bsd/net/bpf.h

   1 /*
   2  * Copyright (c) 2006 Apple Computer, Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_OSREFERENCE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License.  The rights granted to you under the
  10  * License may not be used to create, or enable the creation or
  11  * redistribution of, unlawful or unlicensed copies of an Apple operating
  12  * system, or to circumvent, violate, or enable the circumvention or
  13  * violation of, any terms of an Apple operating system software license
  14  * agreement.
  15  *
  16  * Please obtain a copy of the License at
  17  * http://www.opensource.apple.com/apsl/ and read it before using this
  18  * file.
  19  *
  20  * The Original Code and all software distributed under the License are
  21  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  22  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  23  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  24  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  25  * Please see the License for the specific language governing rights and
  26  * limitations under the License.
  27  *
  28  * @APPLE_LICENSE_OSREFERENCE_HEADER_END@
  29  */
  30 /*
  31  * Copyright (c) 1990, 1991, 1993
  32  *      The Regents of the University of California.  All rights reserved.
  33  *
  34  * This code is derived from the Stanford/CMU enet packet filter,
  35  * (net/enet.c) distributed as part of 4.3BSD, and code contributed
  36  * to Berkeley by Steven McCanne and Van Jacobson both of Lawrence
  37  * Berkeley Laboratory.
  38  *
  39  * Redistribution and use in source and binary forms, with or without
  40  * modification, are permitted provided that the following conditions
  41  * are met:
  42  * 1. Redistributions of source code must retain the above copyright
  43  *    notice, this list of conditions and the following disclaimer.
  44  * 2. Redistributions in binary form must reproduce the above copyright
  45  *    notice, this list of conditions and the following disclaimer in the
  46  *    documentation and/or other materials provided with the distribution.
  47  * 3. All advertising materials mentioning features or use of this software
  48  *    must display the following acknowledgement:
  49  *      This product includes software developed by the University of
  50  *      California, Berkeley and its contributors.
  51  * 4. Neither the name of the University nor the names of its contributors
  52  *    may be used to endorse or promote products derived from this software
  53  *    without specific prior written permission.
  54  *
  55  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  56  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  57  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  58  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  59  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  60  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  61  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  62  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  63  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  64  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  65  * SUCH DAMAGE.
  66  *
  67  *      @(#)bpf.h       8.1 (Berkeley) 6/10/93
  68  *      @(#)bpf.h       1.34 (LBL)     6/16/96
  69  *
  70  * $FreeBSD: src/sys/net/bpf.h,v 1.21.2.3 2001/08/01 00:23:13 fenner Exp $
  71  */
  72
  73 #ifndef _NET_BPF_H_
  74 #define _NET_BPF_H_
  75 #include <sys/appleapiopts.h>
  76 #include <sys/types.h>
  77 #include <sys/time.h>
  78 #include <sys/cdefs.h>
  79
  80 #ifdef KERNEL
  81 #include <sys/kernel_types.h>
  82 #endif
  83
  84 /* BSD style release date */
  85 #define BPF_RELEASE 199606
  86
  87 typedef int32_t   bpf_int32;
  88 typedef u_int32_t bpf_u_int32;
  89
  90 /*
  91  * Alignment macros.  BPF_WORDALIGN rounds up to the next
  92  * even multiple of BPF_ALIGNMENT.
  93  */
  94 #define BPF_ALIGNMENT sizeof(long)
  95 #define BPF_WORDALIGN(x) (((x)+(BPF_ALIGNMENT-1))&~(BPF_ALIGNMENT-1))
  96
  97 #define BPF_MAXINSNS 512
  98 #define BPF_MAXBUFSIZE 0x80000
  99 #define BPF_MINBUFSIZE 32
 100
 101 /*
 102  *  Structure for BIOCSETF.
 103  */
 104 struct bpf_program {
 105         u_int bf_len;
 106         struct bpf_insn *bf_insns;
 107 };
 108
 109 #ifdef KERNEL
 110 /* LP64 version of bpf_program.  all pointers
 111  * grow when we're dealing with a 64-bit process.
 112  * WARNING - keep in sync with bpf_program
 113  */
 114 #if __DARWIN_ALIGN_NATURAL
 115 #pragma options align=natural
 116 #endif
 117
 118 struct user_bpf_program {
 119         u_int           bf_len;
 120         user_addr_t     bf_insns;
 121 };
 122
 123 #if __DARWIN_ALIGN_NATURAL
 124 #pragma options align=reset
 125 #endif
 126
 127 #endif // KERNEL
 128
 129 /*
 130  * Struct returned by BIOCGSTATS.
