1 /*- 2 * Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997 3 * The Regents of the University of California. All rights reserved. 4 * 5 * This code is derived from the Stanford/CMU enet packet filter, 6 * (net/enet.c) distributed as part of 4.3BSD, and code contributed 7 * to Berkeley by Steven McCanne and Van Jacobson both of Lawrence 8 * Berkeley Laboratory. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 3. All advertising materials mentioning features or use of this software 19 * must display the following acknowledgement: 20 * This product includes software developed by the University of 21 * California, Berkeley and its contributors. 22 * 4. Neither the name of the University nor the names of its contributors 23 * may be used to endorse or promote products derived from this software 24 * without specific prior written permission. 25 * 26 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 27 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 28 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 29 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 30 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 31 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 32 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 33 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 34 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 35 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 36 * SUCH DAMAGE. 37 * 38 * @(#)bpf.h 7.1 (Berkeley) 5/7/91 39 * 40 * @(#) $Header: /usr/cvsroot/wpdpack/Include/NET/bpf.h,v 1.10 2003/04/04 11:15:08 degioanni Exp $ (LBL) 41 */ 42 43 #ifndef BPF_MAJOR_VERSION 44 45 #ifdef __cplusplus 46 extern "C" { 47 #endif 48 49 /* BSD style release date */ 50 #define BPF_RELEASE 199606 51 52 typedef int bpf_int32; 53 typedef u_int bpf_u_int32; 54 55 /* 56 * Alignment macros. BPF_WORDALIGN rounds up to the next 57 * even multiple of BPF_ALIGNMENT. 58 */ 59 #ifndef __NetBSD__ 60 #define BPF_ALIGNMENT sizeof(bpf_int32) 61 #else 62 #define BPF_ALIGNMENT sizeof(long) 63 #endif 64 65 #define BPF_WORDALIGN(x) (((x) + (BPF_ALIGNMENT - 1)) & ~(BPF_ALIGNMENT - 1)) 66 67 #define BPF_MAXINSNS 512 68 #define BPF_MAXBUFSIZE 0x8000 69 #define BPF_MINBUFSIZE 32 70 71 /* 72 * Structure for BIOCSETF. 73 */ 74 struct bpf_program { 75 u_int bf_len; 76 struct bpf_insn *bf_insns; 77 }; 78 79 /* 80 * Struct returned by BIOCGSTATS. 81 */ 82 struct bpf_stat { 83 u_int bs_recv; /* number of packets received */ 84 u_int bs_drop; /* number of packets dropped */ 85 }; 86 87 /* 88 * Struct return by BIOCVERSION. This represents the version number of 89 * the filter language described by the instruction encodings below. 90 * bpf understands a program iff kernel_major == filter_major && 91 * kernel_minor >= filter_minor, that is, if the value returned by the 92 * running kernel has the same major number and a minor number equal 93 * equal to or less than the filter being downloaded. Otherwise, the 94 * results are undefined, meaning an error may be returned or packets 95 * may be accepted haphazardly. 96 * It has nothing to do with the source code version. 