| /*- |
| * Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997 |
| * The Regents of the University of California. All rights reserved. |
| * |
| * This code is derived from the Stanford/CMU enet packet filter, |
| * (net/enet.c) distributed as part of 4.3BSD, and code contributed |
| * to Berkeley by Steven McCanne and Van Jacobson both of Lawrence |
| * Berkeley Laboratory. |
| * |
| * Redistribution and use in source and binary forms, with or without |
| * modification, are permitted provided that the following conditions |
| * are met: |
| * 1. Redistributions of source code must retain the above copyright |
| * notice, this list of conditions and the following disclaimer. |
| * 2. Redistributions in binary form must reproduce the above copyright |
| * notice, this list of conditions and the following disclaimer in the |
| * documentation and/or other materials provided with the distribution. |
| * 3. All advertising materials mentioning features or use of this software |
| * must display the following acknowledgement: |
| * This product includes software developed by the University of |
| * California, Berkeley and its contributors. |
| * 4. Neither the name of the University nor the names of its contributors |
| * may be used to endorse or promote products derived from this software |
| * without specific prior written permission. |
| * |
| * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND |
| * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
| * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE |
| * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE |
| * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL |
| * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS |
| * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
| * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT |
| * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY |
| * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF |
| * SUCH DAMAGE. |
| * |
| * @(#)bpf.h 7.1 (Berkeley) 5/7/91 |
| * |
| * @(#) $Header$ (LBL) |
| */ |
| |
| #ifndef BPF_MAJOR_VERSION |
| |
| #ifdef __cplusplus |
| extern "C" { |
| #endif |
| |
| /* BSD style release date */ |
| #define BPF_RELEASE 199606 |
| |
| typedef int bpf_int32; |
| typedef u_int bpf_u_int32; |
| |
| /* |
| * Alignment macros. BPF_WORDALIGN rounds up to the next |
| * even multiple of BPF_ALIGNMENT. |
| */ |
| #ifndef __NetBSD__ |
| #define BPF_ALIGNMENT sizeof(bpf_int32) |
| #else |
| #define BPF_ALIGNMENT sizeof(long) |
| #endif |
| #define BPF_WORDALIGN(x) (((x)+(BPF_ALIGNMENT-1))&~(BPF_ALIGNMENT-1)) |
| |
| #define BPF_MAXINSNS 512 |
| #define BPF_MAXBUFSIZE 0x8000 |
| #define BPF_MINBUFSIZE 32 |
| |
| /* |
| * Structure for BIOCSETF. |
| */ |
| struct bpf_program { |
| u_int bf_len; |
| struct bpf_insn *bf_insns; |
| }; |
| |
| /* |
| * Struct returned by BIOCGSTATS. |
| */ |
| struct bpf_stat { |
| u_int bs_recv; /* number of packets received */ |
| u_int bs_drop; /* number of packets dropped */ |
| }; |
| |
| /* |
| * Struct return by BIOCVERSION. This represents the version number of |
| * the filter language described by the instruction encodings below. |
| * bpf understands a program iff kernel_major == filter_major && |
| * kernel_minor >= filter_minor, that is, if the value returned by the |
| * running kernel has the same major number and a minor number equal |
| * equal to or less than the filter being downloaded. Otherwise, the |
| * results are undefined, meaning an error may be returned or packets |
| * may be accepted haphazardly. |
| * It has nothing to do with the source code version. |
| */ |
| struct bpf_version { |
| u_short bv_major; |
| u_short bv_minor; |
| }; |
| /* Current version number of filter architecture. */ |
| #define BPF_MAJOR_VERSION 1 |
| #define BPF_MINOR_VERSION 1 |
| |
| /* |
| * BPF ioctls |
