dect
/
libpcap
Archived
13
0
Fork 0
Code Releases Activity
This repository has been archived on 2022-02-17. You can view files and clone it, but cannot push or open issues or pull requests.
libpcap/bpf/net/bpf.h

462 lines
14 KiB
C
Raw Normal View History

Initial revision
1999-10-07 23:46:40 +00:00
/*-
* Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997
* The Regents of the University of California. All rights reserved.
*
* This code is derived from the Stanford/CMU enet packet filter,
* (net/enet.c) distributed as part of 4.3BSD, and code contributed
* to Berkeley by Steven McCanne and Van Jacobson both of Lawrence
* Berkeley Laboratory.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. All advertising materials mentioning features or use of this software
* must display the following acknowledgement:
* This product includes software developed by the University of
* California, Berkeley and its contributors.
* 4. Neither the name of the University nor the names of its contributors
* may be used to endorse or promote products derived from this software
* without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
* @(#)bpf.h 7.1 (Berkeley) 5/7/91
*
Reserve a DLT_ value for Frame Relay, and map BSD/OS's DLT_FR to it.
2002-06-07 04:17:15 +00:00
* @(#) $Header: /tcpdump/master/libpcap/bpf/net/Attic/bpf.h,v 1.58 2002-06-07 04:17:15 guy Exp $ (LBL)
Initial revision
1999-10-07 23:46:40 +00:00
*/
#ifndef BPF_MAJOR_VERSION
Throw in #ifdef __cplusplus extern "C" { #endif and change #if __STDC__ to #if __STDC__ || defined(__cplusplus) around the non-kernel function prototypes, so they work right when compiling with C++.
2002-04-20 10:02:16 +00:00
#ifdef __cplusplus
extern "C" {
#endif
Initial revision
1999-10-07 23:46:40 +00:00
/* BSD style release date */
#define BPF_RELEASE 199606
typedef int bpf_int32;
typedef u_int bpf_u_int32;
/*
* Alignment macros. BPF_WORDALIGN rounds up to the next
* even multiple of BPF_ALIGNMENT.
*/
IPv6 packet filtering code. ./configure --enable-ipv6 (requires getaddrinfo(3) and getnameinfo(3)). TODO: make it work even without getaddrinfo(3) or getnameinfo(3) (or, tcpdump/configure.in should provide alternative version by AC_REPLACE_FUNCS) TODO: make IPv6 filtering code work by default TODO: make "protochain" friendly with optimization
1999-10-19 15:18:28 +00:00
#ifndef __NetBSD__
Initial revision
1999-10-07 23:46:40 +00:00
#define BPF_ALIGNMENT sizeof(bpf_int32)
IPv6 packet filtering code. ./configure --enable-ipv6 (requires getaddrinfo(3) and getnameinfo(3)). TODO: make it work even without getaddrinfo(3) or getnameinfo(3) (or, tcpdump/configure.in should provide alternative version by AC_REPLACE_FUNCS) TODO: make IPv6 filtering code work by default TODO: make "protochain" friendly with optimization
1999-10-19 15:18:28 +00:00
#else
#define BPF_ALIGNMENT sizeof(long)
#endif
Initial revision
1999-10-07 23:46:40 +00:00
#define BPF_WORDALIGN(x) (((x)+(BPF_ALIGNMENT-1))&~(BPF_ALIGNMENT-1))
#define BPF_MAXINSNS 512
#define BPF_MAXBUFSIZE 0x8000
#define BPF_MINBUFSIZE 32
/*
* Structure for BIOCSETF.
*/
struct bpf_program {
u_int bf_len;
struct bpf_insn *bf_insns;
};
/*
* Struct returned by BIOCGSTATS.
*/
struct bpf_stat {
u_int bs_recv; /* number of packets received */
u_int bs_drop; /* number of packets dropped */
};
/*
* Struct return by BIOCVERSION. This represents the version number of
* the filter language described by the instruction encodings below.
* bpf understands a program iff kernel_major == filter_major &&
* kernel_minor >= filter_minor, that is, if the value returned by the
* running kernel has the same major number and a minor number equal
* equal to or less than the filter being downloaded. Otherwise, the
* results are undefined, meaning an error may be returned or packets
* may be accepted haphazardly.
* It has nothing to do with the source code version.
*/
struct bpf_version {
u_short bv_major;
u_short bv_minor;
};
/* Current version number of filter architecture. */
#define BPF_MAJOR_VERSION 1
#define BPF_MINOR_VERSION 1
/*
* BPF ioctls
*
* The first set is for compatibility with Sun's pcc style
* header files. If your using gcc, we assume that you
* have run fixincludes so the latter set should work.
*/
#if (defined(sun) || defined(ibm032)) && !defined(__GNUC__)
#define BIOCGBLEN _IOR(B,102, u_int)
#define BIOCSBLEN _IOWR(B,102, u_int)
#define BIOCSETF _IOW(B,103, struct bpf_program)
#define BIOCFLUSH _IO(B,104)
#define BIOCPROMISC _IO(B,105)
#define BIOCGDLT _IOR(B,106, u_int)
#define BIOCGETIF _IOR(B,107, struct ifreq)
#define BIOCSETIF _IOW(B,108, struct ifreq)
#define BIOCSRTIMEOUT _IOW(B,109, struct timeval)
#define BIOCGRTIMEOUT _IOR(B,110, struct timeval)
#define BIOCGSTATS _IOR(B,111, struct bpf_stat)
#define BIOCIMMEDIATE _IOW(B,112, u_int)
#define BIOCVERSION _IOR(B,113, struct bpf_version)
#define BIOCSTCPF _IOW(B,114, struct bpf_program)
#define BIOCSUDPF _IOW(B,115, struct bpf_program)
#else
#define BIOCGBLEN _IOR('B',102, u_int)
#define BIOCSBLEN _IOWR('B',102, u_int)
#define BIOCSETF _IOW('B',103, struct bpf_program)
#define BIOCFLUSH _IO('B',104)
#define BIOCPROMISC _IO('B',105)
#define BIOCGDLT _IOR('B',106, u_int)
#define BIOCGETIF _IOR('B',107, struct ifreq)
#define BIOCSETIF _IOW('B',108, struct ifreq)
#define BIOCSRTIMEOUT _IOW('B',109, struct timeval)
#define BIOCGRTIMEOUT _IOR('B',110, struct timeval)
#define BIOCGSTATS _IOR('B',111, struct bpf_stat)
#define BIOCIMMEDIATE _IOW('B',112, u_int)
#define BIOCVERSION _IOR('B',113, struct bpf_version)
#define BIOCSTCPF _IOW('B',114, struct bpf_program)
#define BIOCSUDPF _IOW('B',115, struct bpf_program)
#endif
/*
* Structure prepended to each packet.
