"Fossies" - the Fresh Open Source Software Archive

Member "libpcap-1.10.1/./pcap/bpf.h" (7 Jun 2021, 9053 Bytes) of package /linux/misc/libpcap-1.10.1.tar.gz:


As a special service "Fossies" has tried to format the requested source page into HTML format using (guessed) C and C++ source code syntax highlighting (style: standard) with prefixed line numbers and code folding option. Alternatively you can here view or download the uninterpreted source code file. For more information about "bpf.h" see the Fossies "Dox" file reference documentation and the latest Fossies "Diffs" side-by-side code changes report: 1.10.0_vs_1.10.1.

    1 /*-
    2  * Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997
    3  *  The Regents of the University of California.  All rights reserved.
    4  *
    5  * This code is derived from the Stanford/CMU enet packet filter,
    6  * (net/enet.c) distributed as part of 4.3BSD, and code contributed
    7  * to Berkeley by Steven McCanne and Van Jacobson both of Lawrence
    8  * Berkeley Laboratory.
    9  *
   10  * Redistribution and use in source and binary forms, with or without
   11  * modification, are permitted provided that the following conditions
   12  * are met:
   13  * 1. Redistributions of source code must retain the above copyright
   14  *    notice, this list of conditions and the following disclaimer.
   15  * 2. Redistributions in binary form must reproduce the above copyright
   16  *    notice, this list of conditions and the following disclaimer in the
   17  *    documentation and/or other materials provided with the distribution.
   18  * 3. Neither the name of the University nor the names of its contributors
   19  *    may be used to endorse or promote products derived from this software
   20  *    without specific prior written permission.
   21  *
   22  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
   23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
   24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
   25  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
   26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
   27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
   28  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
   29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
   30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
   31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
   32  * SUCH DAMAGE.
   33  *
   34  *      @(#)bpf.h       7.1 (Berkeley) 5/7/91
   35  */
   36 
   37 /*
   38  * This is libpcap's cut-down version of bpf.h; it includes only
   39  * the stuff needed for the code generator and the userland BPF
   40  * interpreter, and the libpcap APIs for setting filters, etc..
   41  *
   42  * "pcap-bpf.c" will include the native OS version, as it deals with
   43  * the OS's BPF implementation.
   44  *
   45  * At least two programs found by Google Code Search explicitly includes
   46  * <pcap/bpf.h> (even though <pcap.h>/<pcap/pcap.h> includes it for you),
   47  * so moving that stuff to <pcap/pcap.h> would break the build for some
   48  * programs.
   49  */
   50 
   51 /*
   52  * If we've already included <net/bpf.h>, don't re-define this stuff.
   53  * We assume BSD-style multiple-include protection in <net/bpf.h>,
   54  * which is true of all but the oldest versions of FreeBSD and NetBSD,
   55  * or Tru64 UNIX-style multiple-include protection (or, at least,
   56  * Tru64 UNIX 5.x-style; I don't have earlier versions available to check),
   57  * or AIX-style multiple-include protection (or, at least, AIX 5.x-style;
   58  * I don't have earlier versions available to check), or QNX-style
   59  * multiple-include protection (as per GitHub pull request #394).
   60  *
   61  * We trust that they will define structures and macros and types in
   62  * a fashion that's source-compatible and binary-compatible with our
   63  * definitions.
   64  *
   65  * We do not check for BPF_MAJOR_VERSION, as that's defined by
   66  * <linux/filter.h>, which is directly or indirectly included in some
   67  * programs that also include pcap.h, and <linux/filter.h> doesn't
   68  * define stuff we need.  We *do* protect against <linux/filter.h>
   69  * defining various macros for BPF code itself; <linux/filter.h> says
   70  *
   71  *  Try and keep these values and structures similar to BSD, especially
   72  *  the BPF code definitions which need to match so you can share filters
   73  *
   74  * so we trust that it will define them in a fashion that's source-compatible
   75  * and binary-compatible with our definitions.
   76  *
   77  * This also provides our own multiple-include protection.
