xref: /freebsd/sys/net/bpf.h (revision 6e0da4f753ed6b5d26395001a6194b4fdea70177)
1 /*-
2  * Copyright (c) 1990, 1991, 1993
3  *	The Regents of the University of California.  All rights reserved.
4  *
5  * This code is derived from the Stanford/CMU enet packet filter,
6  * (net/enet.c) distributed as part of 4.3BSD, and code contributed
7  * to Berkeley by Steven McCanne and Van Jacobson both of Lawrence
8  * Berkeley Laboratory.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 4. Neither the name of the University nor the names of its contributors
19  *    may be used to endorse or promote products derived from this software
20  *    without specific prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32  * SUCH DAMAGE.
33  *
34  *      @(#)bpf.h	8.1 (Berkeley) 6/10/93
35  *	@(#)bpf.h	1.34 (LBL)     6/16/96
36  *
37  * $FreeBSD$
38  */
39 
40 #ifndef _NET_BPF_H_
41 #define _NET_BPF_H_
42 
43 /* BSD style release date */
44 #define	BPF_RELEASE 199606
45 
46 typedef	int32_t	  bpf_int32;
47 typedef	u_int32_t bpf_u_int32;
48 
49 /*
50  * Alignment macros.  BPF_WORDALIGN rounds up to the next
51  * even multiple of BPF_ALIGNMENT.
52  */
53 #define BPF_ALIGNMENT sizeof(long)
54 #define BPF_WORDALIGN(x) (((x)+(BPF_ALIGNMENT-1))&~(BPF_ALIGNMENT-1))
55 
56 #define BPF_MAXINSNS 512
57 #define BPF_MAXBUFSIZE 0x80000
58 #define BPF_MINBUFSIZE 32
59 
60 /*
61  *  Structure for BIOCSETF.
62  */
63 struct bpf_program {
64 	u_int bf_len;
65 	struct bpf_insn *bf_insns;
66 };
67 
68 /*
69  * Struct returned by BIOCGSTATS.
70  */
71 struct bpf_stat {
72 	u_int bs_recv;		/* number of packets received */
73 	u_int bs_drop;		/* number of packets dropped */
74 };
75 
76 /*
77  * Struct return by BIOCVERSION.  This represents the version number of
78  * the filter language described by the instruction encodings below.
79  * bpf understands a program iff kernel_major == filter_major &&
80  * kernel_minor >= filter_minor, that is, if the value returned by the
81  * running kernel has the same major number and a minor number equal
82  * equal to or less than the filter being downloaded.  Otherwise, the
83  * results are undefined, meaning an error may be returned or packets
84  * may be accepted haphazardly.
85  * It has nothing to do with the source code version.
86  */
87 struct bpf_version {
88 	u_short bv_major;
89 	u_short bv_minor;
90 };
91 /* Current version number of filter architecture. */
92 #define BPF_MAJOR_VERSION 1
93 #define BPF_MINOR_VERSION 1
94 
95 #define	BIOCGBLEN	_IOR('B',102, u_int)
96 #define	BIOCSBLEN	_IOWR('B',102, u_int)
97 #define	BIOCSETF	_IOW('B',103, struct bpf_program)
98 #define	BIOCFLUSH	_IO('B',104)
99 #define BIOCPROMISC	_IO('B',105)
100 #define	BIOCGDLT	_IOR('B',106, u_int)
101 #define BIOCGETIF	_IOR('B',107, struct ifreq)
102 #define BIOCSETIF	_IOW('B',108, struct ifreq)
103 #define BIOCSRTIMEOUT	_IOW('B',109, struct timeval)
104 #define BIOCGRTIMEOUT	_IOR('B',110, struct timeval)
105 #define BIOCGSTATS	_IOR('B',111, struct bpf_stat)
106 #define BIOCIMMEDIATE	_IOW('B',112, u_int)
107 #define BIOCVERSION	_IOR('B',113, struct bpf_version)
108 #define BIOCGRSIG	_IOR('B',114, u_int)
109 #define BIOCSRSIG	_IOW('B',115, u_int)
110 #define BIOCGHDRCMPLT	_IOR('B',116, u_int)
111 #define BIOCSHDRCMPLT	_IOW('B',117, u_int)
112 #define BIOCGSEESENT	_IOR('B',118, u_int)
113 #define BIOCSSEESENT	_IOW('B',119, u_int)
114 #define	BIOCSDLT	_IOW('B',120, u_int)
115 #define	BIOCGDLTLIST	_IOWR('B',121, struct bpf_dltlist)
116 
117 /*
118  * Structure prepended to each packet.
