bpf_dbg.c 28 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /*
  3. * Minimal BPF debugger
  4. *
  5. * Minimal BPF debugger that mimics the kernel's engine (w/o extensions)
  6. * and allows for single stepping through selected packets from a pcap
  7. * with a provided user filter in order to facilitate verification of a
  8. * BPF program. Besides others, this is useful to verify BPF programs
  9. * before attaching to a live system, and can be used in socket filters,
  10. * cls_bpf, xt_bpf, team driver and e.g. PTP code; in particular when a
  11. * single more complex BPF program is being used. Reasons for a more
  12. * complex BPF program are likely primarily to optimize execution time
  13. * for making a verdict when multiple simple BPF programs are combined
  14. * into one in order to prevent parsing same headers multiple times.
  15. *
  16. * More on how to debug BPF opcodes see Documentation/networking/filter.rst
  17. * which is the main document on BPF. Mini howto for getting started:
  18. *
  19. * 1) `./bpf_dbg` to enter the shell (shell cmds denoted with '>'):
  20. * 2) > load bpf 6,40 0 0 12,21 0 3 20... (output from `bpf_asm` or
  21. * `tcpdump -iem1 -ddd port 22 | tr '\n' ','` to load as filter)
  22. * 3) > load pcap foo.pcap
  23. * 4) > run <n>/disassemble/dump/quit (self-explanatory)
  24. * 5) > breakpoint 2 (sets bp at loaded BPF insns 2, do `run` then;
  25. * multiple bps can be set, of course, a call to `breakpoint`
  26. * w/o args shows currently loaded bps, `breakpoint reset` for
  27. * resetting all breakpoints)
  28. * 6) > select 3 (`run` etc will start from the 3rd packet in the pcap)
  29. * 7) > step [-<n>, +<n>] (performs single stepping through the BPF)
  30. *
  31. * Copyright 2013 Daniel Borkmann <borkmann@redhat.com>
  32. */
  33. #include <stdio.h>
  34. #include <unistd.h>
  35. #include <stdlib.h>
  36. #include <ctype.h>
  37. #include <stdbool.h>
  38. #include <stdarg.h>
  39. #include <setjmp.h>
  40. #include <linux/filter.h>
  41. #include <linux/if_packet.h>
  42. #include <readline/readline.h>
  43. #include <readline/history.h>
  44. #include <sys/types.h>
  45. #include <sys/socket.h>
  46. #include <sys/stat.h>
  47. #include <sys/mman.h>
  48. #include <fcntl.h>
  49. #include <errno.h>
  50. #include <signal.h>
  51. #include <arpa/inet.h>
  52. #include <net/ethernet.h>
  53. #define TCPDUMP_MAGIC 0xa1b2c3d4
  54. #define BPF_LDX_B (BPF_LDX | BPF_B)
  55. #define BPF_LDX_W (BPF_LDX | BPF_W)
  56. #define BPF_JMP_JA (BPF_JMP | BPF_JA)
  57. #define BPF_JMP_JEQ (BPF_JMP | BPF_JEQ)
  58. #define BPF_JMP_JGT (BPF_JMP | BPF_JGT)
  59. #define BPF_JMP_JGE (BPF_JMP | BPF_JGE)
  60. #define BPF_JMP_JSET (BPF_JMP | BPF_JSET)
  61. #define BPF_ALU_ADD (BPF_ALU | BPF_ADD)
  62. #define BPF_ALU_SUB (BPF_ALU | BPF_SUB)
  63. #define BPF_ALU_MUL (BPF_ALU | BPF_MUL)
  64. #define BPF_ALU_DIV (BPF_ALU | BPF_DIV)
  65. #define BPF_ALU_MOD (BPF_ALU | BPF_MOD)
  66. #define BPF_ALU_NEG (BPF_ALU | BPF_NEG)
  67. #define BPF_ALU_AND (BPF_ALU | BPF_AND)
  68. #define BPF_ALU_OR (BPF_ALU | BPF_OR)
  69. #define BPF_ALU_XOR (BPF_ALU | BPF_XOR)
  70. #define BPF_ALU_LSH (BPF_ALU | BPF_LSH)
  71. #define BPF_ALU_RSH (BPF_ALU | BPF_RSH)
  72. #define BPF_MISC_TAX (BPF_MISC | BPF_TAX)
  73. #define BPF_MISC_TXA (BPF_MISC | BPF_TXA)
  74. #define BPF_LD_B (BPF_LD | BPF_B)
  75. #define BPF_LD_H (BPF_LD | BPF_H)
  76. #define BPF_LD_W (BPF_LD | BPF_W)
  77. #ifndef array_size
  78. # define array_size(x) (sizeof(x) / sizeof((x)[0]))
  79. #endif
  80. #ifndef __check_format_printf
  81. # define __check_format_printf(pos_fmtstr, pos_fmtargs) \
  82. __attribute__ ((format (printf, (pos_fmtstr), (pos_fmtargs))))
  83. #endif
  84. enum {
  85. CMD_OK,
  86. CMD_ERR,
  87. CMD_EX,
  88. };
  89. struct shell_cmd {
  90. const char *name;
  91. int (*func)(char *args);
  92. };
  93. struct pcap_filehdr {
  94. uint32_t magic;
  95. uint16_t version_major;
  96. uint16_t version_minor;
  97. int32_t thiszone;
  98. uint32_t sigfigs;
  99. uint32_t snaplen;
  100. uint32_t linktype;
  101. };
  102. struct pcap_timeval {
  103. int32_t tv_sec;
  104. int32_t tv_usec;
  105. };
  106. struct pcap_pkthdr {
  107. struct pcap_timeval ts;
  108. uint32_t caplen;
  109. uint32_t len;
  110. };
  111. struct bpf_regs {
  112. uint32_t A;
  113. uint32_t X;
  114. uint32_t M[BPF_MEMWORDS];
  115. uint32_t R;
  116. bool Rs;
  117. uint16_t Pc;
  118. };
  119. static struct sock_filter bpf_image[BPF_MAXINSNS + 1];
  120. static unsigned int bpf_prog_len;
  121. static int bpf_breakpoints[64];
  122. static struct bpf_regs bpf_regs[BPF_MAXINSNS + 1];
  123. static struct bpf_regs bpf_curr;
  124. static unsigned int bpf_regs_len;
  125. static int pcap_fd = -1;
  126. static unsigned int pcap_packet;
  127. static size_t pcap_map_size;
  128. static char *pcap_ptr_va_start, *pcap_ptr_va_curr;
  129. static const char * const op_table[] = {
  130. [BPF_ST] = "st",
  131. [BPF_STX] = "stx",
  132. [BPF_LD_B] = "ldb",
  133. [BPF_LD_H] = "ldh",
  134. [BPF_LD_W] = "ld",
  135. [BPF_LDX] = "ldx",
  136. [BPF_LDX_B] = "ldxb",
  137. [BPF_JMP_JA] = "ja",
  138. [BPF_JMP_JEQ] = "jeq",
  139. [BPF_JMP_JGT] = "jgt",
  140. [BPF_JMP_JGE] = "jge",
  141. [BPF_JMP_JSET] = "jset",
  142. [BPF_ALU_ADD] = "add",
  143. [BPF_ALU_SUB] = "sub",
  144. [BPF_ALU_MUL] = "mul",
  145. [BPF_ALU_DIV] = "div",
  146. [BPF_ALU_MOD] = "mod",
  147. [BPF_ALU_NEG] = "neg",
  148. [BPF_ALU_AND] = "and",
  149. [BPF_ALU_OR] = "or",
  150. [BPF_ALU_XOR] = "xor",
  151. [BPF_ALU_LSH] = "lsh",
  152. [BPF_ALU_RSH] = "rsh",
  153. [BPF_MISC_TAX] = "tax",
  154. [BPF_MISC_TXA] = "txa",
  155. [BPF_RET] = "ret",
  156. };
  157. static __check_format_printf(1, 2) int rl_printf(const char *fmt, ...)
