src/bpf.h

   1 /*
   2  * netsniff-ng - the packet sniffing beast
   3  * By Daniel Borkmann <daniel@netsniff-ng.org>
   4  * Copyright 2009, 2010 Daniel Borkmann.
   5  * Subject to the GPL, version 2.
   6  */
   7
   8 #ifndef BPF_H
   9 #define BPF_H
  10
  11 #include <linux/filter.h>
  12 #include <stdint.h>
  13
  14 extern void bpf_dump_all(struct sock_fprog *bpf);
  15 extern int bpf_validate(const struct sock_fprog *bpf);
  16 extern uint32_t bpf_run_filter(const struct sock_fprog *bpf, uint8_t *packet,
  17                                size_t plen);
  18 extern void bpf_attach_to_sock(int sock, struct sock_fprog *bpf);
  19 extern void bpf_detach_from_sock(int sock);
  20 extern void enable_kernel_bpf_jit_compiler(void);
  21 extern void bpf_parse_rules(char *rulefile, struct sock_fprog *bpf);
  22
  23 /*
  24  * The instruction encodings.
  25  */
  26 /* instruction classes */
  27 #define BPF_CLASS(code) ((code) & 0x07)
  28 #define BPF_LD          0x00
  29 #define BPF_LDX         0x01
  30 #define BPF_ST          0x02
  31 #define BPF_STX         0x03
  32 #define BPF_ALU         0x04
  33 #define BPF_JMP         0x05
  34 #define BPF_RET         0x06
  35 #define BPF_MISC        0x07
  36
  37 /* ld/ldx fields */
  38 #define BPF_SIZE(code)  ((code) & 0x18)
  39 #define BPF_W           0x00
  40 #define BPF_H           0x08
  41 #define BPF_B           0x10
  42 #define BPF_MODE(code)  ((code) & 0xe0)
  43 #define BPF_IMM         0x00
  44 #define BPF_ABS         0x20
  45 #define BPF_IND         0x40
  46 #define BPF_MEM         0x60
  47 #define BPF_LEN         0x80
  48 #define BPF_MSH         0xa0
  49
  50 /* alu/jmp fields */
  51 #define BPF_OP(code)    ((code) & 0xf0)
  52 #define BPF_ADD         0x00
  53 #define BPF_SUB         0x10
  54 #define BPF_MUL         0x20
  55 #define BPF_DIV         0x30
  56 #define BPF_OR          0x40
  57 #define BPF_AND         0x50
  58 #define BPF_LSH         0x60
  59 #define BPF_RSH         0x70
  60 #define BPF_NEG         0x80
  61 #define BPF_JA          0x00
  62 #define BPF_JEQ         0x10
  63 #define BPF_JGT         0x20
  64 #define BPF_JGE         0x30
  65 #define BPF_JSET        0x40
  66 #define BPF_SRC(code)   ((code) & 0x08)
  67 #define BPF_K           0x00
  68 #define BPF_X           0x08
  69
  70 /* ret - BPF_K and BPF_X also apply */
  71 #define BPF_RVAL(code)  ((code) & 0x18)
  72 #define BPF_A           0x10
  73
  74 /* misc */
  75 #define BPF_MISCOP(code) ((code) & 0xf8)
  76 #define BPF_TAX         0x00
  77 #define BPF_TXA         0x80
  78
  79 /* Hidden Linux kernel BPF extensions */
  80 /*
  81  * RATIONALE. Negative offsets are invalid in BPF.
  82  * We use them to reference ancillary data.
  83  * Unlike introduction new instructions, it does not break
  84  * existing compilers/optimizers.
  85  */
  86
  87 #ifndef SKF_AD_OFF
  88 # define SKF_AD_OFF             (-0x1000)
  89 #endif
  90 #ifndef SKF_AD_PROTOCOL
  91 # define SKF_AD_PROTOCOL        0
  92 #endif
  93 #ifndef SKF_AD_PKTTYPE
  94 # define SKF_AD_PKTTYPE         4
  95 #endif
  96 #ifndef SKF_AD_IFINDEX
  97 # define SKF_AD_IFINDEX         8
  98 #endif
  99 #ifndef SKF_AD_NLATTR
 100 # define SKF_AD_NLATTR          12
 101 #endif
 102 #ifndef SKF_AD_NLATTR_NEST
 103 # define SKF_AD_NLATTR_NEST     16
 104 #endif
 105 #ifndef SKF_AD_MARK
 106 # define SKF_AD_MARK            20
 107 #endif
 108 #ifndef SKF_AD_QUEUE
 109 # define SKF_AD_QUEUE           24
 110 #endif
 111 #ifndef SKF_AD_HATYPE
 112 # define SKF_AD_HATYPE          28
 113 #endif
 114 #ifndef SKF_AD_RXHASH
 115 # define SKF_AD_RXHASH          32
 116 #endif
 117 #ifndef SKF_AD_CPU
 118 # define SKF_AD_CPU             36
 119 #endif
 120
 121 #endif /* BPF_H */