1*0a0e9771SDarren Reed /* $NetBSD: bpf.h,v 1.50 2009/01/13 19:10:52 christos Exp $ */ 2*0a0e9771SDarren Reed 3*0a0e9771SDarren Reed /* 4*0a0e9771SDarren Reed * Copyright (c) 1990, 1991, 1993 5*0a0e9771SDarren Reed * The Regents of the University of California. All rights reserved. 6*0a0e9771SDarren Reed * 7*0a0e9771SDarren Reed * This code is derived from the Stanford/CMU enet packet filter, 8*0a0e9771SDarren Reed * (net/enet.c) distributed as part of 4.3BSD, and code contributed 9*0a0e9771SDarren Reed * to Berkeley by Steven McCanne and Van Jacobson both of Lawrence 10*0a0e9771SDarren Reed * Berkeley Laboratory. 11*0a0e9771SDarren Reed * 12*0a0e9771SDarren Reed * Redistribution and use in source and binary forms, with or without 13*0a0e9771SDarren Reed * modification, are permitted provided that the following conditions 14*0a0e9771SDarren Reed * are met: 15*0a0e9771SDarren Reed * 1. Redistributions of source code must retain the above copyright 16*0a0e9771SDarren Reed * notice, this list of conditions and the following disclaimer. 17*0a0e9771SDarren Reed * 2. Redistributions in binary form must reproduce the above copyright 18*0a0e9771SDarren Reed * notice, this list of conditions and the following disclaimer in the 19*0a0e9771SDarren Reed * documentation and/or other materials provided with the distribution. 20*0a0e9771SDarren Reed * 3. Neither the name of the University nor the names of its contributors 21*0a0e9771SDarren Reed * may be used to endorse or promote products derived from this software 22*0a0e9771SDarren Reed * without specific prior written permission. 23*0a0e9771SDarren Reed * 24*0a0e9771SDarren Reed * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 25*0a0e9771SDarren Reed * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 26*0a0e9771SDarren Reed * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 27*0a0e9771SDarren Reed * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 28*0a0e9771SDarren Reed * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 29*0a0e9771SDarren Reed * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 30*0a0e9771SDarren Reed * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 31*0a0e9771SDarren Reed * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 32*0a0e9771SDarren Reed * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 33*0a0e9771SDarren Reed * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 34*0a0e9771SDarren Reed * SUCH DAMAGE. 35*0a0e9771SDarren Reed * 36*0a0e9771SDarren Reed * @(#)bpf.h 8.2 (Berkeley) 1/9/95 37*0a0e9771SDarren Reed * @(#) Header: bpf.h,v 1.36 97/06/12 14:29:53 leres Exp (LBL) 38*0a0e9771SDarren Reed */ 39*0a0e9771SDarren Reed /* 40*0a0e9771SDarren Reed * Copyright 2009 Sun Microsystems, Inc. All rights reserved. 41*0a0e9771SDarren Reed * Use is subject to license terms. 42*0a0e9771SDarren Reed */ 43*0a0e9771SDarren Reed 44*0a0e9771SDarren Reed #ifndef _NET_BPF_H_ 45*0a0e9771SDarren Reed #define _NET_BPF_H_ 46*0a0e9771SDarren Reed 47*0a0e9771SDarren Reed #include <sys/time.h> 48*0a0e9771SDarren Reed #include <sys/types32.h> 49*0a0e9771SDarren Reed #include <sys/ioccom.h> 50*0a0e9771SDarren Reed 51*0a0e9771SDarren Reed /* BSD style release date */ 52*0a0e9771SDarren Reed #define BPF_RELEASE 199606 53*0a0e9771SDarren Reed 54*0a0e9771SDarren Reed typedef int bpf_int32; 55*0a0e9771SDarren Reed typedef uint_t bpf_uint_t32; 56*0a0e9771SDarren Reed typedef uint_t bpf_u_int32; 57*0a0e9771SDarren Reed 58*0a0e9771SDarren Reed /* 59*0a0e9771SDarren Reed * Alignment macros. BPF_WORDALIGN rounds up to the next 60*0a0e9771SDarren Reed * even multiple of BPF_ALIGNMENT. 