   78  */
   79 #if !defined(_NET_BPF_H_) && !defined(_NET_BPF_H_INCLUDED) && !defined(_BPF_H_) && !defined(_H_BPF) && !defined(lib_pcap_bpf_h)
   80 #define lib_pcap_bpf_h
   81 
   82 #include <pcap/funcattrs.h>
   83 
   84 #include <pcap/dlt.h>
   85 
   86 #ifdef __cplusplus
   87 extern "C" {
   88 #endif
   89 
   90 /* BSD style release date */
   91 #define BPF_RELEASE 199606
   92 
   93 #ifdef MSDOS /* must be 32-bit */
   94 typedef long          bpf_int32;
   95 typedef unsigned long bpf_u_int32;
   96 #else
   97 typedef int bpf_int32;
   98 typedef u_int bpf_u_int32;
   99 #endif
  100 
  101 /*
  102  * Alignment macros.  BPF_WORDALIGN rounds up to the next
  103  * even multiple of BPF_ALIGNMENT.
  104  *
  105  * Tcpdump's print-pflog.c uses this, so we define it here.
  106  */
  107 #ifndef __NetBSD__
  108 #define BPF_ALIGNMENT sizeof(bpf_int32)
  109 #else
  110 #define BPF_ALIGNMENT sizeof(long)
  111 #endif
  112 #define BPF_WORDALIGN(x) (((x)+(BPF_ALIGNMENT-1))&~(BPF_ALIGNMENT-1))
  113 
  114 /*
  115  * Structure for "pcap_compile()", "pcap_setfilter()", etc..
  116  */
  117 struct bpf_program {
  118     u_int bf_len;
  119     struct bpf_insn *bf_insns;
  120 };
  121 
  122 /*
  123  * The instruction encodings.
  124  *
  125  * Please inform tcpdump-workers@lists.tcpdump.org if you use any
  126  * of the reserved values, so that we can note that they're used
  127  * (and perhaps implement it in the reference BPF implementation
  128  * and encourage its implementation elsewhere).
  129  */
  130 
  131 /*
  132  * The upper 8 bits of the opcode aren't used. BSD/OS used 0x8000.
  133  */
  134 
  135 /* instruction classes */
  136 #define BPF_CLASS(code) ((code) & 0x07)
  137 #define     BPF_LD      0x00
  138 #define     BPF_LDX     0x01
  139 #define     BPF_ST      0x02
  140 #define     BPF_STX     0x03
  141 #define     BPF_ALU     0x04
  142 #define     BPF_JMP     0x05
  143 #define     BPF_RET     0x06
  144 #define     BPF_MISC    0x07
  145 
  146 /* ld/ldx fields */
  147 #define BPF_SIZE(code)  ((code) & 0x18)
  148 #define     BPF_W       0x00
  149 #define     BPF_H       0x08
  150 #define     BPF_B       0x10
  151 /*              0x18    reserved; used by BSD/OS */
  152 #define BPF_MODE(code)  ((code) & 0xe0)
  153 #define     BPF_IMM     0x00
  154 #define     BPF_ABS     0x20
  155 #define     BPF_IND     0x40
  156 #define     BPF_MEM     0x60
  157 #define     BPF_LEN     0x80
  158 #define     BPF_MSH     0xa0
  159 /*              0xc0    reserved; used by BSD/OS */
  160 /*              0xe0    reserved; used by BSD/OS */
  161 
  162 /* alu/jmp fields */
  163 #define BPF_OP(code)    ((code) & 0xf0)
  164 #define     BPF_ADD     0x00
  165 #define     BPF_SUB     0x10
  166 #define     BPF_MUL     0x20
  167 #define     BPF_DIV     0x30
  168 #define     BPF_OR      0x40
  169 #define     BPF_AND     0x50
  170 #define     BPF_LSH     0x60
  171 #define     BPF_RSH     0x70
  172 #define     BPF_NEG     0x80
  173 #define     BPF_MOD     0x90
  174 #define     BPF_XOR     0xa0
  175 /*              0xb0    reserved */
  176 /*              0xc0    reserved */
  177 /*              0xd0    reserved */
  178 /*              0xe0    reserved */
  179 /*              0xf0    reserved */
  180 
  181 #define     BPF_JA      0x00
  182 #define     BPF_JEQ     0x10
  183 #define     BPF_JGT     0x20
  184 #define     BPF_JGE     0x30
  185 #define     BPF_JSET    0x40
  186 /*              0x50    reserved; used on BSD/OS */
  187 /*              0x60    reserved */
  188 /*              0x70    reserved */
  189 /*              0x80    reserved */
  190 /*              0x90    reserved */
