From ca4c9f229aa46d7983302323d7468cabde55995c Mon Sep 17 00:00:00 2001 From: Alice Frosi Date: Wed, 21 Dec 2022 12:01:39 +0100 Subject: Create bpf_dbg program to disassemble BPF filters The bpf_dbg binary prints the instructions included in the BPF filter. This is particurarly useful for debugging and verifing the generated filter. E.g: ./bpf_dbg test.bpf Read 7 entries l0: ld [4] l1: jeq #0xc000003e, l2, l5 l2: ld [0] l3: jeq #0x2a, l4, l5 l4: ja 5 l5: ret #0x7fff0000 l6: ret #0x7fc00000 Signed-off-by: Alice Frosi --- disasm.h | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 disasm.h (limited to 'disasm.h') diff --git a/disasm.h b/disasm.h new file mode 100644 index 0000000..4df0cec --- /dev/null +++ b/disasm.h @@ -0,0 +1,9 @@ +#ifndef DISASM_H_ +#define DISASM_H_ + +#define SIZE_FILTER 1024 + +void bpf_disasm(const struct sock_filter f, unsigned int i); +void bpf_disasm_all(const struct sock_filter *f, unsigned int len); + +#endif -- cgit v1.2.3