*/
struct bpf_hdr {
struct timeval bh_tstamp; /* time stamp */
bpf_u_int32 bh_caplen; /* length of captured portion */
bpf_u_int32 bh_datalen; /* original length of packet */
u_short bh_hdrlen; /* length of bpf header (this struct
plus alignment padding) */
};
/*
* Because the structure above is not a multiple of 4 bytes, some compilers
* will insist on inserting padding; hence, sizeof(struct bpf_hdr) won't work.
* Only the kernel needs to know about it; applications use bh_hdrlen.
*/
handle both KERNEL and _KERNEL. add prototypes for functions. From Darren Reed <darrenr@reed.wattle.id.au>
2000-06-26 04:56:28 +00:00
#if defined(KERNEL) || defined(_KERNEL)
Initial revision
1999-10-07 23:46:40 +00:00
#define SIZEOF_BPF_HDR 18
#endif
/*
* Data-link level type codes.
Get rid of the PCAP_ENCAP_ values - if an application uses them, that application won't build with any other version of libpcap, which means that a lot of applications won't use them. In addition, "pcap_linktype()" needs to return DLT_ values, so that platforms that build libpcap as a shared library won't break binary compatibility if they update to this version of libpcap. Instead, we map from DLT_ values to LINKTYPE_ values when writing savefiles, and map from LINKTYPE_ values to DLT_ values when reading savefiles, so that savefiles don't have platform-dependent DLT_ values in the header as the link type, they have platform-independent LINKTYPE_ values. This means we don't need to make DLT_ATM_RFC1483, DLT_RAW, etc. have platform-independent values starting at 100 - only the values in the savefile header need to be like that.
2000-10-12 03:53:57 +00:00
*/
/*
Introduce a set of PCAP_ENCAP_ codes to specify packet encapsulations. For those PCAP_ENCAP_ codes corresponding to DLT_ codes that are (believed to be) the same in all BSDs, the PCAP_ENCAP_ codes have the same values as the corresponding DLT_ codes. For those PCAP_ENCAP_ codes corresponding to DLT_ codes that were added in libpcap 0.5 as "non-kernel" DLT_ codes, or had their values changed in libpcap 0.5 in order to cope with the fact that those DLT_ codes have different values in different systems, the PCAP_ENCAP_ codes have the same values as the corresponding DLT_ codes. We add some additional PCAP_ENCAP_ codes to handle IEEE 802.11 (which currently has its link-layer information turned into an Ethernet header by at least some of the BSDs, but John Hawkinson at MIT wants to add a DLT_ value for 802.11 and pass up the full link-layer header) and the Classical IP encapsulation for ATM on Linux (which isn't always the same as DLT_ATM_RFC1483, from what I can tell, alas). "pcap-bpf.c" maps DLT_ codes to PCAP_ENCAP_ codes, so as not to supply to libpcap's callers any DLT_ codes other than the ones that have the same values on all platforms; it supplies PCAP_ENCAP_ codes for all others. In libpcap's "bpf/net/bpf.h", we define the DLT_ values that aren't the same on all platforms with the new values starting at 100 (to keep them out of the way of the values various BSDs might assign to them), as we did in 0.5, but do so only if they're not already defined; platforms with <net/bpf.h> headers that come with the kernel (e.g., the BSDs) should define them with the values that they have always had on that platform, *not* with the values we used in 0.5. (Code using this version of libpcap should check for the new PCAP_ENCAP_ codes; those are given the values that the corresponding DLT_ values had in 0.5, so code that checks for them will handle 0.5 libpcap files correctly even if the platform defines DLT_RAW, say, as something other than 101. If that code also checks for DLT_RAW - which means it can't just use a switch statement, as DLT_RAW might be defined as 101 if the platform doesn't itself define DLT_RAW with some other value - then it will also handle old DLT_RAW captures, as long as they were made on the same platform or on another platform that used the same value for DLT_RAW. It can't handle captures from a platform that uses that value for another DLT_ code, but that's always been the case, and isn't easily fixable.) The intent here is to decouple the values that are returned by "pcap_datalink()" and put into the header of tcpdump/libpcap save files from the DLT_ values returned by BIOCGDLT in BSD kernels, allowing the BSDs to assign values to DLT_ codes, in their kernels, as they choose, without creating more incompatibilities between tcpdump/libpcap save files from different platforms.
2000-09-17 04:04:36 +00:00
* These are the types that are the same on all platforms; on other
* platforms, a <net/bpf.h> should be supplied that defines the additional
* DLT_* codes appropriately for that platform (the BSDs, for example,
* should not just pick up this version of "bpf.h"; they should also define
* the additional DLT_* codes used by their kernels, as well as the values
Handle DLT_NULL correctly - the AF_ value is in host byte order, which means that we should "htonl()" it before using it in BPF expressions *but*, if we're reading a capture file from a machine with the opposite byte order from ours, we should byte-swap it before "htonl()"ing it. Handle OpenBSD DLT_LOOP as well - it's like DLT_NULL except that the AF_ value is in *network* byte order. Don't support checking for inbound or outbound packets except on those data link types that supply an inbound/outbound qualifier (DLT_SLIP and DLT_PPP) - this came from OpenBSD's libpcap, delta 1.12 to "gencode.c".
2000-12-16 21:31:10 +00:00
* defined here - and, if the values they use for particular DLT_ types
* differ from those here, they should use their values, not the ones
* here).