  158. {
  159. int ret;
  160. va_list vl;
  161. va_start(vl, fmt);
  162. ret = vfprintf(rl_outstream, fmt, vl);
  163. va_end(vl);
  164. return ret;
  165. }
  166. static int matches(const char *cmd, const char *pattern)
  167. {
  168. int len = strlen(cmd);
  169. if (len > strlen(pattern))
  170. return -1;
  171. return memcmp(pattern, cmd, len);
  172. }
  173. static void hex_dump(const uint8_t *buf, size_t len)
  174. {
  175. int i;
  176. rl_printf("%3u: ", 0);
  177. for (i = 0; i < len; i++) {
  178. if (i && !(i % 16))
  179. rl_printf("\n%3u: ", i);
  180. rl_printf("%02x ", buf[i]);
  181. }
  182. rl_printf("\n");
  183. }
  184. static bool bpf_prog_loaded(void)
  185. {
  186. if (bpf_prog_len == 0)
  187. rl_printf("no bpf program loaded!\n");
  188. return bpf_prog_len > 0;
  189. }
  190. static void bpf_disasm(const struct sock_filter f, unsigned int i)
  191. {
  192. const char *op, *fmt;
  193. int val = f.k;
  194. char buf[256];
  195. switch (f.code) {
  196. case BPF_RET | BPF_K:
  197. op = op_table[BPF_RET];
  198. fmt = "#%#x";
  199. break;
  200. case BPF_RET | BPF_A:
  201. op = op_table[BPF_RET];
  202. fmt = "a";
  203. break;
  204. case BPF_RET | BPF_X:
  205. op = op_table[BPF_RET];
  206. fmt = "x";
  207. break;
  208. case BPF_MISC_TAX:
  209. op = op_table[BPF_MISC_TAX];
  210. fmt = "";
  211. break;
  212. case BPF_MISC_TXA:
  213. op = op_table[BPF_MISC_TXA];
  214. fmt = "";
  215. break;
  216. case BPF_ST:
  217. op = op_table[BPF_ST];
  218. fmt = "M[%d]";
  219. break;
  220. case BPF_STX:
  221. op = op_table[BPF_STX];
  222. fmt = "M[%d]";
  223. break;
  224. case BPF_LD_W | BPF_ABS:
  225. op = op_table[BPF_LD_W];
  226. fmt = "[%d]";
  227. break;
  228. case BPF_LD_H | BPF_ABS:
  229. op = op_table[BPF_LD_H];
  230. fmt = "[%d]";
  231. break;
  232. case BPF_LD_B | BPF_ABS:
  233. op = op_table[BPF_LD_B];
  234. fmt = "[%d]";
  235. break;
  236. case BPF_LD_W | BPF_LEN:
  237. op = op_table[BPF_LD_W];
  238. fmt = "#len";
  239. break;
  240. case BPF_LD_W | BPF_IND:
  241. op = op_table[BPF_LD_W];
  242. fmt = "[x+%d]";
  243. break;
  244. case BPF_LD_H | BPF_IND:
  245. op = op_table[BPF_LD_H];
  246. fmt = "[x+%d]";
  247. break;
  248. case BPF_LD_B | BPF_IND:
  249. op = op_table[BPF_LD_B];
  250. fmt = "[x+%d]";
  251. break;
  252. case BPF_LD | BPF_IMM:
  253. op = op_table[BPF_LD_W];
  254. fmt = "#%#x";
  255. break;
  256. case BPF_LDX | BPF_IMM:
  257. op = op_table[BPF_LDX];
  258. fmt = "#%#x";
  259. break;
  260. case BPF_LDX_B | BPF_MSH:
  261. op = op_table[BPF_LDX_B];
  262. fmt = "4*([%d]&0xf)";
  263. break;
  264. case BPF_LD | BPF_MEM:
  265. op = op_table[BPF_LD_W];
  266. fmt = "M[%d]";
  267. break;
  268. case BPF_LDX | BPF_MEM:
  269. op = op_table[BPF_LDX];
  270. fmt = "M[%d]";
  271. break;
  272. case BPF_JMP_JA:
  273. op = op_table[BPF_JMP_JA];
  274. fmt = "%d";
  275. val = i + 1 + f.k;
  276. break;
  277. case BPF_JMP_JGT | BPF_X:
  278. op = op_table[BPF_JMP_JGT];
  279. fmt = "x";
  280. break;
  281. case BPF_JMP_JGT | BPF_K:
  282. op = op_table[BPF_JMP_JGT];
  283. fmt = "#%#x";
  284. break;
  285. case BPF_JMP_JGE | BPF_X:
  286. op = op_table[BPF_JMP_JGE];
  287. fmt = "x";
  288. break;
  289. case BPF_JMP_JGE | BPF_K:
  290. op = op_table[BPF_JMP_JGE];
  291. fmt = "#%#x";
  292. break;
  293. case BPF_JMP_JEQ | BPF_X:
  294. op = op_table[BPF_JMP_JEQ];
  295. fmt = "x";
  296. break;
  297. case BPF_JMP_JEQ | BPF_K:
  298. op = op_table[BPF_JMP_JEQ];
  299. fmt = "#%#x";
  300. break;
  301. case BPF_JMP_JSET | BPF_X:
  302. op = op_table[BPF_JMP_JSET];
  303. fmt = "x";
  304. break;
  305. case BPF_JMP_JSET | BPF_K:
  306. op = op_table[BPF_JMP_JSET];
  307. fmt = "#%#x";
  308. break;
  309. case BPF_ALU_NEG:
  310. op = op_table[BPF_ALU_NEG];
  311. fmt = "";
  312. break;
  313. case BPF_ALU_LSH | BPF_X:
  314. op = op_table[BPF_ALU_LSH];
  315. fmt = "x";
  316. break;
  317. case BPF_ALU_LSH | BPF_K:
  318. op = op_table[BPF_ALU_LSH];
  319. fmt = "#%d";
  320. break;
  321. case BPF_ALU_RSH | BPF_X:
  322. op = op_table[BPF_ALU_RSH];
  323. fmt = "x";
  324. break;
  325. case BPF_ALU_RSH | BPF_K:
  326. op = op_table[BPF_ALU_RSH];
  327. fmt = "#%d";
