bpf_image.c revision 17683
117683Spst/* 217683Spst * Copyright (c) 1990, 1991, 1992, 1994, 1995, 1996 317683Spst * The Regents of the University of California. All rights reserved. 417683Spst * 517683Spst * Redistribution and use in source and binary forms, with or without 617683Spst * modification, are permitted provided that: (1) source code distributions 717683Spst * retain the above copyright notice and this paragraph in its entirety, (2) 817683Spst * distributions including binary code include the above copyright notice and 917683Spst * this paragraph in its entirety in the documentation or other materials 1017683Spst * provided with the distribution, and (3) all advertising materials mentioning 1117683Spst * features or use of this software display the following acknowledgement: 1217683Spst * ``This product includes software developed by the University of California, 1317683Spst * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of 1417683Spst * the University nor the names of its contributors may be used to endorse 1517683Spst * or promote products derived from this software without specific prior 1617683Spst * written permission. 1717683Spst * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED 1817683Spst * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF 1917683Spst * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 2017683Spst */ 2117683Spst 2217683Spst#ifndef lint 2317683Spststatic char rcsid[] = 2417683Spst "@(#) $Header: bpf_image.c,v 1.21 96/07/15 00:48:36 leres Exp $ (LBL)"; 2517683Spst#endif 2617683Spst 2717683Spst#include <sys/types.h> 2817683Spst#include <sys/time.h> 2917683Spst 3017683Spst#include <stdio.h> 3117683Spst#include <string.h> 3217683Spst 3317683Spst#include "pcap-int.h" 3417683Spst 3517683Spst#include "gnuc.h" 3617683Spst#ifdef HAVE_OS_PROTO_H 3717683Spst#include "os-proto.h" 3817683Spst#endif 3917683Spst 4017683Spstchar * 4117683Spstbpf_image(p, n) 4217683Spst struct bpf_insn *p; 4317683Spst int n; 4417683Spst{ 4517683Spst int v; 4617683Spst char *fmt, *op; 4717683Spst static char image[256]; 4817683Spst char operand[64]; 4917683Spst 5017683Spst v = p->k; 5117683Spst switch (p->code) { 5217683Spst 5317683Spst default: 5417683Spst op = "unimp"; 5517683Spst fmt = "0x%x"; 5617683Spst v = p->code; 5717683Spst break; 5817683Spst 5917683Spst case BPF_RET|BPF_K: 6017683Spst op = "ret"; 6117683Spst fmt = "#%d"; 6217683Spst break; 6317683Spst 6417683Spst case BPF_RET|BPF_A: 6517683Spst op = "ret"; 6617683Spst fmt = ""; 6717683Spst break; 6817683Spst 6917683Spst case BPF_LD|BPF_W|BPF_ABS: 7017683Spst op = "ld"; 7117683Spst fmt = "[%d]"; 7217683Spst break; 7317683Spst 7417683Spst case BPF_LD|BPF_H|BPF_ABS: 7517683Spst op = "ldh"; 7617683Spst fmt = "[%d]"; 7717683Spst break; 7817683Spst 7917683Spst case BPF_LD|BPF_B|BPF_ABS: 8017683Spst op = "ldb"; 8117683Spst fmt = "[%d]"; 8217683Spst break; 8317683Spst 8417683Spst case BPF_LD|BPF_W|BPF_LEN: 8517683Spst op = "ld"; 8617683Spst fmt = "#pktlen"; 8717683Spst break; 8817683Spst 8917683Spst case BPF_LD|BPF_W|BPF_IND: 9017683Spst op = "ld"; 9117683Spst fmt = "[x + %d]"; 9217683Spst break; 9317683Spst 9417683Spst case BPF_LD|BPF_H|BPF_IND: 9517683Spst op = "ldh"; 9617683Spst fmt = "[x + %d]"; 9717683Spst break; 9817683Spst 9917683Spst case BPF_LD|BPF_B|BPF_IND: 10017683Spst op = "ldb"; 10117683Spst fmt = "[x + %d]"; 10217683Spst break; 10317683Spst 10417683Spst case BPF_LD|BPF_IMM: 10517683Spst op = "ld"; 10617683Spst fmt = "#0x%x"; 10717683Spst break; 10817683Spst 10917683Spst case BPF_LDX|BPF_IMM: 11017683Spst op = "ldx"; 11117683Spst fmt = "#0x%x"; 11217683Spst break; 11317683Spst 11417683Spst case BPF_LDX|BPF_MSH|BPF_B: 11517683Spst op = "ldxb"; 11617683Spst fmt = "4*([%d]&0xf)"; 11717683Spst break; 11817683Spst 11917683Spst case BPF_LD|BPF_MEM: 12017683Spst op = "ld"; 12117683Spst fmt = "M[%d]"; 12217683Spst break; 12317683Spst 12417683Spst case BPF_LDX|BPF_MEM: 12517683Spst op = "ldx"; 12617683Spst fmt = "M[%d]"; 12717683Spst break; 12817683Spst 12917683Spst case BPF_ST: 