sys/net/bpf.h

   1 /*      $NetBSD: bpf.h,v 1.67 2015/09/05 20:01:21 dholland Exp $        */
   2
   3 /*
   4  * Copyright (c) 1990, 1991, 1993
   5  *      The Regents of the University of California.  All rights reserved.
   6  *
   7  * This code is derived from the Stanford/CMU enet packet filter,
   8  * (net/enet.c) distributed as part of 4.3BSD, and code contributed
   9  * to Berkeley by Steven McCanne and Van Jacobson both of Lawrence
  10  * Berkeley Laboratory.
  11  *
  12  * Redistribution and use in source and binary forms, with or without
  13  * modification, are permitted provided that the following conditions
  14  * are met:
  15  * 1. Redistributions of source code must retain the above copyright
  16  *    notice, this list of conditions and the following disclaimer.
  17  * 2. Redistributions in binary form must reproduce the above copyright
  18  *    notice, this list of conditions and the following disclaimer in the
  19  *    documentation and/or other materials provided with the distribution.
  20  * 3. Neither the name of the University nor the names of its contributors
  21  *    may be used to endorse or promote products derived from this software
  22  *    without specific prior written permission.
  23  *
  24  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  25  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  26  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  27  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  28  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  29  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  30  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  31  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  32  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  33  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  34  * SUCH DAMAGE.
  35  *
  36  *      @(#)bpf.h       8.2 (Berkeley) 1/9/95
  37  * @(#) Header: bpf.h,v 1.36 97/06/12 14:29:53 leres Exp  (LBL)
  38  */
  39
  40 #ifndef _NET_BPF_H_
  41 #define _NET_BPF_H_
  42
  43 #include <sys/ioccom.h>
  44 #include <sys/time.h>
  45
  46 /* BSD style release date */
  47 #define BPF_RELEASE 199606
  48
  49 /* Date when COP instructions and external memory have been released. */
  50 #define BPF_COP_EXTMEM_RELEASE 20140624
  51
  52 __BEGIN_DECLS
  53
  54 typedef int bpf_int32;
  55 typedef u_int bpf_u_int32;
  56
  57 /*
  58  * Alignment macros.  BPF_WORDALIGN rounds up to the next
  59  * even multiple of BPF_ALIGNMENT.
  60  */
  61 #define BPF_ALIGNMENT sizeof(long)
  62 #define BPF_ALIGNMENT32 sizeof(int)
  63
  64 #define BPF_WORDALIGN(x) (((x)+(BPF_ALIGNMENT-1))&~(BPF_ALIGNMENT-1))
  65 #define BPF_WORDALIGN32(x) (((x)+(BPF_ALIGNMENT32-1))&~(BPF_ALIGNMENT32-1))
  66
  67 #define BPF_MAXINSNS 512
  68 #define BPF_DFLTBUFSIZE (1024*1024)     /* default static upper limit */
  69 #define BPF_MAXBUFSIZE (1024*1024*16)   /* hard limit on sysctl'able value */
  70 #define BPF_MINBUFSIZE 32
  71
  72 /*
  73  *  Structure for BIOCSETF.
  74  */
  75 struct bpf_program {
  76         u_int bf_len;
  77         struct bpf_insn *bf_insns;
  78 };
  79
  80 /*
  81  * Struct returned by BIOCGSTATS and net.bpf.stats sysctl.
  82  */
  83 struct bpf_stat {
  84         uint64_t bs_recv;       /* number of packets received */
  85         uint64_t bs_drop;       /* number of packets dropped */
  86         uint64_t bs_capt;       /* number of packets captured */
  87         uint64_t bs_padding[13];
  88 };
  89
  90 /*
  91  * Struct returned by BIOCGSTATSOLD.
  92  */
  93 struct bpf_stat_old {
  94         u_int bs_recv;          /* number of packets received */
  95         u_int bs_drop;          /* number of packets dropped */
  96 };
  97
  98 /*
  99  * Struct return by BIOCVERSION.  This represents the version number of
 100  * the filter language described by the instruction encodings below.
