The Tcpdump Group git mirrors - libpcap/blob - bpf_image.c

   1 /*
   2  * Copyright (c) 1990, 1991, 1992, 1994, 1995, 1996
   3  *      The Regents of the University of California.  All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that: (1) source code distributions
   7  * retain the above copyright notice and this paragraph in its entirety, (2)
   8  * distributions including binary code include the above copyright notice and
   9  * this paragraph in its entirety in the documentation or other materials
  10  * provided with the distribution, and (3) all advertising materials mentioning
  11  * features or use of this software display the following acknowledgement:
  12  * ``This product includes software developed by the University of California,
  13  * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
  14  * the University nor the names of its contributors may be used to endorse
  15  * or promote products derived from this software without specific prior
  16  * written permission.
  17  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
  18  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
  19  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  20  */
  21
  22 #ifdef HAVE_CONFIG_H
  23 #include <config.h>
  24 #endif
  25
  26 #include <pcap-types.h>
  27
  28 #include <stdio.h>
  29 #include <string.h>
  30
  31 #include "pcap-int.h"
  32
  33 #ifdef HAVE_OS_PROTO_H
  34 #include "os-proto.h"
  35 #endif
  36
  37 char *
  38 bpf_image(p, n)
  39         const struct bpf_insn *p;
  40         int n;
  41 {
  42         int v;
  43         const char *fmt, *op;
  44         static char image[256];
  45         char operand[64];
  46
  47         v = p->k;
  48         switch (p->code) {
  49
  50         default:
  51                 op = "unimp";
  52                 fmt = "0x%x";
  53                 v = p->code;
  54                 break;
  55
  56         case BPF_RET|BPF_K:
  57                 op = "ret";
  58                 fmt = "#%d";
  59                 break;
  60
  61         case BPF_RET|BPF_A:
  62                 op = "ret";
  63                 fmt = "";
  64                 break;
  65
  66         case BPF_LD|BPF_W|BPF_ABS:
  67                 op = "ld";
  68                 fmt = "[%d]";
  69                 break;
  70
  71         case BPF_LD|BPF_H|BPF_ABS:
  72                 op = "ldh";
  73                 fmt = "[%d]";
  74                 break;
  75
  76         case BPF_LD|BPF_B|BPF_ABS:
  77                 op = "ldb";
  78                 fmt = "[%d]";
  79                 break;
  80
  81         case BPF_LD|BPF_W|BPF_LEN:
  82                 op = "ld";
  83                 fmt = "#pktlen";
  84                 break;
  85
  86         case BPF_LD|BPF_W|BPF_IND:
  87                 op = "ld";
  88                 fmt = "[x + %d]";
  89                 break;
  90
  91         case BPF_LD|BPF_H|BPF_IND:
  92                 op = "ldh";
  93                 fmt = "[x + %d]";
  94                 break;
  95
  96         case BPF_LD|BPF_B|BPF_IND:
  97                 op = "ldb";
  98                 fmt = "[x + %d]";
  99                 break;
 100
 101         case BPF_LD|BPF_IMM:
 102                 op = "ld";
 103                 fmt = "#0x%x";
 104                 break;
 105
 106         case BPF_LDX|BPF_IMM:
 107                 op = "ldx";
 108                 fmt = "#0x%x";
 109                 break;
 110
 111         case BPF_LDX|BPF_MSH|BPF_B:
 112                 op = "ldxb";
 113                 fmt = "4*([%d]&0xf)";
 114                 break;
 115
 116         case BPF_LD|BPF_MEM:
 117                 op = "ld";
 118                 fmt = "M[%d]";
 119                 break;
 120
 121         case BPF_LDX|BPF_MEM:
 122                 op = "ldx";
 123                 fmt = "M[%d]";
 124                 break;
 125
 126         case BPF_ST:
 127                 op = "st";
 128                 fmt = "M[%d]";
 129                 break;
 130
 131         case BPF_STX:
 132                 op = "stx";
 133                 fmt = "M[%d]";
 134                 break;
 135
 136         case BPF_JMP|BPF_JA:
 137                 op = "ja";
 138                 fmt = "%d";
 139                 v = n + 1 + p->k;
 140                 break;
 141
 142         case BPF_JMP|BPF_JGT|BPF_K:
 143                 op = "jgt";
 144                 fmt = "#0x%x";
 145                 break;
 146
 147         case BPF_JMP|BPF_JGE|BPF_K:
 148                 op = "jge";
 149                 fmt = "#0x%x";
 150                 break;
 151
 152         case BPF_JMP|BPF_JEQ|BPF_K:
 153                 op = "jeq";
 154                 fmt = "#0x%x";
 155                 break;
 156
 157         case BPF_JMP|BPF_JSET|BPF_K:
 158                 op = "jset";
 159                 fmt = "#0x%x";
 160                 break;
 161
 162         case BPF_JMP|BPF_JGT|BPF_X:
 163                 op = "jgt";
 164                 fmt = "x";
 165                 break;
 166
 167         case BPF_JMP|BPF_JGE|BPF_X:
 168                 op = "jge";
 169                 fmt = "x";
 170                 break;
 171
 172         case BPF_JMP|BPF_JEQ|BPF_X:
 173                 op = "jeq";
 174                 fmt = "x";
 175                 break;
 176
 177         case BPF_JMP|BPF_JSET|BPF_X:
 178                 op = "jset";
 179                 fmt = "x";
 180                 break;
 181
 182         case BPF_ALU|BPF_ADD|BPF_X:
 183                 op = "add";
 184                 fmt = "x";
 185                 break;
 186
 187         case BPF_ALU|BPF_SUB|BPF_X:
 188                 op = "sub";
 189                 fmt = "x";
 190                 break;
 191
 192         case BPF_ALU|BPF_MUL|BPF_X:
 193                 op = "mul";
 194                 fmt = "x";
 195                 break;
 196
 197         case BPF_ALU|BPF_DIV|BPF_X:
 198                 op = "div";
 199                 fmt = "x";
 200                 break;
 201
 202         case BPF_ALU|BPF_MOD|BPF_X:
 203                 op = "mod";
 204                 fmt = "x";
 205                 break;
 206
 207         case BPF_ALU|BPF_AND|BPF_X:
 208                 op = "and";
 209                 fmt = "x";
 210                 break;
 211
 212         case BPF_ALU|BPF_OR|BPF_X:
 213                 op = "or";
 214                 fmt = "x";
 215                 break;
 216
 217         case BPF_ALU|BPF_XOR|BPF_X:
 218                 op = "xor";
 219                 fmt = "x";
 220                 break;
 221
 222         case BPF_ALU|BPF_LSH|BPF_X:
 223                 op = "lsh";
 224                 fmt = "x";
 225                 break;
 226
 227         case BPF_ALU|BPF_RSH|BPF_X:
 228                 op = "rsh";
 229                 fmt = "x";
 230                 break;
 231
 232         case BPF_ALU|BPF_ADD|BPF_K:
 233                 op = "add";
 234                 fmt = "#%d";
 235                 break;
 236
 237         case BPF_ALU|BPF_SUB|BPF_K:
 238                 op = "sub";
 239                 fmt = "#%d";
 240                 break;
 241
 242         case BPF_ALU|BPF_MUL|BPF_K:
 243                 op = "mul";
 244                 fmt = "#%d";
 245                 break;
 246
 247         case BPF_ALU|BPF_DIV|BPF_K:
 248                 op = "div";
 249                 fmt = "#%d";
 250                 break;
 251
 252         case BPF_ALU|BPF_MOD|BPF_K:
 253                 op = "mod";
 254                 fmt = "#%d";
 255                 break;
 256
 257         case BPF_ALU|BPF_AND|BPF_K:
 258                 op = "and";
 259                 fmt = "#0x%x";
 260                 break;
 261
 262         case BPF_ALU|BPF_OR|BPF_K:
 263                 op = "or";
 264                 fmt = "#0x%x";
 265                 break;
 266
 267         case BPF_ALU|BPF_XOR|BPF_K:
 268                 op = "xor";
 269                 fmt = "#0x%x";
 270                 break;
 271
 272         case BPF_ALU|BPF_LSH|BPF_K:
 273                 op = "lsh";
 274                 fmt = "#%d";
 275                 break;
 276
 277         case BPF_ALU|BPF_RSH|BPF_K:
 278                 op = "rsh";
 279                 fmt = "#%d";
 280                 break;
 281
 282         case BPF_ALU|BPF_NEG:
 283                 op = "neg";
 284                 fmt = "";
 285                 break;
 286
 287         case BPF_MISC|BPF_TAX:
 288                 op = "tax";
 289                 fmt = "";
 290                 break;
 291
 292         case BPF_MISC|BPF_TXA:
 293                 op = "txa";
 294                 fmt = "";
 295                 break;
 296         }
 297         (void)pcap_snprintf(operand, sizeof operand, fmt, v);
 298         if (BPF_CLASS(p->code) == BPF_JMP && BPF_OP(p->code) != BPF_JA) {
 299                 (void)pcap_snprintf(image, sizeof image,
 300                               "(%03d) %-8s %-16s jt %d\tjf %d",
 301                               n, op, operand, n + 1 + p->jt, n + 1 + p->jf);
 302         } else {
 303                 (void)pcap_snprintf(image, sizeof image,
 304                               "(%03d) %-8s %s",
 305                               n, op, operand);
 306         }
 307         return image;
 308 }