  328. break;
  329. case BPF_ALU_ADD | BPF_X:
  330. op = op_table[BPF_ALU_ADD];
  331. fmt = "x";
  332. break;
  333. case BPF_ALU_ADD | BPF_K:
  334. op = op_table[BPF_ALU_ADD];
  335. fmt = "#%d";
  336. break;
  337. case BPF_ALU_SUB | BPF_X:
  338. op = op_table[BPF_ALU_SUB];
  339. fmt = "x";
  340. break;
  341. case BPF_ALU_SUB | BPF_K:
  342. op = op_table[BPF_ALU_SUB];
  343. fmt = "#%d";
  344. break;
  345. case BPF_ALU_MUL | BPF_X:
  346. op = op_table[BPF_ALU_MUL];
  347. fmt = "x";
  348. break;
  349. case BPF_ALU_MUL | BPF_K:
  350. op = op_table[BPF_ALU_MUL];
  351. fmt = "#%d";
  352. break;
  353. case BPF_ALU_DIV | BPF_X:
  354. op = op_table[BPF_ALU_DIV];
  355. fmt = "x";
  356. break;
  357. case BPF_ALU_DIV | BPF_K:
  358. op = op_table[BPF_ALU_DIV];
  359. fmt = "#%d";
  360. break;
  361. case BPF_ALU_MOD | BPF_X:
  362. op = op_table[BPF_ALU_MOD];
  363. fmt = "x";
  364. break;
  365. case BPF_ALU_MOD | BPF_K:
  366. op = op_table[BPF_ALU_MOD];
  367. fmt = "#%d";
  368. break;
  369. case BPF_ALU_AND | BPF_X:
  370. op = op_table[BPF_ALU_AND];
  371. fmt = "x";
  372. break;
  373. case BPF_ALU_AND | BPF_K:
  374. op = op_table[BPF_ALU_AND];
  375. fmt = "#%#x";
  376. break;
  377. case BPF_ALU_OR | BPF_X:
  378. op = op_table[BPF_ALU_OR];
  379. fmt = "x";
  380. break;
  381. case BPF_ALU_OR | BPF_K:
  382. op = op_table[BPF_ALU_OR];
  383. fmt = "#%#x";
  384. break;
  385. case BPF_ALU_XOR | BPF_X:
  386. op = op_table[BPF_ALU_XOR];
  387. fmt = "x";
  388. break;
  389. case BPF_ALU_XOR | BPF_K:
  390. op = op_table[BPF_ALU_XOR];
  391. fmt = "#%#x";
  392. break;
  393. default:
  394. op = "nosup";
  395. fmt = "%#x";
  396. val = f.code;
  397. break;
  398. }
  399. memset(buf, 0, sizeof(buf));
  400. snprintf(buf, sizeof(buf), fmt, val);
  401. buf[sizeof(buf) - 1] = 0;
  402. if ((BPF_CLASS(f.code) == BPF_JMP && BPF_OP(f.code) != BPF_JA))
  403. rl_printf("l%d:\t%s %s, l%d, l%d\n", i, op, buf,
  404. i + 1 + f.jt, i + 1 + f.jf);
  405. else
  406. rl_printf("l%d:\t%s %s\n", i, op, buf);
  407. }
  408. static void bpf_dump_curr(struct bpf_regs *r, struct sock_filter *f)
  409. {
  410. int i, m = 0;
  411. rl_printf("pc: [%u]\n", r->Pc);
  412. rl_printf("code: [%u] jt[%u] jf[%u] k[%u]\n",
  413. f->code, f->jt, f->jf, f->k);
  414. rl_printf("curr: ");
  415. bpf_disasm(*f, r->Pc);
  416. if (f->jt || f->jf) {
  417. rl_printf("jt: ");
  418. bpf_disasm(*(f + f->jt + 1), r->Pc + f->jt + 1);
  419. rl_printf("jf: ");
  420. bpf_disasm(*(f + f->jf + 1), r->Pc + f->jf + 1);
  421. }
  422. rl_printf("A: [%#08x][%u]\n", r->A, r->A);
  423. rl_printf("X: [%#08x][%u]\n", r->X, r->X);
  424. if (r->Rs)
  425. rl_printf("ret: [%#08x][%u]!\n", r->R, r->R);
  426. for (i = 0; i < BPF_MEMWORDS; i++) {
  427. if (r->M[i]) {
  428. m++;
  429. rl_printf("M[%d]: [%#08x][%u]\n", i, r->M[i], r->M[i]);
  430. }
  431. }
  432. if (m == 0)
  433. rl_printf("M[0,%d]: [%#08x][%u]\n", BPF_MEMWORDS - 1, 0, 0);
  434. }
  435. static void bpf_dump_pkt(uint8_t *pkt, uint32_t pkt_caplen, uint32_t pkt_len)
  436. {
  437. if (pkt_caplen != pkt_len)
  438. rl_printf("cap: %u, len: %u\n", pkt_caplen, pkt_len);
  439. else
  440. rl_printf("len: %u\n", pkt_len);
  441. hex_dump(pkt, pkt_caplen);
  442. }
  443. static void bpf_disasm_all(const struct sock_filter *f, unsigned int len)
  444. {
  445. unsigned int i;
  446. for (i = 0; i < len; i++)
  447. bpf_disasm(f[i], i);
  448. }
  449. static void bpf_dump_all(const struct sock_filter *f, unsigned int len)
  450. {
  451. unsigned int i;
  452. rl_printf("/* { op, jt, jf, k }, */\n");
  453. for (i = 0; i < len; i++)
  454. rl_printf("{ %#04x, %2u, %2u, %#010x },\n",
  455. f[i].code, f[i].jt, f[i].jf, f[i].k);
  456. }
  457. static bool bpf_runnable(struct sock_filter *f, unsigned int len)
  458. {
  459. int sock, ret, i;
  460. struct sock_fprog bpf = {
  461. .filter = f,
  462. .len = len,
  463. };
  464. sock = socket(AF_INET, SOCK_DGRAM, 0);
  465. if (sock < 0) {
  466. rl_printf("cannot open socket!\n");
  467. return false;
  468. }
  469. ret = setsockopt(sock, SOL_SOCKET, SO_ATTACH_FILTER, &bpf, sizeof(bpf));
  470. close(sock);
  471. if (ret < 0) {
  472. rl_printf("program not allowed to run by kernel!\n");