61*0a0e9771SDarren Reed */ 62*0a0e9771SDarren Reed #define BPF_ALIGNMENT sizeof (uint32_t) 63*0a0e9771SDarren Reed #define BPF_WORDALIGN(x) (((x)+(BPF_ALIGNMENT-1))&~(BPF_ALIGNMENT-1)) 64*0a0e9771SDarren Reed 65*0a0e9771SDarren Reed #define BPF_MAXINSNS 512 66*0a0e9771SDarren Reed #define BPF_DFLTBUFSIZE (1024*1024) /* default static upper limit */ 67*0a0e9771SDarren Reed #define BPF_MAXBUFSIZE (1024*1024*16) /* hard limit on sysctl'able value */ 68*0a0e9771SDarren Reed #define BPF_MINBUFSIZE 32 69*0a0e9771SDarren Reed 70*0a0e9771SDarren Reed /* 71*0a0e9771SDarren Reed * Structure for BIOCSETF. 72*0a0e9771SDarren Reed */ 73*0a0e9771SDarren Reed struct bpf_program { 74*0a0e9771SDarren Reed uint_t bf_len; 75*0a0e9771SDarren Reed struct bpf_insn *bf_insns; 76*0a0e9771SDarren Reed }; 77*0a0e9771SDarren Reed struct bpf_program32 { 78*0a0e9771SDarren Reed uint_t bf_len; 79*0a0e9771SDarren Reed caddr32_t bf_insns; 80*0a0e9771SDarren Reed }; 81*0a0e9771SDarren Reed 82*0a0e9771SDarren Reed /* 83*0a0e9771SDarren Reed * Struct returned by BIOCGSTATS and net.bpf.stats sysctl. 84*0a0e9771SDarren Reed */ 85*0a0e9771SDarren Reed struct bpf_stat { 86*0a0e9771SDarren Reed uint64_t bs_recv; /* number of packets received */ 87*0a0e9771SDarren Reed uint64_t bs_drop; /* number of packets dropped */ 88*0a0e9771SDarren Reed uint64_t bs_capt; /* number of packets captured */ 89*0a0e9771SDarren Reed uint64_t bs_padding[13]; 90*0a0e9771SDarren Reed }; 91*0a0e9771SDarren Reed 92*0a0e9771SDarren Reed /* 93*0a0e9771SDarren Reed * Struct returned by BIOCGSTATSOLD. 94*0a0e9771SDarren Reed */ 95*0a0e9771SDarren Reed struct bpf_stat_old { 96*0a0e9771SDarren Reed uint_t bs_recv; /* number of packets received */ 97*0a0e9771SDarren Reed uint_t bs_drop; /* number of packets dropped */ 98*0a0e9771SDarren Reed }; 99*0a0e9771SDarren Reed 100*0a0e9771SDarren Reed /* 101*0a0e9771SDarren Reed * Struct return by BIOCVERSION. This represents the version number of 102*0a0e9771SDarren Reed * the filter language described by the instruction encodings below. 103*0a0e9771SDarren Reed * bpf understands a program iff kernel_major == filter_major && 104*0a0e9771SDarren Reed * kernel_minor >= filter_minor, that is, if the value returned by the 105*0a0e9771SDarren Reed * running kernel has the same major number and a minor number equal 106*0a0e9771SDarren Reed * equal to or less than the filter being downloaded. Otherwise, the 107*0a0e9771SDarren Reed * results are undefined, meaning an error may be returned or packets 108*0a0e9771SDarren Reed * may be accepted haphazardly. 109*0a0e9771SDarren Reed * It has nothing to do with the source code version. 