xref: /freebsd/contrib/libpcap/bpf_image.c (revision 6472ac3d8a86336899b6cfb789a4cd9897e3fab5)
1 /*
2  * Copyright (c) 1990, 1991, 1992, 1994, 1995, 1996
3  *	The Regents of the University of California.  All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that: (1) source code distributions
7  * retain the above copyright notice and this paragraph in its entirety, (2)
8  * distributions including binary code include the above copyright notice and
9  * this paragraph in its entirety in the documentation or other materials
10  * provided with the distribution, and (3) all advertising materials mentioning
11  * features or use of this software display the following acknowledgement:
12  * ``This product includes software developed by the University of California,
13  * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14  * the University nor the names of its contributors may be used to endorse
15  * or promote products derived from this software without specific prior
16  * written permission.
17  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
20  */
21 
22 #ifndef lint
23 static const char rcsid[] _U_ =
24     "@(#) $Header: /tcpdump/master/libpcap/bpf_image.c,v 1.28 2008-01-02 04:16:46 guy Exp $ (LBL)";
25 #endif
26 
27 #ifdef HAVE_CONFIG_H
28 #include "config.h"
29 #endif
30 
31 #ifdef WIN32
32 #include <pcap-stdinc.h>
33 #else /* WIN32 */
34 #if HAVE_INTTYPES_H
35 #include <inttypes.h>
36 #elif HAVE_STDINT_H
37 #include <stdint.h>
38 #endif
39 #ifdef HAVE_SYS_BITYPES_H
40 #include <sys/bitypes.h>
41 #endif
42 #include <sys/types.h>
43 #endif /* WIN32 */
44 
45 #include <stdio.h>
46 #include <string.h>
47 
48 #include "pcap-int.h"
49 
50 #ifdef HAVE_OS_PROTO_H
51 #include "os-proto.h"
52 #endif
53 
54 char *
55 bpf_image(p, n)
56 	struct bpf_insn *p;
57 	int n;
58 {
59 	int v;
60 	const char *fmt, *op;
61 	static char image[256];
62 	char operand[64];
63 
64 	v = p->k;
65 	switch (p->code) {
66 
67 	default:
68 		op = "unimp";
69 		fmt = "0x%x";
70 		v = p->code;
71 		break;
72 
73 	case BPF_RET|BPF_K:
74 		op = "ret";
75 		fmt = "#%d";
76 		break;
77 
78 	case BPF_RET|BPF_A:
79 		op = "ret";
80 		fmt = "";
81 		break;
82 
83 	case BPF_LD|BPF_W|BPF_ABS:
84 		op = "ld";
85 		fmt = "[%d]";
86 		break;
87 
88 	case BPF_LD|BPF_H|BPF_ABS:
89 		op = "ldh";
90 		fmt = "[%d]";
91 		break;
92 
93 	case BPF_LD|BPF_B|BPF_ABS:
94 		op = "ldb";
95 		fmt = "[%d]";
96 		break;
97 
98 	case BPF_LD|BPF_W|BPF_LEN:
99 		op = "ld";
100 		fmt = "#pktlen";
101 		break;
102 
103 	case BPF_LD|BPF_W|BPF_IND:
104 		op = "ld";
105 		fmt = "[x + %d]";
106 		break;
107 
108 	case BPF_LD|BPF_H|BPF_IND:
109 		op = "ldh";
110 		fmt = "[x + %d]";
111 		break;
112 
113 	case BPF_LD|BPF_B|BPF_IND:
114 		op = "ldb";
115 		fmt = "[x + %d]";
116 		break;
117 
118 	case BPF_LD|BPF_IMM:
119 		op = "ld";
120 		fmt = "#0x%x";
121 		break;
122 
123 	case BPF_LDX|BPF_IMM:
124 		op = "ldx";
125 		fmt = "#0x%x";
126 		break;
127 
128 	case BPF_LDX|BPF_MSH|BPF_B:
129 		op = "ldxb";
130 		fmt = "4*([%d]&0xf)";
131 		break;
132 
133 	case BPF_LD|BPF_MEM:
134 		op = "ld";
135 		fmt = "M[%d]";
136 		break;
137 
138 	case BPF_LDX|BPF_MEM:
139 		op = "ldx";
140 		fmt = "M[%d]";
141 		break;
142 
143 	case BPF_ST:
144 		op = "st";
145 		fmt = "M[%d]";
146 		break;
147 
148 	case BPF_STX:
149 		op = "stx";
150 		fmt = "M[%d]";
151 		break;
152 
153 	case BPF_JMP|BPF_JA:
154 		op = "ja";
155 		fmt = "%d";
156 		v = n + 1 + p->k;
157 		break;
158 
159 	case BPF_JMP|BPF_JGT|BPF_K:
160 		op = "jgt";
161 		fmt = "#0x%x";
162 		break;
163 
164 	case BPF_JMP|BPF_JGE|BPF_K:
165 		op = "jge";
166 		fmt = "#0x%x";
167 		break;
168 
169 	case BPF_JMP|BPF_JEQ|BPF_K:
170 		op = "jeq";
171 		fmt = "#0x%x";
172 		break;
173 
174 	case BPF_JMP|BPF_JSET|BPF_K:
175 		op = "jset";
176 		fmt = "#0x%x";
177 		break;
178 
179 	case BPF_JMP|BPF_JGT|BPF_X:
180 		op = "jgt";
181 		fmt = "x";
182 		break;
183 
184 	case BPF_JMP|BPF_JGE|BPF_X:
185 		op = "jge";
186 		fmt = "x";
187 		break;
188 
189 	case BPF_JMP|BPF_JEQ|BPF_X:
190 		op = "jeq";
191 		fmt = "x";
192 		break;
193 
194 	case BPF_JMP|BPF_JSET|BPF_X:
195 		op = "jset";
196 		fmt = "x";
197 		break;
198 
199 	case BPF_ALU|BPF_ADD|BPF_X:
200 		op = "add";
201 		fmt = "x";
202 		break;
203 
204 	case BPF_ALU|BPF_SUB|BPF_X:
205 		op = "sub";
206 		fmt = "x";
207 		break;
208 
209 	case BPF_ALU|BPF_MUL|BPF_X:
210 		op = "mul";
211 		fmt = "x";
212 		break;
213 
214 	case BPF_ALU|BPF_DIV|BPF_X:
215 		op = "div";
216 		fmt = "x";
217 		break;
218 
219 	case BPF_ALU|BPF_AND|BPF_X:
220 		op = "and";
221 		fmt = "x";
222 		break;
223 
224 	case BPF_ALU|BPF_OR|BPF_X:
225 		op = "or";
226 		fmt = "x";
227 		break;
228 
229 	case BPF_ALU|BPF_LSH|BPF_X:
230 		op = "lsh";
231 		fmt = "x";
232 		break;
233 
234 	case BPF_ALU|BPF_RSH|BPF_X:
235 		op = "rsh";
236 		fmt = "x";
237 		break;
238 
239 	case BPF_ALU|BPF_ADD|BPF_K:
240 		op = "add";
241 		fmt = "#%d";
242 		break;
243 
244 	case BPF_ALU|BPF_SUB|BPF_K:
245 		op = "sub";
246 		fmt = "#%d";
247 		break;
248 
249 	case BPF_ALU|BPF_MUL|BPF_K:
250 		op = "mul";
251 		fmt = "#%d";
252 		break;
253 
254 	case BPF_ALU|BPF_DIV|BPF_K:
255 		op = "div";
256 		fmt = "#%d";
257 		break;
258 
259 	case BPF_ALU|BPF_AND|BPF_K:
260 		op = "and";
261 		fmt = "#0x%x";
262 		break;
263 
264 	case BPF_ALU|BPF_OR|BPF_K:
265 		op = "or";
266 		fmt = "#0x%x";
267 		break;
268 
269 	case BPF_ALU|BPF_LSH|BPF_K:
270 		op = "lsh";
271 		fmt = "#%d";
272 		break;
273 
274 	case BPF_ALU|BPF_RSH|BPF_K:
275 		op = "rsh";
276 		fmt = "#%d";
277 		break;
278 
279 	case BPF_ALU|BPF_NEG:
280 		op = "neg";
281 		fmt = "";
282 		break;
283 
284 	case BPF_MISC|BPF_TAX:
285 		op = "tax";
286 		fmt = "";
287 		break;
288 
289 	case BPF_MISC|BPF_TXA:
290 		op = "txa";
291 		fmt = "";
292 		break;
293 	}
294 	(void)snprintf(operand, sizeof operand, fmt, v);
295 	(void)snprintf(image, sizeof image,
296 		      (BPF_CLASS(p->code) == BPF_JMP &&
297 		       BPF_OP(p->code) != BPF_JA) ?
298 		      "(%03d) %-8s %-16s jt %d\tjf %d"
299 		      : "(%03d) %-8s %s",
300 		      n, op, operand, n + 1 + p->jt, n + 1 + p->jf);
301 	return image;
302 }
303