  473. return false;
  474. }
  475. for (i = 0; i < len; i++) {
  476. if (BPF_CLASS(f[i].code) == BPF_LD &&
  477. f[i].k > SKF_AD_OFF) {
  478. rl_printf("extensions currently not supported!\n");
  479. return false;
  480. }
  481. }
  482. return true;
  483. }
  484. static void bpf_reset_breakpoints(void)
  485. {
  486. int i;
  487. for (i = 0; i < array_size(bpf_breakpoints); i++)
  488. bpf_breakpoints[i] = -1;
  489. }
  490. static void bpf_set_breakpoints(unsigned int where)
  491. {
  492. int i;
  493. bool set = false;
  494. for (i = 0; i < array_size(bpf_breakpoints); i++) {
  495. if (bpf_breakpoints[i] == (int) where) {
  496. rl_printf("breakpoint already set!\n");
  497. set = true;
  498. break;
  499. }
  500. if (bpf_breakpoints[i] == -1 && set == false) {
  501. bpf_breakpoints[i] = where;
  502. set = true;
  503. }
  504. }
  505. if (!set)
  506. rl_printf("too many breakpoints set, reset first!\n");
  507. }
  508. static void bpf_dump_breakpoints(void)
  509. {
  510. int i;
  511. rl_printf("breakpoints: ");
  512. for (i = 0; i < array_size(bpf_breakpoints); i++) {
  513. if (bpf_breakpoints[i] < 0)
  514. continue;
  515. rl_printf("%d ", bpf_breakpoints[i]);
  516. }
  517. rl_printf("\n");
  518. }
  519. static void bpf_reset(void)
  520. {
  521. bpf_regs_len = 0;
  522. memset(bpf_regs, 0, sizeof(bpf_regs));
  523. memset(&bpf_curr, 0, sizeof(bpf_curr));
  524. }
  525. static void bpf_safe_regs(void)
  526. {
  527. memcpy(&bpf_regs[bpf_regs_len++], &bpf_curr, sizeof(bpf_curr));
  528. }
  529. static bool bpf_restore_regs(int off)
  530. {
  531. unsigned int index = bpf_regs_len - 1 + off;
  532. if (index == 0) {
  533. bpf_reset();
  534. return true;
  535. } else if (index < bpf_regs_len) {
  536. memcpy(&bpf_curr, &bpf_regs[index], sizeof(bpf_curr));
  537. bpf_regs_len = index;
  538. return true;
  539. } else {
  540. rl_printf("reached bottom of register history stack!\n");
  541. return false;
  542. }
  543. }
  544. static uint32_t extract_u32(uint8_t *pkt, uint32_t off)
  545. {
  546. uint32_t r;
  547. memcpy(&r, &pkt[off], sizeof(r));
  548. return ntohl(r);
  549. }
  550. static uint16_t extract_u16(uint8_t *pkt, uint32_t off)
  551. {
  552. uint16_t r;
  553. memcpy(&r, &pkt[off], sizeof(r));
  554. return ntohs(r);
  555. }
  556. static uint8_t extract_u8(uint8_t *pkt, uint32_t off)
  557. {
  558. return pkt[off];
  559. }
  560. static void set_return(struct bpf_regs *r)
  561. {
  562. r->R = 0;
  563. r->Rs = true;
  564. }
  565. static void bpf_single_step(struct bpf_regs *r, struct sock_filter *f,
  566. uint8_t *pkt, uint32_t pkt_caplen,
  567. uint32_t pkt_len)
  568. {
  569. uint32_t K = f->k;
  570. int d;
  571. switch (f->code) {
  572. case BPF_RET | BPF_K:
  573. r->R = K;
  574. r->Rs = true;
  575. break;
  576. case BPF_RET | BPF_A:
  577. r->R = r->A;
  578. r->Rs = true;
  579. break;
  580. case BPF_RET | BPF_X:
  581. r->R = r->X;
  582. r->Rs = true;
  583. break;
  584. case BPF_MISC_TAX:
  585. r->X = r->A;
  586. break;
  587. case BPF_MISC_TXA:
  588. r->A = r->X;
  589. break;
  590. case BPF_ST:
  591. r->M[K] = r->A;
  592. break;
  593. case BPF_STX:
  594. r->M[K] = r->X;
  595. break;
  596. case BPF_LD_W | BPF_ABS:
  597. d = pkt_caplen - K;
  598. if (d >= sizeof(uint32_t))
  599. r->A = extract_u32(pkt, K);
  600. else
  601. set_return(r);
  602. break;
  603. case BPF_LD_H | BPF_ABS:
  604. d = pkt_caplen - K;
  605. if (d >= sizeof(uint16_t))
  606. r->A = extract_u16(pkt, K);
  607. else
  608. set_return(r);
  609. break;
  610. case BPF_LD_B | BPF_ABS:
  611. d = pkt_caplen - K;
  612. if (d >= sizeof(uint8_t))
  613. r->A = extract_u8(pkt, K);
  614. else
  615. set_return(r);
  616. break;
  617. case BPF_LD_W | BPF_IND:
  618. d = pkt_caplen - (r->X + K);
  619. if (d >= sizeof(uint32_t))
  620. r->A = extract_u32(pkt, r->X + K);
  621. break;
  622. case BPF_LD_H | BPF_IND:
  623. d = pkt_caplen - (r->X + K);
  624. if (d >= sizeof(uint16_t))
  625. r->A = extract_u16(pkt, r->X + K);
  626. else
  627. set_return(r);
  628. break;
  629. case BPF_LD_B | BPF_IND:
  630. d = pkt_caplen - (r->X + K);
  631. if (d >= sizeof(uint8_t))
