap(void) | |
995 | { | |
996 | if (pcap_fd >= 0) { | |
997 | munmap(pcap_ptr_va_start, pcap_map_size); | |
998 | close(pcap_fd); | |
999 | ||
1000 | pcap_ptr_va_start = pcap_ptr_va_curr = NULL; | |
1001 | pcap_map_size = 0; | |
1002 | pcap_packet = 0; | |
1003 | pcap_fd = -1; | |
1004 | } | |
1005 | } | |
1006 | ||
1007 | static int cmd_load_bpf(char *bpf_string) | |
1008 | { | |
1009 | char sp, *token, separator = ','; | |
1010 | unsigned short bpf_len, i = 0; | |
1011 | struct sock_filter tmp; | |
1012 | ||
1013 | bpf_prog_len = 0; | |
1014 | memset(bpf_image, 0, sizeof(bpf_image)); | |
1015 | ||
1016 | if (sscanf(bpf_string, "%hu%c", &bpf_len, &sp) != 2 || | |
1017 | sp != separator || bpf_len > BPF_MAXINSNS || bpf_len == 0) { | |
1018 | rl_printf("syntax error in head length encoding!\n"); | |
1019 | return CMD_ERR; | |
1020 | } | |
1021 | ||
1022 | token = bpf_string; | |
1023 | while ((token = strchr(token, separator)) && (++token)[0]) { | |
1024 | if (i >= bpf_len) { | |
1025 | rl_printf("program exceeds encoded length!\n"); | |
1026 | return CMD_ERR; | |
1027 | } | |
1028 | ||
1029 | if (sscanf(token, "%hu %hhu %hhu %u,", | |
1030 | &tmp.code, &tmp.jt, &tmp.jf, &tmp.k) != 4) { | |
1031 | rl_printf("syntax error at instruction %d!\n", i); | |
1032 | return CMD_ERR; | |
1033 | } | |
1034 | ||
1035 | bpf_image[i].code = tmp.code; | |
1036 | bpf_image[i].jt = tmp.jt; | |
1037 | bpf_image[i].jf = tmp.jf; | |
1038 | bpf_image[i].k = tmp.k; | |
1039 | ||
1040 | i++; | |
1041 | } | |
1042 | ||
1043 | if (i != bpf_len) { | |
1044 | rl_printf("syntax error exceeding encoded length!\n"); | |
1045 | return CMD_ERR; | |
1046 | } else | |
1047 | bpf_prog_len = bpf_len; | |
1048 | if (!bpf_runnable(bpf_image, bpf_prog_len)) | |
1049 | bpf_prog_len = 0; | |
1050 | ||
1051 | return CMD_OK; | |
1052 | } | |
1053 | ||
1054 | static int cmd_load_pcap(char *file) | |
1055 | { | |
1056 | char *file_trim, *tmp; | |
1057 | ||
1058 | file_trim = strtok_r(file, " ", &tmp); | |
1059 | if (file_trim == NULL) | |
1060 | return CMD_ERR; | |
1061 | ||
1062 | try_close_pcap(); | |
1063 | ||
1064 | return try_load_pcap(file_trim); | |
1065 | } | |
1066 | ||
1067 | static int cmd_load(char *arg) | |
1068 | { | |
1069 | char *subcmd, *cont, *tmp = strdup(arg); | |
1070 | int ret = CMD_OK; | |
1071 | ||
1072 | subcmd = strtok_r(tmp, " ", &cont); | |
1073 | if (subcmd == NULL) | |
1074 | goto out; | |
1075 | if (matches(subcmd, "bpf") == 0) { | |
1076 | bpf_reset(); | |
1077 | bpf_reset_breakpoints(); | |
1078 | ||
1079 | ret = cmd_load_bpf(cont); | |
1080 | } else if (matches(subcmd, "pcap") == 0) { | |
1081 | ret = cmd_load_pcap(cont); | |
1082 | } else { | |
1083 | out: | |
1084 | rl_printf("bpf <code>: load bpf code\n"); | |
1085 | rl_printf("pcap <file>: load pcap file\n"); | |
1086 | ret = CMD_ERR; | |
1087 | } | |
1088 | ||
1089 | free(tmp); | |
1090 | return ret; | |
1091 | } | |
1092 | ||
