pcap/bpf_image.c

   1 /*
   2  * Copyright (c) 1999 Apple Computer, Inc. All rights reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * "Portions Copyright (c) 1999 Apple Computer, Inc.  All Rights
   7  * Reserved.  This file contains Original Code and/or Modifications of
   8  * Original Code as defined in and that are subject to the Apple Public
   9  * Source License Version 1.0 (the 'License').  You may not use this file
  10  * except in compliance with the License.  Please obtain a copy of the
  11  * License at http://www.apple.com/publicsource and read it before using
  12  * this file.
  13  *
  14  * The Original Code and all software distributed under the License are
  15  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  16  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  17  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  18  * FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT.  Please see the
  19  * License for the specific language governing rights and limitations
  20  * under the License."
  21  *
  22  * @APPLE_LICENSE_HEADER_END@
  23  */
  24 /*      $OpenBSD */
  25
  26 /*
  27  * Copyright (c) 1990, 1991, 1992, 1994, 1995
  28  *      The Regents of the University of California.  All rights reserved.
  29  *
  30  * Redistribution and use in source and binary forms, with or without
  31  * modification, are permitted provided that: (1) source code distributions
  32  * retain the above copyright notice and this paragraph in its entirety, (2)
  33  * distributions including binary code include the above copyright notice and
  34  * this paragraph in its entirety in the documentation or other materials
  35  * provided with the distribution, and (3) all advertising materials mentioning
  36  * features or use of this software display the following acknowledgement:
  37  * ``This product includes software developed by the University of California,
  38  * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
  39  * the University nor the names of its contributors may be used to endorse
  40  * or promote products derived from this software without specific prior
  41  * written permission.
  42  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
  43  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
  44  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  45  */
  46
  47 #ifndef lint
  48 static char rcsid[] =
  49         "@(#) Header: bpf_image.c,v 1.19 95/11/26 14:02:36 leres Exp (LBL)";
  50 #endif
  51
  52 #include <sys/types.h>
  53 #include <sys/time.h>
  54
  55 #include <net/bpf.h>
  56
  57 #include <pcap.h>
  58 #include <stdio.h>
  59 #include <string.h>
  60
  61 #ifdef HAVE_OS_PROTO_H
  62 #include "os-proto.h"
  63 #endif
  64
  65 #include "pcap-int.h"
  66
  67 char *
  68 bpf_image(p, n)
  69         struct bpf_insn *p;
  70         int n;
  71 {
  72         int v;
  73         char *fmt, *op;
  74         static char image[256];
  75         char operand[64];
  76
  77         v = p->k;
  78         switch (p->code) {
  79
  80         default:
  81                 op = "unimp";
  82                 fmt = "0x%x";
  83                 v = p->code;
  84                 break;
  85
  86         case BPF_RET|BPF_K:
  87                 op = "ret";
  88                 fmt = "#%d";
  89                 break;
  90
  91         case BPF_RET|BPF_A:
  92                 op = "ret";
  93                 fmt = "";
  94                 break;
  95
  96         case BPF_LD|BPF_W|BPF_ABS:
  97                 op = "ld";
  98                 fmt = "[%d]";
  99                 break;
 100
 101         case BPF_LD|BPF_H|BPF_ABS:
 102                 op = "ldh";
 103                 fmt = "[%d]";
 104                 break;
 105
 106         case BPF_LD|BPF_B|BPF_ABS:
 107                 op = "ldb";
 108                 fmt = "[%d]";
 109                 break;
 110
 111         case BPF_LD|BPF_W|BPF_LEN:
 112                 op = "ld";
 113                 fmt = "#pktlen";
 114                 break;
 115
 116         case BPF_LD|BPF_W|BPF_IND:
 117                 op = "ld";
 118                 fmt = "[x + %d]";
 119                 break;
 120
 121         case BPF_LD|BPF_H|BPF_IND:
 122                 op = "ldh";
 123                 fmt = "[x + %d]";
 124                 break;
 125
 126         case BPF_LD|BPF_B|BPF_IND:
 127                 op = "ldb";
 128                 fmt = "[x + %d]";
 129                 break;
 130
 131         case BPF_LD|BPF_IMM:
 132                 op = "ld";
 133                 fmt = "#0x%x";
 134                 break;
 135
 136         case BPF_LDX|BPF_IMM:
 137                 op = "ldx";
 138                 fmt = "#0x%x";
 139                 break;
 140
 141         case BPF_LDX|BPF_MSH|BPF_B:
 142                 op = "ldxb";
 143                 fmt = "4*([%d]&0xf)";
 144                 break;
