bsd/net/bpf.h

   1 /*
   2  * Copyright (c) 2000-2012 Apple Inc. All rights reserved.
   3  *
   4  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. The rights granted to you under the License
  10  * may not be used to create, or enable the creation or redistribution of,
  11  * unlawful or unlicensed copies of an Apple operating system, or to
  12  * circumvent, violate, or enable the circumvention or violation of, any
  13  * terms of an Apple operating system software license agreement.
  14  *
  15  * Please obtain a copy of the License at
  16  * http://www.opensource.apple.com/apsl/ and read it before using this file.
  17  *
  18  * The Original Code and all software distributed under the License are
  19  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  20  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  21  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  22  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  23  * Please see the License for the specific language governing rights and
  24  * limitations under the License.
  25  *
  26  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  27  */
  28 /*
  29  * Copyright (c) 1990, 1991, 1993
  30  *      The Regents of the University of California.  All rights reserved.
  31  *
  32  * This code is derived from the Stanford/CMU enet packet filter,
  33  * (net/enet.c) distributed as part of 4.3BSD, and code contributed
  34  * to Berkeley by Steven McCanne and Van Jacobson both of Lawrence
  35  * Berkeley Laboratory.
  36  *
  37  * Redistribution and use in source and binary forms, with or without
  38  * modification, are permitted provided that the following conditions
  39  * are met:
  40  * 1. Redistributions of source code must retain the above copyright
  41  *    notice, this list of conditions and the following disclaimer.
  42  * 2. Redistributions in binary form must reproduce the above copyright
  43  *    notice, this list of conditions and the following disclaimer in the
  44  *    documentation and/or other materials provided with the distribution.
  45  * 3. All advertising materials mentioning features or use of this software
  46  *    must display the following acknowledgement:
  47  *      This product includes software developed by the University of
  48  *      California, Berkeley and its contributors.
  49  * 4. Neither the name of the University nor the names of its contributors
  50  *    may be used to endorse or promote products derived from this software
  51  *    without specific prior written permission.
  52  *
  53  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  54  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  55  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  56  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  57  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  58  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  59  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  60  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  61  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  62  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  63  * SUCH DAMAGE.
  64  *
  65  *      @(#)bpf.h       8.1 (Berkeley) 6/10/93
  66  *      @(#)bpf.h       1.34 (LBL)     6/16/96
  67  *
  68  * $FreeBSD: src/sys/net/bpf.h,v 1.21.2.3 2001/08/01 00:23:13 fenner Exp $
  69  */
  70 /*
  71  * NOTICE: This file was modified by SPARTA, Inc. in 2006 to introduce
  72  * support for mandatory and extensible security protections.  This notice
  73  * is included in support of clause 2.2 (b) of the Apple Public License,
  74  * Version 2.0.
  75  */
  76
  77 #ifndef _NET_BPF_H_
  78 #define _NET_BPF_H_
  79 #include <sys/param.h>
  80 #include <sys/appleapiopts.h>
  81 #include <sys/types.h>
  82 #include <sys/time.h>
  83 #include <sys/cdefs.h>
  84
  85 #ifdef KERNEL
  86 #include <sys/kernel_types.h>
  87 #endif
  88
  89 /* BSD style release date */
  90 #define BPF_RELEASE 199606
  91
  92 typedef int32_t   bpf_int32;
  93 typedef u_int32_t bpf_u_int32;
  94
  95 /*
  96  * Alignment macros.  BPF_WORDALIGN rounds up to the next
  97  * even multiple of BPF_ALIGNMENT.
  98  */
  99 #define BPF_ALIGNMENT sizeof(int32_t)
 100 #define BPF_WORDALIGN(x) (((x)+(BPF_ALIGNMENT-1))&~(BPF_ALIGNMENT-1))
 101
 102 #define BPF_MAXINSNS 512
 103 #define BPF_MAXBUFSIZE 0x80000
 104 #define BPF_MINBUFSIZE 32
 105
 106 /*
 107  *  Structure for BIOCSETF.