  632. r->A = extract_u8(pkt, r->X + K);
  633. else
  634. set_return(r);
  635. break;
  636. case BPF_LDX_B | BPF_MSH:
  637. d = pkt_caplen - K;
  638. if (d >= sizeof(uint8_t)) {
  639. r->X = extract_u8(pkt, K);
  640. r->X = (r->X & 0xf) << 2;
  641. } else
  642. set_return(r);
  643. break;
  644. case BPF_LD_W | BPF_LEN:
  645. r->A = pkt_len;
  646. break;
  647. case BPF_LDX_W | BPF_LEN:
  648. r->A = pkt_len;
  649. break;
  650. case BPF_LD | BPF_IMM:
  651. r->A = K;
  652. break;
  653. case BPF_LDX | BPF_IMM:
  654. r->X = K;
  655. break;
  656. case BPF_LD | BPF_MEM:
  657. r->A = r->M[K];
  658. break;
  659. case BPF_LDX | BPF_MEM:
  660. r->X = r->M[K];
  661. break;
  662. case BPF_JMP_JA:
  663. r->Pc += K;
  664. break;
  665. case BPF_JMP_JGT | BPF_X:
  666. r->Pc += r->A > r->X ? f->jt : f->jf;
  667. break;
  668. case BPF_JMP_JGT | BPF_K:
  669. r->Pc += r->A > K ? f->jt : f->jf;
  670. break;
  671. case BPF_JMP_JGE | BPF_X:
  672. r->Pc += r->A >= r->X ? f->jt : f->jf;
  673. break;
  674. case BPF_JMP_JGE | BPF_K:
  675. r->Pc += r->A >= K ? f->jt : f->jf;
  676. break;
  677. case BPF_JMP_JEQ | BPF_X:
  678. r->Pc += r->A == r->X ? f->jt : f->jf;
  679. break;
  680. case BPF_JMP_JEQ | BPF_K:
  681. r->Pc += r->A == K ? f->jt : f->jf;
  682. break;
  683. case BPF_JMP_JSET | BPF_X:
  684. r->Pc += r->A & r->X ? f->jt : f->jf;
  685. break;
  686. case BPF_JMP_JSET | BPF_K:
  687. r->Pc += r->A & K ? f->jt : f->jf;
  688. break;
  689. case BPF_ALU_NEG:
  690. r->A = -r->A;
  691. break;
  692. case BPF_ALU_LSH | BPF_X:
  693. r->A <<= r->X;
  694. break;
  695. case BPF_ALU_LSH | BPF_K:
  696. r->A <<= K;
  697. break;
  698. case BPF_ALU_RSH | BPF_X:
  699. r->A >>= r->X;
  700. break;
  701. case BPF_ALU_RSH | BPF_K:
  702. r->A >>= K;
  703. break;
  704. case BPF_ALU_ADD | BPF_X:
  705. r->A += r->X;
  706. break;
  707. case BPF_ALU_ADD | BPF_K:
  708. r->A += K;
  709. break;
  710. case BPF_ALU_SUB | BPF_X:
  711. r->A -= r->X;
  712. break;
  713. case BPF_ALU_SUB | BPF_K:
  714. r->A -= K;
  715. break;
  716. case BPF_ALU_MUL | BPF_X:
  717. r->A *= r->X;
  718. break;
  719. case BPF_ALU_MUL | BPF_K:
  720. r->A *= K;
  721. break;
  722. case BPF_ALU_DIV | BPF_X:
  723. case BPF_ALU_MOD | BPF_X:
  724. if (r->X == 0) {
  725. set_return(r);
  726. break;
  727. }
  728. goto do_div;
  729. case BPF_ALU_DIV | BPF_K:
  730. case BPF_ALU_MOD | BPF_K:
  731. if (K == 0) {
  732. set_return(r);
  733. break;
  734. }
  735. do_div:
  736. switch (f->code) {
  737. case BPF_ALU_DIV | BPF_X:
  738. r->A /= r->X;
  739. break;
  740. case BPF_ALU_DIV | BPF_K:
  741. r->A /= K;
  742. break;
  743. case BPF_ALU_MOD | BPF_X:
  744. r->A %= r->X;
  745. break;
  746. case BPF_ALU_MOD | BPF_K:
  747. r->A %= K;
  748. break;
  749. }
  750. break;
  751. case BPF_ALU_AND | BPF_X:
  752. r->A &= r->X;
  753. break;
  754. case BPF_ALU_AND | BPF_K:
  755. r->A &= K;
  756. break;
  757. case BPF_ALU_OR | BPF_X:
  758. r->A |= r->X;
  759. break;
  760. case BPF_ALU_OR | BPF_K:
  761. r->A |= K;
  762. break;
  763. case BPF_ALU_XOR | BPF_X:
  764. r->A ^= r->X;
  765. break;
  766. case BPF_ALU_XOR | BPF_K:
  767. r->A ^= K;
  768. break;
  769. }
  770. }
  771. static bool bpf_pc_has_breakpoint(uint16_t pc)
  772. {
  773. int i;
  774. for (i = 0; i < array_size(bpf_breakpoints); i++) {
  775. if (bpf_breakpoints[i] < 0)
  776. continue;
  777. if (bpf_breakpoints[i] == pc)
  778. return true;
  779. }
  780. return false;
  781. }
  782. static bool bpf_handle_breakpoint(struct bpf_regs *r, struct sock_filter *f,
  783. uint8_t *pkt, uint32_t pkt_caplen,
  784. uint32_t pkt_len)
  785. {
  786. rl_printf("-- register dump --\n");
  787. bpf_dump_curr(r, &f[r->Pc]);
  788. rl_printf("-- packet dump --\n");
  789. bpf_dump_pkt(pkt, pkt_caplen, pkt_len);
  790. rl_printf("(breakpoint)\n");
  791. return true;
  792. }
  793. static int bpf_run_all(struct sock_filter *f, uint16_t bpf_len, uint8_t *pkt,
  794. uint32_t pkt_caplen, uint32_t pkt_len)
  795. {
  796. bool stop = false;
  797. while (bpf_curr.Rs == false && stop == false) {
  798. bpf_safe_regs();
  799. if (bpf_pc_has_breakpoint(bpf_curr.Pc))
  800. stop = bpf_handle_breakpoint(&bpf_curr, f, pkt,