 101  * bpf understands a program iff kernel_major == filter_major &&
 102  * kernel_minor >= filter_minor, that is, if the value returned by the
 103  * running kernel has the same major number and a minor number equal
 104  * equal to or less than the filter being downloaded.  Otherwise, the
 105  * results are undefined, meaning an error may be returned or packets
 106  * may be accepted haphazardly.
 107  * It has nothing to do with the source code version.
 108  */
 109 struct bpf_version {
 110         u_short bv_major;
 111         u_short bv_minor;
 112 };
 113 /* Current version number of filter architecture. */
 114 #define BPF_MAJOR_VERSION 1
 115 #define BPF_MINOR_VERSION 1
 116
 117 /*
 118  * BPF ioctls
 119  *
 120  * The first set is for compatibility with Sun's pcc style
 121  * header files.  If your using gcc, we assume that you
 122  * have run fixincludes so the latter set should work.
 123  */
 124 #define BIOCGBLEN        _IOR('B',102, u_int)
 125 #define BIOCSBLEN       _IOWR('B',102, u_int)
 126 #define BIOCSETF         _IOW('B',103, struct bpf_program)
 127 #define BIOCFLUSH         _IO('B',104)
 128 #define BIOCPROMISC       _IO('B',105)
 129 #define BIOCGDLT         _IOR('B',106, u_int)
 130 #define BIOCGETIF        _IOR('B',107, struct ifreq)
 131 #define BIOCSETIF        _IOW('B',108, struct ifreq)
 132 #ifdef COMPAT_50
 133 #include <compat/sys/time.h>
 134 #define BIOCSORTIMEOUT   _IOW('B',109, struct timeval50)
 135 #define BIOCGORTIMEOUT   _IOR('B',110, struct timeval50)
 136 #endif
 137 #define BIOCGSTATS       _IOR('B',111, struct bpf_stat)
 138 #define BIOCGSTATSOLD    _IOR('B',111, struct bpf_stat_old)
 139 #define BIOCIMMEDIATE    _IOW('B',112, u_int)
 140 #define BIOCVERSION      _IOR('B',113, struct bpf_version)
 141 #define BIOCSTCPF        _IOW('B',114, struct bpf_program)
 142 #define BIOCSUDPF        _IOW('B',115, struct bpf_program)
 143 #define BIOCGHDRCMPLT    _IOR('B',116, u_int)
 144 #define BIOCSHDRCMPLT    _IOW('B',117, u_int)
 145 #define BIOCSDLT         _IOW('B',118, u_int)
 146 #define BIOCGDLTLIST    _IOWR('B',119, struct bpf_dltlist)
 147 #define BIOCGSEESENT     _IOR('B',120, u_int)
 148 #define BIOCSSEESENT     _IOW('B',121, u_int)
 149 #define BIOCSRTIMEOUT    _IOW('B',122, struct timeval)
 150 #define BIOCGRTIMEOUT    _IOR('B',123, struct timeval)
 151 #define BIOCGFEEDBACK    _IOR('B',124, u_int)
 152 #define BIOCSFEEDBACK    _IOW('B',125, u_int)
 153 #define BIOCFEEDBACK     BIOCSFEEDBACK          /* FreeBSD name */
 154
 155 /*
 156  * Structure prepended to each packet. This is "wire" format, so we
 157  * cannot change it unfortunately to 64 bit times on 32 bit systems [yet].