1093 | static int cmd_step(char *num) | |
1094 | { | |
1095 | struct pcap_pkthdr *hdr; | |
1096 | int steps, ret; | |
1097 | ||
1098 | if (!bpf_prog_loaded() || !pcap_loaded()) | |
1099 | return CMD_ERR; | |
1100 | ||
1101 | steps = strtol(num, NULL, 10); | |
1102 | if (steps == 0 || strlen(num) == 0) | |
1103 | steps = 1; | |
1104 | if (steps < 0) { | |
1105 | if (!bpf_restore_regs(steps)) | |
1106 | return CMD_ERR; | |
1107 | steps = 1; | |
1108 | } | |
1109 | ||
1110 | hdr = pcap_curr_pkt(); | |
1111 | ret = bpf_run_stepping(bpf_image, bpf_prog_len, | |
1112 | (uint8_t *) hdr + sizeof(*hdr), | |
1113 | hdr->caplen, hdr->len, steps); | |
1114 | if (ret >= 0 || bpf_curr.Rs) { | |
1115 | bpf_reset(); | |
1116 | if (!pcap_next_pkt()) { | |
1117 | rl_printf("(going back to first packet)\n"); | |
1118 | pcap_reset_pkt(); | |
1119 | } else { | |
1120 | rl_printf("(next packet)\n"); | |
1121 | } | |
1122 | } | |
1123 | ||
1124 | return CMD_OK; | |
1125 | } | |
1126 | ||
1127 | static int cmd_select(char *num) | |
1128 | { | |
1129 | unsigned int which, i; | |
1130 | struct pcap_pkthdr *hdr; | |
1131 | bool have_next = true; | |
1132 | ||
1133 | if (!pcap_loaded() || strlen(num) == 0) | |
1134 | return CMD_ERR; | |
1135 | ||
1136 | which = strtoul(num, NULL, 10); | |
1137 | if (which == 0) { | |
1138 | rl_printf("packet count starts with 1, clamping!\n"); | |
1139 | which = 1; | |
1140 | } | |
1141 | ||
1142 | pcap_reset_pkt(); | |
1143 | bpf_reset(); | |
1144 | ||
1145 | for (i = 0; i < which && (have_next = pcap_next_pkt()); i++) | |
1146 | /* noop */; | |
1147 | if (!have_next || (hdr = pcap_curr_pkt()) == NULL) { | |
1148 | rl_printf("no packet #%u available!\n", which); | |
1149 | pcap_reset_pkt(); | |
1150 | return CMD_ERR; | |
1151 | } | |
1152 | ||
1153 | return CMD_OK; | |
1154 | } | |
1155 | ||
1156 | static int cmd_breakpoint(char *subcmd) | |
1157 | { | |
1158 | if (!bpf_prog_loaded()) | |
1159 | return CMD_ERR; | |
1160 | if (strlen(subcmd) == 0) | |
1161 | bpf_dump_breakpoints(); | |
1162 | else if (matches(subcmd, "reset") == 0) | |
1163 | bpf_reset_breakpoints(); | |
1164 | else { | |
1165 | unsigned int where = strtoul(subcmd, NULL, 10); | |
1166 | ||
1167 | if (where < bpf_prog_len) { | |
1168 | bpf_set_breakpoints(where); | |
1169 | rl_printf("breakpoint at: "); | |
1170 | bpf_disasm(bpf_image[where], where); | |
1171 | } | |
1172 | } | |
1173 | ||
1174 | return CMD_OK; | |
1175 | } | |
1176 | ||
1177 | static int cmd_run(char *num) | |
1178 | { | |
1179 | static uint32_t pass = 0, fail = 0; | |
1180 | struct pcap_pkthdr *hdr; | |
1181 | bool has_limit = true; | |
1182 | int ret, pkts = 0, i = 0; | |
1183 | ||
1184 | if (!bpf_prog_loaded() || !pcap_loaded()) | |
1185 | return CMD_ERR; | |
1186 | ||
1187 | pkts = strtol(num, NULL, 10); | |
1188 | if (pkts == 0 || strlen(num) == 0) | |
1189 | has_limit = false; | |
1190 | ||
1191 | do { | |
1192 | hdr = pcap_curr_pkt(); | |