| * |
| * The first set is for compatibility with Sun's pcc style |
| * header files. If your using gcc, we assume that you |
| * have run fixincludes so the latter set should work. |
| */ |
| #if (defined(sun) || defined(ibm032)) && !defined(__GNUC__) |
| #define BIOCGBLEN _IOR(B,102, u_int) |
| #define BIOCSBLEN _IOWR(B,102, u_int) |
| #define BIOCSETF _IOW(B,103, struct bpf_program) |
| #define BIOCFLUSH _IO(B,104) |
| #define BIOCPROMISC _IO(B,105) |
| #define BIOCGDLT _IOR(B,106, u_int) |
| #define BIOCGETIF _IOR(B,107, struct ifreq) |
| #define BIOCSETIF _IOW(B,108, struct ifreq) |
| #define BIOCSRTIMEOUT _IOW(B,109, struct timeval) |
| #define BIOCGRTIMEOUT _IOR(B,110, struct timeval) |
| #define BIOCGSTATS _IOR(B,111, struct bpf_stat) |
| #define BIOCIMMEDIATE _IOW(B,112, u_int) |
| #define BIOCVERSION _IOR(B,113, struct bpf_version) |
| #define BIOCSTCPF _IOW(B,114, struct bpf_program) |
| #define BIOCSUDPF _IOW(B,115, struct bpf_program) |
| #else |
| #define BIOCGBLEN _IOR('B',102, u_int) |
| #define BIOCSBLEN _IOWR('B',102, u_int) |
| #define BIOCSETF _IOW('B',103, struct bpf_program) |
| #define BIOCFLUSH _IO('B',104) |
| #define BIOCPROMISC _IO('B',105) |
| #define BIOCGDLT _IOR('B',106, u_int) |
| #define BIOCGETIF _IOR('B',107, struct ifreq) |
| #define BIOCSETIF _IOW('B',108, struct ifreq) |
| #define BIOCSRTIMEOUT _IOW('B',109, struct timeval) |
| #define BIOCGRTIMEOUT _IOR('B',110, struct timeval) |
| #define BIOCGSTATS _IOR('B',111, struct bpf_stat) |
| #define BIOCIMMEDIATE _IOW('B',112, u_int) |
| #define BIOCVERSION _IOR('B',113, struct bpf_version) |
| #define BIOCSTCPF _IOW('B',114, struct bpf_program) |
| #define BIOCSUDPF _IOW('B',115, struct bpf_program) |
| #endif |
| |
| /* |
| * Structure prepended to each packet. |
| */ |
| struct bpf_hdr { |
| struct timeval bh_tstamp; /* time stamp */ |
| bpf_u_int32 bh_caplen; /* length of captured portion */ |
| bpf_u_int32 bh_datalen; /* original length of packet */ |
| u_short bh_hdrlen; /* length of bpf header (this struct |
| plus alignment padding) */ |
| }; |
| /* |
| * Because the structure above is not a multiple of 4 bytes, some compilers |
| * will insist on inserting padding; hence, sizeof(struct bpf_hdr) won't work. |
| * Only the kernel needs to know about it; applications use bh_hdrlen. |
| */ |
| #if defined(KERNEL) || defined(_KERNEL) |
| #define SIZEOF_BPF_HDR 18 |
| #endif |
| |
| /* |
| * Data-link level type codes. |
| */ |
| |
| /* |
| * These are the types that are the same on all platforms; on other |
| * platforms, a <net/bpf.h> should be supplied that defines the additional |
| * DLT_* codes appropriately for that platform (the BSDs, for example, |
| * should not just pick up this version of "bpf.h"; they should also define |
| * the additional DLT_* codes used by their kernels, as well as the values |
| * defined here - and, if the values they use for particular DLT_ types |
| * differ from those here, they should use their values, not the ones |
| * here). |
| */ |
| #define DLT_NULL 0 /* no link-layer encapsulation */ |
| #define DLT_EN10MB 1 /* Ethernet (10Mb) */ |
| #define DLT_EN3MB 2 /* Experimental Ethernet (3Mb) */ |
| #define DLT_AX25 3 /* Amateur Radio AX.25 */ |
| #define DLT_PRONET 4 /* Proteon ProNET Token Ring */ |
| #define DLT_CHAOS 5 /* Chaos */ |
| #define DLT_IEEE802 6 /* IEEE 802 Networks */ |
| #define DLT_ARCNET 7 /* ARCNET */ |
| #define DLT_SLIP 8 /* Serial Line IP */ |
| #define DLT_PPP 9 /* Point-to-point Protocol */ |
| #define DLT_FDDI 10 /* FDDI */ |
| |
| /* |
| * These are values from the traditional libpcap "bpf.h". |
| * Ports of this to particular platforms should replace these definitions |
| * with the ones appropriate to that platform, if the values are |
| * different on that platform. |
| */ |
| #define DLT_ATM_RFC1483 11 /* LLC/SNAP encapsulated atm */ |