119  */
120 struct bpf_hdr {
121 	struct timeval	bh_tstamp;	/* time stamp */
122 	bpf_u_int32	bh_caplen;	/* length of captured portion */
123 	bpf_u_int32	bh_datalen;	/* original length of packet */
124 	u_short		bh_hdrlen;	/* length of bpf header (this struct
125 					   plus alignment padding) */
126 };
127 /*
128  * Because the structure above is not a multiple of 4 bytes, some compilers
129  * will insist on inserting padding; hence, sizeof(struct bpf_hdr) won't work.
130  * Only the kernel needs to know about it; applications use bh_hdrlen.
131  */
132 #ifdef _KERNEL
133 #define	SIZEOF_BPF_HDR	(sizeof(struct bpf_hdr) <= 20 ? 18 : \
134     sizeof(struct bpf_hdr))
135 #endif
136 
137 /*
138  * Data-link level type codes.
139  */
140 #define DLT_NULL	0	/* BSD loopback encapsulation */
141 #define DLT_EN10MB	1	/* Ethernet (10Mb) */
142 #define DLT_EN3MB	2	/* Experimental Ethernet (3Mb) */
143 #define DLT_AX25	3	/* Amateur Radio AX.25 */
144 #define DLT_PRONET	4	/* Proteon ProNET Token Ring */
145 #define DLT_CHAOS	5	/* Chaos */
146 #define DLT_IEEE802	6	/* IEEE 802 Networks */
147 #define DLT_ARCNET	7	/* ARCNET */
148 #define DLT_SLIP	8	/* Serial Line IP */
149 #define DLT_PPP		9	/* Point-to-point Protocol */
150 #define DLT_FDDI	10	/* FDDI */
151 #define DLT_ATM_RFC1483	11	/* LLC/SNAP encapsulated atm */
152 #define DLT_RAW		12	/* raw IP */
153 
154 /*
155  * These are values from BSD/OS's "bpf.h".
156  * These are not the same as the values from the traditional libpcap
157  * "bpf.h"; however, these values shouldn't be generated by any
158  * OS other than BSD/OS, so the correct values to use here are the
159  * BSD/OS values.
160  *
161  * Platforms that have already assigned these values to other
162  * DLT_ codes, however, should give these codes the values
163  * from that platform, so that programs that use these codes will
164  * continue to compile - even though they won't correctly read
165  * files of these types.
166  */
167 #define DLT_SLIP_BSDOS	15	/* BSD/OS Serial Line IP */
168 #define DLT_PPP_BSDOS	16	/* BSD/OS Point-to-point Protocol */
169 
170 #define DLT_ATM_CLIP	19	/* Linux Classical-IP over ATM */
171 
172 /*
173  * These values are defined by NetBSD; other platforms should refrain from
174  * using them for other purposes, so that NetBSD savefiles with link
175  * types of 50 or 51 can be read as this type on all platforms.
176  */
177 #define DLT_PPP_SERIAL	50	/* PPP over serial with HDLC encapsulation */
178 #define DLT_PPP_ETHER	51	/* PPP over Ethernet */
179 
180 /*
181  * Reserved for the Symantec Enterprise Firewall.