  801. pkt_caplen, pkt_len);
  802. bpf_single_step(&bpf_curr, &f[bpf_curr.Pc], pkt, pkt_caplen,
  803. pkt_len);
  804. bpf_curr.Pc++;
  805. }
  806. return stop ? -1 : bpf_curr.R;
  807. }
  808. static int bpf_run_stepping(struct sock_filter *f, uint16_t bpf_len,
  809. uint8_t *pkt, uint32_t pkt_caplen,
  810. uint32_t pkt_len, int next)
  811. {
  812. bool stop = false;
  813. int i = 1;
  814. while (bpf_curr.Rs == false && stop == false) {
  815. bpf_safe_regs();
  816. if (i++ == next)
  817. stop = bpf_handle_breakpoint(&bpf_curr, f, pkt,
  818. pkt_caplen, pkt_len);
  819. bpf_single_step(&bpf_curr, &f[bpf_curr.Pc], pkt, pkt_caplen,
  820. pkt_len);
  821. bpf_curr.Pc++;
  822. }
  823. return stop ? -1 : bpf_curr.R;
  824. }
  825. static bool pcap_loaded(void)
  826. {
  827. if (pcap_fd < 0)
  828. rl_printf("no pcap file loaded!\n");
  829. return pcap_fd >= 0;
  830. }
  831. static struct pcap_pkthdr *pcap_curr_pkt(void)
  832. {
  833. return (void *) pcap_ptr_va_curr;
  834. }
  835. static bool pcap_next_pkt(void)
  836. {
  837. struct pcap_pkthdr *hdr = pcap_curr_pkt();
  838. if (pcap_ptr_va_curr + sizeof(*hdr) -
  839. pcap_ptr_va_start >= pcap_map_size)
  840. return false;
  841. if (hdr->caplen == 0 || hdr->len == 0 || hdr->caplen > hdr->len)
  842. return false;
  843. if (pcap_ptr_va_curr + sizeof(*hdr) + hdr->caplen -
  844. pcap_ptr_va_start >= pcap_map_size)
  845. return false;
  846. pcap_ptr_va_curr += (sizeof(*hdr) + hdr->caplen);
  847. return true;
  848. }
  849. static void pcap_reset_pkt(void)
  850. {
  851. pcap_ptr_va_curr = pcap_ptr_va_start + sizeof(struct pcap_filehdr);
  852. }
  853. static int try_load_pcap(const char *file)
  854. {
  855. struct pcap_filehdr *hdr;
  856. struct stat sb;
  857. int ret;
  858. pcap_fd = open(file, O_RDONLY);
  859. if (pcap_fd < 0) {
  860. rl_printf("cannot open pcap [%s]!\n", strerror(errno));
  861. return CMD_ERR;
  862. }
  863. ret = fstat(pcap_fd, &sb);
  864. if (ret < 0) {
  865. rl_printf("cannot fstat pcap file!\n");
  866. return CMD_ERR;
  867. }
  868. if (!S_ISREG(sb.st_mode)) {
  869. rl_printf("not a regular pcap file, duh!\n");
  870. return CMD_ERR;
  871. }
  872. pcap_map_size = sb.st_size;
  873. if (pcap_map_size <= sizeof(struct pcap_filehdr)) {
  874. rl_printf("pcap file too small!\n");
  875. return CMD_ERR;
  876. }
  877. pcap_ptr_va_start = mmap(NULL, pcap_map_size, PROT_READ,
  878. MAP_SHARED | MAP_LOCKED, pcap_fd, 0);
  879. if (pcap_ptr_va_start == MAP_FAILED) {
  880. rl_printf("mmap of file failed!");
  881. return CMD_ERR;
  882. }
  883. hdr = (void *) pcap_ptr_va_start;
  884. if (hdr->magic != TCPDUMP_MAGIC) {
  885. rl_printf("wrong pcap magic!\n");
  886. return CMD_ERR;
  887. }
  888. pcap_reset_pkt();
  889. return CMD_OK;
  890. }
  891. static void try_close_pcap(void)
  892. {
  893. if (pcap_fd >= 0) {
  894. munmap(pcap_ptr_va_start, pcap_map_size);
  895. close(pcap_fd);
  896. pcap_ptr_va_start = pcap_ptr_va_curr = NULL;
  897. pcap_map_size = 0;
  898. pcap_packet = 0;
  899. pcap_fd = -1;
  900. }
  901. }
  902. static int cmd_load_bpf(char *bpf_string)
  903. {
  904. char sp, *token, separator = ',';
  905. unsigned short bpf_len, i = 0;
  906. struct sock_filter tmp;
  907. bpf_prog_len = 0;
  908. memset(bpf_image, 0, sizeof(bpf_image));
  909. if (sscanf(bpf_string, "%hu%c", &bpf_len, &sp) != 2 ||
  910. sp != separator || bpf_len > BPF_MAXINSNS || bpf_len == 0) {
  911. rl_printf("syntax error in head length encoding!\n");
  912. return CMD_ERR;
  913. }
  914. token = bpf_string;
  915. while ((token = strchr(token, separator)) && (++token)[0]) {
  916. if (i >= bpf_len) {
  917. rl_printf("program exceeds encoded length!\n");
  918. return CMD_ERR;
  919. }
  920. if (sscanf(token, "%hu %hhu %hhu %u,",
  921. &tmp.code, &tmp.jt, &tmp.jf, &tmp.k) != 4) {
  922. rl_printf("syntax error at instruction %d!\n", i);
  923. return CMD_ERR;
  924. }
  925. bpf_image[i].code = tmp.code;
  926. bpf_image[i].jt = tmp.jt;
  927. bpf_image[i].jf = tmp.jf;
  928. bpf_image[i].k = tmp.k;
  929. i++;
  930. }
  931. if (i != bpf_len) {
  932. rl_printf("syntax error exceeding encoded length!\n");
  933. return CMD_ERR;