 108  */
 109 struct bpf_program {
 110         u_int bf_len;
 111         struct bpf_insn *bf_insns;
 112 };
 113
 114 #ifdef KERNEL_PRIVATE
 115 /* LP64 version of bpf_program.  all pointers
 116  * grow when we're dealing with a 64-bit process.
 117  * WARNING - keep in sync with bpf_program
 118  */
 119 struct bpf_program64 {
 120         u_int           bf_len;
 121         user64_addr_t   bf_insns __attribute__((aligned(8)));
 122 };
 123
 124 struct bpf_program32 {
 125         u_int           bf_len;
 126         user32_addr_t   bf_insns;
 127 };
 128 #endif /* KERNEL_PRIVATE */
 129
 130 /*
 131  * Struct returned by BIOCGSTATS.
 132  */
 133 struct bpf_stat {
 134         u_int bs_recv;          /* number of packets received */
 135         u_int bs_drop;          /* number of packets dropped */
 136 };
 137
 138 /*
 139  * Struct return by BIOCVERSION.  This represents the version number of
 140  * the filter language described by the instruction encodings below.
 141  * bpf understands a program iff kernel_major == filter_major &&
 142  * kernel_minor >= filter_minor, that is, if the value returned by the
 143  * running kernel has the same major number and a minor number equal
 144  * equal to or less than the filter being downloaded.  Otherwise, the
 145  * results are undefined, meaning an error may be returned or packets
 146  * may be accepted haphazardly.
 147  * It has nothing to do with the source code version.
 148  */
 149 struct bpf_version {
 150         u_short bv_major;
 151         u_short bv_minor;
 152 };
 153 #if defined(__LP64__)
 154 #define __need_struct_timeval32
 155 #include <sys/_structs.h>
 156 #define BPF_TIMEVAL timeval32
 157 #else
 158 #define BPF_TIMEVAL timeval
 159 #endif /* __LP64__ */
 160 /* Current version number of filter architecture. */
 161 #define BPF_MAJOR_VERSION 1
 162 #define BPF_MINOR_VERSION 1
 163
 164 #define BIOCGBLEN       _IOR('B',102, u_int)
 165 #define BIOCSBLEN       _IOWR('B',102, u_int)
 166 #define BIOCSETF        _IOW('B',103, struct bpf_program)
 167 #ifdef KERNEL_PRIVATE
 168 #define BIOCSETF64      _IOW('B',103, struct bpf_program64)
 169 #define BIOCSETF32      _IOW('B',103, struct bpf_program32)
 170 #endif /* KERNEL_PRIVATE */
 171 #define BIOCFLUSH       _IO('B',104)
 172 #define BIOCPROMISC     _IO('B',105)
 173 #define BIOCGDLT        _IOR('B',106, u_int)
 174 #define BIOCGETIF       _IOR('B',107, struct ifreq)
 175 #define BIOCSETIF       _IOW('B',108, struct ifreq)
 176 #define BIOCSRTIMEOUT   _IOW('B',109, struct timeval)
 177 #ifdef KERNEL_PRIVATE
 178 #define BIOCSRTIMEOUT64 _IOW('B',109, struct user64_timeval)
 179 #define BIOCSRTIMEOUT32 _IOW('B',109, struct user32_timeval)
 180 #endif /* KERNEL_PRIVATE */
 181 #define BIOCGRTIMEOUT   _IOR('B',110, struct timeval)
 182 #ifdef KERNEL_PRIVATE