110*0a0e9771SDarren Reed */ 111*0a0e9771SDarren Reed struct bpf_version { 112*0a0e9771SDarren Reed ushort_t bv_major; 113*0a0e9771SDarren Reed ushort_t bv_minor; 114*0a0e9771SDarren Reed }; 115*0a0e9771SDarren Reed /* Current version number of filter architecture. */ 116*0a0e9771SDarren Reed #define BPF_MAJOR_VERSION 1 117*0a0e9771SDarren Reed #define BPF_MINOR_VERSION 1 118*0a0e9771SDarren Reed 119*0a0e9771SDarren Reed /* 120*0a0e9771SDarren Reed * BPF ioctls 121*0a0e9771SDarren Reed * 122*0a0e9771SDarren Reed * The first set is for compatibility with Sun's pcc style 123*0a0e9771SDarren Reed * header files. If your using gcc, we assume that you 124*0a0e9771SDarren Reed * have run fixincludes so the latter set should work. 125*0a0e9771SDarren Reed */ 126*0a0e9771SDarren Reed #define BIOCGBLEN _IOR('B', 102, uint_t) 127*0a0e9771SDarren Reed #define BIOCSBLEN _IOWR('B', 102, uint_t) 128*0a0e9771SDarren Reed #define BIOCSETF _IOW('B', 103, struct bpf_program) 129*0a0e9771SDarren Reed #define BIOCFLUSH _IO('B', 104) 130*0a0e9771SDarren Reed #define BIOCPROMISC _IO('B', 105) 131*0a0e9771SDarren Reed #define BIOCGDLT _IOR('B', 106, uint_t) 132*0a0e9771SDarren Reed #define BIOCGETIF _IOR('B', 107, struct ifreq) 133*0a0e9771SDarren Reed #define BIOCGETLIF _IOR('B', 107, struct lifreq) 134*0a0e9771SDarren Reed #define BIOCSETIF _IOW('B', 108, struct ifreq) 135*0a0e9771SDarren Reed #define BIOCSETLIF _IOW('B', 108, struct lifreq) 136*0a0e9771SDarren Reed #define BIOCGSTATS _IOR('B', 111, struct bpf_stat) 137*0a0e9771SDarren Reed #define BIOCGSTATSOLD _IOR('B', 111, struct bpf_stat_old) 138*0a0e9771SDarren Reed #define BIOCIMMEDIATE _IOW('B', 112, uint_t) 139*0a0e9771SDarren Reed #define BIOCVERSION _IOR('B', 113, struct bpf_version) 140*0a0e9771SDarren Reed #define BIOCSTCPF _IOW('B', 114, struct bpf_program) 141*0a0e9771SDarren Reed #define BIOCSUDPF _IOW('B', 115, struct bpf_program) 142*0a0e9771SDarren Reed #define BIOCGHDRCMPLT _IOR('B', 116, uint_t) 143*0a0e9771SDarren Reed #define BIOCSHDRCMPLT _IOW('B', 117, uint_t) 144*0a0e9771SDarren Reed #define BIOCSDLT _IOW('B', 118, uint_t) 145*0a0e9771SDarren Reed #define BIOCGDLTLIST _IOWR('B', 119, struct bpf_dltlist) 146*0a0e9771SDarren Reed #define BIOCGSEESENT _IOR('B', 120, uint_t) 147*0a0e9771SDarren Reed #define BIOCSSEESENT _IOW('B', 121, uint_t) 148*0a0e9771SDarren Reed #define BIOCSRTIMEOUT _IOW('B', 122, struct timeval) 149*0a0e9771SDarren Reed #define BIOCGRTIMEOUT _IOR('B', 123, struct timeval) 150*0a0e9771SDarren Reed /* 151*0a0e9771SDarren Reed */ 152*0a0e9771SDarren Reed #define BIOCSETF32 _IOW('B', 103, struct bpf_program32) 153*0a0e9771SDarren Reed #define BIOCGDLTLIST32 _IOWR('B', 119, struct bpf_dltlist32) 154*0a0e9771SDarren Reed #define BIOCSRTIMEOUT32 _IOW('B', 122, struct timeval32) 155*0a0e9771SDarren Reed #define BIOCGRTIMEOUT32 _IOR('B', 123, struct timeval32) 156*0a0e9771SDarren Reed 157*0a0e9771SDarren Reed /* 158*0a0e9771SDarren Reed * Structure prepended to each packet. This is "wire" format, so we 159*0a0e9771SDarren Reed * cannot change it unfortunately to 64 bit times on 32 bit systems [yet]. 