1193 | ret = bpf_run_all(bpf_image, bpf_prog_len, | |
1194 | (uint8_t *) hdr + sizeof(*hdr), | |
1195 | hdr->caplen, hdr->len); | |
1196 | if (ret > 0) | |
1197 | pass++; | |
1198 | else if (ret == 0) | |
1199 | fail++; | |
1200 | else | |
1201 | return CMD_OK; | |
1202 | bpf_reset(); | |
1203 | } while (pcap_next_pkt() && (!has_limit || (has_limit && ++i < pkts))); | |
1204 | ||
1205 | rl_printf("bpf passes:%u fails:%u\n", pass, fail); | |
1206 | ||
1207 | pcap_reset_pkt(); | |
1208 | bpf_reset(); | |
1209 | ||
1210 | pass = fail = 0; | |
1211 | return CMD_OK; | |
1212 | } | |
1213 | ||
1214 | static int cmd_disassemble(char *line_string) | |
1215 | { | |
1216 | bool single_line = false; | |
1217 | unsigned long line; | |
1218 | ||
1219 | if (!bpf_prog_loaded()) | |
1220 | return CMD_ERR; | |
1221 | if (strlen(line_string) > 0 && | |
1222 | (line = strtoul(line_string, NULL, 10)) < bpf_prog_len) | |
1223 | single_line = true; | |
1224 | if (single_line) | |
1225 | bpf_disasm(bpf_image[line], line); | |
1226 | else | |
1227 | bpf_disasm_all(bpf_image, bpf_prog_len); | |
1228 | ||
1229 | return CMD_OK; | |
1230 | } | |
1231 | ||
1232 | static int cmd_dump(char *dontcare) | |
1233 | { | |
1234 | if (!bpf_prog_loaded()) | |
1235 | return CMD_ERR; | |
1236 | ||
1237 | bpf_dump_all(bpf_image, bpf_prog_len); | |
1238 | ||
1239 | return CMD_OK; | |
1240 | } | |
1241 | ||
1242 | static int cmd_quit(char *dontcare) | |
1243 | { | |
1244 | return CMD_EX; | |
1245 | } | |
1246 | ||
1247 | static const struct shell_cmd cmds[] = { | |
1248 | CMD("load", cmd_load), | |
1249 | CMD("select", cmd_select), | |
1250 | CMD("step", cmd_step), | |
1251 | CMD("run", cmd_run), | |
1252 | CMD("breakpoint", cmd_breakpoint), | |
1253 | CMD("disassemble", cmd_disassemble), | |
1254 | CMD("dump", cmd_dump), | |
1255 | CMD("quit", cmd_quit), | |
1256 | }; | |
1257 | ||
1258 | static int execf(char *arg) | |
1259 | { | |
1260 | char *cmd, *cont, *tmp = strdup(arg); | |
1261 | int i, ret = 0, len; | |
1262 | ||
1263 | cmd = strtok_r(tmp, " ", &cont); | |
1264 | if (cmd == NULL) | |
1265 | goto out; | |
1266 | len = strlen(cmd); | |
1267 | for (i = 0; i < array_size(cmds); i++) { | |
1268 | if (len != strlen(cmds[i].name)) | |
1269 | continue; | |
1270 | if (strncmp(cmds[i].name, cmd, len) == 0) { | |
1271 | ret = cmds[i].func(cont); | |
1272 | break; | |
1273 | } | |
1274 | } | |
1275 | out: | |
1276 | free(tmp); | |
1277 | return ret; | |
1278 | } | |
1279 | ||
1280 | static char *shell_comp_gen(const char *buf, int state) | |
1281 | { | |
1282 | static int list_index, len; | |
1283 | const char *name; | |
1284 | ||
1285 | if (!state) { | |
1286 | list_index = 0; | |
1287 | len = strlen(buf); | |
1288 | } | |
1289 | ||
1290 | for (; list_index < array_size(cmds); ) { | |
1291 | name = cmds[list_index].name; | |
1292 | list_index++; | |
1293 | ||
1294 | if (strncmp(name, buf, len) == 0) | |
1295 | return strdup(name); | |