 158  */
 159 struct bpf_timeval {
 160         long tv_sec;
 161         long tv_usec;
 162 };
 163
 164 struct bpf_timeval32 {
 165         int32_t tv_sec;
 166         int32_t tv_usec;
 167 };
 168
 169 struct bpf_hdr {
 170         struct bpf_timeval bh_tstamp;   /* time stamp */
 171         uint32_t        bh_caplen;      /* length of captured portion */
 172         uint32_t        bh_datalen;     /* original length of packet */
 173         uint16_t        bh_hdrlen;      /* length of bpf header (this struct
 174                                            plus alignment padding) */
 175 };
 176
 177 struct bpf_hdr32 {
 178         struct bpf_timeval32 bh_tstamp; /* time stamp */
 179         uint32_t        bh_caplen;      /* length of captured portion */
 180         uint32_t        bh_datalen;     /* original length of packet */
 181         uint16_t        bh_hdrlen;      /* length of bpf header (this struct
 182                                            plus alignment padding) */
 183 };
 184 /*
 185  * Because the structure above is not a multiple of 4 bytes, some compilers
 186  * will insist on inserting padding; hence, sizeof(struct bpf_hdr) won't work.
 187  * Only the kernel needs to know about it; applications use bh_hdrlen.
 188  * XXX To save a few bytes on 32-bit machines, we avoid end-of-struct
 189  * XXX padding by using the size of the header data elements.  This is
 190  * XXX fail-safe: on new machines, we just use the 'safe' sizeof.
 191  */
 192 #ifdef _KERNEL
 193 #if defined(__arm32__) || defined(__i386__) || defined(__m68k__) || \
 194     defined(__mips__) || defined(__ns32k__) || defined(__vax__) || \
 195     defined(__sh__) || (defined(__sparc__) && !defined(__sparc64__))
 196 #define SIZEOF_BPF_HDR 18
 197 #define SIZEOF_BPF_HDR32 18
 198 #else
 199 #define SIZEOF_BPF_HDR sizeof(struct bpf_hdr)
 200 #define SIZEOF_BPF_HDR32 sizeof(struct bpf_hdr32)
 201 #endif
 202 #endif
 203
 204 /* Pull in data-link level type codes. */
 205 #include <net/dlt.h>
 206
 207 /*
 208  * The instruction encodings.
 209  */
 210 /* instruction classes */
 211 #define BPF_CLASS(code) ((code) & 0x07)
 212 #define         BPF_LD          0x00
 213 #define         BPF_LDX         0x01
 214 #define         BPF_ST          0x02
 215 #define         BPF_STX         0x03
 216 #define         BPF_ALU         0x04
 217 #define         BPF_JMP         0x05
 218 #define         BPF_RET         0x06
 219 #define         BPF_MISC        0x07
 220
 221 /* ld/ldx fields */
 222 #define BPF_SIZE(code)  ((code) & 0x18)
 223 #define         BPF_W           0x00
 224 #define         BPF_H           0x08
 225 #define         BPF_B           0x10
 226 /*                              0x18    reserved; used by BSD/OS */
 227 #define BPF_MODE(code)  ((code) & 0xe0)
 228 #define         BPF_IMM         0x00
 229 #define         BPF_ABS         0x20
 230 #define         BPF_IND         0x40
 231 #define         BPF_MEM         0x60
 232 #define         BPF_LEN         0x80
 233 #define         BPF_MSH         0xa0
 234 /*                              0xc0    reserved; used by BSD/OS */
 235 /*                              0xe0    reserved; used by BSD/OS */
 236
 237 /* alu/jmp fields */
 238 #define BPF_OP(code)    ((code) & 0xf0)
 239 #define         BPF_ADD         0x00
 240 #define         BPF_SUB         0x10
 241 #define         BPF_MUL         0x20
 242 #define         BPF_DIV         0x30
 243 #define         BPF_OR          0x40
 244 #define         BPF_AND         0x50
 245 #define         BPF_LSH         0x60
 246 #define         BPF_RSH         0x70
 247 #define         BPF_NEG         0x80
 248 #define         BPF_MOD         0x90
 249 #define         BPF_XOR         0xa0
 250 /*                              0xb0    reserved */
 251 /*                              0xc0    reserved */
 252 /*                              0xd0    reserved */
 253 /*                              0xe0    reserved */
 254 /*                              0xf0    reserved */