 183 #define BIOCGRTIMEOUT64 _IOR('B',110, struct user64_timeval)
 184 #define BIOCGRTIMEOUT32 _IOR('B',110, struct user32_timeval)
 185 #endif /* KERNEL_PRIVATE */
 186 #define BIOCGSTATS      _IOR('B',111, struct bpf_stat)
 187 #define BIOCIMMEDIATE   _IOW('B',112, u_int)
 188 #define BIOCVERSION     _IOR('B',113, struct bpf_version)
 189 #define BIOCGRSIG       _IOR('B',114, u_int)
 190 #define BIOCSRSIG       _IOW('B',115, u_int)
 191 #define BIOCGHDRCMPLT   _IOR('B',116, u_int)
 192 #define BIOCSHDRCMPLT   _IOW('B',117, u_int)
 193 #define BIOCGSEESENT    _IOR('B',118, u_int)
 194 #define BIOCSSEESENT    _IOW('B',119, u_int)
 195 #define BIOCSDLT        _IOW('B',120, u_int)
 196 #define BIOCGDLTLIST    _IOWR('B',121, struct bpf_dltlist)
 197 #ifdef PRIVATE
 198 #define BIOCGETTC       _IOR('B', 122, int)
 199 #define BIOCSETTC       _IOW('B', 123, int)
 200 #define BIOCSEXTHDR     _IOW('B', 124, u_int)
 201 #endif /* PRIVATE */
 202
 203 /*
 204  * Structure prepended to each packet.
 205  */
 206 struct bpf_hdr {
 207         struct BPF_TIMEVAL bh_tstamp;   /* time stamp */
 208         bpf_u_int32     bh_caplen;      /* length of captured portion */
 209         bpf_u_int32     bh_datalen;     /* original length of packet */
 210         u_short         bh_hdrlen;      /* length of bpf header (this struct
 211                                            plus alignment padding) */
 212 };
 213 #ifdef KERNEL
 214 /*
 215  * Because the structure above is not a multiple of 4 bytes, some compilers
 216  * will insist on inserting padding; hence, sizeof(struct bpf_hdr) won't work.
 217  * Only the kernel needs to know about it; applications use bh_hdrlen.
 218  */
 219 #define SIZEOF_BPF_HDR  (sizeof(struct bpf_hdr) <= 20 ? 18 : \
 220     sizeof(struct bpf_hdr))
 221 #endif
 222 #ifdef PRIVATE
 223 /*
 224  * This structure must be a multiple of 4 bytes.
 225  * It includes padding and spare fields that we can use later if desired.
 226  */
 227 struct bpf_hdr_ext {
 228         struct BPF_TIMEVAL bh_tstamp;   /* time stamp */
 229         bpf_u_int32     bh_caplen;      /* length of captured portion */
 230         bpf_u_int32     bh_datalen;     /* original length of packet */
 231         u_short         bh_hdrlen;      /* length of bpf header */
 232         u_short         bh_flags;
 233 #define BPF_HDR_EXT_FLAGS_DIR_IN        0x0000
 234 #define BPF_HDR_EXT_FLAGS_DIR_OUT       0x0001
 235 #define BPF_HDR_EXT_FLAGS_TCP           0x0002
 236         pid_t           bh_pid;         /* process PID */
 237         char            bh_comm[MAXCOMLEN+1]; /* process command */
 238         u_char          _bh_pad2[3];
 239         bpf_u_int32     bh_svc;         /* service class */
 240         bpf_u_int32     bh_flowhash;    /* kernel reserved; 0 in userland */
 241 };
 242 #endif /* PRIVATE */
 243
 244 /*
 245  * Data-link level type codes.
