1/*
2 * Copyright (c) 2000-2018 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28/*
29 * Copyright (c) 1990, 1991, 1993
30 * The Regents of the University of California. All rights reserved.
31 *
32 * This code is derived from the Stanford/CMU enet packet filter,
33 * (net/enet.c) distributed as part of 4.3BSD, and code contributed
34 * to Berkeley by Steven McCanne and Van Jacobson both of Lawrence
35 * Berkeley Laboratory.
36 *
37 * Redistribution and use in source and binary forms, with or without
38 * modification, are permitted provided that the following conditions
39 * are met:
40 * 1. Redistributions of source code must retain the above copyright
41 * notice, this list of conditions and the following disclaimer.
42 * 2. Redistributions in binary form must reproduce the above copyright
43 * notice, this list of conditions and the following disclaimer in the
44 * documentation and/or other materials provided with the distribution.
45 * 3. All advertising materials mentioning features or use of this software
46 * must display the following acknowledgement:
47 * This product includes software developed by the University of
48 * California, Berkeley and its contributors.
49 * 4. Neither the name of the University nor the names of its contributors
50 * may be used to endorse or promote products derived from this software
51 * without specific prior written permission.
52 *
53 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
54 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
55 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
56 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
57 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
58 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
59 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
60 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
61 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
62 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
63 * SUCH DAMAGE.
64 *
65 * @(#)bpf.h 8.1 (Berkeley) 6/10/93
66 * @(#)bpf.h 1.34 (LBL) 6/16/96
67 *
68 * $FreeBSD: src/sys/net/bpf.h,v 1.21.2.3 2001/08/01 00:23:13 fenner Exp $
69 */
70/*
71 * NOTICE: This file was modified by SPARTA, Inc. in 2006 to introduce
72 * support for mandatory and extensible security protections. This notice
73 * is included in support of clause 2.2 (b) of the Apple Public License,
74 * Version 2.0.
75 */
76
77#ifndef _NET_BPF_H_
78#define _NET_BPF_H_
79#include <sys/param.h>
80#include <sys/appleapiopts.h>
81#include <sys/types.h>
82#include <sys/time.h>
83#include <sys/cdefs.h>
84#include <stdint.h>
85
86#ifdef PRIVATE
87#include <net/if_var.h>
88#include <uuid/uuid.h>
89
90struct bpf_setup_args {
91 uuid_t bsa_uuid;
92 char bsa_ifname[IFNAMSIZ];
93};
94#endif /* PRIVATE */
95
96#ifdef KERNEL
97#include <sys/kernel_types.h>
98
99#if !defined(__i386__) && !defined(__x86_64__)
100#define BPF_ALIGN 1
101#else /* defined(__i386__) || defined(__x86_64__) */
102#define BPF_ALIGN 0
103#endif /* defined(__i386__) || defined(__x86_64__) */
104
105#if !BPF_ALIGN
106#define EXTRACT_SHORT(p) ((u_int16_t)ntohs(*(u_int16_t *)(void *)p))
107#define EXTRACT_LONG(p) (ntohl(*(u_int32_t *)(void *)p))
108#else
109#define EXTRACT_SHORT(p)\
110 ((u_int16_t)\
111 ((u_int16_t)*((u_char *)p+0)<<8|\
112 (u_int16_t)*((u_char *)p+1)<<0))
113#define EXTRACT_LONG(p)\
114 ((u_int32_t)*((u_char *)p+0)<<24|\
115 (u_int32_t)*((u_char *)p+1)<<16|\
116 (u_int32_t)*((u_char *)p+2)<<8|\
117 (u_int32_t)*((u_char *)p+3)<<0)
118#endif
119
120#endif /* KERNEL */
121
122/* BSD style release date */
123#define BPF_RELEASE 199606
124
125typedef int32_t bpf_int32;
126typedef u_int32_t bpf_u_int32;
127
128/*
129 * Alignment macros. BPF_WORDALIGN rounds up to the next
130 * even multiple of BPF_ALIGNMENT.
