1 /* 2 * Copyright (c) 1990, 1991, 1992, 1994, 1995, 1996 3 * The Regents of the University of California. All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that: (1) source code distributions 7 * retain the above copyright notice and this paragraph in its entirety, (2) 8 * distributions including binary code include the above copyright notice and 9 * this paragraph in its entirety in the documentation or other materials 10 * provided with the distribution, and (3) all advertising materials mentioning 11 * features or use of this software display the following acknowledgement: 12 * ``This product includes software developed by the University of California, 13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of 14 * the University nor the names of its contributors may be used to endorse 15 * or promote products derived from this software without specific prior 16 * written permission. 17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED 18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF 19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 20 */ 21 22 #ifndef lint 23 static const char rcsid[] _U_ = 24 "@(#) $Header: /tcpdump/master/libpcap/bpf_image.c,v 1.27.2.1 2008/01/02 04:22:16 guy Exp $ (LBL)"; 25 #endif 26 27 #ifdef HAVE_CONFIG_H 28 #include "config.h" 29 #endif 30 31 #include <stdio.h> 32 #include <string.h> 33 34 #include "pcap-int.h" 35 36 #ifdef HAVE_OS_PROTO_H 37 #include "os-proto.h" 38 #endif 39 40 char * 41 bpf_image(p, n) 42 const struct bpf_insn *p; 43 int n; 44 { 45 int v; 46 const char *fmt, *op; 47 static char image[256]; 48 char operand[64]; 49 50 v = p->k; 51 switch (p->code) { 52 53 default: 54 op = "unimp"; 55 fmt = "0x%x"; 56 v = p->code; 57 break; 58 59 case BPF_RET|BPF_K: 60 op = "ret"; 61 fmt = "#%d"; 62 break; 63 64 case BPF_RET|BPF_A: 65 op = "ret"; 66 fmt = ""; 67 break; 68 69 case BPF_LD|BPF_W|BPF_ABS: 70 op = "ld"; 71 fmt = "[%d]"; 72 break; 73 74 case BPF_LD|BPF_H|BPF_ABS: 75 op = "ldh"; 76 fmt = "[%d]"; 77 break; 78 79 case BPF_LD|BPF_B|BPF_ABS: 80 op = "ldb"; 81 fmt = "[%d]"; 82 break; 83 84 case BPF_LD|BPF_W|BPF_LEN: 85 op = "ld"; 86 fmt = "#pktlen"; 87 break; 88 89 case BPF_LD|BPF_W|BPF_IND: 90 op = "ld"; 91 fmt = "[x + %d]"; 92 break; 93 94 case BPF_LD|BPF_H|BPF_IND: 95 op = "ldh"; 96 fmt = "[x + %d]"; 97 break; 98 99 case BPF_LD|BPF_B|BPF_IND: 100 op = "ldb"; 101 fmt = "[x + %d]"; 102 break; 103 104 case BPF_LD|BPF_IMM: 105 op = "ld"; 106 fmt = "#0x%x"; 107 break; 108 109 case BPF_LDX|BPF_IMM: 110 op = "ldx"; 111 fmt = "#0x%x"; 112 break; 113 114 case BPF_LDX|BPF_MSH|BPF_B: 115 op = "ldxb"; 116 fmt = "4*([%d]&0xf)"; 117 break; 118 119 case BPF_LD|BPF_MEM: 120 op = "ld"; 121 fmt = "M[%d]"; 122 break; 123 124 case