 246  */
 247 #define DLT_NULL        0       /* no link-layer encapsulation */
 248 #define DLT_EN10MB      1       /* Ethernet (10Mb) */
 249 #define DLT_EN3MB       2       /* Experimental Ethernet (3Mb) */
 250 #define DLT_AX25        3       /* Amateur Radio AX.25 */
 251 #define DLT_PRONET      4       /* Proteon ProNET Token Ring */
 252 #define DLT_CHAOS       5       /* Chaos */
 253 #define DLT_IEEE802     6       /* IEEE 802 Networks */
 254 #define DLT_ARCNET      7       /* ARCNET */
 255 #define DLT_SLIP        8       /* Serial Line IP */
 256 #define DLT_PPP         9       /* Point-to-point Protocol */
 257 #define DLT_FDDI        10      /* FDDI */
 258 #define DLT_ATM_RFC1483 11      /* LLC/SNAP encapsulated atm */
 259 #define DLT_RAW         12      /* raw IP */
 260
 261 /*
 262  * These are values from BSD/OS's "bpf.h".
 263  * These are not the same as the values from the traditional libpcap
 264  * "bpf.h"; however, these values shouldn't be generated by any
 265  * OS other than BSD/OS, so the correct values to use here are the
 266  * BSD/OS values.
 267  *
 268  * Platforms that have already assigned these values to other
 269  * DLT_ codes, however, should give these codes the values
 270  * from that platform, so that programs that use these codes will
 271  * continue to compile - even though they won't correctly read
 272  * files of these types.
 273  */
 274 #define DLT_SLIP_BSDOS  15      /* BSD/OS Serial Line IP */
 275 #define DLT_PPP_BSDOS   16      /* BSD/OS Point-to-point Protocol */
 276
 277 #define DLT_PFSYNC      18      /* Packet filter state syncing */
 278 #define DLT_ATM_CLIP    19      /* Linux Classical-IP over ATM */
 279
 280 /*
 281  * This value is defined by NetBSD; other platforms should refrain from
 282  * using it for other purposes, so that NetBSD savefiles with a link
 283  * type of 50 can be read as this type on all platforms.
 284  */
 285 #define DLT_PPP_SERIAL  50      /* PPP over serial with HDLC encapsulation */
 286
 287 /*
 288  * This value was defined by libpcap 0.5; platforms that have defined
 289  * it with a different value should define it here with that value -
 290  * a link type of 104 in a save file will be mapped to DLT_C_HDLC,
 291  * whatever value that happens to be, so programs will correctly
 292  * handle files with that link type regardless of the value of
 293  * DLT_C_HDLC.
 294  *
 295  * The name DLT_C_HDLC was used by BSD/OS; we use that name for source
 296  * compatibility with programs written for BSD/OS.
 297  *
 298  * libpcap 0.5 defined it as DLT_CHDLC; we define DLT_CHDLC as well,
 299  * for source compatibility with programs written for libpcap 0.5.
 300  */
 301 #define DLT_C_HDLC      104     /* Cisco HDLC */
 302 #define DLT_CHDLC       DLT_C_HDLC
 303
 304 /*
 305  * Reserved for future use.
 306  * Do not pick other numerical value for these unless you have also
 307  * picked up the tcpdump.org top-of-CVS-tree version of "savefile.c",
 308  * which will arrange that capture files for these DLT_ types have
 309  * the same "network" value on all platforms, regardless of what
 310  * value is chosen for their DLT_ type (thus allowing captures made
 311  * on one platform to be read on other platforms, even if the two
 312  * platforms don't use the same numerical values for all DLT_ types).
 313  */
 314 #define DLT_IEEE802_11  105     /* IEEE 802.11 wireless */
 315
 316 /*
 317  * Values between 106 and 107 are used in capture file headers as
 318  * link-layer types corresponding to DLT_ types that might differ
 319  * between platforms; don't use those values for new DLT_ new types.
 320  */
 321
 322 /*
 323  * OpenBSD DLT_LOOP, for loopback devices; it's like DLT_NULL, except
 324  * that the AF_ type in the link-layer header is in network byte order.
 325  *
 326  * OpenBSD defines it as 12, but that collides with DLT_RAW, so we
 327  * define it as 108 here.  If OpenBSD picks up this file, it should
 328  * define DLT_LOOP as 12 in its version, as per the comment above -
 329  * and should not use 108 for any purpose.
