00001 /* 00002 * Copyright (c) 1990, 1991, 1992, 1994, 1995, 1996 00003 * The Regents of the University of California. All rights reserved. 00004 * 00005 * Redistribution and use in source and binary forms, with or without 00006 * modification, are permitted provided that: (1) source code distributions 00007 * retain the above copyright notice and this paragraph in its entirety, (2) 00008 * distributions including binary code include the above copyright notice and 00009 * this paragraph in its entirety in the documentation or other materials 00010 * provided with the distribution, and (3) all advertising materials mentioning 00011 * features or use of this software display the following acknowledgement: 00012 * ``This product includes software developed by the University of California, 00013 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of 00014 * the University nor the names of its contributors may be used to endorse 00015 * or promote products derived from this software without specific prior 00016 * written permission. 00017 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED 00018 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF 00019 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 00020 */ 00021 00022 #ifndef lint 00023 static const char rcsid[] = 00024 "@(#) $Header: /tcpdump/master/libpcap/bpf_image.c,v 1.25 2002/03/24 23:21:51 guy Exp $ (LBL)"; 00025 #endif 00026 00027 #ifdef HAVE_CONFIG_H 00028 #include "config.h" 00029 #endif 00030 00031 #include <stdio.h> 00032 #include <string.h> 00033 00034 #include "pcap-int.h" 00035 00036 #ifdef HAVE_OS_PROTO_H 00037 #include "os-proto.h" 00038 #endif 00039 00040 char * 00041 bpf_image(p, n) 00042 struct bpf_insn *p; 00043 int n; 00044 { 00045 int v; 00046 char *fmt, *op; 00047 static char image[256]; 00048 char operand[64]; 00049 00050 v = p->k; 00051 switch (p->code) { 00052 00053 default: 00054 op = "unimp"; 00055 fmt = "0x%x"; 00056 v = p->code; 00057 break; 00058 00059 case BPF_RET|BPF_K: 00060 op = "ret"; 00061 fmt = "#%d"; 00062 break; 00063 00064 case BPF_RET|BPF_A: 00065 op = "ret"; 00066 fmt = ""; 00067 break; 00068 00069 case BPF_LD|BPF_W|BPF_ABS: 00070 op = "ld"; 00071 fmt = "[%d]"; 00072 break; 00073 00074 case BPF_LD|BPF_H|BPF_ABS: 00075 op = "ldh"; 00076 fmt = "[%d]"; 00077 break; 00078 00079 case BPF_LD|BPF_B|BPF_ABS: 00080 op = "ldb"; 00081 fmt = "[%d]"; 00082 break; 00083 00084 case BPF_LD|BPF_W|BPF_LEN: 00085 op = "ld"; 00086 fmt = "#pktlen"; 00087 break; 00088 00089 case BPF_LD|BPF_W|BPF_IND: 00090 op = "ld"; 00091 fmt = "[x + %d]"; 00092 break; 00093 00094 case BPF_LD|BPF_H|BPF_IND: 00095 op = "ldh"; 00096 fmt = "[x + %d]"; 00097 break; 00098 00099 case BPF_LD|BPF_B|BPF_IND: 00100 op = "ldb"; 00101 fmt = "[x + %d]"; 00102 break; 00103 00104 case BPF_LD|BPF_IMM: 00105 op = "ld"; 00106 fmt = "#0x%x"; 00107 break; 00108 00109 case BPF_LDX|BPF_IMM: 00110 op = "ldx"; 00111 fmt = "#0x%x"; 00112 break; 00113 00114 case BPF_LDX|BPF_MSH|BPF_B: 00115 op = "ldxb"; 00116 fmt = "4*([%d]&0xf)"; 00117 break; 00118 00119 case BPF_LD|BPF_MEM: 00120 op = "ld"; 00121 fmt = "M[%d]"; 00122 break; 00123 00124 