182  */
183 #define DLT_SYMANTEC_FIREWALL	99
184 
185 
186 /*
187  * This value was defined by libpcap 0.5; platforms that have defined
188  * it with a different value should define it here with that value -
189  * a link type of 104 in a save file will be mapped to DLT_C_HDLC,
190  * whatever value that happens to be, so programs will correctly
191  * handle files with that link type regardless of the value of
192  * DLT_C_HDLC.
193  *
194  * The name DLT_C_HDLC was used by BSD/OS; we use that name for source
195  * compatibility with programs written for BSD/OS.
196  *
197  * libpcap 0.5 defined it as DLT_CHDLC; we define DLT_CHDLC as well,
198  * for source compatibility with programs written for libpcap 0.5.
199  */
200 #define DLT_C_HDLC	104	/* Cisco HDLC */
201 #define DLT_CHDLC	DLT_C_HDLC
202 
203 #define DLT_IEEE802_11	105	/* IEEE 802.11 wireless */
204 
205 /*
206  * Values between 106 and 107 are used in capture file headers as
207  * link-layer types corresponding to DLT_ types that might differ
208  * between platforms; don't use those values for new DLT_ new types.
209  */
210 
211 /*
212  * Frame Relay; BSD/OS has a DLT_FR with a value of 11, but that collides
213  * with other values.
214  * DLT_FR and DLT_FRELAY packets start with the Q.922 Frame Relay header
215  * (DLCI, etc.).
216  */
217 #define DLT_FRELAY	107
218 
219 /*
220  * OpenBSD DLT_LOOP, for loopback devices; it's like DLT_NULL, except
221  * that the AF_ type in the link-layer header is in network byte order.
222  *
223  * OpenBSD defines it as 12, but that collides with DLT_RAW, so we
224  * define it as 108 here.  If OpenBSD picks up this file, it should
225  * define DLT_LOOP as 12 in its version, as per the comment above -
226  * and should not use 108 as a DLT_ value.
227  */
228 #define DLT_LOOP	108
229 
230 /*
231  * Values between 109 and 112 are used in capture file headers as
232  * link-layer types corresponding to DLT_ types that might differ
233  * between platforms; don't use those values for new DLT_ new types.
234  */
235 
236 /*
237  * Encapsulated packets for IPsec; DLT_ENC is 13 in OpenBSD, but that's
238  * DLT_SLIP_BSDOS in NetBSD, so we don't use 13 for it in OSes other
239  * than OpenBSD.
240  */
241 #define DLT_ENC	109
242 
243 /*
244  * This is for Linux cooked sockets.
245  */
246 #define DLT_LINUX_SLL	113
247 
248 /*
249  * Apple LocalTalk hardware.
250  */
251 #define DLT_LTALK	114
252 
253 /*
254  * Acorn Econet.
255  */
256 #define DLT_ECONET	115
257 
258 /*
259  * Reserved for use with OpenBSD ipfilter.
260  */
261 #define DLT_IPFILTER	116
262 
263 /*
264  * Reserved for use in capture-file headers as a link-layer type
265  * corresponding to OpenBSD DLT_PFLOG; DLT_PFLOG is 17 in OpenBSD,
266  * but that's DLT_LANE8023 in SuSE 6.3, so we can't use 17 for it
267  * in capture-file headers.
268  */
269 #define DLT_PFLOG	117
270 
271 /*
272  * Registered for Cisco-internal use.
273  */
274 #define DLT_CISCO_IOS	118
275 
276 /*
277  * Reserved for 802.11 cards using the Prism II chips, with a link-layer
278  * header including Prism monitor mode information plus an 802.11
279  * header.
280  */
281 #define DLT_PRISM_HEADER	119
282 
283 /*
284  * Reserved for Aironet 802.11 cards, with an Aironet link-layer header
285  * (see Doug Ambrisko's FreeBSD patches).
