winpcap/Packet9x/VXD/win_Bpf.h

   1 /*-
   2  * Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997
   3  *      The Regents of the University of California.  All rights reserved.
   4  *
   5  * This code is derived from the Stanford/CMU enet packet filter,
   6  * (net/enet.c) distributed as part of 4.3BSD, and code contributed
   7  * to Berkeley by Steven McCanne and Van Jacobson both of Lawrence
   8  * Berkeley Laboratory.
   9  *
  10  * Redistribution and use in source and binary forms, with or without
  11  * modification, are permitted provided that the following conditions
  12  * are met:
  13  * 1. Redistributions of source code must retain the above copyright
  14  *    notice, this list of conditions and the following disclaimer.
  15  * 2. Redistributions in binary form must reproduce the above copyright
  16  *    notice, this list of conditions and the following disclaimer in the
  17  *    documentation and/or other materials provided with the distribution.
  18  * 3. All advertising materials mentioning features or use of this software
  19  *    must display the following acknowledgement:
  20  *      This product includes software developed by the University of
  21  *      California, Berkeley and its contributors.
  22  * 4. Neither the name of the University nor the names of its contributors
  23  *    may be used to endorse or promote products derived from this software
  24  *    without specific prior written permission.
  25  *
  26  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  27  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  28  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  29  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  30  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  31  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  32  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  33  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  34  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  35  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  36  * SUCH DAMAGE.
  37  *
  38  *      @(#)bpf.h       7.1 (Berkeley) 5/7/91
  39  *
  40  * @(#) $Header: /usr/cvsroot_private/winpcap/Packet9x/VXD/win_Bpf.h,v 1.2 2005/12/02 22:31:27 gianlucav Exp $ (LBL)
  41  */
  42
  43 #ifndef BPF_MAJOR_VERSION
  44
  45 /* BSD style release date */
  46 #define BPF_RELEASE 199606
  47
  48 #ifndef NTKERNEL
  49 #include <winsock2.h>
  50 typedef int bpf_int32;
  51 typedef u_int bpf_u_int32;
  52 #else
  53 typedef UCHAR u_char;
  54 typedef USHORT u_short;
  55 typedef UINT u_int;
  56 typedef INT bpf_int32;
  57 typedef UINT bpf_u_int32;
  58 #endif
  59
  60 /*
  61  * Alignment macros.  BPF_WORDALIGN rounds up to the next
  62  * even multiple of BPF_ALIGNMENT.
  63  */
  64 #ifndef __NetBSD__
  65 #define BPF_ALIGNMENT sizeof(bpf_int32)
  66 #else
  67 #define BPF_ALIGNMENT sizeof(long)
  68 #endif
  69 #define BPF_WORDALIGN(x) (((x)+(BPF_ALIGNMENT-1))&~(BPF_ALIGNMENT-1))
  70
  71 #define BPF_MAXINSNS 512
  72 #define BPF_MAXBUFSIZE 0x8000
  73 #define BPF_MINBUFSIZE 32
  74
  75 /*
  76  *  Structure for BIOCSETF.
  77  */
  78 struct bpf_program {
  79         u_int bf_len;
  80         struct bpf_insn *bf_insns;
  81 };
  82
  83 /*
  84  * Struct returned by BIOCGSTATS.
  85  */
  86 struct bpf_stat {
  87         u_int bs_recv;          /* number of packets received */
  88         u_int bs_drop;          /* number of packets dropped */
  89 };
  90
  91 /*
  92  * Struct return by BIOCVERSION.  This represents the version number of
  93  * the filter language described by the instruction encodings below.
  94  * bpf understands a program iff kernel_major == filter_major &&
  95  * kernel_minor >= filter_minor, that is, if the value returned by the
  96  * running kernel has the same major number and a minor number equal
  97  * equal to or less than the filter being downloaded.  Otherwise, the
  98  * results are undefined, meaning an error may be returned or packets
  99  * may be accepted haphazardly.
 100  * It has nothing to do with the source code version.
 101  */
 102 struct bpf_version {
 103         u_short bv_major;
 104         u_short bv_minor;
 105 };
 106 /* Current version number of filter architecture. */
 107 #define BPF_MAJOR_VERSION 1
 108 #define BPF_MINOR_VERSION 1
 109
 110
 111 /*
 112  * Structure prepended to each packet.
 113  */
 114 struct bpf_hdr {
 115         struct timeval  bh_tstamp;      /* time stamp */
 116         bpf_u_int32     bh_caplen;      /* length of captured portion */
 117         bpf_u_int32     bh_datalen;     /* original length of packet */
 118         u_short         bh_hdrlen;      /* length of bpf header (this struct
 119                                            plus alignment padding) */
 120 };
 121 /*
 122  * Because the structure above is not a multiple of 4 bytes, some compilers
 123  * will insist on inserting padding; hence, sizeof(struct bpf_hdr) won't work.
 124  * Only the kernel needs to know about it; applications use bh_hdrlen.