  191 /*              0xa0    reserved */
  192 /*              0xb0    reserved */
  193 /*              0xc0    reserved */
  194 /*              0xd0    reserved */
  195 /*              0xe0    reserved */
  196 /*              0xf0    reserved */
  197 #define BPF_SRC(code)   ((code) & 0x08)
  198 #define     BPF_K       0x00
  199 #define     BPF_X       0x08
  200 
  201 /* ret - BPF_K and BPF_X also apply */
  202 #define BPF_RVAL(code)  ((code) & 0x18)
  203 #define     BPF_A       0x10
  204 /*              0x18    reserved */
  205 
  206 /* misc */
  207 #define BPF_MISCOP(code) ((code) & 0xf8)
  208 #define     BPF_TAX     0x00
  209 /*              0x08    reserved */
  210 /*              0x10    reserved */
  211 /*              0x18    reserved */
  212 /* #define  BPF_COP     0x20    NetBSD "coprocessor" extensions */
  213 /*              0x28    reserved */
  214 /*              0x30    reserved */
  215 /*              0x38    reserved */
  216 /* #define  BPF_COPX    0x40    NetBSD "coprocessor" extensions */
  217 /*                  also used on BSD/OS */
  218 /*              0x48    reserved */
  219 /*              0x50    reserved */
  220 /*              0x58    reserved */
  221 /*              0x60    reserved */
  222 /*              0x68    reserved */
  223 /*              0x70    reserved */
  224 /*              0x78    reserved */
  225 #define     BPF_TXA     0x80
  226 /*              0x88    reserved */
  227 /*              0x90    reserved */
  228 /*              0x98    reserved */
  229 /*              0xa0    reserved */
  230 /*              0xa8    reserved */
  231 /*              0xb0    reserved */
  232 /*              0xb8    reserved */
  233 /*              0xc0    reserved; used on BSD/OS */
  234 /*              0xc8    reserved */
  235 /*              0xd0    reserved */
  236 /*              0xd8    reserved */
  237 /*              0xe0    reserved */
  238 /*              0xe8    reserved */
  239 /*              0xf0    reserved */
  240 /*              0xf8    reserved */
  241 
  242 /*
  243  * The instruction data structure.
  244  */
  245 struct bpf_insn {
  246     u_short code;
  247     u_char  jt;
  248     u_char  jf;
  249     bpf_u_int32 k;
  250 };
  251 
  252 /*
  253  * Macros for insn array initializers.
  254  *
  255  * In case somebody's included <linux/filter.h>, or something else that
  256  * gives the kernel's definitions of BPF statements, get rid of its
  257  * definitions, so we can supply ours instead.  If some kernel's
  258  * definitions aren't *binary-compatible* with what BPF has had
  259  * since it first sprung from the brows of Van Jacobson and Steve
  260  * McCanne, that kernel should be fixed.
  261  */
  262 #ifdef BPF_STMT
  263 #undef BPF_STMT
  264 #endif
  265 #define BPF_STMT(code, k) { (u_short)(code), 0, 0, k }
  266 #ifdef BPF_JUMP
  267 #undef BPF_JUMP
  268 #endif
  269 #define BPF_JUMP(code, k, jt, jf) { (u_short)(code), jt, jf, k }
  270 
  271 PCAP_AVAILABLE_0_4
  272 PCAP_API u_int  bpf_filter(const struct bpf_insn *, const u_char *, u_int, u_int);
  273 
  274 PCAP_AVAILABLE_0_6
  275 PCAP_API int    bpf_validate(const struct bpf_insn *f, int len);
  276 
  277 PCAP_AVAILABLE_0_4
  278 PCAP_API char   *bpf_image(const struct bpf_insn *, int);
  279 
  280 PCAP_AVAILABLE_0_6
  281 PCAP_API void   bpf_dump(const struct bpf_program *, int);
  282 
  283 /*
  284  * Number of scratch memory words (for BPF_LD|BPF_MEM and BPF_ST).
  285  */
  286 #define BPF_MEMWORDS 16
  287 
  288 #ifdef __cplusplus
  289 }
  290 #endif
  291 
  292 #endif /* !defined(_NET_BPF_H_) && !defined(_BPF_H_) && !defined(_H_BPF) && !defined(lib_pcap_bpf_h) */