131 */
132#define BPF_ALIGNMENT sizeof(int32_t)
133#define BPF_WORDALIGN(x) (((x)+(BPF_ALIGNMENT-1))&~(BPF_ALIGNMENT-1))
134
135#define BPF_MAXINSNS 512
136#define BPF_MAXBUFSIZE 0x80000
137#define BPF_MINBUFSIZE 32
138
139/*
140 * Structure for BIOCSETF.
141 */
142struct bpf_program {
143 u_int bf_len;
144 struct bpf_insn *bf_insns;
145};
146
147#ifdef KERNEL_PRIVATE
148/*
149 * LP64 version of bpf_program. all pointers
150 * grow when we're dealing with a 64-bit process.
151 * WARNING - keep in sync with bpf_program
152 */
153struct bpf_program64 {
154 u_int bf_len;
155 user64_addr_t bf_insns __attribute__((aligned(8)));
156};
157
158struct bpf_program32 {
159 u_int bf_len;
160 user32_addr_t bf_insns;
161};
162#endif /* KERNEL_PRIVATE */
163
164/*
165 * Struct returned by BIOCGSTATS.
166 */
167struct bpf_stat {
168 u_int bs_recv; /* number of packets received */
169 u_int bs_drop; /* number of packets dropped */
170};
171
172/*
173 * Struct return by BIOCVERSION. This represents the version number of
174 * the filter language described by the instruction encodings below.
175 * bpf understands a program iff kernel_major == filter_major &&
176 * kernel_minor >= filter_minor, that is, if the value returned by the
177 * running kernel has the same major number and a minor number equal
178 * equal to or less than the filter being downloaded. Otherwise, the
179 * results are undefined, meaning an error may be returned or packets
180 * may be accepted haphazardly.
181 * It has nothing to do with the source code version.
182 */
183struct bpf_version {
184 u_short bv_major;
185 u_short bv_minor;
186};
187#if defined(__LP64__)
188#include <sys/_types/_timeval32.h>
189
190#define BPF_TIMEVAL timeval32
191#else
192#define BPF_TIMEVAL timeval
193#endif /* __LP64__ */
194/* Current version number of filter architecture. */
195#define BPF_MAJOR_VERSION 1
196#define BPF_MINOR_VERSION 1
197
198#define BIOCGBLEN _IOR('B',102, u_int)
199#define BIOCSBLEN _IOWR('B',102, u_int)
200#define BIOCSETF _IOW('B',103, struct bpf_program)
201#ifdef KERNEL_PRIVATE
202#define BIOCSETF64 _IOW('B',103, struct bpf_program64)
203#define BIOCSETF32 _IOW('B',103, struct bpf_program32)
204#endif /* KERNEL_PRIVATE */
205#define BIOCFLUSH _IO('B',104)
206#define BIOCPROMISC _IO('B',105)
207#define BIOCGDLT _IOR('B',106, u_int)
208#define BIOCGETIF _IOR('B',107, struct ifreq)
209#define BIOCSETIF _IOW('B',108, struct ifreq)
210#define BIOCSRTIMEOUT _IOW('B',109, struct timeval)
211#ifdef KERNEL_PRIVATE
212#define BIOCSRTIMEOUT64 _IOW('B',109, struct user64_timeval)
213#define BIOCSRTIMEOUT32 _IOW('B',109, struct user32_timeval)
214#endif /* KERNEL_PRIVATE */
215#define BIOCGRTIMEOUT _IOR('B',110, struct timeval)
216#ifdef KERNEL_PRIVATE
217#define BIOCGRTIMEOUT64 _IOR('B',110, struct user64_timeval)
218#define BIOCGRTIMEOUT32 _IOR('B',110, struct user32_timeval)
219#endif /* KERNEL_PRIVATE */
220#define BIOCGSTATS _IOR('B',111, struct bpf_stat)
221#define BIOCIMMEDIATE _IOW('B',112, u_int)
222#define BIOCVERSION _IOR('B',113, struct bpf_version)
223#define BIOCGRSIG _IOR('B',114, u_int)
224#define BIOCSRSIG _IOW('B',115, u_int)
225#define BIOCGHDRCMPLT _IOR('B',116, u_int)
226#define BIOCSHDRCMPLT _IOW('B',117, u_int)