Initial revision
1999-10-07 23:46:40 +00:00
*/
#define DLT_NULL 0 /* no link-layer encapsulation */
#define DLT_EN10MB 1 /* Ethernet (10Mb) */
#define DLT_EN3MB 2 /* Experimental Ethernet (3Mb) */
#define DLT_AX25 3 /* Amateur Radio AX.25 */
#define DLT_PRONET 4 /* Proteon ProNET Token Ring */
#define DLT_CHAOS 5 /* Chaos */
#define DLT_IEEE802 6 /* IEEE 802 Networks */
#define DLT_ARCNET 7 /* ARCNET */
#define DLT_SLIP 8 /* Serial Line IP */
#define DLT_PPP 9 /* Point-to-point Protocol */
#define DLT_FDDI 10 /* FDDI */
Introduce a set of PCAP_ENCAP_ codes to specify packet encapsulations. For those PCAP_ENCAP_ codes corresponding to DLT_ codes that are (believed to be) the same in all BSDs, the PCAP_ENCAP_ codes have the same values as the corresponding DLT_ codes. For those PCAP_ENCAP_ codes corresponding to DLT_ codes that were added in libpcap 0.5 as "non-kernel" DLT_ codes, or had their values changed in libpcap 0.5 in order to cope with the fact that those DLT_ codes have different values in different systems, the PCAP_ENCAP_ codes have the same values as the corresponding DLT_ codes. We add some additional PCAP_ENCAP_ codes to handle IEEE 802.11 (which currently has its link-layer information turned into an Ethernet header by at least some of the BSDs, but John Hawkinson at MIT wants to add a DLT_ value for 802.11 and pass up the full link-layer header) and the Classical IP encapsulation for ATM on Linux (which isn't always the same as DLT_ATM_RFC1483, from what I can tell, alas). "pcap-bpf.c" maps DLT_ codes to PCAP_ENCAP_ codes, so as not to supply to libpcap's callers any DLT_ codes other than the ones that have the same values on all platforms; it supplies PCAP_ENCAP_ codes for all others. In libpcap's "bpf/net/bpf.h", we define the DLT_ values that aren't the same on all platforms with the new values starting at 100 (to keep them out of the way of the values various BSDs might assign to them), as we did in 0.5, but do so only if they're not already defined; platforms with <net/bpf.h> headers that come with the kernel (e.g., the BSDs) should define them with the values that they have always had on that platform, *not* with the values we used in 0.5. (Code using this version of libpcap should check for the new PCAP_ENCAP_ codes; those are given the values that the corresponding DLT_ values had in 0.5, so code that checks for them will handle 0.5 libpcap files correctly even if the platform defines DLT_RAW, say, as something other than 101. If that code also checks for DLT_RAW - which means it can't just use a switch statement, as DLT_RAW might be defined as 101 if the platform doesn't itself define DLT_RAW with some other value - then it will also handle old DLT_RAW captures, as long as they were made on the same platform or on another platform that used the same value for DLT_RAW. It can't handle captures from a platform that uses that value for another DLT_ code, but that's always been the case, and isn't easily fixable.) The intent here is to decouple the values that are returned by "pcap_datalink()" and put into the header of tcpdump/libpcap save files from the DLT_ values returned by BIOCGDLT in BSD kernels, allowing the BSDs to assign values to DLT_ codes, in their kernels, as they choose, without creating more incompatibilities between tcpdump/libpcap save files from different platforms.
2000-09-17 04:04:36 +00:00
/*
Get rid of the PCAP_ENCAP_ values - if an application uses them, that application won't build with any other version of libpcap, which means that a lot of applications won't use them. In addition, "pcap_linktype()" needs to return DLT_ values, so that platforms that build libpcap as a shared library won't break binary compatibility if they update to this version of libpcap. Instead, we map from DLT_ values to LINKTYPE_ values when writing savefiles, and map from LINKTYPE_ values to DLT_ values when reading savefiles, so that savefiles don't have platform-dependent DLT_ values in the header as the link type, they have platform-independent LINKTYPE_ values. This means we don't need to make DLT_ATM_RFC1483, DLT_RAW, etc. have platform-independent values starting at 100 - only the values in the savefile header need to be like that.
2000-10-12 03:53:57 +00:00
* These are values from the traditional libpcap "bpf.h".
* Ports of this to particular platforms should replace these definitions
* with the ones appropriate to that platform, if the values are
* different on that platform.
Introduce a set of PCAP_ENCAP_ codes to specify packet encapsulations. For those PCAP_ENCAP_ codes corresponding to DLT_ codes that are (believed to be) the same in all BSDs, the PCAP_ENCAP_ codes have the same values as the corresponding DLT_ codes. For those PCAP_ENCAP_ codes corresponding to DLT_ codes that were added in libpcap 0.5 as "non-kernel" DLT_ codes, or had their values changed in libpcap 0.5 in order to cope with the fact that those DLT_ codes have different values in different systems, the PCAP_ENCAP_ codes have the same values as the corresponding DLT_ codes. We add some additional PCAP_ENCAP_ codes to handle IEEE 802.11 (which currently has its link-layer information turned into an Ethernet header by at least some of the BSDs, but John Hawkinson at MIT wants to add a DLT_ value for 802.11 and pass up the full link-layer header) and the Classical IP encapsulation for ATM on Linux (which isn't always the same as DLT_ATM_RFC1483, from what I can tell, alas). "pcap-bpf.c" maps DLT_ codes to PCAP_ENCAP_ codes, so as not to supply to libpcap's callers any DLT_ codes other than the ones that have the same values on all platforms; it supplies PCAP_ENCAP_ codes for all others. In libpcap's "bpf/net/bpf.h", we define the DLT_ values that aren't the same on all platforms with the new values starting at 100 (to keep them out of the way of the values various BSDs might assign to them), as we did in 0.5, but do so only if they're not already defined; platforms with <net/bpf.h> headers that come with the kernel (e.g., the BSDs) should define them with the values that they have always had on that platform, *not* with the values we used in 0.5. (Code using this version of libpcap should check for the new PCAP_ENCAP_ codes; those are given the values that the corresponding DLT_ values had in 0.5, so code that checks for them will handle 0.5 libpcap files correctly even if the platform defines DLT_RAW, say, as something other than 101. If that code also checks for DLT_RAW - which means it can't just use a switch statement, as DLT_RAW might be defined as 101 if the platform doesn't itself define DLT_RAW with some other value - then it will also handle old DLT_RAW captures, as long as they were made on the same platform or on another platform that used the same value for DLT_RAW. It can't handle captures from a platform that uses that value for another DLT_ code, but that's always been the case, and isn't easily fixable.) The intent here is to decouple the values that are returned by "pcap_datalink()" and put into the header of tcpdump/libpcap save files from the DLT_ values returned by BIOCGDLT in BSD kernels, allowing the BSDs to assign values to DLT_ codes, in their kernels, as they choose, without creating more incompatibilities between tcpdump/libpcap save files from different platforms.
2000-09-17 04:04:36 +00:00
*/
Get rid of the PCAP_ENCAP_ values - if an application uses them, that application won't build with any other version of libpcap, which means that a lot of applications won't use them. In addition, "pcap_linktype()" needs to return DLT_ values, so that platforms that build libpcap as a shared library won't break binary compatibility if they update to this version of libpcap. Instead, we map from DLT_ values to LINKTYPE_ values when writing savefiles, and map from LINKTYPE_ values to DLT_ values when reading savefiles, so that savefiles don't have platform-dependent DLT_ values in the header as the link type, they have platform-independent LINKTYPE_ values. This means we don't need to make DLT_ATM_RFC1483, DLT_RAW, etc. have platform-independent values starting at 100 - only the values in the savefile header need to be like that.
2000-10-12 03:53:57 +00:00
#define DLT_ATM_RFC1483 11 /* LLC/SNAP encapsulated atm */
#define DLT_RAW 12 /* raw IP */
/*
* These are values from BSD/OS's "bpf.h".
* These are not the same as the values from the traditional libpcap
* "bpf.h"; however, these values shouldn't be generated by any
* OS other than BSD/OS, so the correct values to use here are the
* BSD/OS values.
*
* Platforms that have already assigned these values to other
* DLT_ codes, however, should give these codes the values
* from that platform, so that programs that use these codes will
* continue to compile - even though they won't correctly read
* files of these types.
*/
#ifdef to work around NetBSD dlt.h problem.