 131  */
 132 struct bpf_stat {
 133         u_int bs_recv;          /* number of packets received */
 134         u_int bs_drop;          /* number of packets dropped */
 135 };
 136
 137 /*
 138  * Struct return by BIOCVERSION.  This represents the version number of
 139  * the filter language described by the instruction encodings below.
 140  * bpf understands a program iff kernel_major == filter_major &&
 141  * kernel_minor >= filter_minor, that is, if the value returned by the
 142  * running kernel has the same major number and a minor number equal
 143  * equal to or less than the filter being downloaded.  Otherwise, the
 144  * results are undefined, meaning an error may be returned or packets
 145  * may be accepted haphazardly.
 146  * It has nothing to do with the source code version.
 147  */
 148 struct bpf_version {
 149         u_short bv_major;
 150         u_short bv_minor;
 151 };
 152 /* Current version number of filter architecture. */
 153 #define BPF_MAJOR_VERSION 1
 154 #define BPF_MINOR_VERSION 1
 155
 156 #define BIOCGBLEN       _IOR('B',102, u_int)
 157 #define BIOCSBLEN       _IOWR('B',102, u_int)
 158 #define BIOCSETF        _IOW('B',103, struct bpf_program)
 159 #define BIOCFLUSH       _IO('B',104)
 160 #define BIOCPROMISC     _IO('B',105)
 161 #define BIOCGDLT        _IOR('B',106, u_int)
 162 #define BIOCGETIF       _IOR('B',107, struct ifreq)
 163 #define BIOCSETIF       _IOW('B',108, struct ifreq)
 164 #define BIOCSRTIMEOUT   _IOW('B',109, struct timeval)
 165 #define BIOCGRTIMEOUT   _IOR('B',110, struct timeval)
 166 #define BIOCGSTATS      _IOR('B',111, struct bpf_stat)
 167 #define BIOCIMMEDIATE   _IOW('B',112, u_int)
 168 #define BIOCVERSION     _IOR('B',113, struct bpf_version)
 169 #define BIOCGRSIG       _IOR('B',114, u_int)
 170 #define BIOCSRSIG       _IOW('B',115, u_int)
 171 #define BIOCGHDRCMPLT   _IOR('B',116, u_int)
 172 #define BIOCSHDRCMPLT   _IOW('B',117, u_int)
 173 #define BIOCGSEESENT    _IOR('B',118, u_int)
 174 #define BIOCSSEESENT    _IOW('B',119, u_int)
 175
 176 /*
 177  * Structure prepended to each packet.
 178  */
 179 struct bpf_hdr {
 180         struct timeval  bh_tstamp;      /* time stamp */
 181         bpf_u_int32     bh_caplen;      /* length of captured portion */
 182         bpf_u_int32     bh_datalen;     /* original length of packet */
 183         u_short         bh_hdrlen;      /* length of bpf header (this struct
 184                                            plus alignment padding) */
 185 };
 186 /*
 187  * Because the structure above is not a multiple of 4 bytes, some compilers
 188  * will insist on inserting padding; hence, sizeof(struct bpf_hdr) won't work.
 189  * Only the kernel needs to know about it; applications use bh_hdrlen.
 190  */
 191 #ifdef KERNEL
 192 #define SIZEOF_BPF_HDR  (sizeof(struct bpf_hdr) <= 20 ? 18 : \
 193     sizeof(struct bpf_hdr))
 194 #endif
 195
 196 /*
 197  * Data-link level type codes.
 198  */
 199 #define DLT_NULL        0       /* no link-layer encapsulation */
 200 #define DLT_EN10MB      1       /* Ethernet (10Mb) */
 201 #define DLT_EN3MB       2       /* Experimental Ethernet (3Mb) */
 202 #define DLT_AX25        3       /* Amateur Radio AX.25 */
 203 #define DLT_PRONET      4       /* Proteon ProNET Token Ring */
 204 #define DLT_CHAOS       5       /* Chaos */
 205 #define DLT_IEEE802     6       /* IEEE 802 Networks */
 206 #define DLT_ARCNET      7       /* ARCNET */
 207 #define DLT_SLIP        8       /* Serial Line IP */
 208 #define DLT_PPP         9       /* Point-to-point Protocol */
 209 #define DLT_FDDI        10      /* FDDI */
 210 #define DLT_ATM_RFC1483 11      /* LLC/SNAP encapsulated atm */
 211 #define DLT_RAW         12      /* raw IP */
 212 #define DLT_APPLE_IP_OVER_IEEE1394      138
 213
 214 /*
 215  * These are values from BSD/OS's "bpf.h".