| #define DLT_RAW 12 /* raw IP */ |
| |
| /* |
| * These are values from BSD/OS's "bpf.h". |
| * These are not the same as the values from the traditional libpcap |
| * "bpf.h"; however, these values shouldn't be generated by any |
| * OS other than BSD/OS, so the correct values to use here are the |
| * BSD/OS values. |
| * |
| * Platforms that have already assigned these values to other |
| * DLT_ codes, however, should give these codes the values |
| * from that platform, so that programs that use these codes will |
| * continue to compile - even though they won't correctly read |
| * files of these types. |
| */ |
| #ifdef __NetBSD__ |
| #ifndef DLT_SLIP_BSDOS |
| #define DLT_SLIP_BSDOS 13 /* BSD/OS Serial Line IP */ |
| #define DLT_PPP_BSDOS 14 /* BSD/OS Point-to-point Protocol */ |
| #endif |
| #else |
| #define DLT_SLIP_BSDOS 15 /* BSD/OS Serial Line IP */ |
| #define DLT_PPP_BSDOS 16 /* BSD/OS Point-to-point Protocol */ |
| #endif |
| |
| #define DLT_ATM_CLIP 19 /* Linux Classical-IP over ATM */ |
| |
| /* |
| * These values are defined by NetBSD; other platforms should refrain from |
| * using them for other purposes, so that NetBSD savefiles with link |
| * types of 50 or 51 can be read as this type on all platforms. |
| */ |
| #define DLT_PPP_SERIAL 50 /* PPP over serial with HDLC encapsulation */ |
| #define DLT_PPP_ETHER 51 /* PPP over Ethernet */ |
| |
| /* |
| * Values between 100 and 103 are used in capture file headers as |
| * link-layer types corresponding to DLT_ types that differ |
| * between platforms; don't use those values for new DLT_ new types. |
| */ |
| |
| /* |
| * This value was defined by libpcap 0.5; platforms that have defined |
| * it with a different value should define it here with that value - |
| * a link type of 104 in a save file will be mapped to DLT_C_HDLC, |
| * whatever value that happens to be, so programs will correctly |
| * handle files with that link type regardless of the value of |
| * DLT_C_HDLC. |
| * |
| * The name DLT_C_HDLC was used by BSD/OS; we use that name for source |
| * compatibility with programs written for BSD/OS. |
| * |
| * libpcap 0.5 defined it as DLT_CHDLC; we define DLT_CHDLC as well, |
| * for source compatibility with programs written for libpcap 0.5. |
| */ |
| #define DLT_C_HDLC 104 /* Cisco HDLC */ |
| #define DLT_CHDLC DLT_C_HDLC |
| |
| #define DLT_IEEE802_11 105 /* IEEE 802.11 wireless */ |
| |
| /* |
| * Values between 106 and 107 are used in capture file headers as |
| * link-layer types corresponding to DLT_ types that might differ |
| * between platforms; don't use those values for new DLT_ new types. |
| */ |
| |
| /* |
| * OpenBSD DLT_LOOP, for loopback devices; it's like DLT_NULL, except |
| * that the AF_ type in the link-layer header is in network byte order. |
| * |
| * OpenBSD defines it as 12, but that collides with DLT_RAW, so we |
| * define it as 108 here. If OpenBSD picks up this file, it should |
| * define DLT_LOOP as 12 in its version, as per the comment above - |
| * and should not use 108 as a DLT_ value. |
| */ |
| #define DLT_LOOP 108 |
| |
| /* |
| * Values between 109 and 112 are used in capture file headers as |
| * link-layer types corresponding to DLT_ types that might differ |
| * between platforms; don't use those values for new DLT_ types |
| * other than the corresponding DLT_ types. |
| */ |
| |
| /* |
| * This is for Linux cooked sockets. |
| */ |
| #define DLT_LINUX_SLL 113 |
| |
| /* |
| * Apple LocalTalk hardware. |
| */ |
| #define DLT_LTALK 114 |
| |
| /* |
| * Acorn Econet. |
| */ |
| #define DLT_ECONET 115 |
| |
| /* |
| * Reserved for use with OpenBSD ipfilter. |
| */ |
| #define DLT_IPFILTER 116 |
| |
| /* |
| * Reserved for use in capture-file headers as a link-layer type |
| * corresponding to OpenBSD DLT_PFLOG; DLT_PFLOG is 17 in OpenBSD, |