2002-01-22 23:36:19 +00:00
#ifdef __NetBSD__
#ifndef DLT_SLIP_BSDOS
#define DLT_SLIP_BSDOS 13 /* BSD/OS Serial Line IP */
#define DLT_PPP_BSDOS 14 /* BSD/OS Point-to-point Protocol */
#endif
#else
Get rid of the PCAP_ENCAP_ values - if an application uses them, that application won't build with any other version of libpcap, which means that a lot of applications won't use them. In addition, "pcap_linktype()" needs to return DLT_ values, so that platforms that build libpcap as a shared library won't break binary compatibility if they update to this version of libpcap. Instead, we map from DLT_ values to LINKTYPE_ values when writing savefiles, and map from LINKTYPE_ values to DLT_ values when reading savefiles, so that savefiles don't have platform-dependent DLT_ values in the header as the link type, they have platform-independent LINKTYPE_ values. This means we don't need to make DLT_ATM_RFC1483, DLT_RAW, etc. have platform-independent values starting at 100 - only the values in the savefile header need to be like that.
2000-10-12 03:53:57 +00:00
#define DLT_SLIP_BSDOS 15 /* BSD/OS Serial Line IP */
#define DLT_PPP_BSDOS 16 /* BSD/OS Point-to-point Protocol */
#ifdef to work around NetBSD dlt.h problem.
2002-01-22 23:36:19 +00:00
#endif
Get rid of the PCAP_ENCAP_ values - if an application uses them, that application won't build with any other version of libpcap, which means that a lot of applications won't use them. In addition, "pcap_linktype()" needs to return DLT_ values, so that platforms that build libpcap as a shared library won't break binary compatibility if they update to this version of libpcap. Instead, we map from DLT_ values to LINKTYPE_ values when writing savefiles, and map from LINKTYPE_ values to DLT_ values when reading savefiles, so that savefiles don't have platform-dependent DLT_ values in the header as the link type, they have platform-independent LINKTYPE_ values. This means we don't need to make DLT_ATM_RFC1483, DLT_RAW, etc. have platform-independent values starting at 100 - only the values in the savefile header need to be like that.
2000-10-12 03:53:57 +00:00
#define DLT_ATM_CLIP 19 /* Linux Classical-IP over ATM */
Introduce a set of PCAP_ENCAP_ codes to specify packet encapsulations. For those PCAP_ENCAP_ codes corresponding to DLT_ codes that are (believed to be) the same in all BSDs, the PCAP_ENCAP_ codes have the same values as the corresponding DLT_ codes. For those PCAP_ENCAP_ codes corresponding to DLT_ codes that were added in libpcap 0.5 as "non-kernel" DLT_ codes, or had their values changed in libpcap 0.5 in order to cope with the fact that those DLT_ codes have different values in different systems, the PCAP_ENCAP_ codes have the same values as the corresponding DLT_ codes. We add some additional PCAP_ENCAP_ codes to handle IEEE 802.11 (which currently has its link-layer information turned into an Ethernet header by at least some of the BSDs, but John Hawkinson at MIT wants to add a DLT_ value for 802.11 and pass up the full link-layer header) and the Classical IP encapsulation for ATM on Linux (which isn't always the same as DLT_ATM_RFC1483, from what I can tell, alas). "pcap-bpf.c" maps DLT_ codes to PCAP_ENCAP_ codes, so as not to supply to libpcap's callers any DLT_ codes other than the ones that have the same values on all platforms; it supplies PCAP_ENCAP_ codes for all others. In libpcap's "bpf/net/bpf.h", we define the DLT_ values that aren't the same on all platforms with the new values starting at 100 (to keep them out of the way of the values various BSDs might assign to them), as we did in 0.5, but do so only if they're not already defined; platforms with <net/bpf.h> headers that come with the kernel (e.g., the BSDs) should define them with the values that they have always had on that platform, *not* with the values we used in 0.5. (Code using this version of libpcap should check for the new PCAP_ENCAP_ codes; those are given the values that the corresponding DLT_ values had in 0.5, so code that checks for them will handle 0.5 libpcap files correctly even if the platform defines DLT_RAW, say, as something other than 101. If that code also checks for DLT_RAW - which means it can't just use a switch statement, as DLT_RAW might be defined as 101 if the platform doesn't itself define DLT_RAW with some other value - then it will also handle old DLT_RAW captures, as long as they were made on the same platform or on another platform that used the same value for DLT_RAW. It can't handle captures from a platform that uses that value for another DLT_ code, but that's always been the case, and isn't easily fixable.) The intent here is to decouple the values that are returned by "pcap_datalink()" and put into the header of tcpdump/libpcap save files from the DLT_ values returned by BIOCGDLT in BSD kernels, allowing the BSDs to assign values to DLT_ codes, in their kernels, as they choose, without creating more incompatibilities between tcpdump/libpcap save files from different platforms.
2000-09-17 04:04:36 +00:00
/*
Add support for NetBSD DLT_PPP_ETHER, as per the NetBSD libpcap.
2001-04-17 08:10:00 +00:00
* These values are defined by NetBSD; other platforms should refrain from
* using them for other purposes, so that NetBSD savefiles with link
* types of 50 or 51 can be read as this type on all platforms.
Introduce a set of PCAP_ENCAP_ codes to specify packet encapsulations. For those PCAP_ENCAP_ codes corresponding to DLT_ codes that are (believed to be) the same in all BSDs, the PCAP_ENCAP_ codes have the same values as the corresponding DLT_ codes. For those PCAP_ENCAP_ codes corresponding to DLT_ codes that were added in libpcap 0.5 as "non-kernel" DLT_ codes, or had their values changed in libpcap 0.5 in order to cope with the fact that those DLT_ codes have different values in different systems, the PCAP_ENCAP_ codes have the same values as the corresponding DLT_ codes. We add some additional PCAP_ENCAP_ codes to handle IEEE 802.11 (which currently has its link-layer information turned into an Ethernet header by at least some of the BSDs, but John Hawkinson at MIT wants to add a DLT_ value for 802.11 and pass up the full link-layer header) and the Classical IP encapsulation for ATM on Linux (which isn't always the same as DLT_ATM_RFC1483, from what I can tell, alas). "pcap-bpf.c" maps DLT_ codes to PCAP_ENCAP_ codes, so as not to supply to libpcap's callers any DLT_ codes other than the ones that have the same values on all platforms; it supplies PCAP_ENCAP_ codes for all others. In libpcap's "bpf/net/bpf.h", we define the DLT_ values that aren't the same on all platforms with the new values starting at 100 (to keep them out of the way of the values various BSDs might assign to them), as we did in 0.5, but do so only if they're not already defined; platforms with <net/bpf.h> headers that come with the kernel (e.g., the BSDs) should define them with the values that they have always had on that platform, *not* with the values we used in 0.5. (Code using this version of libpcap should check for the new PCAP_ENCAP_ codes; those are given the values that the corresponding DLT_ values had in 0.5, so code that checks for them will handle 0.5 libpcap files correctly even if the platform defines DLT_RAW, say, as something other than 101. If that code also checks for DLT_RAW - which means it can't just use a switch statement, as DLT_RAW might be defined as 101 if the platform doesn't itself define DLT_RAW with some other value - then it will also handle old DLT_RAW captures, as long as they were made on the same platform or on another platform that used the same value for DLT_RAW. It can't handle captures from a platform that uses that value for another DLT_ code, but that's always been the case, and isn't easily fixable.) The intent here is to decouple the values that are returned by "pcap_datalink()" and put into the header of tcpdump/libpcap save files from the DLT_ values returned by BIOCGDLT in BSD kernels, allowing the BSDs to assign values to DLT_ codes, in their kernels, as they choose, without creating more incompatibilities between tcpdump/libpcap save files from different platforms.