 330  */
 331 #define DLT_LOOP        108
 332
 333 /*
 334  * Values between 109 and 112 are used in capture file headers as
 335  * link-layer types corresponding to DLT_ types that might differ
 336  * between platforms; don't use those values for new DLT_ new types.
 337  */
 338
 339 /*
 340  * This is for Linux cooked sockets.
 341  */
 342 #define DLT_LINUX_SLL   113
 343
 344 /*
 345  * For use in capture-file headers as a link-layer type corresponding
 346  * to OpenBSD PF (Packet Filter) log.
 347  */
 348 #define DLT_PFLOG       117
 349
 350 /*
 351  * BSD header for 802.11 plus a number of bits of link-layer information
 352  * including radio information.
 353  */
 354 #ifndef DLT_IEEE802_11_RADIO
 355 #define DLT_IEEE802_11_RADIO    127
 356 #endif
 357
 358 /*
 359  * Apple IP-over-IEEE 1394, as per a request from Dieter Siegmund
 360  * <dieter@apple.com>.  The header that's presented is an Ethernet-like
 361  * header:
 362  *
 363  *      #define FIREWIRE_EUI64_LEN      8
 364  *      struct firewire_header {
 365  *              u_char  firewire_dhost[FIREWIRE_EUI64_LEN];
 366  *              u_char  firewire_shost[FIREWIRE_EUI64_LEN];
 367  *              u_short firewire_type;
 368  *      };
 369  *
 370  * with "firewire_type" being an Ethernet type value, rather than,
 371  * for example, raw GASP frames being handed up.
 372  */
 373 #define DLT_APPLE_IP_OVER_IEEE1394      138
 374
 375 /*
 376  * For future use with 802.11 captures - defined by AbsoluteValue
 377  * Systems to store a number of bits of link-layer information
 378  * including radio information:
 379  *
 380  *      http://www.shaftnet.org/~pizza/software/capturefrm.txt
 381  *
 382  * but it might be used by some non-AVS drivers now or in the
 383  * future.
 384  */
 385 #define DLT_IEEE802_11_RADIO_AVS 163    /* 802.11 plus AVS radio header */
 386
 387
 388 /*
 389  * The instruction encodings.
 390  */
 391 /* instruction classes */
 392 #define BPF_CLASS(code) ((code) & 0x07)
 393 #define         BPF_LD          0x00
 394 #define         BPF_LDX         0x01
 395 #define         BPF_ST          0x02
 396 #define         BPF_STX         0x03
 397 #define         BPF_ALU         0x04
 398 #define         BPF_JMP         0x05
 399 #define         BPF_RET         0x06
 400 #define         BPF_MISC        0x07
 401
 402 /* ld/ldx fields */
 403 #define BPF_SIZE(code)  ((code) & 0x18)
 404 #define         BPF_W           0x00
 405 #define         BPF_H           0x08
 406 #define         BPF_B           0x10
 407 #define BPF_MODE(code)  ((code) & 0xe0)
 408 #define         BPF_IMM         0x00
 409 #define         BPF_ABS         0x20
 410 #define         BPF_IND         0x40
 411 #define         BPF_MEM         0x60
 412 #define         BPF_LEN         0x80
 413 #define         BPF_MSH         0xa0
 414
 415 /* alu/jmp fields */
 416 #define BPF_OP(code)    ((code) & 0xf0)
 417 #define         BPF_ADD         0x00
 418 #define         BPF_SUB         0x10
 419 #define         BPF_MUL         0x20
 420 #define         BPF_DIV         0x30
 421 #define         BPF_OR          0x40
 422 #define         BPF_AND         0x50
 423 #define         BPF_LSH         0x60
 424 #define         BPF_RSH         0x70
 425 #define         BPF_NEG         0x80
 426 #define         BPF_JA          0x00
 427 #define         BPF_JEQ         0x10
 428 #define         BPF_JGT         0x20
 429 #define         BPF_JGE         0x30
 430 #define         BPF_JSET        0x40
 431 #define BPF_SRC(code)   ((code) & 0x08)
 432 #define         BPF_K           0x00
 433 #define         BPF_X           0x08
 434
 435 /* ret - BPF_K and BPF_X also apply */
 436 #define BPF_RVAL(code)  ((code) & 0x18)
 437 #define         BPF_A           0x10
 438
 439 /* misc */
 440 #define BPF_MISCOP(code) ((code) & 0xf8)
 441 #define         BPF_TAX         0x00
 442 #define         BPF_TXA         0x80
 443
 444 /*
 445  * The instruction data structure.