227#define BIOCGSEESENT _IOR('B',118, u_int)
228#define BIOCSSEESENT _IOW('B',119, u_int)
229#define BIOCSDLT _IOW('B',120, u_int)
230#define BIOCGDLTLIST _IOWR('B',121, struct bpf_dltlist)
231#ifdef PRIVATE
232#define BIOCGETTC _IOR('B', 122, int)
233#define BIOCSETTC _IOW('B', 123, int)
234#define BIOCSEXTHDR _IOW('B', 124, u_int)
235#define BIOCGIFATTACHCOUNT _IOWR('B', 125, struct ifreq)
236#endif /* PRIVATE */
237#define BIOCSETFNR _IOW('B', 126, struct bpf_program)
238#ifdef KERNEL_PRIVATE
239#define BIOCSETFNR64 _IOW('B',126, struct bpf_program64)
240#define BIOCSETFNR32 _IOW('B',126, struct bpf_program32)
241#endif /* KERNEL_PRIVATE */
242#ifdef PRIVATE
243#define BIOCGWANTPKTAP _IOR('B', 127, u_int)
244#define BIOCSWANTPKTAP _IOWR('B', 127, u_int)
245#define BIOCSHEADDROP _IOW('B', 128, int)
246#define BIOCGHEADDROP _IOR('B', 128, int)
247#define BIOCSTRUNCATE _IOW('B', 129, u_int)
248#define BIOCGETUUID _IOR('B', 130, uuid_t)
249#define BIOCSETUP _IOW('B', 131, struct bpf_setup_args)
250#define BIOCSPKTHDRV2 _IOW('B', 132, int)
251#define BIOCGPKTHDRV2 _IOW('B', 133, int)
252#endif /* PRIVATE */
253/*
254 * Structure prepended to each packet.
255 */
256struct bpf_hdr {
257 struct BPF_TIMEVAL bh_tstamp; /* time stamp */
258 bpf_u_int32 bh_caplen; /* length of captured portion */
259 bpf_u_int32 bh_datalen; /* original length of packet */
260 u_short bh_hdrlen; /* length of bpf header (this struct
261 plus alignment padding) */
262};
263#ifdef KERNEL
264/*
265 * Because the structure above is not a multiple of 4 bytes, some compilers
266 * will insist on inserting padding; hence, sizeof(struct bpf_hdr) won't work.
267 * Only the kernel needs to know about it; applications use bh_hdrlen.
268 */
269#define SIZEOF_BPF_HDR (sizeof(struct bpf_hdr) <= 20 ? 18 : \
270 sizeof(struct bpf_hdr))
271#endif
272#ifdef PRIVATE
273/*
274 * This structure must be a multiple of 4 bytes.
275 * It includes padding and spare fields that we can use later if desired.
276 */
277struct bpf_hdr_ext {
278 struct BPF_TIMEVAL bh_tstamp; /* time stamp */
279 bpf_u_int32 bh_caplen; /* length of captured portion */
280 bpf_u_int32 bh_datalen; /* original length of packet */
281 u_short bh_hdrlen; /* length of bpf header */
282 u_short bh_flags;
283#define BPF_HDR_EXT_FLAGS_DIR_IN 0x0000
284#define BPF_HDR_EXT_FLAGS_DIR_OUT 0x0001
285 pid_t bh_pid; /* process PID */
286 char bh_comm[MAXCOMLEN+1]; /* process command */
287 u_char _bh_pad2[1];
288 u_char bh_pktflags;
289#define BPF_PKTFLAGS_TCP_REXMT 0x0001
290#define BPF_PKTFLAGS_START_SEQ 0x0002
291#define BPF_PKTFLAGS_LAST_PKT 0x0004
292 u_char bh_proto; /* kernel reserved; 0 in userland */
293 bpf_u_int32 bh_svc; /* service class */
294 bpf_u_int32 bh_flowid; /* kernel reserved; 0 in userland */
295 bpf_u_int32 bh_unsent_bytes; /* unsent bytes at interface */
296 bpf_u_int32 bh_unsent_snd; /* unsent bytes at socket buffer */
297};
298
299#define BPF_CONTROL_NAME "com.apple.net.bpf"
300
301struct bpf_mtag {
302 char bt_comm[MAXCOMLEN];
303 pid_t bt_pid;
304 bpf_u_int32 bt_svc;
305 unsigned char bt_direction;
306#define BPF_MTAG_DIR_IN 0
307#define BPF_MTAG_DIR_OUT 1
308};
309
310#endif /* PRIVATE */
311
312/*
313 * Data-link level type codes.