97 */ 98 struct bpf_version { 99 u_short bv_major; 100 u_short bv_minor; 101 }; 102 103 /* Current version number of filter architecture. */ 104 #define BPF_MAJOR_VERSION 1 105 #define BPF_MINOR_VERSION 1 106 107 /* 108 * BPF ioctls 109 * 110 * The first set is for compatibility with Sun's pcc style 111 * header files. If your using gcc, we assume that you 112 * have run fixincludes so the latter set should work. 113 */ 114 #if (defined(sun) || defined(ibm032)) && !defined(__GNUC__) 115 #define BIOCGBLEN _IOR(B, 102, u_int) 116 #define BIOCSBLEN _IOWR(B, 102, u_int) 117 #define BIOCSETF _IOW(B, 103, struct bpf_program) 118 #define BIOCFLUSH _IO(B, 104) 119 #define BIOCPROMISC _IO(B, 105) 120 #define BIOCGDLT _IOR(B, 106, u_int) 121 #define BIOCGETIF _IOR(B, 107, struct ifreq) 122 #define BIOCSETIF _IOW(B, 108, struct ifreq) 123 #define BIOCSRTIMEOUT _IOW(B, 109, struct timeval) 124 #define BIOCGRTIMEOUT _IOR(B, 110, struct timeval) 125 #define BIOCGSTATS _IOR(B, 111, struct bpf_stat) 126 #define BIOCIMMEDIATE _IOW(B, 112, u_int) 127 #define BIOCVERSION _IOR(B, 113, struct bpf_version) 128 #define BIOCSTCPF _IOW(B, 114, struct bpf_program) 129 #define BIOCSUDPF _IOW(B, 115, struct bpf_program) 130 #else 131 #define BIOCGBLEN _IOR('B', 102, u_int) 132 #define BIOCSBLEN _IOWR('B', 102, u_int) 133 #define BIOCSETF _IOW('B', 103, struct bpf_program) 134 #define BIOCFLUSH _IO('B', 104) 135 #define BIOCPROMISC _IO('B', 105) 136 #define BIOCGDLT _IOR('B', 106, u_int) 137 #define BIOCGETIF _IOR('B', 107, struct ifreq) 138 #define BIOCSETIF _IOW('B', 108, struct ifreq) 139 #define BIOCSRTIMEOUT _IOW('B', 109, struct timeval) 140 #define BIOCGRTIMEOUT _IOR('B', 110, struct timeval) 141 #define BIOCGSTATS _IOR('B', 111, struct bpf_stat) 142 #define BIOCIMMEDIATE _IOW('B', 112, u_int) 143 #define BIOCVERSION _IOR('B', 113, struct bpf_version) 144 #define BIOCSTCPF _IOW('B', 114, struct bpf_program) 145 #define BIOCSUDPF _IOW('B', 115, struct bpf_program) 146 #endif 147 148 /* 149 * Structure prepended to each packet. 150 */ 151 struct bpf_hdr { 152 struct timeval bh_tstamp; /* time stamp */ 153 bpf_u_int32 bh_caplen; /* length of captured portion */ 154 bpf_u_int32 bh_datalen; /* original length of packet */ 155 u_short bh_hdrlen; /* length of bpf header (this struct 156 plus alignment padding) */ 157 }; 158 159 /* 160 * Because the structure above is not a multiple of 4 bytes, some compilers 161 * will insist on inserting padding; hence, sizeof(struct bpf_hdr) won't work. 162 * Only the kernel needs to know about it; applications use bh_hdrlen. 163 */ 164 #if defined(KERNEL) || defined(_KERNEL) 165 #define SIZEOF_BPF_HDR 18 166 #endif 167 168 /* 169 * Data-link level type codes. 170 */ 171 172 /* 173 * These are the types that are the same on all platforms; on other 174 * platforms, a <net/bpf.h> should be supplied that defines the additional 175 * DLT_* codes appropriately for that platform (the BSDs, for example, 176 * should not just pick up this version of "bpf.h"; they should also define 177 * the additional DLT_* codes used by their kernels, as well as the values 178 * defined here - and, if the values they use for particular DLT_ types 179 * differ from those here, they should use their values, not the ones 180 * here). 181 */ 182 #define DLT_NULL 0 /* no link-layer encapsulation */ 183 #define DLT_EN10MB 1 /* Ethernet (10Mb) */ 184 #define DLT_EN3MB 2 /* Experimental Ethernet (3Mb) */ 185 #define DLT_AX25 3 /* Amateur Radio AX.25 */ 186 #define DLT_PRONET 4 /* Proteon ProNET Token Ring */ 187 #define DLT_CHAOS 5 /* Chaos */ 188 #define DLT_IEEE802 6 /* IEEE 802 Networks */ 189 #define DLT_ARCNET 7 /* ARCNET, with BSD-style header */ 190 #define DLT_SLIP 8 /* Serial Line IP */ 191 #define DLT_PPP 9 /* Point-to-point Protocol */ 192 #define DLT_FDDI 10 /* FDDI */ 193 194 /* 195 * These are values from the traditional libpcap "bpf.h". 