286  */
287 #define DLT_AIRONET_HEADER	120
288 
289 /*
290  * Reserved for use by OpenBSD's pfsync device.
291  */
292 #define DLT_PFSYNC	121
293 
294 /*
295  * Reserved for Siemens HiPath HDLC. XXX
296  */
297 #define DLT_HHDLC	121
298 
299 /*
300  * Reserved for RFC 2625 IP-over-Fibre Channel.
301  */
302 #define DLT_IP_OVER_FC	122
303 
304 /*
305  * Reserved for Full Frontal ATM on Solaris.
306  */
307 #define DLT_SUNATM	123
308 
309 /*
310  * Reserved as per request from Kent Dahlgren <kent@praesum.com>
311  * for private use.
312  */
313 #define DLT_RIO		124	/* RapidIO */
314 #define DLT_PCI_EXP	125	/* PCI Express */
315 #define DLT_AURORA	126	/* Xilinx Aurora link layer */
316 
317 /*
318  * BSD header for 802.11 plus a number of bits of link-layer information
319  * including radio information.
320  */
321 #ifndef DLT_IEEE802_11_RADIO
322 #define DLT_IEEE802_11_RADIO	127
323 #endif
324 
325 /*
326  * Reserved for TZSP encapsulation.
327  */
328 #define DLT_TZSP		128	/* Tazmen Sniffer Protocol */
329 
330 /*
331  * Reserved for Linux ARCNET.
332  */
333 #define DLT_ARCNET_LINUX	129
334 
335 /*
336  * Juniper-private data link types.
337  */
338 #define DLT_JUNIPER_MLPPP	130
339 #define DLT_JUNIPER_MLFR	131
340 #define DLT_JUNIPER_ES		132
341 #define DLT_JUNIPER_GGSN	133
342 #define DLT_JUNIPER_MFR		134
343 #define DLT_JUNIPER_ATM2	135
344 #define DLT_JUNIPER_SERVICES	136
345 #define DLT_JUNIPER_ATM1	137
346 
347 /*
348  * Reserved for Apple IP-over-IEEE-1394.
349  */
350 #define DLT_APPLE_IP_OVER_IEEE1394	138
351 
352 /*
353  * Reserved for DOCSIS.
354  */
355 #define DLT_DOCSIS	143
356 
357 /*
358  * Reserved for Linux IrDA.
359  */
360 #define DLT_LINUX_IRDA	144
361 
362 /*
363  * Reserved for IBM SP switch and IBM Next Federation switch.
364  */
365 #define DLT_IBM_SP	145
366 #define DLT_IBM_SN	146
367 
368 /*
369  * Reserved for AbsoluteValue Systems 802.11 capture.
370  */
371 #define DLT_IEEE802_11_RADIO_AVS	163
372 
373 /*
374  * Reserved for Juniper-private DLT.
375  */
376 #define DLT_JUNIPER_MONITOR	164
377 
378 /*
379  * The instruction encodings.