  934. } else
  935. bpf_prog_len = bpf_len;
  936. if (!bpf_runnable(bpf_image, bpf_prog_len))
  937. bpf_prog_len = 0;
  938. return CMD_OK;
  939. }
  940. static int cmd_load_pcap(char *file)
  941. {
  942. char *file_trim, *tmp;
  943. file_trim = strtok_r(file, " ", &tmp);
  944. if (file_trim == NULL)
  945. return CMD_ERR;
  946. try_close_pcap();
  947. return try_load_pcap(file_trim);
  948. }
  949. static int cmd_load(char *arg)
  950. {
  951. char *subcmd, *cont = NULL, *tmp = strdup(arg);
  952. int ret = CMD_OK;
  953. subcmd = strtok_r(tmp, " ", &cont);
  954. if (subcmd == NULL)
  955. goto out;
  956. if (matches(subcmd, "bpf") == 0) {
  957. bpf_reset();
  958. bpf_reset_breakpoints();
  959. if (!cont)
  960. ret = CMD_ERR;
  961. else
  962. ret = cmd_load_bpf(cont);
  963. } else if (matches(subcmd, "pcap") == 0) {
  964. ret = cmd_load_pcap(cont);
  965. } else {
  966. out:
  967. rl_printf("bpf <code>: load bpf code\n");
  968. rl_printf("pcap <file>: load pcap file\n");
  969. ret = CMD_ERR;
  970. }
  971. free(tmp);
  972. return ret;
  973. }
  974. static int cmd_step(char *num)
  975. {
  976. struct pcap_pkthdr *hdr;
  977. int steps, ret;
  978. if (!bpf_prog_loaded() || !pcap_loaded())
  979. return CMD_ERR;
  980. steps = strtol(num, NULL, 10);
  981. if (steps == 0 || strlen(num) == 0)
  982. steps = 1;
  983. if (steps < 0) {
  984. if (!bpf_restore_regs(steps))
  985. return CMD_ERR;
  986. steps = 1;
  987. }
  988. hdr = pcap_curr_pkt();
  989. ret = bpf_run_stepping(bpf_image, bpf_prog_len,
  990. (uint8_t *) hdr + sizeof(*hdr),
  991. hdr->caplen, hdr->len, steps);
  992. if (ret >= 0 || bpf_curr.Rs) {
  993. bpf_reset();
  994. if (!pcap_next_pkt()) {
  995. rl_printf("(going back to first packet)\n");
  996. pcap_reset_pkt();
  997. } else {
  998. rl_printf("(next packet)\n");
  999. }
  1000. }
  1001. return CMD_OK;
  1002. }
  1003. static int cmd_select(char *num)
  1004. {
  1005. unsigned int which, i;
  1006. bool have_next = true;
  1007. if (!pcap_loaded() || strlen(num) == 0)
  1008. return CMD_ERR;
  1009. which = strtoul(num, NULL, 10);
  1010. if (which == 0) {
  1011. rl_printf("packet count starts with 1, clamping!\n");
  1012. which = 1;
  1013. }
  1014. pcap_reset_pkt();
  1015. bpf_reset();
  1016. for (i = 0; i < which && (have_next = pcap_next_pkt()); i++)
  1017. /* noop */;
  1018. if (!have_next || pcap_curr_pkt() == NULL) {
  1019. rl_printf("no packet #%u available!\n", which);
  1020. pcap_reset_pkt();
  1021. return CMD_ERR;
  1022. }
  1023. return CMD_OK;
  1024. }
  1025. static int cmd_breakpoint(char *subcmd)
  1026. {
  1027. if (!bpf_prog_loaded())
  1028. return CMD_ERR;
  1029. if (strlen(subcmd) == 0)
  1030. bpf_dump_breakpoints();
  1031. else if (matches(subcmd, "reset") == 0)
  1032. bpf_reset_breakpoints();
  1033. else {
  1034. unsigned int where = strtoul(subcmd, NULL, 10);
  1035. if (where < bpf_prog_len) {
  1036. bpf_set_breakpoints(where);
  1037. rl_printf("breakpoint at: ");
  1038. bpf_disasm(bpf_image[where], where);
  1039. }
  1040. }
  1041. return CMD_OK;
  1042. }
  1043. static int cmd_run(char *num)
  1044. {
  1045. static uint32_t pass, fail;
  1046. bool has_limit = true;
  1047. int pkts = 0, i = 0;
  1048. if (!bpf_prog_loaded() || !pcap_loaded())
  1049. return CMD_ERR;
  1050. pkts = strtol(num, NULL, 10);
  1051. if (pkts == 0 || strlen(num) == 0)
  1052. has_limit = false;
  1053. do {
  1054. struct pcap_pkthdr *hdr = pcap_curr_pkt();
  1055. int ret = bpf_run_all(bpf_image, bpf_prog_len,
  1056. (uint8_t *) hdr + sizeof(*hdr),
  1057. hdr->caplen, hdr->len);
  1058. if (ret > 0)
  1059. pass++;
  1060. else if (ret == 0)
  1061. fail++;
  1062. else
  1063. return CMD_OK;
  1064. bpf_reset();
  1065. } while (pcap_next_pkt() && (!has_limit || (has_limit && ++i < pkts)));
  1066. rl_printf("bpf passes:%u fails:%u\n", pass, fail);
  1067. pcap_reset_pkt();
  1068. bpf_reset();
  1069. pass = fail = 0;
  1070. return CMD_OK;
  1071. }
  1072. static int cmd_disassemble(char *line_string)
  1073. {
  1074. bool single_line = false;
  1075. unsigned long line;
  1076. if (!bpf_prog_loaded())
  1077. return CMD_ERR;
  1078. if (strlen(line_string) > 0 &&