 216  * These are not the same as the values from the traditional libpcap
 217  * "bpf.h"; however, these values shouldn't be generated by any
 218  * OS other than BSD/OS, so the correct values to use here are the
 219  * BSD/OS values.
 220  *
 221  * Platforms that have already assigned these values to other
 222  * DLT_ codes, however, should give these codes the values
 223  * from that platform, so that programs that use these codes will
 224  * continue to compile - even though they won't correctly read
 225  * files of these types.
 226  */
 227 #define DLT_SLIP_BSDOS  15      /* BSD/OS Serial Line IP */
 228 #define DLT_PPP_BSDOS   16      /* BSD/OS Point-to-point Protocol */
 229
 230 #define DLT_ATM_CLIP    19      /* Linux Classical-IP over ATM */
 231
 232 /*
 233  * This value is defined by NetBSD; other platforms should refrain from
 234  * using it for other purposes, so that NetBSD savefiles with a link
 235  * type of 50 can be read as this type on all platforms.
 236  */
 237 #define DLT_PPP_SERIAL  50      /* PPP over serial with HDLC encapsulation */
 238
 239 /*
 240  * This value was defined by libpcap 0.5; platforms that have defined
 241  * it with a different value should define it here with that value -
 242  * a link type of 104 in a save file will be mapped to DLT_C_HDLC,
 243  * whatever value that happens to be, so programs will correctly
 244  * handle files with that link type regardless of the value of
 245  * DLT_C_HDLC.
 246  *
 247  * The name DLT_C_HDLC was used by BSD/OS; we use that name for source
 248  * compatibility with programs written for BSD/OS.
 249  *
 250  * libpcap 0.5 defined it as DLT_CHDLC; we define DLT_CHDLC as well,
 251  * for source compatibility with programs written for libpcap 0.5.
 252  */
 253 #define DLT_C_HDLC      104     /* Cisco HDLC */
 254 #define DLT_CHDLC       DLT_C_HDLC
 255
 256 /*
 257  * Reserved for future use.
 258  * Do not pick other numerical value for these unless you have also
 259  * picked up the tcpdump.org top-of-CVS-tree version of "savefile.c",
 260  * which will arrange that capture files for these DLT_ types have
 261  * the same "network" value on all platforms, regardless of what
 262  * value is chosen for their DLT_ type (thus allowing captures made
 263  * on one platform to be read on other platforms, even if the two
 264  * platforms don't use the same numerical values for all DLT_ types).
 265  */
 266 #define DLT_IEEE802_11  105     /* IEEE 802.11 wireless */
 267
 268 /*
 269  * Values between 106 and 107 are used in capture file headers as
 270  * link-layer types corresponding to DLT_ types that might differ
 271  * between platforms; don't use those values for new DLT_ new types.
 272  */
 273
 274 /*
 275  * OpenBSD DLT_LOOP, for loopback devices; it's like DLT_NULL, except
 276  * that the AF_ type in the link-layer header is in network byte order.
 277  *
 278  * OpenBSD defines it as 12, but that collides with DLT_RAW, so we
 279  * define it as 108 here.  If OpenBSD picks up this file, it should
 280  * define DLT_LOOP as 12 in its version, as per the comment above -
 281  * and should not use 108 for any purpose.
 282  */
 283 #define DLT_LOOP        108
 284
 285 /*
 286  * Values between 109 and 112 are used in capture file headers as
 287  * link-layer types corresponding to DLT_ types that might differ
 288  * between platforms; don't use those values for new DLT_ new types.
 289  */
 290
 291 /*
 292  * This is for Linux cooked sockets.
 293  */
 294 #define DLT_LINUX_SLL   113
 295
 296 /*
 297  * The instruction encodings.