 145
 146         case BPF_LD|BPF_MEM:
 147                 op = "ld";
 148                 fmt = "M[%d]";
 149                 break;
 150
 151         case BPF_LDX|BPF_MEM:
 152                 op = "ldx";
 153                 fmt = "M[%d]";
 154                 break;
 155
 156         case BPF_ST:
 157                 op = "st";
 158                 fmt = "M[%d]";
 159                 break;
 160
 161         case BPF_STX:
 162                 op = "stx";
 163                 fmt = "M[%d]";
 164                 break;
 165
 166         case BPF_JMP|BPF_JA:
 167                 op = "ja";
 168                 fmt = "%d";
 169                 v = n + 1 + p->k;
 170                 break;
 171
 172         case BPF_JMP|BPF_JGT|BPF_K:
 173                 op = "jgt";
 174                 fmt = "#0x%x";
 175                 break;
 176
 177         case BPF_JMP|BPF_JGE|BPF_K:
 178                 op = "jge";
 179                 fmt = "#0x%x";
 180                 break;
 181
 182         case BPF_JMP|BPF_JEQ|BPF_K:
 183                 op = "jeq";
 184                 fmt = "#0x%x";
 185                 break;
 186
 187         case BPF_JMP|BPF_JSET|BPF_K:
 188                 op = "jset";
 189                 fmt = "#0x%x";
 190                 break;
 191
 192         case BPF_JMP|BPF_JGT|BPF_X:
 193                 op = "jgt";
 194                 fmt = "x";
 195                 break;
 196
 197         case BPF_JMP|BPF_JGE|BPF_X:
 198                 op = "jge";
 199                 fmt = "x";
 200                 break;
 201
 202         case BPF_JMP|BPF_JEQ|BPF_X:
 203                 op = "jeq";
 204                 fmt = "x";
 205                 break;
 206
 207         case BPF_JMP|BPF_JSET|BPF_X:
 208                 op = "jset";
 209                 fmt = "x";
 210                 break;
 211
 212         case BPF_ALU|BPF_ADD|BPF_X:
 213                 op = "add";
 214                 fmt = "x";
 215                 break;
 216
 217         case BPF_ALU|BPF_SUB|BPF_X:
 218                 op = "sub";
 219                 fmt = "x";
 220                 break;
 221
 222         case BPF_ALU|BPF_MUL|BPF_X:
 223                 op = "mul";
 224                 fmt = "x";
 225                 break;
 226
 227         case BPF_ALU|BPF_DIV|BPF_X:
 228                 op = "div";
 229                 fmt = "x";
 230                 break;
 231
 232         case BPF_ALU|BPF_AND|BPF_X:
 233                 op = "and";
 234                 fmt = "x";
 235                 break;
 236
 237         case BPF_ALU|BPF_OR|BPF_X:
 238                 op = "or";
 239                 fmt = "x";
 240                 break;
 241
 242         case BPF_ALU|BPF_LSH|BPF_X:
 243                 op = "lsh";
 244                 fmt = "x";
 245                 break;
 246
 247         case BPF_ALU|BPF_RSH|BPF_X:
 248                 op = "rsh";
 249                 fmt = "x";
 250                 break;
 251
 252         case BPF_ALU|BPF_ADD|BPF_K:
 253                 op = "add";
 254                 fmt = "#%d";
 255                 break;
 256
 257         case BPF_ALU|BPF_SUB|BPF_K:
 258                 op = "sub";
 259                 fmt = "#%d";
 260                 break;
 261
 262         case BPF_ALU|BPF_MUL|BPF_K:
 263                 op = "mul";
 264                 fmt = "#%d";
 265                 break;
 266
 267         case BPF_ALU|BPF_DIV|BPF_K:
 268                 op = "div";
 269                 fmt = "#%d";
 270                 break;
 271
 272         case BPF_ALU|BPF_AND|BPF_K:
 273                 op = "and";
 274                 fmt = "#%d";
 275                 break;
 276
 277         case BPF_ALU|BPF_OR|BPF_K:
 278                 op = "or";
 279                 fmt = "#%d";
 280                 break;
 281
 282         case BPF_ALU|BPF_LSH|BPF_K:
 283                 op = "lsh";
 284                 fmt = "#%d";
 285                 break;
 286
 287         case BPF_ALU|BPF_RSH|BPF_K:
 288                 op = "rsh";
 289                 fmt = "#%d";
 290                 break;
 291
 292         case BPF_ALU|BPF_NEG:
 293                 op = "neg";
 294                 fmt = "";
 295                 break;
 296
 297         case BPF_MISC|BPF_TAX:
 298                 op = "tax";
 299                 fmt = "";
 300                 break;
 301
 302         case BPF_MISC|BPF_TXA:
 303                 op = "txa";
 304                 fmt = "";
 305                 break;
 306         }
 307         (void)sprintf(operand, fmt, v);
 308         (void)sprintf(image,
 309                       (BPF_CLASS(p->code) == BPF_JMP &&
 310                        BPF_OP(p->code) != BPF_JA) ?
 311                       "(%03d) %-8s %-16s jt %d\tjf %d"
 312                       : "(%03d) %-8s %s",
 313                       n, op, operand, n + 1 + p->jt, n + 1 + p->jf);
 314         return image;
 315 }