case BPF_LDX|BPF_MEM: 00125 op = "ldx"; 00126 fmt = "M[%d]"; 00127 break; 00128 00129 case BPF_ST: 00130 op = "st"; 00131 fmt = "M[%d]"; 00132 break; 00133 00134 case BPF_STX: 00135 op = "stx"; 00136 fmt = "M[%d]"; 00137 break; 00138 00139 case BPF_JMP|BPF_JA: 00140 op = "ja"; 00141 fmt = "%d"; 00142 v = n + 1 + p->k; 00143 break; 00144 00145 case BPF_JMP|BPF_JGT|BPF_K: 00146 op = "jgt"; 00147 fmt = "#0x%x"; 00148 break; 00149 00150 case BPF_JMP|BPF_JGE|BPF_K: 00151 op = "jge"; 00152 fmt = "#0x%x"; 00153 break; 00154 00155 case BPF_JMP|BPF_JEQ|BPF_K: 00156 op = "jeq"; 00157 fmt = "#0x%x"; 00158 break; 00159 00160 case BPF_JMP|BPF_JSET|BPF_K: 00161 op = "jset"; 00162 fmt = "#0x%x"; 00163 break; 00164 00165 case BPF_JMP|BPF_JGT|BPF_X: 00166 op = "jgt"; 00167 fmt = "x"; 00168 break; 00169 00170 case BPF_JMP|BPF_JGE|BPF_X: 00171 op = "jge"; 00172 fmt = "x"; 00173 break; 00174 00175 case BPF_JMP|BPF_JEQ|BPF_X: 00176 op = "jeq"; 00177 fmt = "x"; 00178 break; 00179 00180 case BPF_JMP|BPF_JSET|BPF_X: 00181 op = "jset"; 00182 fmt = "x"; 00183 break; 00184 00185 case BPF_ALU|BPF_ADD|BPF_X: 00186 op = "add"; 00187 fmt = "x"; 00188 break; 00189 00190 case BPF_ALU|BPF_SUB|BPF_X: 00191 op = "sub"; 00192 fmt = "x"; 00193 break; 00194 00195 case BPF_ALU|BPF_MUL|BPF_X: 00196 op = "mul"; 00197 fmt = "x"; 00198 break; 00199 00200 case BPF_ALU|BPF_DIV|BPF_X: 00201 op = "div"; 00202 fmt = "x"; 00203 break; 00204 00205 case BPF_ALU|BPF_AND|BPF_X: 00206 op = "and"; 00207 fmt = "x"; 00208 break; 00209 00210 case BPF_ALU|BPF_OR|BPF_X: 00211 op = "or"; 00212 fmt = "x"; 00213 break; 00214 00215 case BPF_ALU|BPF_LSH|BPF_X: 00216 op = "lsh"; 00217 fmt = "x"; 00218 break; 00219 00220 case BPF_ALU|BPF_RSH|BPF_X: 00221 op = "rsh"; 00222 fmt = "x"; 00223 break; 00224 00225 case BPF_ALU|BPF_ADD|BPF_K: 00226 op = "add"; 00227 fmt = "#%d"; 00228 break; 00229 00230 case BPF_ALU|BPF_SUB|BPF_K: 00231 op = "sub"; 00232 fmt = "#%d"; 00233 break; 00234 00235 case BPF_ALU|BPF_MUL|BPF_K: 00236 op = "mul"; 00237 fmt = "#%d"; 00238 break; 00239 00240 case BPF_ALU|BPF_DIV|BPF_K: 00241 op = "div"; 00242 fmt = "#%d"; 00243 break; 00244 00245 case BPF_ALU|BPF_AND|BPF_K: 00246 op = "and"; 00247 fmt = "#0x%x"; 00248 break; 00249 00250 case BPF_ALU|BPF_OR|BPF_K: 00251 op = "or"; 00252 fmt = "#0x%x"; 00253 break; 00254 00255 case BPF_ALU|BPF_LSH|BPF_K: 00256 op = "lsh"; 00257 fmt = "#%d"; 00258 break; 00259 00260 case BPF_ALU|BPF_RSH|BPF_K: 00261 op = "rsh"; 00262 fmt = "#%d"; 00263 break; 00264 00265 case BPF_ALU|BPF_NEG: 00266 op = "neg"; 00267 fmt = ""; 00268 break; 00269 00270 case BPF_MISC|BPF_TAX: 00271 op = "tax"; 00272 fmt = ""; 00273 break; 00274 00275 case BPF_MISC|BPF_TXA: 00276 op = "txa"; 00277 fmt = ""; 00278 break; 00279 } 00280 (void)snprintf(operand, sizeof operand, fmt, v); 00281 (void)snprintf(image, sizeof image, 00282 (BPF_CLASS(p->code) == BPF_JMP && 00283 BPF_OP(p->code) != BPF_JA) ? 00284 "(%03d) %-8s %-16s jt %d\tjf %d" 00285 : "(%03d) %-8s %s", 00286 n, op, operand, n + 1 + p->jt, n + 1 + p->jf); 00287 return image; 00288 }
documentation. Copyright (c) 2002-2003 Politecnico di Torino. All rights reserved.