 125  */
 126 #if defined(KERNEL) || defined(_KERNEL)
 127 #define SIZEOF_BPF_HDR 18
 128 #endif
 129
 130 /*
 131  * Data-link level type codes.
 132  */
 133
 134 /*
 135  * These are the types that are the same on all platforms; on other
 136  * platforms, a <net/bpf.h> should be supplied that defines the additional
 137  * DLT_* codes appropriately for that platform (the BSDs, for example,
 138  * should not just pick up this version of "bpf.h"; they should also define
 139  * the additional DLT_* codes used by their kernels, as well as the values
 140  * defined here - and, if the values they use for particular DLT_ types
 141  * differ from those here, they should use their values, not the ones
 142  * here).
 143  */
 144 #define DLT_NULL        0       /* no link-layer encapsulation */
 145 #define DLT_EN10MB      1       /* Ethernet (10Mb) */
 146 #define DLT_EN3MB       2       /* Experimental Ethernet (3Mb) */
 147 #define DLT_AX25        3       /* Amateur Radio AX.25 */
 148 #define DLT_PRONET      4       /* Proteon ProNET Token Ring */
 149 #define DLT_CHAOS       5       /* Chaos */
 150 #define DLT_IEEE802     6       /* IEEE 802 Networks */
 151 #define DLT_ARCNET      7       /* ARCNET */
 152 #define DLT_SLIP        8       /* Serial Line IP */
 153 #define DLT_PPP         9       /* Point-to-point Protocol */
 154 #define DLT_FDDI        10      /* FDDI */
 155
 156 /*
 157  * These are values from the traditional libpcap "bpf.h".
 158  * Ports of this to particular platforms should replace these definitions
 159  * with the ones appropriate to that platform, if the values are
 160  * different on that platform.
 161  */
 162 #define DLT_ATM_RFC1483 11      /* LLC/SNAP encapsulated atm */
 163 #define DLT_RAW         12      /* raw IP */
 164
 165 /*
 166  * These are values from BSD/OS's "bpf.h".
 167  * These are not the same as the values from the traditional libpcap
 168  * "bpf.h"; however, these values shouldn't be generated by any
 169  * OS other than BSD/OS, so the correct values to use here are the
 170  * BSD/OS values.
 171  *
 172  * Platforms that have already assigned these values to other
 173  * DLT_ codes, however, should give these codes the values
 174  * from that platform, so that programs that use these codes will
 175  * continue to compile - even though they won't correctly read
 176  * files of these types.
 177  */
 178 #define DLT_SLIP_BSDOS  15      /* BSD/OS Serial Line IP */
 179 #define DLT_PPP_BSDOS   16      /* BSD/OS Point-to-point Protocol */
 180
 181 #define DLT_ATM_CLIP    19      /* Linux Classical-IP over ATM */
 182
 183 /*
 184  * This value is defined by NetBSD; other platforms should refrain from
 185  * using it for other purposes, so that NetBSD savefiles with a link
 186  * type of 50 can be read as this type on all platforms.
 187  */
 188 #define DLT_PPP_SERIAL  50      /* PPP over serial with HDLC encapsulation */
 189
 190 /*
 191  * This value was defined by libpcap 0.5; platforms that have defined
 192  * it with a different value should define it here with that value -
 193  * a link type of 104 in a save file will be mapped to DLT_C_HDLC,
 194  * whatever value that happens to be, so programs will correctly
 195  * handle files with that link type regardless of the value of
 196  * DLT_C_HDLC.
 197  *
 198  * The name DLT_C_HDLC was used by BSD/OS; we use that name for source
 199  * compatibility with programs written for BSD/OS.
 200  *
 201  * libpcap 0.5 defined it as DLT_CHDLC; we define DLT_CHDLC as well,
 202  * for source compatibility with programs written for libpcap 0.5.
 203  */
 204 #define DLT_C_HDLC      104     /* Cisco HDLC */
 205 #define DLT_CHDLC       DLT_C_HDLC
 206
 207 /*
 208  * Reserved for future use.
 209  * Do not pick other numerical value for these unless you have also
 210  * picked up the tcpdump.org top-of-CVS-tree version of "savefile.c",
 211  * which will arrange that capture files for these DLT_ types have
 212  * the same "network" value on all platforms, regardless of what
 213  * value is chosen for their DLT_ type (thus allowing captures made
 214  * on one platform to be read on other platforms, even if the two
 215  * platforms don't use the same numerical values for all DLT_ types).
 216  */
 217 #define DLT_IEEE802_11  105     /* IEEE 802.11 wireless */
 218
 219 /*
 220  * Values between 106 and 107 are used in capture file headers as
 221  * link-layer types corresponding to DLT_ types that might differ
 222  * between platforms; don't use those values for new DLT_ new types.
 223  */
 224
 225 /*
 226  * OpenBSD DLT_LOOP, for loopback devices; it's like DLT_NULL, except
 227  * that the AF_ type in the link-layer header is in network byte order.