 255 #define         BPF_JA          0x00
 256 #define         BPF_JEQ         0x10
 257 #define         BPF_JGT         0x20
 258 #define         BPF_JGE         0x30
 259 #define         BPF_JSET        0x40
 260 /*                              0x50    reserved; used by BSD/OS */
 261 /*                              0x60    reserved */
 262 /*                              0x70    reserved */
 263 /*                              0x80    reserved */
 264 /*                              0x90    reserved */
 265 /*                              0xa0    reserved */
 266 /*                              0xb0    reserved */
 267 /*                              0xc0    reserved */
 268 /*                              0xd0    reserved */
 269 /*                              0xe0    reserved */
 270 /*                              0xf0    reserved */
 271 #define BPF_SRC(code)   ((code) & 0x08)
 272 #define         BPF_K           0x00
 273 #define         BPF_X           0x08
 274
 275 /* ret - BPF_K and BPF_X also apply */
 276 #define BPF_RVAL(code)  ((code) & 0x18)
 277 #define         BPF_A           0x10
 278 /*                              0x18    reserved */
 279
 280 /* misc */
 281 #define BPF_MISCOP(code) ((code) & 0xf8)
 282 #define         BPF_TAX         0x00
 283 /*                              0x10    reserved */
 284 /*                              0x18    reserved */
 285 #define         BPF_COP         0x20
 286 /*                              0x28    reserved */
 287 /*                              0x30    reserved */
 288 /*                              0x38    reserved */
 289 #define         BPF_COPX        0x40    /* XXX: also used by BSD/OS */
 290 /*                              0x48    reserved */
 291 /*                              0x50    reserved */
 292 /*                              0x58    reserved */
 293 /*                              0x60    reserved */
 294 /*                              0x68    reserved */
 295 /*                              0x70    reserved */
 296 /*                              0x78    reserved */
 297 #define         BPF_TXA         0x80
 298 /*                              0x88    reserved */
 299 /*                              0x90    reserved */
 300 /*                              0x98    reserved */
 301 /*                              0xa0    reserved */
 302 /*                              0xa8    reserved */
 303 /*                              0xb0    reserved */
 304 /*                              0xb8    reserved */
 305 /*                              0xc0    reserved; used by BSD/OS */
 306 /*                              0xc8    reserved */
 307 /*                              0xd0    reserved */
 308 /*                              0xd8    reserved */
 309 /*                              0xe0    reserved */
 310 /*                              0xe8    reserved */
 311 /*                              0xf0    reserved */
 312 /*                              0xf8    reserved */
 313
 314 /*
 315  * The instruction data structure.
 316  */
 317 struct bpf_insn {
 318         uint16_t  code;
 319         u_char    jt;
 320         u_char    jf;
 321         uint32_t  k;
 322 };
 323
 324 /*
 325  * Macros for insn array initializers.
 326  */
 327 #define BPF_STMT(code, k) { (uint16_t)(code), 0, 0, k }
 328 #define BPF_JUMP(code, k, jt, jf) { (uint16_t)(code), jt, jf, k }
 329
 330 /*
 331  * Number of scratch memory words (for BPF_LD|BPF_MEM and BPF_ST).
 332  */
 333 #define BPF_MEMWORDS            16
 334
 335 /*
 336  * bpf_memword_init_t: bits indicate which words in the external memory
 337  * store will be initialised by the caller before BPF program execution.
 338  */
 339 typedef uint32_t bpf_memword_init_t;
 340 #define BPF_MEMWORD_INIT(k)     (UINT32_C(1) << (k))
 341
 342 /* Note: two most significant bits are reserved by bpfjit. */
 343 __CTASSERT(BPF_MEMWORDS + 2 <= sizeof(bpf_memword_init_t) * NBBY);
 344
 345 #ifdef _KERNEL
 346 /*
 347  * Max number of external memory words (for BPF_LD|BPF_MEM and BPF_ST).