2000-09-17 04:04:36 +00:00
*/
Get rid of the PCAP_ENCAP_ values - if an application uses them, that application won't build with any other version of libpcap, which means that a lot of applications won't use them. In addition, "pcap_linktype()" needs to return DLT_ values, so that platforms that build libpcap as a shared library won't break binary compatibility if they update to this version of libpcap. Instead, we map from DLT_ values to LINKTYPE_ values when writing savefiles, and map from LINKTYPE_ values to DLT_ values when reading savefiles, so that savefiles don't have platform-dependent DLT_ values in the header as the link type, they have platform-independent LINKTYPE_ values. This means we don't need to make DLT_ATM_RFC1483, DLT_RAW, etc. have platform-independent values starting at 100 - only the values in the savefile header need to be like that.
2000-10-12 03:53:57 +00:00
#define DLT_PPP_SERIAL 50 /* PPP over serial with HDLC encapsulation */
Add support for NetBSD DLT_PPP_ETHER, as per the NetBSD libpcap.
2001-04-17 08:10:00 +00:00
#define DLT_PPP_ETHER 51 /* PPP over Ethernet */
Introduce a set of PCAP_ENCAP_ codes to specify packet encapsulations. For those PCAP_ENCAP_ codes corresponding to DLT_ codes that are (believed to be) the same in all BSDs, the PCAP_ENCAP_ codes have the same values as the corresponding DLT_ codes. For those PCAP_ENCAP_ codes corresponding to DLT_ codes that were added in libpcap 0.5 as "non-kernel" DLT_ codes, or had their values changed in libpcap 0.5 in order to cope with the fact that those DLT_ codes have different values in different systems, the PCAP_ENCAP_ codes have the same values as the corresponding DLT_ codes. We add some additional PCAP_ENCAP_ codes to handle IEEE 802.11 (which currently has its link-layer information turned into an Ethernet header by at least some of the BSDs, but John Hawkinson at MIT wants to add a DLT_ value for 802.11 and pass up the full link-layer header) and the Classical IP encapsulation for ATM on Linux (which isn't always the same as DLT_ATM_RFC1483, from what I can tell, alas). "pcap-bpf.c" maps DLT_ codes to PCAP_ENCAP_ codes, so as not to supply to libpcap's callers any DLT_ codes other than the ones that have the same values on all platforms; it supplies PCAP_ENCAP_ codes for all others. In libpcap's "bpf/net/bpf.h", we define the DLT_ values that aren't the same on all platforms with the new values starting at 100 (to keep them out of the way of the values various BSDs might assign to them), as we did in 0.5, but do so only if they're not already defined; platforms with <net/bpf.h> headers that come with the kernel (e.g., the BSDs) should define them with the values that they have always had on that platform, *not* with the values we used in 0.5. (Code using this version of libpcap should check for the new PCAP_ENCAP_ codes; those are given the values that the corresponding DLT_ values had in 0.5, so code that checks for them will handle 0.5 libpcap files correctly even if the platform defines DLT_RAW, say, as something other than 101. If that code also checks for DLT_RAW - which means it can't just use a switch statement, as DLT_RAW might be defined as 101 if the platform doesn't itself define DLT_RAW with some other value - then it will also handle old DLT_RAW captures, as long as they were made on the same platform or on another platform that used the same value for DLT_RAW. It can't handle captures from a platform that uses that value for another DLT_ code, but that's always been the case, and isn't easily fixable.) The intent here is to decouple the values that are returned by "pcap_datalink()" and put into the header of tcpdump/libpcap save files from the DLT_ values returned by BIOCGDLT in BSD kernels, allowing the BSDs to assign values to DLT_ codes, in their kernels, as they choose, without creating more incompatibilities between tcpdump/libpcap save files from different platforms.
2000-09-17 04:04:36 +00:00
LINKTYPE_IEEE802_11 and LINKTYPE_LOOP, and DLT_IEEE802_11, are no longer reserved for future use; they're being used. Move other currently-being-used LINKTYPE_ values above the "reserved for future use" comment, to make it clear which types are reserved and which are already in use. Note that 100 through 103 shouldn't be used for new DLT_ types.
2001-09-09 04:27:18 +00:00
/*
* Values between 100 and 103 are used in capture file headers as
* link-layer types corresponding to DLT_ types that differ
* between platforms; don't use those values for new DLT_ new types.
*/
Introduce a set of PCAP_ENCAP_ codes to specify packet encapsulations. For those PCAP_ENCAP_ codes corresponding to DLT_ codes that are (believed to be) the same in all BSDs, the PCAP_ENCAP_ codes have the same values as the corresponding DLT_ codes. For those PCAP_ENCAP_ codes corresponding to DLT_ codes that were added in libpcap 0.5 as "non-kernel" DLT_ codes, or had their values changed in libpcap 0.5 in order to cope with the fact that those DLT_ codes have different values in different systems, the PCAP_ENCAP_ codes have the same values as the corresponding DLT_ codes. We add some additional PCAP_ENCAP_ codes to handle IEEE 802.11 (which currently has its link-layer information turned into an Ethernet header by at least some of the BSDs, but John Hawkinson at MIT wants to add a DLT_ value for 802.11 and pass up the full link-layer header) and the Classical IP encapsulation for ATM on Linux (which isn't always the same as DLT_ATM_RFC1483, from what I can tell, alas). "pcap-bpf.c" maps DLT_ codes to PCAP_ENCAP_ codes, so as not to supply to libpcap's callers any DLT_ codes other than the ones that have the same values on all platforms; it supplies PCAP_ENCAP_ codes for all others. In libpcap's "bpf/net/bpf.h", we define the DLT_ values that aren't the same on all platforms with the new values starting at 100 (to keep them out of the way of the values various BSDs might assign to them), as we did in 0.5, but do so only if they're not already defined; platforms with <net/bpf.h> headers that come with the kernel (e.g., the BSDs) should define them with the values that they have always had on that platform, *not* with the values we used in 0.5. (Code using this version of libpcap should check for the new PCAP_ENCAP_ codes; those are given the values that the corresponding DLT_ values had in 0.5, so code that checks for them will handle 0.5 libpcap files correctly even if the platform defines DLT_RAW, say, as something other than 101. If that code also checks for DLT_RAW - which means it can't just use a switch statement, as DLT_RAW might be defined as 101 if the platform doesn't itself define DLT_RAW with some other value - then it will also handle old DLT_RAW captures, as long as they were made on the same platform or on another platform that used the same value for DLT_RAW. It can't handle captures from a platform that uses that value for another DLT_ code, but that's always been the case, and isn't easily fixable.) The intent here is to decouple the values that are returned by "pcap_datalink()" and put into the header of tcpdump/libpcap save files from the DLT_ values returned by BIOCGDLT in BSD kernels, allowing the BSDs to assign values to DLT_ codes, in their kernels, as they choose, without creating more incompatibilities between tcpdump/libpcap save files from different platforms.