BPF_LDX|BPF_MEM: 125 op = "ldx"; 126 fmt = "M[%d]"; 127 break; 128 129 case BPF_ST: 130 op = "st"; 131 fmt = "M[%d]"; 132 break; 133 134 case BPF_STX: 135 op = "stx"; 136 fmt = "M[%d]"; 137 break; 138 139 case BPF_JMP|BPF_JA: 140 op = "ja"; 141 fmt = "%d"; 142 v = n + 1 + p->k; 143 break; 144 145 case BPF_JMP|BPF_JGT|BPF_K: 146 op = "jgt"; 147 fmt = "#0x%x"; 148 break; 149 150 case BPF_JMP|BPF_JGE|BPF_K: 151 op = "jge"; 152 fmt = "#0x%x"; 153 break; 154 155 case BPF_JMP|BPF_JEQ|BPF_K: 156 op = "jeq"; 157 fmt = "#0x%x"; 158 break; 159 160 case BPF_JMP|BPF_JSET|BPF_K: 161 op = "jset"; 162 fmt = "#0x%x"; 163 break; 164 165 case BPF_JMP|BPF_JGT|BPF_X: 166 op = "jgt"; 167 fmt = "x"; 168 break; 169 170 case BPF_JMP|BPF_JGE|BPF_X: 171 op = "jge"; 172 fmt = "x"; 173 break; 174 175 case BPF_JMP|BPF_JEQ|BPF_X: 176 op = "jeq"; 177 fmt = "x"; 178 break; 179 180 case BPF_JMP|BPF_JSET|BPF_X: 181 op = "jset"; 182 fmt = "x"; 183 break; 184 185 case BPF_ALU|BPF_ADD|BPF_X: 186 op = "add"; 187 fmt = "x"; 188 break; 189 190 case BPF_ALU|BPF_SUB|BPF_X: 191 op = "sub"; 192 fmt = "x"; 193 break; 194 195 case BPF_ALU|BPF_MUL|BPF_X: 196 op = "mul"; 197 fmt = "x"; 198 break; 199 200 case BPF_ALU|BPF_DIV|BPF_X: 201 op = "div"; 202 fmt = "x"; 203 break; 204 205 case BPF_ALU|BPF_AND|BPF_X: 206 op = "and"; 207 fmt = "x"; 208 break; 209 210 case BPF_ALU|BPF_OR|BPF_X: 211 op = "or"; 212 fmt = "x"; 213 break; 214 215 case BPF_ALU|BPF_LSH|BPF_X: 216 op = "lsh"; 217 fmt = "x"; 218 break; 219 220 case BPF_ALU|BPF_RSH|BPF_X: 221 op = "rsh"; 222 fmt = "x"; 223 break; 224 225 case BPF_ALU|BPF_ADD|BPF_K: 226 op = "add"; 227 fmt = "#%d"; 228 break; 229 230 case BPF_ALU|BPF_SUB|BPF_K: 231 op = "sub"; 232 fmt = "#%d"; 233 break; 234 235 case BPF_ALU|BPF_MUL|BPF_K: 236 op = "mul"; 237 fmt = "#%d"; 238 break; 239 240 case BPF_ALU|BPF_DIV|BPF_K: 241 op = "div"; 242 fmt = "#%d"; 243 break; 244 245 case BPF_ALU|BPF_AND|BPF_K: 246 op = "and"; 247 fmt = "#0x%x"; 248 break; 249 250 case BPF_ALU|BPF_OR|BPF_K: 251 op = "or"; 252 fmt = "#0x%x"; 253 break; 254 255 case BPF_ALU|BPF_LSH|BPF_K: 256 op = "lsh"; 257 fmt = "#%d"; 258 break; 259 260 case BPF_ALU|BPF_RSH|BPF_K: 261 op = "rsh"; 262 fmt = "#%d"; 263 break; 264 265 case BPF_ALU|BPF_NEG: 266 op = "neg"; 267 fmt = ""; 268 break; 269 270 case BPF_MISC|BPF_TAX: 271 op = "tax"; 272 fmt = ""; 273 break; 274 275 case BPF_MISC|BPF_TXA: 276 op = "txa"; 277 fmt = ""; 278 break; 279 } 280 (void)snprintf(operand, sizeof operand, fmt, v); 281 (void)snprintf(image, sizeof image, 282 (BPF_CLASS(p->code) == BPF_JMP && 283 BPF_OP(p->code) != BPF_JA) ? 284 "(%03d) %-8s %-16s jt %d\tjf %d" 285 : "(%03d) %-8s %s", 286 n, op, operand, n + 1 + p->jt, n + 1 + p->jf); 287 return image; 288 } 289