160*0a0e9771SDarren Reed */ 161*0a0e9771SDarren Reed struct bpf_timeval { 162*0a0e9771SDarren Reed int32_t tv_sec; 163*0a0e9771SDarren Reed int32_t tv_usec; 164*0a0e9771SDarren Reed }; 165*0a0e9771SDarren Reed 166*0a0e9771SDarren Reed struct bpf_hdr { 167*0a0e9771SDarren Reed struct bpf_timeval bh_tstamp; /* time stamp */ 168*0a0e9771SDarren Reed uint32_t bh_caplen; /* length of captured portion */ 169*0a0e9771SDarren Reed uint32_t bh_datalen; /* original length of packet */ 170*0a0e9771SDarren Reed uint16_t bh_hdrlen; /* length of bpf header (this struct */ 171*0a0e9771SDarren Reed /* plus alignment padding) */ 172*0a0e9771SDarren Reed }; 173*0a0e9771SDarren Reed /* 174*0a0e9771SDarren Reed * Because the structure above is not a multiple of 4 bytes, some compilers 175*0a0e9771SDarren Reed * will insist on inserting padding; hence, sizeof(struct bpf_hdr) won't work. 176*0a0e9771SDarren Reed * Only the kernel needs to know about it; applications use bh_hdrlen. 177*0a0e9771SDarren Reed * XXX To save a few bytes on 32-bit machines, we avoid end-of-struct 178*0a0e9771SDarren Reed * XXX padding by using the size of the header data elements. This is 179*0a0e9771SDarren Reed * XXX fail-safe: on new machines, we just use the 'safe' sizeof. 180*0a0e9771SDarren Reed */ 181*0a0e9771SDarren Reed #ifdef _KERNEL 182*0a0e9771SDarren Reed #if defined(__arm32__) || defined(__i386__) || defined(__m68k__) || \ 183*0a0e9771SDarren Reed defined(__mips__) || defined(__ns32k__) || defined(__vax__) || \ 184*0a0e9771SDarren Reed defined(__sh__) || (defined(__sparc__) && !defined(__sparc64__)) 185*0a0e9771SDarren Reed #define SIZEOF_BPF_HDR 18 186*0a0e9771SDarren Reed #else 187*0a0e9771SDarren Reed #define SIZEOF_BPF_HDR sizeof (struct bpf_hdr) 188*0a0e9771SDarren Reed #endif 189*0a0e9771SDarren Reed #endif 190*0a0e9771SDarren Reed 191*0a0e9771SDarren Reed /* Pull in data-link level type codes. */ 192*0a0e9771SDarren Reed #include <net/dlt.h> 193*0a0e9771SDarren Reed 194*0a0e9771SDarren Reed /* 195*0a0e9771SDarren Reed * The instruction encodings. 196*0a0e9771SDarren Reed */ 197*0a0e9771SDarren Reed /* instruction classes */ 198*0a0e9771SDarren Reed #define BPF_CLASS(code) ((code) & 0x07) 199*0a0e9771SDarren Reed #define BPF_LD 0x00 200*0a0e9771SDarren Reed #define BPF_LDX 0x01 201*0a0e9771SDarren Reed #define BPF_ST 0x02 202*0a0e9771SDarren Reed #define BPF_STX 0x03 203*0a0e9771SDarren Reed #define BPF_ALU 0x04 204*0a0e9771SDarren Reed #define BPF_JMP 0x05 205*0a0e9771SDarren Reed #define BPF_RET 0x06 206*0a0e9771SDarren Reed #define BPF_MISC 0x07 207*0a0e9771SDarren Reed 208*0a0e9771SDarren Reed /* ld/ldx fields */ 209*0a0e9771SDarren Reed #define BPF_SIZE(code) ((code) & 0x18) 210*0a0e9771SDarren Reed #define BPF_W 0x00 211*0a0e9771SDarren Reed #define BPF_H 0x08 212*0a0e9771SDarren Reed #define BPF_B 0x10 213*0a0e9771SDarren Reed #define BPF_MODE(code) ((code) & 0xe0) 214*0a0e9771SDarren Reed #define BPF_IMM 0x00 215*0a0e9771SDarren Reed #define BPF_ABS 0x20 216*0a0e9771SDarren Reed #define BPF_IND 0x40 217*0a0e9771SDarren Reed #define BPF_MEM 0x60 218*0a0e9771SDarren Reed #define BPF_LEN 0x80 219*0a0e9771SDarren Reed #define BPF_MSH 0xa0 220*0a0e9771SDarren Reed 221*0a0e9771SDarren Reed /* alu/jmp fields */ 222*0a0e9771SDarren Reed #define BPF_OP(code) ((code) & 0xf0) 223*0a0e9771SDarren Reed #define BPF_ADD 0x00 224*0a0e9771SDarren Reed #define BPF_SUB 0x10 225*0a0e9771SDarren Reed #define BPF_MUL 0x20 226*0a0e9771SDarren Reed #define BPF_DIV 0x30 227*0a0e9771SDarren Reed #define BPF_OR 0x40 228*0a0e9771SDarren Reed #define BPF_AND 0x50 229*0a0e9771SDarren Reed #define BPF_LSH 0x60 230*0a0e9771SDarren