  1079. (line = strtoul(line_string, NULL, 10)) < bpf_prog_len)
  1080. single_line = true;
  1081. if (single_line)
  1082. bpf_disasm(bpf_image[line], line);
  1083. else
  1084. bpf_disasm_all(bpf_image, bpf_prog_len);
  1085. return CMD_OK;
  1086. }
  1087. static int cmd_dump(char *dontcare)
  1088. {
  1089. if (!bpf_prog_loaded())
  1090. return CMD_ERR;
  1091. bpf_dump_all(bpf_image, bpf_prog_len);
  1092. return CMD_OK;
  1093. }
  1094. static int cmd_quit(char *dontcare)
  1095. {
  1096. return CMD_EX;
  1097. }
  1098. static const struct shell_cmd cmds[] = {
  1099. { .name = "load", .func = cmd_load },
  1100. { .name = "select", .func = cmd_select },
  1101. { .name = "step", .func = cmd_step },
  1102. { .name = "run", .func = cmd_run },
  1103. { .name = "breakpoint", .func = cmd_breakpoint },
  1104. { .name = "disassemble", .func = cmd_disassemble },
  1105. { .name = "dump", .func = cmd_dump },
  1106. { .name = "quit", .func = cmd_quit },
  1107. };
  1108. static int execf(char *arg)
  1109. {
  1110. char *cmd, *cont, *tmp = strdup(arg);
  1111. int i, ret = 0, len;
  1112. cmd = strtok_r(tmp, " ", &cont);
  1113. if (cmd == NULL)
  1114. goto out;
  1115. len = strlen(cmd);
  1116. for (i = 0; i < array_size(cmds); i++) {
  1117. if (len != strlen(cmds[i].name))
  1118. continue;
  1119. if (strncmp(cmds[i].name, cmd, len) == 0) {
  1120. ret = cmds[i].func(cont);
  1121. break;
  1122. }
  1123. }
  1124. out:
  1125. free(tmp);
  1126. return ret;
  1127. }
  1128. static char *shell_comp_gen(const char *buf, int state)
  1129. {
  1130. static int list_index, len;
  1131. if (!state) {
  1132. list_index = 0;
  1133. len = strlen(buf);
  1134. }
  1135. for (; list_index < array_size(cmds); ) {
  1136. const char *name = cmds[list_index].name;
  1137. list_index++;
  1138. if (strncmp(name, buf, len) == 0)
  1139. return strdup(name);
  1140. }
  1141. return NULL;
  1142. }
  1143. static char **shell_completion(const char *buf, int start, int end)
  1144. {
  1145. char **matches = NULL;
  1146. if (start == 0)
  1147. matches = rl_completion_matches(buf, shell_comp_gen);
  1148. return matches;
  1149. }
  1150. static void intr_shell(int sig)
  1151. {
  1152. if (rl_end)
  1153. rl_kill_line(-1, 0);
  1154. rl_crlf();
  1155. rl_refresh_line(0, 0);
  1156. rl_free_line_state();
  1157. }
  1158. static void init_shell(FILE *fin, FILE *fout)
  1159. {
  1160. char file[128];
  1161. snprintf(file, sizeof(file), "%s/.bpf_dbg_history", getenv("HOME"));
  1162. read_history(file);
  1163. rl_instream = fin;
  1164. rl_outstream = fout;
  1165. rl_readline_name = "bpf_dbg";
  1166. rl_terminal_name = getenv("TERM");
  1167. rl_catch_signals = 0;
  1168. rl_catch_sigwinch = 1;
  1169. rl_attempted_completion_function = shell_completion;
  1170. rl_bind_key('\t', rl_complete);
  1171. rl_bind_key_in_map('\t', rl_complete, emacs_meta_keymap);
  1172. rl_bind_key_in_map('\033', rl_complete, emacs_meta_keymap);
  1173. snprintf(file, sizeof(file), "%s/.bpf_dbg_init", getenv("HOME"));
  1174. rl_read_init_file(file);
  1175. rl_prep_terminal(0);
  1176. rl_set_signals();
  1177. signal(SIGINT, intr_shell);
  1178. }
  1179. static void exit_shell(FILE *fin, FILE *fout)
  1180. {
  1181. char file[128];
  1182. snprintf(file, sizeof(file), "%s/.bpf_dbg_history", getenv("HOME"));
  1183. write_history(file);
  1184. clear_history();
  1185. rl_deprep_terminal();
  1186. try_close_pcap();
  1187. if (fin != stdin)
  1188. fclose(fin);
  1189. if (fout != stdout)
  1190. fclose(fout);
  1191. }
  1192. static int run_shell_loop(FILE *fin, FILE *fout)
  1193. {
  1194. char *buf;
  1195. init_shell(fin, fout);
  1196. while ((buf = readline("> ")) != NULL) {
  1197. int ret = execf(buf);
  1198. if (ret == CMD_EX)
  1199. break;
  1200. if (ret == CMD_OK && strlen(buf) > 0)
  1201. add_history(buf);
  1202. free(buf);
  1203. }
  1204. exit_shell(fin, fout);
  1205. return 0;
  1206. }
  1207. int main(int argc, char **argv)
  1208. {
  1209. FILE *fin = NULL, *fout = NULL;
  1210. if (argc >= 2)
  1211. fin = fopen(argv[1], "r");
  1212. if (argc >= 3)
  1213. fout = fopen(argv[2], "w");
  1214. return run_shell_loop(fin ? : stdin, fout ? : stdout);
  1215. }