196 * Ports of this to particular platforms should replace these definitions 197 * with the ones appropriate to that platform, if the values are 198 * different on that platform. 199 */ 200 #define DLT_ATM_RFC1483 11 /* LLC/SNAP encapsulated atm */ 201 #define DLT_RAW 12 /* raw IP */ 202 203 /* 204 * These are values from BSD/OS's "bpf.h". 205 * These are not the same as the values from the traditional libpcap 206 * "bpf.h"; however, these values shouldn't be generated by any 207 * OS other than BSD/OS, so the correct values to use here are the 208 * BSD/OS values. 209 * 210 * Platforms that have already assigned these values to other 211 * DLT_ codes, however, should give these codes the values 212 * from that platform, so that programs that use these codes will 213 * continue to compile - even though they won't correctly read 214 * files of these types. 215 */ 216 #ifdef __NetBSD__ 217 #ifndef DLT_SLIP_BSDOS 218 #define DLT_SLIP_BSDOS 13 /* BSD/OS Serial Line IP */ 219 #define DLT_PPP_BSDOS 14 /* BSD/OS Point-to-point Protocol */ 220 #endif 221 #else 222 #define DLT_SLIP_BSDOS 15 /* BSD/OS Serial Line IP */ 223 #define DLT_PPP_BSDOS 16 /* BSD/OS Point-to-point Protocol */ 224 #endif 225 226 #define DLT_ATM_CLIP 19 /* Linux Classical-IP over ATM */ 227 228 /* 229 * These values are defined by NetBSD; other platforms should refrain from 230 * using them for other purposes, so that NetBSD savefiles with link 231 * types of 50 or 51 can be read as this type on all platforms. 232 */ 233 #define DLT_PPP_SERIAL 50 /* PPP over serial with HDLC encapsulation */ 234 #define DLT_PPP_ETHER 51 /* PPP over Ethernet */ 235 236 /* 237 * Values between 100 and 103 are used in capture file headers as 238 * link-layer types corresponding to DLT_ types that differ 239 * between platforms; don't use those values for new DLT_ new types. 240 */ 241 242 /* 243 * This value was defined by libpcap 0.5; platforms that have defined 244 * it with a different value should define it here with that value - 245 * a link type of 104 in a save file will be mapped to DLT_C_HDLC, 246 * whatever value that happens to be, so programs will correctly 247 * handle files with that link type regardless of the value of 248 * DLT_C_HDLC. 249 * 250 * The name DLT_C_HDLC was used by BSD/OS; we use that name for source 251 * compatibility with programs written for BSD/OS. 252 * 253 * libpcap 0.5 defined it as DLT_CHDLC; we define DLT_CHDLC as well, 254 * for source compatibility with programs written for libpcap 0.5. 255 */ 256 #define DLT_C_HDLC 104 /* Cisco HDLC */ 257 #define DLT_CHDLC DLT_C_HDLC 258 259 #define DLT_IEEE802_11 105 /* IEEE 802.11 wireless */ 260 261 /* 262 * 106 is reserved for Linux Classical IP over ATM; it's like DLT_RAW, 263 * except when it isn't. (I.e., sometimes it's just raw IP, and 264 * sometimes it isn't.) We currently handle it as DLT_LINUX_SLL, 265 * so that we don't have to worry about the link-layer header.) 266 */ 267 268 /* 269 * Frame Relay; BSD/OS has a DLT_FR with a value of 11, but that collides 270 * with other values. 271 * DLT_FR and DLT_FRELAY packets start with the Q.922 Frame Relay header 272 * (DLCI, etc.). 273 */ 274 #define DLT_FRELAY 107 275 276 /* 277 * OpenBSD DLT_LOOP, for loopback devices; it's like DLT_NULL, except 278 * that the AF_ type in the link-layer header is in network byte order. 279 * 280 * OpenBSD defines it as 12, but that collides with DLT_RAW, so we 281 * define it as 108 here. If OpenBSD picks up this file, it should 282 * define DLT_LOOP as 12 in its version, as per the comment above - 283 * and should not use 108 as a DLT_ value. 