1*a71a9546SAutomerger Merge Worker /*
2*a71a9546SAutomerger Merge Worker * BPF program compilation tool
3*a71a9546SAutomerger Merge Worker *
4*a71a9546SAutomerger Merge Worker * Generates decimal output, similar to `tcpdump -ddd ...`.
5*a71a9546SAutomerger Merge Worker * Unlike tcpdump, will generate for any given link layer type.
6*a71a9546SAutomerger Merge Worker *
7*a71a9546SAutomerger Merge Worker * Written by Willem de Bruijn ([email protected])
8*a71a9546SAutomerger Merge Worker * Copyright Google, Inc. 2013
9*a71a9546SAutomerger Merge Worker * Licensed under the GNU General Public License version 2 (GPLv2)
10*a71a9546SAutomerger Merge Worker */
11*a71a9546SAutomerger Merge Worker
12*a71a9546SAutomerger Merge Worker #include <pcap.h>
13*a71a9546SAutomerger Merge Worker #include <stdio.h>
14*a71a9546SAutomerger Merge Worker
main(int argc,char ** argv)15*a71a9546SAutomerger Merge Worker int main(int argc, char **argv)
16*a71a9546SAutomerger Merge Worker {
17*a71a9546SAutomerger Merge Worker struct bpf_program program;
18*a71a9546SAutomerger Merge Worker struct bpf_insn *ins;
19*a71a9546SAutomerger Merge Worker int i, dlt = DLT_RAW;
20*a71a9546SAutomerger Merge Worker pcap_t *pcap;
21*a71a9546SAutomerger Merge Worker
22*a71a9546SAutomerger Merge Worker if (argc < 2 || argc > 3) {
23*a71a9546SAutomerger Merge Worker fprintf(stderr, "Usage: %s [link] '<program>'\n\n"
24*a71a9546SAutomerger Merge Worker " link is a pcap linklayer type:\n"
25*a71a9546SAutomerger Merge Worker " one of EN10MB, RAW, SLIP, ...\n\n"
26*a71a9546SAutomerger Merge Worker "Examples: %s RAW 'tcp and greater 100'\n"
27*a71a9546SAutomerger Merge Worker " %s EN10MB 'ip proto 47'\n'",
28*a71a9546SAutomerger Merge Worker argv[0], argv[0], argv[0]);
29*a71a9546SAutomerger Merge Worker return 1;
30*a71a9546SAutomerger Merge Worker }
31*a71a9546SAutomerger Merge Worker
32*a71a9546SAutomerger Merge Worker if (argc == 3) {
33*a71a9546SAutomerger Merge Worker dlt = pcap_datalink_name_to_val(argv[1]);
34*a71a9546SAutomerger Merge Worker if (dlt == -1) {
35*a71a9546SAutomerger Merge Worker fprintf(stderr, "Unknown datalinktype: %s\n", argv[1]);
36*a71a9546SAutomerger Merge Worker return 1;
37*a71a9546SAutomerger Merge Worker }
38*a71a9546SAutomerger Merge Worker }
39*a71a9546SAutomerger Merge Worker
40*a71a9546SAutomerger Merge Worker pcap = pcap_open_dead(dlt, 65535);
41*a71a9546SAutomerger Merge Worker if (!pcap) {
42*a71a9546SAutomerger Merge Worker fprintf(stderr, "Memory allocation failure\n");
43*a71a9546SAutomerger Merge Worker return 1;
44*a71a9546SAutomerger Merge Worker }
45*a71a9546SAutomerger Merge Worker if (pcap_compile(pcap, &program, argv[argc - 1], 1,
46*a71a9546SAutomerger Merge Worker PCAP_NETMASK_UNKNOWN)) {
47*a71a9546SAutomerger Merge Worker fprintf(stderr, "Compilation error\n");
48*a71a9546SAutomerger Merge Worker pcap_close(pcap);
49*a71a9546SAutomerger Merge Worker return 1;
50*a71a9546SAutomerger Merge Worker }
51*a71a9546SAutomerger Merge Worker
52*a71a9546SAutomerger Merge Worker printf("%d,", program.bf_len);
53*a71a9546SAutomerger Merge Worker ins = program.bf_insns;
54*a71a9546SAutomerger Merge Worker for (i = 0; i < program.bf_len-1; ++ins, ++i)
55*a71a9546SAutomerger Merge Worker printf("%u %u %u %u,", ins->code, ins->jt, ins->jf, ins->k);
56*a71a9546SAutomerger Merge Worker
57*a71a9546SAutomerger Merge Worker printf("%u %u %u %u\n", ins->code, ins->jt, ins->jf, ins->k);
58*a71a9546SAutomerger Merge Worker
59*a71a9546SAutomerger Merge Worker pcap_freecode(&program);
60*a71a9546SAutomerger Merge Worker pcap_close(pcap);
61*a71a9546SAutomerger Merge Worker return 0;
62*a71a9546SAutomerger Merge Worker }
63*a71a9546SAutomerger Merge Worker
64