1 /* $NetBSD: bpf_image.c,v 1.1.1.4 2013/12/31 16:57:24 christos Exp $ */ 2 3 /* 4 * Copyright (c) 1990, 1991, 1992, 1994, 1995, 1996 5 * The Regents of the University of California. All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that: (1) source code distributions 9 * retain the above copyright notice and this paragraph in its entirety, (2) 10 * distributions including binary code include the above copyright notice and 11 * this paragraph in its entirety in the documentation or other materials 12 * provided with the distribution, and (3) all advertising materials mentioning 13 * features or use of this software display the following acknowledgement: 14 * ``This product includes software developed by the University of California, 15 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of 16 * the University nor the names of its contributors may be used to endorse 17 * or promote products derived from this software without specific prior 18 * written permission. 19 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED 20 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF 21 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 22 */ 23 24 #ifndef lint 25 static const char rcsid[] _U_ = 26 "@(#) Header: /tcpdump/master/libpcap/bpf_image.c,v 1.28 2008-01-02 04:16:46 guy Exp (LBL)"; 27 #endif 28 29 #ifdef HAVE_CONFIG_H 30 #include "config.h" 31 #endif 32 33 #ifdef WIN32 34 #include <pcap-stdinc.h> 35 #else /* WIN32 */ 36 #if HAVE_INTTYPES_H 37 #include <inttypes.h> 38 #elif HAVE_STDINT_H 39 #include <stdint.h> 40 #endif 41 #ifdef HAVE_SYS_BITYPES_H 42 #include <sys/bitypes.h> 43 #endif 44 #include <sys/types.h> 45 #endif /* WIN32 */ 46 47 #include <stdio.h> 48 #include <string.h> 49 50 #include "pcap-int.h" 51 52 #ifdef HAVE_OS_PROTO_H 53 #include "os-proto.h" 54 #endif 55 56 char * 57 bpf_image(p, n) 58 const struct bpf_insn *p; 59 int n; 60 { 61 int v; 62 const char *fmt, *op; 63 static char image[256]; 64 char operand[64]; 65 66 v = p->k; 67 switch (p->code) { 68 69 default: 70 op = "unimp"; 71 fmt = "0x%x"; 72 v = p->code; 73 break; 74 75 case BPF_RET|BPF_K: 76 op = "ret"; 77 fmt = "#%d"; 78 break; 79 80 case BPF_RET|BPF_A: 81 op = "ret"; 82 fmt = ""; 83 break; 84 85 case BPF_LD|BPF_W|BPF_ABS: 86 op = "ld"; 87 fmt = "[%d]"; 88 break; 89 90 case BPF_LD|BPF_H|BPF_ABS: 91 op = "ldh"; 92 fmt = "[%d]"; 93 break; 94 95 case BPF_LD|BPF_B|BPF_ABS: 96 op = "ldb"; 97 fmt = "[%d]"; 98 break; 99 100 case BPF_LD|BPF_W|BPF_LEN: 101 op = "ld"; 102 fmt = "#pktlen"; 103 break; 104 105 case BPF_LD|BPF_W|BPF_IND: 106 op = "ld"; 107 fmt = "[x + %d]"; 108 break; 109 110 case BPF_LD|BPF_H|BPF_IND: 111 op = "ldh"; 112 fmt = "[x + %d]"; 113 break; 114 115 case BPF_LD|BPF_B|BPF_IND: 116 op = "ldb"; 117 fmt = "[x + %d]"; 118 break; 119 120 case BPF_LD|BPF_IMM: 121 op = "ld"; 122 fmt = "#0x%x"; 123 break; 124 125 case BPF_LDX|BPF_IMM: 126 op = "ldx"; 127 fmt = "#0x%x"; 128 break; 129 130 case BPF_LDX|BPF_MSH|BPF_B: 