 298  */
 299 /* instruction classes */
 300 #define BPF_CLASS(code) ((code) & 0x07)
 301 #define         BPF_LD          0x00
 302 #define         BPF_LDX         0x01
 303 #define         BPF_ST          0x02
 304 #define         BPF_STX         0x03
 305 #define         BPF_ALU         0x04
 306 #define         BPF_JMP         0x05
 307 #define         BPF_RET         0x06
 308 #define         BPF_MISC        0x07
 309
 310 /* ld/ldx fields */
 311 #define BPF_SIZE(code)  ((code) & 0x18)
 312 #define         BPF_W           0x00
 313 #define         BPF_H           0x08
 314 #define         BPF_B           0x10
 315 #define BPF_MODE(code)  ((code) & 0xe0)
 316 #define         BPF_IMM         0x00
 317 #define         BPF_ABS         0x20
 318 #define         BPF_IND         0x40
 319 #define         BPF_MEM         0x60
 320 #define         BPF_LEN         0x80
 321 #define         BPF_MSH         0xa0
 322
 323 /* alu/jmp fields */
 324 #define BPF_OP(code)    ((code) & 0xf0)
 325 #define         BPF_ADD         0x00
 326 #define         BPF_SUB         0x10
 327 #define         BPF_MUL         0x20
 328 #define         BPF_DIV         0x30
 329 #define         BPF_OR          0x40
 330 #define         BPF_AND         0x50
 331 #define         BPF_LSH         0x60
 332 #define         BPF_RSH         0x70
 333 #define         BPF_NEG         0x80
 334 #define         BPF_JA          0x00
 335 #define         BPF_JEQ         0x10
 336 #define         BPF_JGT         0x20
 337 #define         BPF_JGE         0x30
 338 #define         BPF_JSET        0x40
 339 #define BPF_SRC(code)   ((code) & 0x08)
 340 #define         BPF_K           0x00
 341 #define         BPF_X           0x08
 342
 343 /* ret - BPF_K and BPF_X also apply */
 344 #define BPF_RVAL(code)  ((code) & 0x18)
 345 #define         BPF_A           0x10
 346
 347 /* misc */
 348 #define BPF_MISCOP(code) ((code) & 0xf8)
 349 #define         BPF_TAX         0x00
 350 #define         BPF_TXA         0x80
 351
 352 /*
 353  * The instruction data structure.
 354  */
 355 struct bpf_insn {
 356         u_short         code;
 357         u_char          jt;
 358         u_char          jf;
 359         bpf_u_int32     k;
 360 };
 361
 362 /*
 363  * Macros for insn array initializers.
 364  */
 365 #define BPF_STMT(code, k) { (u_short)(code), 0, 0, k }
 366 #define BPF_JUMP(code, k, jt, jf) { (u_short)(code), jt, jf, k }
 367
 368 #ifdef KERNEL_PRIVATE
 369 /* Forward declerations */
 370 struct ifnet;
 371 struct mbuf;
 372
 373 int      bpf_validate(const struct bpf_insn *, int);
 374 void     bpf_tap(struct ifnet *, u_char *, u_int);
 375 void     bpf_mtap(struct ifnet *, struct mbuf *);
 376
 377 void     bpfdetach(struct ifnet *);
 378
 379 void     bpfilterattach(int);
 380 u_int    bpf_filter(const struct bpf_insn *, u_char *, u_int, u_int);
 381
 382 #ifdef __APPLE__
 383 #define BPF_TAP(x, y, z) bpf_tap(x,y,z)
 384 #define BPF_MTAP(x, y) bpf_mtap(x, y)
 385 #endif /* __APPLE__ */
 386
 387 #endif /* KERNEL_PRIVATE */
 388
 389 #ifdef KERNEL
 390 /*!
 391         @function bpfattach
 392         @discussion Registers an interface with BPF. This allows bpf devices
 393                 to attach to your interface to capture packets. Your interface
 394                 will be unregistered automatically when your interface is
 395                 detached.
 396         @param interface The interface to register with BPF.
 397         @param data_link_type The data link type of the interface. See the
 398                 DLT_* defines in bpf.h.
 399         @param header_length The length, in bytes, of the data link header.
 400  */
 401 void     bpfattach(ifnet_t interface, u_int data_link_type, u_int header_length);
 402 #endif /* KERNEL */
 403
 404 /*
 405  * Number of scratch memory words (for BPF_LD|BPF_MEM and BPF_ST).
 406  */
 407 #define BPF_MEMWORDS 16
 408
 409 #endif