Reed #define BPF_RSH 0x70 231*0a0e9771SDarren Reed #define BPF_NEG 0x80 232*0a0e9771SDarren Reed #define BPF_JA 0x00 233*0a0e9771SDarren Reed #define BPF_JEQ 0x10 234*0a0e9771SDarren Reed #define BPF_JGT 0x20 235*0a0e9771SDarren Reed #define BPF_JGE 0x30 236*0a0e9771SDarren Reed #define BPF_JSET 0x40 237*0a0e9771SDarren Reed #define BPF_SRC(code) ((code) & 0x08) 238*0a0e9771SDarren Reed #define BPF_K 0x00 239*0a0e9771SDarren Reed #define BPF_X 0x08 240*0a0e9771SDarren Reed 241*0a0e9771SDarren Reed /* ret - BPF_K and BPF_X also apply */ 242*0a0e9771SDarren Reed #define BPF_RVAL(code) ((code) & 0x18) 243*0a0e9771SDarren Reed #define BPF_A 0x10 244*0a0e9771SDarren Reed 245*0a0e9771SDarren Reed /* misc */ 246*0a0e9771SDarren Reed #define BPF_MISCOP(code) ((code) & 0xf8) 247*0a0e9771SDarren Reed #define BPF_TAX 0x00 248*0a0e9771SDarren Reed #define BPF_TXA 0x80 249*0a0e9771SDarren Reed 250*0a0e9771SDarren Reed /* 251*0a0e9771SDarren Reed * The instruction data structure. 252*0a0e9771SDarren Reed */ 253*0a0e9771SDarren Reed struct bpf_insn { 254*0a0e9771SDarren Reed uint16_t code; 255*0a0e9771SDarren Reed uint8_t jt; 256*0a0e9771SDarren Reed uint8_t jf; 257*0a0e9771SDarren Reed uint32_t k; 258*0a0e9771SDarren Reed }; 259*0a0e9771SDarren Reed 260*0a0e9771SDarren Reed /* 261*0a0e9771SDarren Reed * Macros for insn array initializers. 262*0a0e9771SDarren Reed */ 263*0a0e9771SDarren Reed #define BPF_STMT(code, k) { (uint16_t)(code), 0, 0, k } 264*0a0e9771SDarren Reed #define BPF_JUMP(code, k, jt, jf) { (uint16_t)(code), jt, jf, k } 265*0a0e9771SDarren Reed 266*0a0e9771SDarren Reed /* 267*0a0e9771SDarren Reed * Structure to retrieve available DLTs for the interface. 268*0a0e9771SDarren Reed */ 269*0a0e9771SDarren Reed struct bpf_dltlist { 270*0a0e9771SDarren Reed uint_t bfl_len; /* number of bfd_list array */ 271*0a0e9771SDarren Reed uint_t *bfl_list; /* array of DLTs */ 272*0a0e9771SDarren Reed }; 273*0a0e9771SDarren Reed struct bpf_dltlist32 { 274*0a0e9771SDarren Reed uint_t bfl_len; 275*0a0e9771SDarren Reed caddr32_t bfl_list; 276*0a0e9771SDarren Reed }; 277*0a0e9771SDarren Reed 278*0a0e9771SDarren Reed #ifdef _KERNEL 279*0a0e9771SDarren Reed #include <sys/mac.h> 280*0a0e9771SDarren Reed #include <sys/dls_impl.h> 281*0a0e9771SDarren Reed 282*0a0e9771SDarren Reed typedef void (*bpf_itap_fn_t)(void *, mblk_t *, boolean_t, uint_t); 283*0a0e9771SDarren Reed 284*0a0e9771SDarren Reed extern void bpfattach(uintptr_t, int, zoneid_t, int); 285*0a0e9771SDarren Reed extern void bpfdetach(uintptr_t); 286*0a0e9771SDarren Reed extern uint_t bpf_filter(struct bpf_insn *, uchar_t *, uint_t, uint_t); 287*0a0e9771SDarren Reed extern void bpf_itap(void *, mblk_t *, boolean_t, uint_t); 288*0a0e9771SDarren Reed extern void bpf_mtap(void *, mac_resource_handle_t, mblk_t *, boolean_t); 289*0a0e9771SDarren Reed extern int bpf_validate(struct bpf_insn *, int); 290*0a0e9771SDarren Reed 291*0a0e9771SDarren Reed #endif /* _KERNEL */ 292*0a0e9771SDarren Reed 293*0a0e9771SDarren Reed /* 294*0a0e9771SDarren Reed * Number of scratch memory words (for BPF_LD|BPF_MEM and BPF_ST). 295*0a0e9771SDarren Reed */ 296*0a0e9771SDarren Reed #define BPF_MEMWORDS 16 297*0a0e9771SDarren Reed 298*0a0e9771SDarren Reed #endif /* !_NET_BPF_H_ */ 299