131 op = "ldxb"; 132 fmt = "4*([%d]&0xf)"; 133 break; 134 135 case BPF_LD|BPF_MEM: 136 op = "ld"; 137 fmt = "M[%d]"; 138 break; 139 140 case BPF_LDX|BPF_MEM: 141 op = "ldx"; 142 fmt = "M[%d]"; 143 break; 144 145 case BPF_ST: 146 op = "st"; 147 fmt = "M[%d]"; 148 break; 149 150 case BPF_STX: 151 op = "stx"; 152 fmt = "M[%d]"; 153 break; 154 155 case BPF_JMP|BPF_JA: 156 op = "ja"; 157 fmt = "%d"; 158 v = n + 1 + p->k; 159 break; 160 161 case BPF_JMP|BPF_JGT|BPF_K: 162 op = "jgt"; 163 fmt = "#0x%x"; 164 break; 165 166 case BPF_JMP|BPF_JGE|BPF_K: 167 op = "jge"; 168 fmt = "#0x%x"; 169 break; 170 171 case BPF_JMP|BPF_JEQ|BPF_K: 172 op = "jeq"; 173 fmt = "#0x%x"; 174 break; 175 176 case BPF_JMP|BPF_JSET|BPF_K: 177 op = "jset"; 178 fmt = "#0x%x"; 179 break; 180 181 case BPF_JMP|BPF_JGT|BPF_X: 182 op = "jgt"; 183 fmt = "x"; 184 break; 185 186 case BPF_JMP|BPF_JGE|BPF_X: 187 op = "jge"; 188 fmt = "x"; 189 break; 190 191 case BPF_JMP|BPF_JEQ|BPF_X: 192 op = "jeq"; 193 fmt = "x"; 194 break; 195 196 case BPF_JMP|BPF_JSET|BPF_X: 197 op = "jset"; 198 fmt = "x"; 199 break; 200 201 case BPF_ALU|BPF_ADD|BPF_X: 202 op = "add"; 203 fmt = "x"; 204 break; 205 206 case BPF_ALU|BPF_SUB|BPF_X: 207 op = "sub"; 208 fmt = "x"; 209 break; 210 211 case BPF_ALU|BPF_MUL|BPF_X: 212 op = "mul"; 213 fmt = "x"; 214 break; 215 216 case BPF_ALU|BPF_DIV|BPF_X: 217 op = "div"; 218 fmt = "x"; 219 break; 220 221 case BPF_ALU|BPF_AND|BPF_X: 222 op = "and"; 223 fmt = "x"; 224 break; 225 226 case BPF_ALU|BPF_OR|BPF_X: 227 op = "or"; 228 fmt = "x"; 229 break; 230 231 case BPF_ALU|BPF_LSH|BPF_X: 232 op = "lsh"; 233 fmt = "x"; 234 break; 235 236 case BPF_ALU|BPF_RSH|BPF_X: 237 op = "rsh"; 238 fmt = "x"; 239 break; 240 241 case BPF_ALU|BPF_ADD|BPF_K: 242 op = "add"; 243 fmt = "#%d"; 244 break; 245 246 case BPF_ALU|BPF_SUB|BPF_K: 247 op = "sub"; 248 fmt = "#%d"; 249 break; 250 251 case BPF_ALU|BPF_MUL|BPF_K: 252 op = "mul"; 253 fmt = "#%d"; 254 break; 255 256 case BPF_ALU|BPF_DIV|BPF_K: 257 op = "div"; 258 fmt = "#%d"; 259 break; 260 261 case BPF_ALU|BPF_AND|BPF_K: 262 op = "and"; 263 fmt = "#0x%x"; 264 break; 265 266 case BPF_ALU|BPF_OR|BPF_K: 267 op = "or"; 268 fmt = "#0x%x"; 269 break; 270 271 case BPF_ALU|BPF_LSH|BPF_K: 272 op = "lsh"; 273 fmt = "#%d"; 274 break; 275 276 case BPF_ALU|BPF_RSH|BPF_K: 277 op = "rsh"; 278 fmt = "#%d"; 279 break; 280 281 case BPF_ALU|BPF_NEG: 282 op = "neg"; 283 fmt = ""; 284 break; 285 286 case BPF_MISC|BPF_TAX: 287 op = "tax"; 288 fmt = ""; 289 break; 290 291 case BPF_MISC|BPF_TXA: 292 op = "txa"; 293 fmt = ""; 294 break; 295 } 296 (void)snprintf(operand, sizeof operand, fmt, v); 297 if (BPF_CLASS(p->code) == BPF_JMP && BPF_OP(p->code) != BPF_JA) { 298 (void)snprintf(image, sizeof image, 299 "(%03d) %-8s %-16s jt %d\tjf %d", 300 n, op, operand, n + 1 + p->jt, n + 1 + p->jf); 301 } else { 302 (void)snprintf(image, sizeof image, 303 "(%03d) %-8s %s", 304 n, op, operand); 305 } 306 return image; 307 } 308