2000-09-17 04:04:36 +00:00
/*
Get rid of the PCAP_ENCAP_ values - if an application uses them, that application won't build with any other version of libpcap, which means that a lot of applications won't use them. In addition, "pcap_linktype()" needs to return DLT_ values, so that platforms that build libpcap as a shared library won't break binary compatibility if they update to this version of libpcap. Instead, we map from DLT_ values to LINKTYPE_ values when writing savefiles, and map from LINKTYPE_ values to DLT_ values when reading savefiles, so that savefiles don't have platform-dependent DLT_ values in the header as the link type, they have platform-independent LINKTYPE_ values. This means we don't need to make DLT_ATM_RFC1483, DLT_RAW, etc. have platform-independent values starting at 100 - only the values in the savefile header need to be like that.
2000-10-12 03:53:57 +00:00
* This value was defined by libpcap 0.5; platforms that have defined
* it with a different value should define it here with that value -
* a link type of 104 in a save file will be mapped to DLT_C_HDLC,
* whatever value that happens to be, so programs will correctly
* handle files with that link type regardless of the value of
* DLT_C_HDLC.
*
* The name DLT_C_HDLC was used by BSD/OS; we use that name for source
* compatibility with programs written for BSD/OS.
*
* libpcap 0.5 defined it as DLT_CHDLC; we define DLT_CHDLC as well,
* for source compatibility with programs written for libpcap 0.5.
Introduce a set of PCAP_ENCAP_ codes to specify packet encapsulations. For those PCAP_ENCAP_ codes corresponding to DLT_ codes that are (believed to be) the same in all BSDs, the PCAP_ENCAP_ codes have the same values as the corresponding DLT_ codes. For those PCAP_ENCAP_ codes corresponding to DLT_ codes that were added in libpcap 0.5 as "non-kernel" DLT_ codes, or had their values changed in libpcap 0.5 in order to cope with the fact that those DLT_ codes have different values in different systems, the PCAP_ENCAP_ codes have the same values as the corresponding DLT_ codes. We add some additional PCAP_ENCAP_ codes to handle IEEE 802.11 (which currently has its link-layer information turned into an Ethernet header by at least some of the BSDs, but John Hawkinson at MIT wants to add a DLT_ value for 802.11 and pass up the full link-layer header) and the Classical IP encapsulation for ATM on Linux (which isn't always the same as DLT_ATM_RFC1483, from what I can tell, alas). "pcap-bpf.c" maps DLT_ codes to PCAP_ENCAP_ codes, so as not to supply to libpcap's callers any DLT_ codes other than the ones that have the same values on all platforms; it supplies PCAP_ENCAP_ codes for all others. In libpcap's "bpf/net/bpf.h", we define the DLT_ values that aren't the same on all platforms with the new values starting at 100 (to keep them out of the way of the values various BSDs might assign to them), as we did in 0.5, but do so only if they're not already defined; platforms with <net/bpf.h> headers that come with the kernel (e.g., the BSDs) should define them with the values that they have always had on that platform, *not* with the values we used in 0.5. (Code using this version of libpcap should check for the new PCAP_ENCAP_ codes; those are given the values that the corresponding DLT_ values had in 0.5, so code that checks for them will handle 0.5 libpcap files correctly even if the platform defines DLT_RAW, say, as something other than 101. If that code also checks for DLT_RAW - which means it can't just use a switch statement, as DLT_RAW might be defined as 101 if the platform doesn't itself define DLT_RAW with some other value - then it will also handle old DLT_RAW captures, as long as they were made on the same platform or on another platform that used the same value for DLT_RAW. It can't handle captures from a platform that uses that value for another DLT_ code, but that's always been the case, and isn't easily fixable.) The intent here is to decouple the values that are returned by "pcap_datalink()" and put into the header of tcpdump/libpcap save files from the DLT_ values returned by BIOCGDLT in BSD kernels, allowing the BSDs to assign values to DLT_ codes, in their kernels, as they choose, without creating more incompatibilities between tcpdump/libpcap save files from different platforms.
2000-09-17 04:04:36 +00:00
*/
Get rid of the PCAP_ENCAP_ values - if an application uses them, that application won't build with any other version of libpcap, which means that a lot of applications won't use them. In addition, "pcap_linktype()" needs to return DLT_ values, so that platforms that build libpcap as a shared library won't break binary compatibility if they update to this version of libpcap. Instead, we map from DLT_ values to LINKTYPE_ values when writing savefiles, and map from LINKTYPE_ values to DLT_ values when reading savefiles, so that savefiles don't have platform-dependent DLT_ values in the header as the link type, they have platform-independent LINKTYPE_ values. This means we don't need to make DLT_ATM_RFC1483, DLT_RAW, etc. have platform-independent values starting at 100 - only the values in the savefile header need to be like that.
2000-10-12 03:53:57 +00:00
#define DLT_C_HDLC 104 /* Cisco HDLC */
#define DLT_CHDLC DLT_C_HDLC
Initial revision
1999-10-07 23:46:40 +00:00
Add a DLT_IEEE802_11 for use by any platform that provides raw 802.11 link-layer headers on capture. (Nothing uses it yet, but hopefully this will make it less likely that they'll use different DLT_ names or values.)
2000-11-15 05:36:48 +00:00
#define DLT_IEEE802_11 105 /* IEEE 802.11 wireless */
Handle DLT_NULL correctly - the AF_ value is in host byte order, which means that we should "htonl()" it before using it in BPF expressions *but*, if we're reading a capture file from a machine with the opposite byte order from ours, we should byte-swap it before "htonl()"ing it. Handle OpenBSD DLT_LOOP as well - it's like DLT_NULL except that the AF_ value is in *network* byte order. Don't support checking for inbound or outbound packets except on those data link types that supply an inbound/outbound qualifier (DLT_SLIP and DLT_PPP) - this came from OpenBSD's libpcap, delta 1.12 to "gencode.c".
2000-12-16 21:31:10 +00:00
/*
* Values between 106 and 107 are used in capture file headers as
* link-layer types corresponding to DLT_ types that might differ
* between platforms; don't use those values for new DLT_ new types.