380  */
381 /* instruction classes */
382 #define BPF_CLASS(code) ((code) & 0x07)
383 #define		BPF_LD		0x00
384 #define		BPF_LDX		0x01
385 #define		BPF_ST		0x02
386 #define		BPF_STX		0x03
387 #define		BPF_ALU		0x04
388 #define		BPF_JMP		0x05
389 #define		BPF_RET		0x06
390 #define		BPF_MISC	0x07
391 
392 /* ld/ldx fields */
393 #define BPF_SIZE(code)	((code) & 0x18)
394 #define		BPF_W		0x00
395 #define		BPF_H		0x08
396 #define		BPF_B		0x10
397 #define BPF_MODE(code)	((code) & 0xe0)
398 #define		BPF_IMM 	0x00
399 #define		BPF_ABS		0x20
400 #define		BPF_IND		0x40
401 #define		BPF_MEM		0x60
402 #define		BPF_LEN		0x80
403 #define		BPF_MSH		0xa0
404 
405 /* alu/jmp fields */
406 #define BPF_OP(code)	((code) & 0xf0)
407 #define		BPF_ADD		0x00
408 #define		BPF_SUB		0x10
409 #define		BPF_MUL		0x20
410 #define		BPF_DIV		0x30
411 #define		BPF_OR		0x40
412 #define		BPF_AND		0x50
413 #define		BPF_LSH		0x60
414 #define		BPF_RSH		0x70
415 #define		BPF_NEG		0x80
416 #define		BPF_JA		0x00
417 #define		BPF_JEQ		0x10
418 #define		BPF_JGT		0x20
419 #define		BPF_JGE		0x30
420 #define		BPF_JSET	0x40
421 #define BPF_SRC(code)	((code) & 0x08)
422 #define		BPF_K		0x00
423 #define		BPF_X		0x08
424 
425 /* ret - BPF_K and BPF_X also apply */
426 #define BPF_RVAL(code)	((code) & 0x18)
427 #define		BPF_A		0x10
428 
429 /* misc */
430 #define BPF_MISCOP(code) ((code) & 0xf8)
431 #define		BPF_TAX		0x00
432 #define		BPF_TXA		0x80
433 
434 /*
435  * The instruction data structure.
436  */
437 struct bpf_insn {
438 	u_short		code;
439 	u_char		jt;
440 	u_char		jf;
441 	bpf_u_int32	k;
442 };
443 
444 /*
445  * Macros for insn array initializers.
446  */
447 #define BPF_STMT(code, k) { (u_short)(code), 0, 0, k }
448 #define BPF_JUMP(code, k, jt, jf) { (u_short)(code), jt, jf, k }
449 
450 /*
451  * Structure to retrieve available DLTs for the interface.
452  */
453 struct bpf_dltlist {
454 	u_int	bfl_len;	/* number of bfd_list array */
455 	u_int	*bfl_list;	/* array of DLTs */
456 };
457 
458 #ifdef _KERNEL
459 struct bpf_if;
460 int	 bpf_validate(const struct bpf_insn *, int);
461 void	 bpf_tap(struct bpf_if *, u_char *, u_int);
462 void	 bpf_mtap(struct bpf_if *, struct mbuf *);
463 void	 bpf_mtap2(struct bpf_if *, void *, u_int, struct mbuf *);
464 void	 bpfattach(struct ifnet *, u_int, u_int);
465 void	 bpfattach2(struct ifnet *, u_int, u_int, struct bpf_if **);
466 void	 bpfdetach(struct ifnet *);
467 
468 void	 bpfilterattach(int);
469 u_int	 bpf_filter(const struct bpf_insn *, u_char *, u_int, u_int);
470 
471 #define	BPF_TAP(_ifp,_pkt,_pktlen) do {				\
472 	if ((_ifp)->if_bpf)					\
473 		bpf_tap((_ifp)->if_bpf, (_pkt), (_pktlen));	\
474 } while (0)
475 #define	BPF_MTAP(_ifp,_m) do {					\
476 	if ((_ifp)->if_bpf) {					\
477 		M_ASSERTVALID(_m);				\
478 		bpf_mtap((_ifp)->if_bpf, (_m));			\
479 	}							\
480 } while (0)
481 #define	BPF_MTAP2(_ifp,_data,_dlen,_m) do {			\
482 	if ((_ifp)->if_bpf) {					\
483 		M_ASSERTVALID(_m);				\
484 		bpf_mtap2((_ifp)->if_bpf,(_data),(_dlen),(_m));	\
485 	}							\
486 } while (0)
487 #endif
488 
489 /*
490  * Number of scratch memory words (for BPF_LD|BPF_MEM and BPF_ST).
491  */
492 #define BPF_MEMWORDS 16
493 
494 #endif /* _NET_BPF_H_ */
495