284 */ 285 #define DLT_LOOP 108 286 287 /* 288 * Values between 109 and 112 are used in capture file headers as 289 * link-layer types corresponding to DLT_ types that might differ 290 * between platforms; don't use those values for new DLT_ types 291 * other than the corresponding DLT_ types. 292 */ 293 294 /* 295 * This is for Linux cooked sockets. 296 */ 297 #define DLT_LINUX_SLL 113 298 299 /* 300 * Apple LocalTalk hardware. 301 */ 302 #define DLT_LTALK 114 303 304 /* 305 * Acorn Econet. 306 */ 307 #define DLT_ECONET 115 308 309 /* 310 * Reserved for use with OpenBSD ipfilter. 311 */ 312 #define DLT_IPFILTER 116 313 314 /* 315 * Reserved for use in capture-file headers as a link-layer type 316 * corresponding to OpenBSD DLT_PFLOG; DLT_PFLOG is 17 in OpenBSD, 317 * but that's DLT_LANE8023 in SuSE 6.3, so we can't use 17 for it 318 * in capture-file headers. 319 */ 320 #define DLT_PFLOG 117 321 322 /* 323 * Registered for Cisco-internal use. 324 */ 325 #define DLT_CISCO_IOS 118 326 327 /* 328 * Reserved for 802.11 cards using the Prism II chips, with a link-layer 329 * header including Prism monitor mode information plus an 802.11 330 * header. 331 */ 332 #define DLT_PRISM_HEADER 119 333 334 /* 335 * Reserved for Aironet 802.11 cards, with an Aironet link-layer header 336 * (see Doug Ambrisko's FreeBSD patches). 337 */ 338 #define DLT_AIRONET_HEADER 120 339 340 /* 341 * Reserved for Siemens HiPath HDLC. 342 */ 343 #define DLT_HHDLC 121 344 345 /* 346 * This is for RFC 2625 IP-over-Fibre Channel. 347 * 348 * This is not for use with raw Fibre Channel, where the link-layer 349 * header starts with a Fibre Channel frame header; it's for IP-over-FC, 350 * where the link-layer header starts with an RFC 2625 Network_Header 351 * field. 352 */ 353 #define DLT_IP_OVER_FC 122 354 355 /* 356 * This is for Full Frontal ATM on Solaris with SunATM, with a 357 * pseudo-header followed by an AALn PDU. 358 * 359 * There may be other forms of Full Frontal ATM on other OSes, 360 * with different pseudo-headers. 361 * 362 * If ATM software returns a pseudo-header with VPI/VCI information 363 * (and, ideally, packet type information, e.g. signalling, ILMI, 364 * LANE, LLC-multiplexed traffic, etc.), it should not use 365 * DLT_ATM_RFC1483, but should get a new DLT_ value, so tcpdump 366 * and the like don't have to infer the presence or absence of a 367 * pseudo-header and the form of the pseudo-header. 368 */ 369 #define DLT_SUNATM 123 /* Solaris+SunATM */ 370 371 /* 372 * Reserved as per request from Kent Dahlgren <kent@praesum.com> 373 * for private use. 374 */ 375 #define DLT_RIO 124 /* RapidIO */ 376 #define DLT_PCI_EXP 125 /* PCI Express */ 377 #define DLT_AURORA 126 /* Xilinx Aurora link layer */ 378 379 /* 380 * For future use with 802.11 captures - defined by AbsoluteValue 381 * Systems to store a number of bits of link-layer information: 382 * 383 * http://www.shaftnet.org/~pizza/software/capturefrm.txt 384 * 385 * but could and arguably should also be used by non-AVS Linux 386 * 802.11 drivers and BSD drivers; that may happen in the future. 387 */ 388 #define DLT_IEEE802_11_RADIO 127 /* 802.11 plus WLAN header */ 389 390 /* 391 * Reserved for the TZSP encapsulation, as per request from 392 * Chris Waters <chris.waters@networkchemistry.com> 393 * TZSP is a generic encapsulation for any other link type, 394 * which includes a means to include meta-information 395 * with the packet, e.g. signal strength and channel 396 * for 802.11 packets. 