 228  *
 229  * OpenBSD defines it as 12, but that collides with DLT_RAW, so we
 230  * define it as 108 here.  If OpenBSD picks up this file, it should
 231  * define DLT_LOOP as 12 in its version, as per the comment above -
 232  * and should not use 108 for any purpose.
 233  */
 234 #define DLT_LOOP        108
 235
 236 /*
 237  * Values between 109 and 112 are used in capture file headers as
 238  * link-layer types corresponding to DLT_ types that might differ
 239  * between platforms; don't use those values for new DLT_ new types.
 240  */
 241
 242 /*
 243  * This is for Linux cooked sockets.
 244  */
 245 #define DLT_LINUX_SLL   113
 246
 247 /*
 248  * The instruction encodings.
 249  */
 250 /* instruction classes */
 251 #define BPF_CLASS(code) ((code) & 0x07)
 252 #define         BPF_LD          0x00
 253 #define         BPF_LDX         0x01
 254 #define         BPF_ST          0x02
 255 #define         BPF_STX         0x03
 256 #define         BPF_ALU         0x04
 257 #define         BPF_JMP         0x05
 258 #define         BPF_RET         0x06
 259 #define         BPF_MISC        0x07
 260
 261 /* ld/ldx fields */
 262 #define BPF_SIZE(code)  ((code) & 0x18)
 263 #define         BPF_W           0x00
 264 #define         BPF_H           0x08
 265 #define         BPF_B           0x10
 266 #define BPF_MODE(code)  ((code) & 0xe0)
 267 #define         BPF_IMM         0x00
 268 #define         BPF_ABS         0x20
 269 #define         BPF_IND         0x40
 270 #define         BPF_MEM         0x60
 271 #define         BPF_LEN         0x80
 272 #define         BPF_MSH         0xa0
 273
 274 /* alu/jmp fields */
 275 #define BPF_OP(code)    ((code) & 0xf0)
 276 #define         BPF_ADD         0x00
 277 #define         BPF_SUB         0x10
 278 #define         BPF_MUL         0x20
 279 #define         BPF_DIV         0x30
 280 #define         BPF_OR          0x40
 281 #define         BPF_AND         0x50
 282 #define         BPF_LSH         0x60
 283 #define         BPF_RSH         0x70
 284 #define         BPF_NEG         0x80
 285 #define         BPF_JA          0x00
 286 #define         BPF_JEQ         0x10
 287 #define         BPF_JGT         0x20
 288 #define         BPF_JGE         0x30
 289 #define         BPF_JSET        0x40
 290 #define BPF_SRC(code)   ((code) & 0x08)
 291 #define         BPF_K           0x00
 292 #define         BPF_X           0x08
 293
 294 /* ret - BPF_K and BPF_X also apply */
 295 #define BPF_RVAL(code)  ((code) & 0x18)
 296 #define         BPF_A           0x10
 297
 298 /* misc */
 299 #define BPF_MISCOP(code) ((code) & 0xf8)
 300 #define         BPF_TAX         0x00
 301 #define         BPF_TXA         0x80
 302
 303 /*
 304  * The instruction data structure.
 305  */
 306 struct bpf_insn {
 307         u_short code;
 308         u_char  jt;
 309         u_char  jf;
 310         bpf_u_int32 k;
 311 };
 312
 313 /*
 314  * Macros for insn array initializers.
 315  */
 316 #define BPF_STMT(code, k) { (u_short)(code), 0, 0, k }
 317 #define BPF_JUMP(code, k, jt, jf) { (u_short)(code), jt, jf, k }
 318
 319 /**
 320  *  @}
 321  */
 322
 323 #if defined(BSD) && (defined(KERNEL) || defined(_KERNEL))
 324 /*
 325  * Systems based on non-BSD kernels don't have ifnet's (or they don't mean
 326  * anything if it is in <net/if.h>) and won't work like this.
 327  */
 328 # if __STDC__
 329 extern void bpf_tap(struct ifnet *, u_char *, u_int);
 330 extern void bpf_mtap(struct ifnet *, struct mbuf *);
 331 extern void bpfattach(struct ifnet *, u_int, u_int);
 332 extern void bpfilterattach(int);
 333 # else
 334 extern void bpf_tap();
 335 extern void bpf_mtap();
 336 extern void bpfattach();
 337 extern void bpfilterattach();
 338 # endif /* __STDC__ */
 339 #endif /* BSD && (_KERNEL || KERNEL) */
 340 #if __STDC__
 341 extern int bpf_validate(struct bpf_insn *, int);
 342 extern u_int bpf_filter(struct bpf_insn *, u_char *, u_int, u_int);
 343 #else
 344 extern int bpf_validate();
 345 extern u_int bpf_filter();
 346 #endif
 347
 348 /*
 349  * Number of scratch memory words (for BPF_LD|BPF_MEM and BPF_ST).
 350  */
 351 #define BPF_MEMWORDS 16
 352
 353 #endif