*/
/*
* OpenBSD DLT_LOOP, for loopback devices; it's like DLT_NULL, except
* that the AF_ type in the link-layer header is in network byte order.
*
* OpenBSD defines it as 12, but that collides with DLT_RAW, so we
* define it as 108 here. If OpenBSD picks up this file, it should
* define DLT_LOOP as 12 in its version, as per the comment above -
Reserve 116 for IP Filter capture files and 117 for OpenBSD DLT_PFLOG.
2001-09-09 05:02:28 +00:00
* and should not use 108 as a DLT_ value.
Handle DLT_NULL correctly - the AF_ value is in host byte order, which means that we should "htonl()" it before using it in BPF expressions *but*, if we're reading a capture file from a machine with the opposite byte order from ours, we should byte-swap it before "htonl()"ing it. Handle OpenBSD DLT_LOOP as well - it's like DLT_NULL except that the AF_ value is in *network* byte order. Don't support checking for inbound or outbound packets except on those data link types that supply an inbound/outbound qualifier (DLT_SLIP and DLT_PPP) - this came from OpenBSD's libpcap, delta 1.12 to "gencode.c".
2000-12-16 21:31:10 +00:00
*/
#define DLT_LOOP 108
/*
Use 50, not 113, for the link layer type in NetBSD DLT_PPP_SERIAL capture files; NetBSD uses 50, and, hopefully, nobody else will use 50 for something else.
2000-12-16 22:19:12 +00:00
* Values between 109 and 112 are used in capture file headers as
Handle DLT_NULL correctly - the AF_ value is in host byte order, which means that we should "htonl()" it before using it in BPF expressions *but*, if we're reading a capture file from a machine with the opposite byte order from ours, we should byte-swap it before "htonl()"ing it. Handle OpenBSD DLT_LOOP as well - it's like DLT_NULL except that the AF_ value is in *network* byte order. Don't support checking for inbound or outbound packets except on those data link types that supply an inbound/outbound qualifier (DLT_SLIP and DLT_PPP) - this came from OpenBSD's libpcap, delta 1.12 to "gencode.c".
2000-12-16 21:31:10 +00:00
* link-layer types corresponding to DLT_ types that might differ
Reserve 116 for IP Filter capture files and 117 for OpenBSD DLT_PFLOG.
2001-09-09 05:02:28 +00:00
* between platforms; don't use those values for new DLT_ types
* other than the corresponding DLT_ types.
Handle DLT_NULL correctly - the AF_ value is in host byte order, which means that we should "htonl()" it before using it in BPF expressions *but*, if we're reading a capture file from a machine with the opposite byte order from ours, we should byte-swap it before "htonl()"ing it. Handle OpenBSD DLT_LOOP as well - it's like DLT_NULL except that the AF_ value is in *network* byte order. Don't support checking for inbound or outbound packets except on those data link types that supply an inbound/outbound qualifier (DLT_SLIP and DLT_PPP) - this came from OpenBSD's libpcap, delta 1.12 to "gencode.c".
2000-12-16 21:31:10 +00:00
*/
Initial revision
1999-10-07 23:46:40 +00:00
/*
Add support for a new link layer type DLT_LINUX_SLL, for use when doing live captures with a "cooked" (SOCK_DGRAM) rather than a "raw" (SOCK_RAW) PF_PACKET socket; it includes a bunch of the fields from the "struct sockaddr_ll" you get in a "recvfrom()", including the Ethernet protocol field. This requires us to rewrite the BPF program if we're stuffing it into the kernel; as long as we're doing *ex post facto* rewriting, we might as well also do the "ret <snaplen>" -> "ret 65535" fixup there as well, rather than in the code generator.
2000-12-21 10:29:21 +00:00
* This is for Linux cooked sockets.
*/
#define DLT_LINUX_SLL 113
DLT_ value and capture file header LINKTYPE_ value reserved for Apple LocalTalk hardware.
2001-06-05 03:09:39 +00:00
/*
* Apple LocalTalk hardware.
*/
#define DLT_LTALK 114
Add a DLT_ value and a link-layer type value for savefiles for Acorn Econet.
2001-09-05 04:27:23 +00:00
/*
* Acorn Econet.
*/
#define DLT_ECONET 115
Reserve 116 for IP Filter capture files and 117 for OpenBSD DLT_PFLOG.
2001-09-09 05:02:28 +00:00
/*
Reserve DLT_ type 118 for Cisco internal use, as per a request from Gilbert Ramirez of Cisco. More explicitly reserve 116 and 117 as well.
2001-11-02 08:03:39 +00:00
* Reserved for use with OpenBSD ipfilter.
*/
#define DLT_IPFILTER 116
/*
* Reserved for use in capture-file headers as a link-layer type
* corresponding to OpenBSD DLT_PFLOG; DLT_PFLOG is 17 in OpenBSD,
* but that's DLT_LANE8023 in SuSE 6.3, so we can't use 17 for it
* in capture-file headers.
*/
#define DLT_PFLOG 117
/*
* Registered for Cisco-internal use.
Reserve 116 for IP Filter capture files and 117 for OpenBSD DLT_PFLOG.
2001-09-09 05:02:28 +00:00
*/
Reserve DLT_ type 118 for Cisco internal use, as per a request from Gilbert Ramirez of Cisco. More explicitly reserve 116 and 117 as well.
2001-11-02 08:03:39 +00:00
#define DLT_CISCO_IOS 118
Reserve 116 for IP Filter capture files and 117 for OpenBSD DLT_PFLOG.
2001-09-09 05:02:28 +00:00
Reserve link-layer types for Prism II 802.11 chip monitor mode information plus 802.11 header (as per Tim Newsham's stuff) and for some flavor of Aironet 802.11 link-layer header (as per Doug Ambrisko's FreeBSD patches).
2001-11-28 05:50:05 +00:00
/*
* Reserved for 802.11 cards using the Prism II chips, with a link-layer
* header including Prism monitor mode information plus an 802.11
* header.
*/
#define DLT_PRISM_HEADER 119
/*
* Reserved for Aironet 802.11 cards, with an Aironet link-layer header
* (see Doug Ambrisko's FreeBSD patches).
*/
#define DLT_AIRONET_HEADER 120
Link-layer type 121 reserved for Siemens HiPath HDLC, as per a request from Tomas Kukosa <tomas.kukosa@anfdata.cz>.
2002-01-25 08:27:33 +00:00
/*
* Reserved for Siemens HiPath HDLC.
*/
#define DLT_HHDLC 121
Add a DLT_ value for Fibre Channel, as per a request from Don Lee <donlee@cray.com>.
2002-03-08 11:16:34 +00:00
/*
Don Lee was doing IP-over-FC, with the link-layer header from the capture device having only an RFC 2625 Network_Header field, not a Fibre Channel frame header; rename the constants to emphasize this and to leave room for another "raw Fibre Channel" link-layer type, if it's ever needed.
