granicus.if.org Git - strace/blob - bpf_filter.c

   1 /*
   2  * Decoder of classic BPF programs.
   3  *
   4  * Copyright (c) 2015-2017 Dmitry V. Levin <ldv@altlinux.org>
   5  * Copyright (c) 2017-2018 The strace developers.
   6  * All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  * 1. Redistributions of source code must retain the above copyright
  12  *    notice, this list of conditions and the following disclaimer.
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  * 3. The name of the author may not be used to endorse or promote products
  17  *    derived from this software without specific prior written permission.
  18  *
  19  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  20  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  21  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  22  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  23  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  24  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  25  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  26  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  27  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  28  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  29  */
  30
  31 #include "defs.h"
  32
  33 #include "bpf_filter.h"
  34 #include "bpf_fprog.h"
  35
  36 #include <linux/filter.h>
  37
  38 #include "xlat/bpf_class.h"
  39 #include "xlat/bpf_miscop.h"
  40 #include "xlat/bpf_mode.h"
  41 #include "xlat/bpf_op_alu.h"
  42 #include "xlat/bpf_op_jmp.h"
  43 #include "xlat/bpf_rval.h"
  44 #include "xlat/bpf_size.h"
  45 #include "xlat/bpf_src.h"
  46
  47 #include "xlat/ebpf_class.h"
  48 #include "xlat/ebpf_mode.h"
  49 #include "xlat/ebpf_op_alu.h"
  50 #include "xlat/ebpf_op_jmp.h"
  51 #include "xlat/ebpf_size.h"
  52
  53 void
  54 print_bpf_filter_code(const uint16_t code, bool extended)
  55 {
  56         const struct xlat *class = extended ? ebpf_class : bpf_class;
  57         const struct xlat *mode = extended ? ebpf_mode : bpf_mode;
  58
  59         uint16_t i = code & ~BPF_CLASS(code);
  60
  61         printxval(class, BPF_CLASS(code), "BPF_???");
  62         switch (BPF_CLASS(code)) {
  63         case BPF_ST:
  64         case BPF_STX:
  65                 if (!extended) {
  66                         if (i) {
  67                                 tprintf("|%#x", i);
  68                                 tprints_comment("BPF_???");
  69                         }
  70                         break;
  71                 }
  72                 ATTRIBUTE_FALLTHROUGH; /* extended == true */
  73
  74         case BPF_LD:
  75         case BPF_LDX:
  76                 tprints("|");
  77                 printxvals(BPF_SIZE(code), "BPF_???",
  78                            bpf_size, extended ? ebpf_size : NULL, NULL);
  79                 tprints("|");
  80                 printxval(mode, BPF_MODE(code), "BPF_???");
  81                 break;
  82
  83         case BPF_MISC: /* BPF_ALU64 in eBPF */
  84                 if (!extended) {
  85                         tprints("|");
  86                         printxval(bpf_miscop, BPF_MISCOP(code), "BPF_???");
  87                         i &= ~BPF_MISCOP(code);
  88                         if (i) {
  89                                 tprintf("|%#x", i);
  90                                 tprints_comment("BPF_???");
  91                         }
  92                         break;
  93                 }
  94                 ATTRIBUTE_FALLTHROUGH; /* extended == true */
  95
  96         case BPF_ALU:
  97                 tprints("|");
  98                 printxval(bpf_src, BPF_SRC(code), "BPF_???");
  99                 tprints("|");
 100                 printxvals(BPF_OP(code), "BPF_???",
 101                            bpf_op_alu,
 102                            extended ? ebpf_op_alu : NULL, NULL);
 103                 break;
 104
 105         case BPF_JMP:
 106                 tprints("|");
 107                 printxval(bpf_src, BPF_SRC(code), "BPF_???");
 108                 tprints("|");
 109                 printxvals(BPF_OP(code), "BPF_???",
 110                            bpf_op_jmp, extended ? ebpf_op_jmp : NULL, NULL);
 111                 break;
 112
 113         case BPF_RET: /* Reserved in eBPF */
 114                 if (!extended) {
 115                         tprints("|");
 116                         printxval(bpf_rval, BPF_RVAL(code), "BPF_???");
 117                         i &= ~BPF_RVAL(code);
 118                 }
 119
 120                 if (i) {
 121                         tprintf("|%#x", i);
 122                         tprints_comment("BPF_???");
 123                 }
 124
 125                 break;
 126         }
 127 }
 128
 129 static void
 130 print_bpf_filter_stmt(const struct bpf_filter_block *const filter,
 131                       const print_bpf_filter_fn print_k)
 132 {
 133         tprints("BPF_STMT(");
 134         print_bpf_filter_code(filter->code, false);
 135         tprints(", ");
 136         if (!print_k || !print_k(filter))
 137                 tprintf("%#x", filter->k);
 138         tprints(")");
 139 }
 140
 141 static void
 142 print_bpf_filter_jump(const struct bpf_filter_block *const filter)
 143 {
 144         tprints("BPF_JUMP(");
 145         print_bpf_filter_code(filter->code, false);
 146         tprintf(", %#x, %#x, %#x)", filter->k, filter->jt, filter->jf);
 147 }
 148
 149 struct bpf_filter_block_data {
 150         const print_bpf_filter_fn fn;
 151         unsigned int count;
 152 };
 153
 154 static bool
 155 print_bpf_filter_block(struct tcb *const tcp, void *const elem_buf,
 156                        const size_t elem_size, void *const data)
 157 {
 158         const struct bpf_filter_block *const filter = elem_buf;
 159         struct bpf_filter_block_data *const fbd = data;
 160
 161         if (fbd->count++ >= BPF_MAXINSNS) {
 162                 tprints("...");
 163                 return false;
 164         }
 165
 166         if (filter->jt || filter->jf)
 167                 print_bpf_filter_jump(filter);
 168         else
 169                 print_bpf_filter_stmt(filter, fbd->fn);
 170
 171         return true;
 172 }
 173
 174 void
 175 print_bpf_fprog(struct tcb *const tcp, const kernel_ulong_t addr,
 176                 const unsigned short len, const print_bpf_filter_fn print_k)
 177 {
 178         if (abbrev(tcp)) {
 179                 printaddr(addr);
 180         } else {
 181                 struct bpf_filter_block_data fbd = { .fn = print_k };
 182                 struct bpf_filter_block filter;
 183
 184                 print_array(tcp, addr, len, &filter, sizeof(filter),
 185                             umoven_or_printaddr, print_bpf_filter_block, &fbd);
 186         }
 187 }
 188
 189 void
 190 decode_bpf_fprog(struct tcb *const tcp, const kernel_ulong_t addr,
 191                  const print_bpf_filter_fn print_k)
 192 {
 193         struct bpf_fprog fprog;
 194
 195         if (fetch_bpf_fprog(tcp, addr, &fprog)) {
 196                 tprintf("{len=%hu, filter=", fprog.len);
 197                 print_bpf_fprog(tcp, fprog.filter, fprog.len, print_k);
 198                 tprints("}");
 199         }
 200 }