The Tcpdump Group git mirrors - libpcap/blob - bpf_image.c

   1 /*
   2  * Copyright (c) 1990, 1991, 1992, 1994, 1995, 1996
   3  *      The Regents of the University of California.  All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that: (1) source code distributions
   7  * retain the above copyright notice and this paragraph in its entirety, (2)
   8  * distributions including binary code include the above copyright notice and
   9  * this paragraph in its entirety in the documentation or other materials
  10  * provided with the distribution, and (3) all advertising materials mentioning
  11  * features or use of this software display the following acknowledgement:
  12  * ``This product includes software developed by the University of California,
  13  * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
  14  * the University nor the names of its contributors may be used to endorse
  15  * or promote products derived from this software without specific prior
  16  * written permission.
  17  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
  18  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
  19  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  20  */
  21
  22 #ifdef HAVE_CONFIG_H
  23 #include <config.h>
  24 #endif
  25
  26 #include <pcap-types.h>
  27
  28 #include <stdio.h>
  29 #include <string.h>
  30
  31 #include "pcap-int.h"
  32
  33 #ifdef HAVE_OS_PROTO_H
  34 #include "os-proto.h"
  35 #endif
  36
  37 char *
  38 bpf_image(const struct bpf_insn *p, int n)
  39 {
  40         int v;
  41         const char *fmt, *op;
  42         static char image[256];
  43         char operand[64];
  44
  45         v = p->k;
  46         switch (p->code) {
  47
  48         default:
  49                 op = "unimp";
  50                 fmt = "0x%x";
  51                 v = p->code;
  52                 break;
  53
  54         case BPF_RET|BPF_K:
  55                 op = "ret";
  56                 fmt = "#%d";
  57                 break;
  58
  59         case BPF_RET|BPF_A:
  60                 op = "ret";
  61                 fmt = "";
  62                 break;
  63
  64         case BPF_LD|BPF_W|BPF_ABS:
  65                 op = "ld";
  66                 fmt = "[%d]";
  67                 break;
  68
  69         case BPF_LD|BPF_H|BPF_ABS:
  70                 op = "ldh";
  71                 fmt = "[%d]";
  72                 break;
  73
  74         case BPF_LD|BPF_B|BPF_ABS:
  75                 op = "ldb";
  76                 fmt = "[%d]";
  77                 break;
  78
  79         case BPF_LD|BPF_W|BPF_LEN:
  80                 op = "ld";
  81                 fmt = "#pktlen";
  82                 break;
  83
  84         case BPF_LD|BPF_W|BPF_IND:
  85                 op = "ld";
  86                 fmt = "[x + %d]";
  87                 break;
  88
  89         case BPF_LD|BPF_H|BPF_IND:
  90                 op = "ldh";
  91                 fmt = "[x + %d]";
  92                 break;
  93
  94         case BPF_LD|BPF_B|BPF_IND:
  95                 op = "ldb";
  96                 fmt = "[x + %d]";
  97                 break;
  98
  99         case BPF_LD|BPF_IMM:
 100                 op = "ld";
 101                 fmt = "#0x%x";
 102                 break;
 103
 104         case BPF_LDX|BPF_IMM:
 105                 op = "ldx";
 106                 fmt = "#0x%x";
 107                 break;
 108
 109         case BPF_LDX|BPF_MSH|BPF_B:
 110                 op = "ldxb";
 111                 fmt = "4*([%d]&0xf)";
 112                 break;
 113
 114         case BPF_LD|BPF_MEM:
 115                 op = "ld";
 116                 fmt = "M[%d]";
 117                 break;
 118
 119         case BPF_LDX|BPF_MEM:
 120                 op = "ldx";
 121                 fmt = "M[%d]";
 122                 break;
 123
 124         case BPF_ST:
 125                 op = "st";
 126                 fmt = "M[%d]";
 127                 break;
 128
 129         case BPF_STX:
 130                 op = "stx";
 131                 fmt = "M[%d]";
 132                 break;
 133
 134         case BPF_JMP|BPF_JA:
 135                 op = "ja";
 136                 fmt = "%d";
 137                 v = n + 1 + p->k;
 138                 break;
 139
 140         case BPF_JMP|BPF_JGT|BPF_K:
 141                 op = "jgt";
 142                 fmt = "#0x%x";
 143                 break;
 144
 145         case BPF_JMP|BPF_JGE|BPF_K:
 146                 op = "jge";
 147                 fmt = "#0x%x";
 148                 break;
 149
 150         case BPF_JMP|BPF_JEQ|BPF_K:
 151                 op = "jeq";
 152                 fmt = "#0x%x";
 153                 break;
 154
 155         case BPF_JMP|BPF_JSET|BPF_K:
 156                 op = "jset";
 157                 fmt = "#0x%x";
 158                 break;
 159
 160         case BPF_JMP|BPF_JGT|BPF_X:
 161                 op = "jgt";
 162                 fmt = "x";
 163                 break;
 164
 165         case BPF_JMP|BPF_JGE|BPF_X:
 166                 op = "jge";
 167                 fmt = "x";
 168                 break;
 169
 170         case BPF_JMP|BPF_JEQ|BPF_X:
 171                 op = "jeq";
 172                 fmt = "x";
 173                 break;
 174
 175         case BPF_JMP|BPF_JSET|BPF_X:
 176                 op = "jset";
 177                 fmt = "x";
 178                 break;
 179
 180         case BPF_ALU|BPF_ADD|BPF_X:
 181                 op = "add";
 182                 fmt = "x";
 183                 break;
 184
 185         case BPF_ALU|BPF_SUB|BPF_X:
 186                 op = "sub";
 187                 fmt = "x";
 188                 break;
 189
 190         case BPF_ALU|BPF_MUL|BPF_X:
 191                 op = "mul";
 192                 fmt = "x";
 193                 break;
 194
 195         case BPF_ALU|BPF_DIV|BPF_X:
 196                 op = "div";
 197                 fmt = "x";
 198                 break;
 199
 200         case BPF_ALU|BPF_MOD|BPF_X:
 201                 op = "mod";
 202                 fmt = "x";
 203                 break;
 204
 205         case BPF_ALU|BPF_AND|BPF_X:
 206                 op = "and";
 207                 fmt = "x";
 208                 break;
 209
 210         case BPF_ALU|BPF_OR|BPF_X:
 211                 op = "or";
 212                 fmt = "x";
 213                 break;
 214
 215         case BPF_ALU|BPF_XOR|BPF_X:
 216                 op = "xor";
 217                 fmt = "x";
 218                 break;
 219
 220         case BPF_ALU|BPF_LSH|BPF_X:
 221                 op = "lsh";
 222                 fmt = "x";
 223                 break;
 224
 225         case BPF_ALU|BPF_RSH|BPF_X:
 226                 op = "rsh";
 227                 fmt = "x";
 228                 break;
 229
 230         case BPF_ALU|BPF_ADD|BPF_K:
 231                 op = "add";
 232                 fmt = "#%d";
 233                 break;
 234
 235         case BPF_ALU|BPF_SUB|BPF_K:
 236                 op = "sub";
 237                 fmt = "#%d";
 238                 break;
 239
 240         case BPF_ALU|BPF_MUL|BPF_K:
 241                 op = "mul";
 242                 fmt = "#%d";
 243                 break;
 244
 245         case BPF_ALU|BPF_DIV|BPF_K:
 246                 op = "div";
 247                 fmt = "#%d";
 248                 break;
 249
 250         case BPF_ALU|BPF_MOD|BPF_K:
 251                 op = "mod";
 252                 fmt = "#%d";
 253                 break;
 254
 255         case BPF_ALU|BPF_AND|BPF_K:
 256                 op = "and";
 257                 fmt = "#0x%x";
 258                 break;
 259
 260         case BPF_ALU|BPF_OR|BPF_K:
 261                 op = "or";
 262                 fmt = "#0x%x";
 263                 break;
 264
 265         case BPF_ALU|BPF_XOR|BPF_K:
 266                 op = "xor";
 267                 fmt = "#0x%x";
 268                 break;
 269
 270         case BPF_ALU|BPF_LSH|BPF_K:
 271                 op = "lsh";
 272                 fmt = "#%d";
 273                 break;
 274
 275         case BPF_ALU|BPF_RSH|BPF_K:
 276                 op = "rsh";
 277                 fmt = "#%d";
 278                 break;
 279
 280         case BPF_ALU|BPF_NEG:
 281                 op = "neg";
 282                 fmt = "";
 283                 break;
 284
 285         case BPF_MISC|BPF_TAX:
 286                 op = "tax";
 287                 fmt = "";
 288                 break;
 289
 290         case BPF_MISC|BPF_TXA:
 291                 op = "txa";
 292                 fmt = "";
 293                 break;
 294         }
 295         (void)pcap_snprintf(operand, sizeof operand, fmt, v);
 296         if (BPF_CLASS(p->code) == BPF_JMP && BPF_OP(p->code) != BPF_JA) {
 297                 (void)pcap_snprintf(image, sizeof image,
 298                               "(%03d) %-8s %-16s jt %d\tjf %d",
 299                               n, op, operand, n + 1 + p->jt, n + 1 + p->jf);
 300         } else {
 301                 (void)pcap_snprintf(image, sizeof image,
 302                               "(%03d) %-8s %s",
 303                               n, op, operand);
 304         }
 305         return image;
 306 }