 348  */
 349 #define BPF_MAX_MEMWORDS        30
 350
 351 __CTASSERT(BPF_MAX_MEMWORDS >= BPF_MEMWORDS);
 352 __CTASSERT(BPF_MAX_MEMWORDS + 2 <= sizeof(bpf_memword_init_t) * NBBY);
 353 #endif
 354
 355 /*
 356  * Structure to retrieve available DLTs for the interface.
 357  */
 358 struct bpf_dltlist {
 359         u_int   bfl_len;        /* number of bfd_list array */
 360         u_int   *bfl_list;      /* array of DLTs */
 361 };
 362
 363 struct bpf_ctx;
 364 typedef struct bpf_ctx bpf_ctx_t;
 365
 366 typedef struct bpf_args {
 367         const uint8_t * pkt;
 368         size_t          wirelen;
 369         size_t          buflen;
 370         /*
 371          * The following arguments are used only by some kernel
 372          * subsystems.
 373          * They aren't required for classical bpf filter programs.
 374          * For such programs, bpfjit generated code doesn't read
 375          * those arguments at all. Note however that bpf interpreter
 376          * always needs a pointer to memstore.
 377          */
 378         uint32_t *      mem; /* pointer to external memory store */
 379         void *          arg; /* auxiliary argument for a copfunc */
 380 } bpf_args_t;
 381
 382 #if defined(_KERNEL) || defined(__BPF_PRIVATE)
 383
 384 typedef uint32_t (*bpf_copfunc_t)(const bpf_ctx_t *, bpf_args_t *, uint32_t);
 385
 386 struct bpf_ctx {
 387         /*
 388          * BPF coprocessor functions and the number of them.
 389          */
 390         const bpf_copfunc_t *   copfuncs;
 391         size_t                  nfuncs;
 392
 393         /*
 394          * The number of memory words in the external memory store.
 395          * There may be up to BPF_MAX_MEMWORDS words; if zero is set,
 396          * then the internal memory store is used which has a fixed
 397          * number of words (BPF_MEMWORDS).
 398          */
 399         size_t                  extwords;
 400
 401         /*
 402          * The bitmask indicating which words in the external memstore
 403          * will be initialised by the caller.
 404          */
 405         bpf_memword_init_t      preinited;
 406 };
 407 #endif
 408
 409 #ifdef _KERNEL
 410 #include <net/bpfjit.h>
 411 #include <net/if.h>
 412
 413 struct bpf_if;
 414
 415 struct bpf_ops {
 416         void (*bpf_attach)(struct ifnet *, u_int, u_int, struct bpf_if **);
 417         void (*bpf_detach)(struct ifnet *);
 418         void (*bpf_change_type)(struct ifnet *, u_int, u_int);
 419
 420         void (*bpf_tap)(struct bpf_if *, u_char *, u_int);
 421         void (*bpf_mtap)(struct bpf_if *, struct mbuf *);
 422         void (*bpf_mtap2)(struct bpf_if *, void *, u_int, struct mbuf *);
 423         void (*bpf_mtap_af)(struct bpf_if *, uint32_t, struct mbuf *);
 424         void (*bpf_mtap_sl_in)(struct bpf_if *, u_char *, struct mbuf **);
 425         void (*bpf_mtap_sl_out)(struct bpf_if *, u_char *, struct mbuf *);