397 */ 398 #define DLT_TZSP 128 /* Tazmen Sniffer Protocol */ 399 400 /* 401 * BSD's ARCNET headers have the source host, destination host, 402 * and type at the beginning of the packet; that's what's handed 403 * up to userland via BPF. 404 * 405 * Linux's ARCNET headers, however, have a 2-byte offset field 406 * between the host IDs and the type; that's what's handed up 407 * to userland via PF_PACKET sockets. 408 * 409 * We therefore have to have separate DLT_ values for them. 410 */ 411 #define DLT_ARCNET_LINUX 129 /* ARCNET */ 412 413 /* 414 * The instruction encodings. 415 */ 416 /* instruction classes */ 417 #define BPF_CLASS(code) ((code) & 0x07) 418 419 #define BPF_LD 0x00 420 #define BPF_LDX 0x01 421 #define BPF_ST 0x02 422 #define BPF_STX 0x03 423 #define BPF_ALU 0x04 424 #define BPF_JMP 0x05 425 #define BPF_RET 0x06 426 #define BPF_MISC 0x07 427 428 /* ld/ldx fields */ 429 #define BPF_SIZE(code) ((code) & 0x18) 430 431 #define BPF_W 0x00 432 #define BPF_H 0x08 433 #define BPF_B 0x10 434 435 #define BPF_MODE(code) ((code) & 0xe0) 436 437 #define BPF_IMM 0x00 438 #define BPF_ABS 0x20 439 #define BPF_IND 0x40 440 #define BPF_MEM 0x60 441 #define BPF_LEN 0x80 442 #define BPF_MSH 0xa0 443 444 /* alu/jmp fields */ 445 #define BPF_OP(code) ((code) & 0xf0) 446 447 #define BPF_ADD 0x00 448 #define BPF_SUB 0x10 449 #define BPF_MUL 0x20 450 #define BPF_DIV 0x30 451 #define BPF_OR 0x40 452 #define BPF_AND 0x50 453 #define BPF_LSH 0x60 454 #define BPF_RSH 0x70 455 #define BPF_NEG 0x80 456 #define BPF_JA 0x00 457 #define BPF_JEQ 0x10 458 #define BPF_JGT 0x20 459 #define BPF_JGE 0x30 460 #define BPF_JSET 0x40 461 462 #define BPF_SRC(code) ((code) & 0x08) 463 464 #define BPF_K 0x00 465 #define BPF_X 0x08 466 467 /* ret - BPF_K and BPF_X also apply */ 468 #define BPF_RVAL(code) ((code) & 0x18) 469 470 #define BPF_A 0x10 471 472 /* misc */ 473 #define BPF_MISCOP(code) ((code) & 0xf8) 474 475 #define BPF_TAX 0x00 476 #define BPF_TXA 0x80 477 478 /* 479 * The instruction data structure. 480 */ 481 struct bpf_insn { 482 u_short code; 483 u_char jt; 484 u_char jf; 485 bpf_int32 k; 486 }; 487 488 /* 489 * Macros for insn array initializers. 490 */ 491 #define BPF_STMT(code, k) { (u_short)(code), 0, 0, k } 492 #define BPF_JUMP(code, k, jt, jf) { (u_short)(code), jt, jf, k } 493 494 #if defined(BSD) && (defined(KERNEL) || defined(_KERNEL)) 495 /* 496 * Systems based on non-BSD kernels don't have ifnet's (or they don't mean 497 * anything if it is in <net/if.h>) and won't work like this. 498 */ 499 # if __STDC__ 500 extern void bpf_tap(struct ifnet *, u_char *, u_int); 501 extern void bpf_mtap(struct ifnet *, struct mbuf *); 502 extern void bpfattach(struct ifnet *, u_int, u_int); 503 extern void bpfilterattach(int); 504 # else 505 extern void bpf_tap(); 506 extern void bpf_mtap(); 507 extern void bpfattach(); 508 extern void bpfilterattach(); 509 # endif /* __STDC__ */ 510 #endif /* BSD && (_KERNEL || KERNEL) */ 511 512 #if __STDC__ || defined(__cplusplus) 513 extern int bpf_validate(struct bpf_insn *, int); 514 extern u_int bpf_filter(struct bpf_insn *, u_char *, u_int, u_int); 515 #else 516 extern int bpf_validate(); 517 extern u_int bpf_filter(); 518 #endif 519 520 /* 521 * Number of scratch memory words (for BPF_LD|BPF_MEM and BPF_ST). 522 */ 523 #define BPF_MEMWORDS 16 524 525 #ifdef __cplusplus 526 } 527 #endif 528 529 #endif 530