 446  */
 447 struct bpf_insn {
 448         u_short         code;
 449         u_char          jt;
 450         u_char          jf;
 451         bpf_u_int32     k;
 452 };
 453
 454 /*
 455  * Macros for insn array initializers.
 456  */
 457 #define BPF_STMT(code, k) { (u_short)(code), 0, 0, k }
 458 #define BPF_JUMP(code, k, jt, jf) { (u_short)(code), jt, jf, k }
 459
 460 #pragma pack(4)
 461
 462 /*
 463  * Structure to retrieve available DLTs for the interface.
 464  */
 465 struct bpf_dltlist {
 466         u_int32_t               bfl_len;        /* number of bfd_list array */
 467         union {
 468                 u_int32_t       *bflu_list;     /* array of DLTs */
 469                 u_int64_t       bflu_pad;
 470         } bfl_u;
 471 };
 472 #define bfl_list bfl_u.bflu_list
 473
 474 #pragma pack()
 475
 476 #ifdef KERNEL_PRIVATE
 477 /* Forward declerations */
 478 struct ifnet;
 479 struct mbuf;
 480
 481 extern int      bpf_validate(const struct bpf_insn *, int);
 482 extern void     bpfdetach(struct ifnet *);
 483 extern void     bpfilterattach(int);
 484 extern u_int    bpf_filter(const struct bpf_insn *, u_char *, u_int, u_int);
 485 #endif /* KERNEL_PRIVATE */
 486
 487 #ifdef KERNEL
 488 #ifndef BPF_TAP_MODE_T
 489 #define BPF_TAP_MODE_T
 490 /*!
 491         @enum BPF tap mode
 492         @abstract Constants defining interface families.
 493         @constant BPF_MODE_DISABLED Disable bpf.
 494         @constant BPF_MODE_INPUT Enable input only.
 495         @constant BPF_MODE_OUTPUT Enable output only.
 496         @constant BPF_MODE_INPUT_OUTPUT Enable input and output.
 497 */
 498
 499 enum {
 500         BPF_MODE_DISABLED       = 0,
 501         BPF_MODE_INPUT          = 1,
 502         BPF_MODE_OUTPUT         = 2,
 503         BPF_MODE_INPUT_OUTPUT   = 3
 504 };
 505 /*!
 506         @typedef bpf_tap_mode
 507         @abstract Mode for tapping. BPF_MODE_DISABLED/BPF_MODE_INPUT_OUTPUT etc.
 508 */
 509 typedef u_int32_t bpf_tap_mode;
 510 #endif /* !BPF_TAP_MODE_T */
 511
 512 /*!
 513         @typedef bpf_send_func
 514         @discussion bpf_send_func is called when a bpf file descriptor is
 515                 used to send a raw packet on the interface. The mbuf and data
 516                 link type are specified. The callback is responsible for
 517                 releasing the mbuf whether or not it returns an error.
 518         @param interface The interface the packet is being sent on.
 519         @param dlt The data link type the bpf device is attached to.
 520         @param packet The packet to be sent.
 521  */
 522 typedef errno_t (*bpf_send_func)(ifnet_t interface, u_int32_t data_link_type,
 523                                                                  mbuf_t packet);
 524
 525 /*!