 426 };
 427
 428 extern struct bpf_ops *bpf_ops;
 429
 430 static inline void
 431 bpf_attach(struct ifnet *_ifp, u_int _dlt, u_int _hdrlen)
 432 {
 433         bpf_ops->bpf_attach(_ifp, _dlt, _hdrlen, &_ifp->if_bpf);
 434 }
 435
 436 static inline void
 437 bpf_attach2(struct ifnet *_ifp, u_int _dlt, u_int _hdrlen, struct bpf_if **_dp)
 438 {
 439         bpf_ops->bpf_attach(_ifp, _dlt, _hdrlen, _dp);
 440 }
 441
 442 static inline void
 443 bpf_tap(struct ifnet *_ifp, u_char *_pkt, u_int _len)
 444 {
 445         if (_ifp->if_bpf)
 446                 bpf_ops->bpf_tap(_ifp->if_bpf, _pkt, _len);
 447 }
 448
 449 static inline void
 450 bpf_mtap(struct ifnet *_ifp, struct mbuf *_m)
 451 {
 452         if (_ifp->if_bpf)
 453                 bpf_ops->bpf_mtap(_ifp->if_bpf, _m);
 454 }
 455
 456 static inline void
 457 bpf_mtap2(struct bpf_if *_bpf, void *_data, u_int _dlen, struct mbuf *_m)
 458 {
 459         bpf_ops->bpf_mtap2(_bpf, _data, _dlen, _m);
 460 }
 461
 462 static inline void
 463 bpf_mtap3(struct bpf_if *_bpf, struct mbuf *_m)
 464 {
 465         if (_bpf)
 466                 bpf_ops->bpf_mtap(_bpf, _m);
 467 }
 468
 469 static inline void
 470 bpf_mtap_af(struct ifnet *_ifp, uint32_t _af, struct mbuf *_m)
 471 {
 472         if (_ifp->if_bpf)
 473                 bpf_ops->bpf_mtap_af(_ifp->if_bpf, _af, _m);
 474 }
 475
 476 static inline void
 477 bpf_change_type(struct ifnet *_ifp, u_int _dlt, u_int _hdrlen)
 478 {
 479         bpf_ops->bpf_change_type(_ifp, _dlt, _hdrlen);
 480 }
 481
 482 static inline void
 483 bpf_detach(struct ifnet *_ifp)
 484 {
 485         bpf_ops->bpf_detach(_ifp);
 486 }
 487
 488 static inline void
 489 bpf_mtap_sl_in(struct ifnet *_ifp, u_char *_hdr, struct mbuf **_m)
 490 {
 491         bpf_ops->bpf_mtap_sl_in(_ifp->if_bpf, _hdr, _m);
 492 }
 493
 494 static inline void
 495 bpf_mtap_sl_out(struct ifnet *_ifp, u_char *_hdr, struct mbuf *_m)
 496 {
 497         if (_ifp->if_bpf)
 498                 bpf_ops->bpf_mtap_sl_out(_ifp->if_bpf, _hdr, _m);
 499 }
 500
 501
 502 void    bpf_setops(void);
 503
 504 void    bpf_ops_handover_enter(struct bpf_ops *);
 505 void    bpf_ops_handover_exit(void);
 506
 507 void    bpfilterattach(int);
 508
 509 bpf_ctx_t *bpf_create(void);
 510 void    bpf_destroy(bpf_ctx_t *);
 511
 512 int     bpf_set_cop(bpf_ctx_t *, const bpf_copfunc_t *, size_t);
 513 int     bpf_set_extmem(bpf_ctx_t *, size_t, bpf_memword_init_t);
 514 u_int   bpf_filter_ext(const bpf_ctx_t *, const struct bpf_insn *, bpf_args_t *);
 515 int     bpf_validate_ext(const bpf_ctx_t *, const struct bpf_insn *, int);
 516
 517 bpfjit_func_t bpf_jit_generate(bpf_ctx_t *, void *, size_t);
 518 void    bpf_jit_freecode(bpfjit_func_t);
 519
 520 #endif
 521
 522 int     bpf_validate(const struct bpf_insn *, int);
 523 u_int   bpf_filter(const struct bpf_insn *, const u_char *, u_int, u_int);
 524
 525 __END_DECLS
 526
 527 #endif /* !_NET_BPF_H_ */