13017683Spst op = "st"; 13117683Spst fmt = "M[%d]"; 13217683Spst break; 13317683Spst 13417683Spst case BPF_STX: 13517683Spst op = "stx"; 13617683Spst fmt = "M[%d]"; 13717683Spst break; 13817683Spst 13917683Spst case BPF_JMP|BPF_JA: 14017683Spst op = "ja"; 14117683Spst fmt = "%d"; 14217683Spst v = n + 1 + p->k; 14317683Spst break; 14417683Spst 14517683Spst case BPF_JMP|BPF_JGT|BPF_K: 14617683Spst op = "jgt"; 14717683Spst fmt = "#0x%x"; 14817683Spst break; 14917683Spst 15017683Spst case BPF_JMP|BPF_JGE|BPF_K: 15117683Spst op = "jge"; 15217683Spst fmt = "#0x%x"; 15317683Spst break; 15417683Spst 15517683Spst case BPF_JMP|BPF_JEQ|BPF_K: 15617683Spst op = "jeq"; 15717683Spst fmt = "#0x%x"; 15817683Spst break; 15917683Spst 16017683Spst case BPF_JMP|BPF_JSET|BPF_K: 16117683Spst op = "jset"; 16217683Spst fmt = "#0x%x"; 16317683Spst break; 16417683Spst 16517683Spst case BPF_JMP|BPF_JGT|BPF_X: 16617683Spst op = "jgt"; 16717683Spst fmt = "x"; 16817683Spst break; 16917683Spst 17017683Spst case BPF_JMP|BPF_JGE|BPF_X: 17117683Spst op = "jge"; 17217683Spst fmt = "x"; 17317683Spst break; 17417683Spst 17517683Spst case BPF_JMP|BPF_JEQ|BPF_X: 17617683Spst op = "jeq"; 17717683Spst fmt = "x"; 17817683Spst break; 17917683Spst 18017683Spst case BPF_JMP|BPF_JSET|BPF_X: 18117683Spst op = "jset"; 18217683Spst fmt = "x"; 18317683Spst break; 18417683Spst 18517683Spst case BPF_ALU|BPF_ADD|BPF_X: 18617683Spst op = "add"; 18717683Spst fmt = "x"; 18817683Spst break; 18917683Spst 19017683Spst case BPF_ALU|BPF_SUB|BPF_X: 19117683Spst op = "sub"; 19217683Spst fmt = "x"; 19317683Spst break; 19417683Spst 19517683Spst case BPF_ALU|BPF_MUL|BPF_X: 19617683Spst op = "mul"; 19717683Spst fmt = "x"; 19817683Spst break; 19917683Spst 20017683Spst case BPF_ALU|BPF_DIV|BPF_X: 20117683Spst op = "div"; 20217683Spst fmt = "x"; 20317683Spst break; 20417683Spst 20517683Spst case BPF_ALU|BPF_AND|BPF_X: 20617683Spst op = "and"; 20717683Spst fmt = "x"; 20817683Spst break; 20917683Spst 21017683Spst case BPF_ALU|BPF_OR|BPF_X: 21117683Spst op = "or"; 21217683Spst fmt = "x"; 21317683Spst break; 21417683Spst 21517683Spst case BPF_ALU|BPF_LSH|BPF_X: 21617683Spst op = "lsh"; 21717683Spst fmt = "x"; 21817683Spst break; 21917683Spst 22017683Spst case BPF_ALU|BPF_RSH|BPF_X: 22117683Spst op = "rsh"; 22217683Spst fmt = "x"; 22317683Spst break; 22417683Spst 22517683Spst case BPF_ALU|BPF_ADD|BPF_K: 22617683Spst op = "add"; 22717683Spst fmt = "#%d"; 22817683Spst break; 22917683Spst 23017683Spst case BPF_ALU|BPF_SUB|BPF_K: 23117683Spst op = "sub"; 23217683Spst fmt = "#%d"; 23317683Spst break; 23417683Spst 23517683Spst case BPF_ALU|BPF_MUL|BPF_K: 23617683Spst op = "mul"; 23717683Spst fmt = "#%d"; 23817683Spst break; 23917683Spst 24017683Spst case BPF_ALU|BPF_DIV|BPF_K: 24117683Spst op = "div"; 24217683Spst fmt = "#%d"; 24317683Spst break; 24417683Spst 24517683Spst case BPF_ALU|BPF_AND|BPF_K: 24617683Spst op = "and"; 24717683Spst fmt = "#0x%x"; 24817683Spst break; 24917683Spst 25017683Spst case BPF_ALU|BPF_OR|BPF_K: 25117683Spst op = "or"; 25217683Spst fmt = "#0x%x"; 25317683Spst break; 25417683Spst 25517683Spst case BPF_ALU|BPF_LSH|BPF_K: 25617683Spst op = "lsh"; 25717683Spst fmt = "#%d"; 25817683Spst break; 25917683Spst 26017683Spst case BPF_ALU|BPF_RSH|BPF_K: 26117683Spst op = "rsh"; 26217683Spst fmt = "#%d"; 26317683Spst break; 26417683Spst 26517683Spst case BPF_ALU|BPF_NEG: 26617683Spst op = "neg"; 26717683Spst fmt = ""; 26817683Spst break; 26917683Spst 27017683Spst case BPF_MISC|BPF_TAX: 27117683Spst op = "tax"; 27217683Spst fmt = ""; 27317683Spst break; 27417683Spst 27517683Spst case BPF_MISC|BPF_TXA: 27617683Spst op = "txa"; 27717683Spst fmt = ""; 27817683Spst break; 27917683Spst } 28017683Spst (void)sprintf(operand, fmt, v); 28117683Spst (void)sprintf(image, 28217683Spst (BPF_CLASS(p->code) == BPF_JMP && 28317683Spst BPF_OP(p->code) != BPF_JA) ? 28417683Spst "(%03d) %-8s %-16s jt %d\tjf %d" 28517683Spst : "(%03d) %-8s %s", 28617683Spst n, op, operand, n + 1 + p->jt, n + 1 + p->jf); 28717683Spst return image; 28817683Spst} 289