 526         @typedef bpf_tap_func
 527         @discussion bpf_tap_func is called when the tap state of the
 528                 interface changes. This happens when a bpf device attaches to an
 529                 interface or detaches from an interface. The tap mode will join
 530                 together (bit or) the modes of all bpf devices using that
 531                 interface for that dlt. If you return an error from this
 532                 function, the bpf device attach attempt that triggered the tap
 533                 will fail. If this function was called bacuse the tap state was
 534                 decreasing (tap in or out is stopping), the error will be
 535                 ignored.
 536         @param interface The interface being tapped.
 537         @param dlt The data link type being tapped.
 538         @param direction The direction of the tap.
 539  */
 540 typedef errno_t (*bpf_tap_func)(ifnet_t interface, u_int32_t data_link_type,
 541                                                                 bpf_tap_mode direction);
 542
 543 /*!
 544         @function bpfattach
 545         @discussion Registers an interface with BPF. This allows bpf devices
 546                 to attach to your interface to capture packets. Your interface
 547                 will be unregistered automatically when your interface is
 548                 detached.
 549         @param interface The interface to register with BPF.
 550         @param data_link_type The data link type of the interface. See the
 551                 DLT_* defines in bpf.h.
 552         @param header_length The length, in bytes, of the data link header.
 553  */
 554 extern void  bpfattach(ifnet_t interface, u_int data_link_type,
 555     u_int header_length);
 556
 557 /*!
 558         @function bpf_attach
 559         @discussion Registers an interface with BPF. This allows bpf devices
 560                 to attach to your interface to capture and transmit packets.
 561                 Your interface will be unregistered automatically when your
 562                 interface is detached. You may register multiple times with
 563                 different data link types. An 802.11 interface would use this to
 564                 allow clients to pick whether they want just an ethernet style
 565                 frame or the 802.11 wireless headers as well. The first dlt you
 566                 register will be considered the default. Any bpf device attaches
 567                 that do not specify a data link type will use the default.
 568         @param interface The interface to register with BPF.
 569         @param data_link_type The data link type of the interface. See the
 570                 DLT_* defines in bpf.h.
 571         @param header_length The length, in bytes, of the data link header.
 572  */
 573 extern errno_t  bpf_attach(ifnet_t interface, u_int32_t data_link_type,
 574     u_int32_t header_length, bpf_send_func send, bpf_tap_func tap);
 575
 576 /*!
 577         @function bpf_tap_in
 578         @discussion Call this function when your interface receives a
 579                 packet. This function will check if any bpf devices need a
 580                 a copy of the packet.
 581         @param interface The interface the packet was received on.
 582         @param dlt The data link type of the packet.
 583         @param packet The packet received.
 584         @param header An optional pointer to a header that will be prepended.
 585         @param headerlen If the header was specified, the length of the header.
 586  */
 587 extern void bpf_tap_in(ifnet_t interface, u_int32_t dlt, mbuf_t packet,
 588     void *header, size_t header_len);
 589
 590 /*!
 591         @function bpf_tap_out
 592         @discussion Call this function when your interface trasmits a
 593                 packet. This function will check if any bpf devices need a
 594                 a copy of the packet.
 595         @param interface The interface the packet was or will be transmitted on.
 596         @param dlt The data link type of the packet.
 597         @param packet The packet received.
 598         @param header An optional pointer to a header that will be prepended.
 599         @param headerlen If the header was specified, the length of the header.
 600  */
 601 extern void bpf_tap_out(ifnet_t interface, u_int32_t dlt, mbuf_t packet,
 602     void *header, size_t header_len);
 603
 604 #endif /* KERNEL */
 605
 606 /*
 607  * Number of scratch memory words (for BPF_LD|BPF_MEM and BPF_ST).
 608  */
 609 #define BPF_MEMWORDS 16
 610
 611 #endif /* _NET_BPF_H_ */