| * but that's DLT_LANE8023 in SuSE 6.3, so we can't use 17 for it |
| * in capture-file headers. |
| */ |
| #define DLT_PFLOG 117 |
| |
| /* |
| * Registered for Cisco-internal use. |
| */ |
| #define DLT_CISCO_IOS 118 |
| |
| /* |
| * Reserved for 802.11 cards using the Prism II chips, with a link-layer |
| * header including Prism monitor mode information plus an 802.11 |
| * header. |
| */ |
| #define DLT_PRISM_HEADER 119 |
| |
| /* |
| * Reserved for Aironet 802.11 cards, with an Aironet link-layer header |
| * (see Doug Ambrisko's FreeBSD patches). |
| */ |
| #define DLT_AIRONET_HEADER 120 |
| |
| /* |
| * Reserved for Siemens HiPath HDLC. |
| */ |
| #define DLT_HHDLC 121 |
| |
| /* |
| * Reserved for RFC 2625 IP-over-Fibre Channel, as per a request from |
| * Don Lee <donlee@cray.com>. |
| * |
| * This is not for use with raw Fibre Channel, where the link-layer |
| * header starts with a Fibre Channel frame header; it's for IP-over-FC, |
| * where the link-layer header starts with an RFC 2625 Network_Header |
| * field. |
| */ |
| #define DLT_IP_OVER_FC 122 |
| |
| /* |
| * The instruction encodings. |
| */ |
| /* instruction classes */ |
| #define BPF_CLASS(code) ((code) & 0x07) |
| #define BPF_LD 0x00 |
| #define BPF_LDX 0x01 |
| #define BPF_ST 0x02 |
| #define BPF_STX 0x03 |
| #define BPF_ALU 0x04 |
| #define BPF_JMP 0x05 |
| #define BPF_RET 0x06 |
| #define BPF_MISC 0x07 |
| |
| /* ld/ldx fields */ |
| #define BPF_SIZE(code) ((code) & 0x18) |
| #define BPF_W 0x00 |
| #define BPF_H 0x08 |
| #define BPF_B 0x10 |
| #define BPF_MODE(code) ((code) & 0xe0) |
| #define BPF_IMM 0x00 |
| #define BPF_ABS 0x20 |
| #define BPF_IND 0x40 |
| #define BPF_MEM 0x60 |
| #define BPF_LEN 0x80 |
| #define BPF_MSH 0xa0 |
| |
| /* alu/jmp fields */ |
| #define BPF_OP(code) ((code) & 0xf0) |
| #define BPF_ADD 0x00 |
| #define BPF_SUB 0x10 |
| #define BPF_MUL 0x20 |
| #define BPF_DIV 0x30 |
| #define BPF_OR 0x40 |
| #define BPF_AND 0x50 |
| #define BPF_LSH 0x60 |
| #define BPF_RSH 0x70 |
| #define BPF_NEG 0x80 |
| #define BPF_JA 0x00 |
| #define BPF_JEQ 0x10 |
| #define BPF_JGT 0x20 |
| #define BPF_JGE 0x30 |
| #define BPF_JSET 0x40 |
| #define BPF_SRC(code) ((code) & 0x08) |
| #define BPF_K 0x00 |
| #define BPF_X 0x08 |
| |
| /* ret - BPF_K and BPF_X also apply */ |
| #define BPF_RVAL(code) ((code) & 0x18) |
| #define BPF_A 0x10 |
| |
| /* misc */ |
| #define BPF_MISCOP(code) ((code) & 0xf8) |
| #define BPF_TAX 0x00 |
| #define BPF_TXA 0x80 |
| |
| /* |
| * The instruction data structure. |
| */ |
| struct bpf_insn { |
| u_short code; |
| u_char jt; |
| u_char jf; |
| bpf_int32 k; |
| }; |
| |
| /* |
| * Macros for insn array initializers. |
| */ |
| #define BPF_STMT(code, k) { (u_short)(code), 0, 0, k } |
| #define BPF_JUMP(code, k, jt, jf) { (u_short)(code), jt, jf, k } |
| |
| #if defined(BSD) && (defined(KERNEL) || defined(_KERNEL)) |
| /* |
| * Systems based on non-BSD kernels don't have ifnet's (or they don't mean |
| * anything if it is in <net/if.h>) and won't work like this. |
| */ |
| # if __STDC__ |
| extern void bpf_tap(struct ifnet *, u_char *, u_int); |
| extern void bpf_mtap(struct ifnet *, struct mbuf *); |
| extern void bpfattach(struct ifnet *, u_int, u_int); |
| extern void bpfilterattach(int); |
| # else |
| extern void bpf_tap(); |
| extern void bpf_mtap(); |
| extern void bpfattach(); |
| extern void bpfilterattach(); |
| # endif /* __STDC__ */ |
| #endif /* BSD && (_KERNEL || KERNEL) */ |
| #if __STDC__ || defined(__cplusplus) |
| extern int bpf_validate(struct bpf_insn *, int); |
| extern u_int bpf_filter(struct bpf_insn *, u_char *, u_int, u_int); |
| #else |
| extern int bpf_validate(); |
| extern u_int bpf_filter(); |
| #endif |
| |
| /* |
| * Number of scratch memory words (for BPF_LD|BPF_MEM and BPF_ST). |
| */ |
| #define BPF_MEMWORDS 16 |
| |
| #ifdef __cplusplus |
| } |
| #endif |
| |
| #endif |