2002-04-20 21:01:57 +00:00
* Reserved for RFC 2625 IP-over-Fibre Channel, as per a request from
* Don Lee <donlee@cray.com>.
*
* This is not for use with raw Fibre Channel, where the link-layer
* header starts with a Fibre Channel frame header; it's for IP-over-FC,
* where the link-layer header starts with an RFC 2625 Network_Header
* field.
Add a DLT_ value for Fibre Channel, as per a request from Don Lee <donlee@cray.com>.
2002-03-08 11:16:34 +00:00
*/
Don Lee was doing IP-over-FC, with the link-layer header from the capture device having only an RFC 2625 Network_Header field, not a Fibre Channel frame header; rename the constants to emphasize this and to leave room for another "raw Fibre Channel" link-layer type, if it's ever needed.
2002-04-20 21:01:57 +00:00
#define DLT_IP_OVER_FC 122
Add a DLT_ value for Fibre Channel, as per a request from Don Lee <donlee@cray.com>.
2002-03-08 11:16:34 +00:00
Reserve a DLT_ value for capturing on Solaris with SunATM.
2002-06-06 08:57:03 +00:00
/*
* Reserved for capturing on Solaris with SunATM.
*/
#define DLT_SUNATM 123 /* Solaris+SunATM */
Reserve a DLT_ value for Frame Relay, and map BSD/OS's DLT_FR to it.
2002-06-07 04:17:15 +00:00
/*
* Reserved for Frame Relay; BSD/OS has a DLT_FR, with a value of 11,
* but that collides with other values.
*/
#define DLT_FRELAY 124
Add support for a new link layer type DLT_LINUX_SLL, for use when doing live captures with a "cooked" (SOCK_DGRAM) rather than a "raw" (SOCK_RAW) PF_PACKET socket; it includes a bunch of the fields from the "struct sockaddr_ll" you get in a "recvfrom()", including the Ethernet protocol field. This requires us to rewrite the BPF program if we're stuffing it into the kernel; as long as we're doing *ex post facto* rewriting, we might as well also do the "ret <snaplen>" -> "ret 65535" fixup there as well, rather than in the code generator.
2000-12-21 10:29:21 +00:00
/*
* The instruction encodings.
Initial revision
1999-10-07 23:46:40 +00:00
*/
/* instruction classes */
#define BPF_CLASS(code) ((code) & 0x07)
#define BPF_LD 0x00
#define BPF_LDX 0x01
#define BPF_ST 0x02
#define BPF_STX 0x03
#define BPF_ALU 0x04
#define BPF_JMP 0x05
#define BPF_RET 0x06
#define BPF_MISC 0x07
/* ld/ldx fields */
#define BPF_SIZE(code) ((code) & 0x18)
#define BPF_W 0x00
#define BPF_H 0x08
#define BPF_B 0x10
#define BPF_MODE(code) ((code) & 0xe0)
#define BPF_IMM 0x00
#define BPF_ABS 0x20
#define BPF_IND 0x40
#define BPF_MEM 0x60
#define BPF_LEN 0x80
#define BPF_MSH 0xa0
/* alu/jmp fields */
#define BPF_OP(code) ((code) & 0xf0)
#define BPF_ADD 0x00
#define BPF_SUB 0x10
#define BPF_MUL 0x20
#define BPF_DIV 0x30
#define BPF_OR 0x40
#define BPF_AND 0x50
#define BPF_LSH 0x60
#define BPF_RSH 0x70
#define BPF_NEG 0x80
#define BPF_JA 0x00
#define BPF_JEQ 0x10
#define BPF_JGT 0x20
#define BPF_JGE 0x30
#define BPF_JSET 0x40
#define BPF_SRC(code) ((code) & 0x08)
#define BPF_K 0x00
#define BPF_X 0x08
/* ret - BPF_K and BPF_X also apply */
#define BPF_RVAL(code) ((code) & 0x18)
#define BPF_A 0x10
/* misc */
#define BPF_MISCOP(code) ((code) & 0xf8)
#define BPF_TAX 0x00
#define BPF_TXA 0x80
/*
* The instruction data structure.
*/
struct bpf_insn {
u_short code;
u_char jt;
u_char jf;
bpf_int32 k;
};
/*
* Macros for insn array initializers.
*/
#define BPF_STMT(code, k) { (u_short)(code), 0, 0, k }
#define BPF_JUMP(code, k, jt, jf) { (u_short)(code), jt, jf, k }
handle both KERNEL and _KERNEL. add prototypes for functions. From Darren Reed <darrenr@reed.wattle.id.au>
2000-06-26 04:56:28 +00:00
#if defined(BSD) && (defined(KERNEL) || defined(_KERNEL))
/*
* Systems based on non-BSD kernels don't have ifnet's (or they don't mean
* anything if it is in <net/if.h>) and won't work like this.
*/
# if __STDC__
extern void bpf_tap(struct ifnet *, u_char *, u_int);
extern void bpf_mtap(struct ifnet *, struct mbuf *);
extern void bpfattach(struct ifnet *, u_int, u_int);
extern void bpfilterattach(int);
# else
Initial revision
1999-10-07 23:46:40 +00:00
extern void bpf_tap();
extern void bpf_mtap();
handle both KERNEL and _KERNEL. add prototypes for functions. From Darren Reed <darrenr@reed.wattle.id.au>
2000-06-26 04:56:28 +00:00
extern void bpfattach();
extern void bpfilterattach();
# endif /* __STDC__ */
#endif /* BSD && (_KERNEL || KERNEL) */
Throw in #ifdef __cplusplus extern "C" { #endif and change #if __STDC__ to #if __STDC__ || defined(__cplusplus) around the non-kernel function prototypes, so they work right when compiling with C++.
2002-04-20 10:02:16 +00:00
#if __STDC__ || defined(__cplusplus)
handle both KERNEL and _KERNEL. add prototypes for functions. From Darren Reed <darrenr@reed.wattle.id.au>
2000-06-26 04:56:28 +00:00
extern int bpf_validate(struct bpf_insn *, int);
Initial revision
1999-10-07 23:46:40 +00:00
extern u_int bpf_filter(struct bpf_insn *, u_char *, u_int, u_int);
handle both KERNEL and _KERNEL. add prototypes for functions. From Darren Reed <darrenr@reed.wattle.id.au>
2000-06-26 04:56:28 +00:00
#else
extern int bpf_validate();
extern u_int bpf_filter();
Initial revision
1999-10-07 23:46:40 +00:00
#endif
/*
* Number of scratch memory words (for BPF_LD|BPF_MEM and BPF_ST).
*/
#define BPF_MEMWORDS 16
Throw in #ifdef __cplusplus extern "C" { #endif and change #if __STDC__ to #if __STDC__ || defined(__cplusplus) around the non-kernel function prototypes, so they work right when compiling with C++.
2002-04-20 10:02:16 +00:00
#ifdef __cplusplus
}
#endif
Initial revision
1999-10-07 23:46:40 +00:00
#endif