1296 | } | |
1297 | ||
1298 | return NULL; | |
1299 | } | |
1300 | ||
1301 | static char **shell_completion(const char *buf, int start, int end) | |
1302 | { | |
1303 | char **matches = NULL; | |
1304 | ||
1305 | if (start == 0) | |
1306 | matches = rl_completion_matches(buf, shell_comp_gen); | |
1307 | ||
1308 | return matches; | |
1309 | } | |
1310 | ||
1311 | static void intr_shell(int sig) | |
1312 | { | |
1313 | if (rl_end) | |
1314 | rl_kill_line(-1, 0); | |
1315 | ||
1316 | rl_crlf(); | |
1317 | rl_refresh_line(0, 0); | |
1318 | rl_free_line_state(); | |
1319 | } | |
1320 | ||
1321 | static void init_shell(FILE *fin, FILE *fout) | |
1322 | { | |
1323 | char file[128]; | |
1324 | ||
1325 | memset(file, 0, sizeof(file)); | |
1326 | snprintf(file, sizeof(file) - 1, | |
1327 | "%s/.bpf_dbg_history", getenv("HOME")); | |
1328 | ||
1329 | read_history(file); | |
1330 | ||
1331 | memset(file, 0, sizeof(file)); | |
1332 | snprintf(file, sizeof(file) - 1, | |
1333 | "%s/.bpf_dbg_init", getenv("HOME")); | |
1334 | ||
1335 | rl_instream = fin; | |
1336 | rl_outstream = fout; | |
1337 | ||
1338 | rl_readline_name = "bpf_dbg"; | |
1339 | rl_terminal_name = getenv("TERM"); | |
1340 | ||
1341 | rl_catch_signals = 0; | |
1342 | rl_catch_sigwinch = 1; | |
1343 | ||
1344 | rl_attempted_completion_function = shell_completion; | |
1345 | ||
1346 | rl_bind_key('\t', rl_complete); | |
1347 | ||
1348 | rl_bind_key_in_map('\t', rl_complete, emacs_meta_keymap); | |
1349 | rl_bind_key_in_map('\033', rl_complete, emacs_meta_keymap); | |
1350 | ||
1351 | rl_read_init_file(file); | |
1352 | rl_prep_terminal(0); | |
1353 | rl_set_signals(); | |
1354 | ||
1355 | signal(SIGINT, intr_shell); | |
1356 | } | |
1357 | ||
1358 | static void exit_shell(void) | |
1359 | { | |
1360 | char file[128]; | |
1361 | ||
1362 | memset(file, 0, sizeof(file)); | |
1363 | snprintf(file, sizeof(file) - 1, | |
1364 | "%s/.bpf_dbg_history", getenv("HOME")); | |
1365 | ||
1366 | write_history(file); | |
1367 | clear_history(); | |
1368 | rl_deprep_terminal(); | |
1369 | ||
1370 | try_close_pcap(); | |
1371 | } | |
1372 | ||
1373 | static int run_shell_loop(FILE *fin, FILE *fout) | |
1374 | { | |
1375 | char *buf; | |
1376 | int ret; | |
1377 | ||
1378 | init_shell(fin, fout); | |
1379 | ||
1380 | while ((buf = readline("> ")) != NULL) { | |
1381 | ret = execf(buf); | |
1382 | if (ret == CMD_EX) | |
1383 | break; | |
1384 | if (ret == CMD_OK && strlen(buf) > 0) | |
1385 | add_history(buf); | |
1386 | ||
1387 | free(buf); | |
1388 | } | |
1389 | ||
1390 | exit_shell(); | |
1391 | return 0; | |
1392 | } | |
1393 | ||
1394 | int main(int argc, char **argv) | |
1395 | { | |
1396 | FILE *fin = NULL, *fout = NULL; | |
1397 | ||
1398 | if (argc >= 2) | |
1399 | fin = fopen(argv[1], "r"); | |
1400 | if (argc >= 3) | |
1401 | fout = fopen(argv[2], "w"); | |
1402 | ||
1403 | return run_shell_loop(fin ? : stdin, fout ? : stdout); | |
1404 | } |