314 */
315#define DLT_NULL 0 /* no link-layer encapsulation */
316#define DLT_EN10MB 1 /* Ethernet (10Mb) */
317#define DLT_EN3MB 2 /* Experimental Ethernet (3Mb) */
318#define DLT_AX25 3 /* Amateur Radio AX.25 */
319#define DLT_PRONET 4 /* Proteon ProNET Token Ring */
320#define DLT_CHAOS 5 /* Chaos */
321#define DLT_IEEE802 6 /* IEEE 802 Networks */
322#define DLT_ARCNET 7 /* ARCNET */
323#define DLT_SLIP 8 /* Serial Line IP */
324#define DLT_PPP 9 /* Point-to-point Protocol */
325#define DLT_FDDI 10 /* FDDI */
326#define DLT_ATM_RFC1483 11 /* LLC/SNAP encapsulated atm */
327#define DLT_RAW 12 /* raw IP */
328
329/*
330 * These are values from BSD/OS's "bpf.h".
331 * These are not the same as the values from the traditional libpcap
332 * "bpf.h"; however, these values shouldn't be generated by any
333 * OS other than BSD/OS, so the correct values to use here are the
334 * BSD/OS values.
335 *
336 * Platforms that have already assigned these values to other
337 * DLT_ codes, however, should give these codes the values
338 * from that platform, so that programs that use these codes will
339 * continue to compile - even though they won't correctly read
340 * files of these types.
341 */
342#define DLT_SLIP_BSDOS 15 /* BSD/OS Serial Line IP */
343#define DLT_PPP_BSDOS 16 /* BSD/OS Point-to-point Protocol */
344
345/*
346 * 17 was used for DLT_PFLOG in OpenBSD; it no longer is.
347 *
348 * It was DLT_LANE8023 in SuSE 6.3, so we defined LINKTYPE_PFLOG
349 * as 117 so that pflog captures would use a link-layer header type
350 * value that didn't collide with any other values. On all
351 * platforms other than OpenBSD, we defined DLT_PFLOG as 117,
352 * and we mapped between LINKTYPE_PFLOG and DLT_PFLOG.
353 *
354 * OpenBSD eventually switched to using 117 for DLT_PFLOG as well.
355 *
356 * Don't use 17 for anything else.
357 */
358
359/*
360 * 18 is used for DLT_PFSYNC in OpenBSD, NetBSD, DragonFly BSD and
361 * Mac OS X; don't use it for anything else. (FreeBSD uses 121,
362 * which collides with DLT_HHDLC, even though it doesn't use 18
363 * for anything and doesn't appear to have ever used it for anything.)
364 *
365 * We define it as 18 on those platforms; it is, unfortunately, used
366 * for DLT_CIP in Suse 6.3, so we don't define it as DLT_PFSYNC
367 * in general. As the packet format for it, like that for
368 * DLT_PFLOG, is not only OS-dependent but OS-version-dependent,
369 * we don't support printing it in tcpdump except on OSes that
370 * have the relevant header files, so it's not that useful on
371 * other platforms.
372 */
373#define DLT_PFSYNC 18 /* Packet filter state syncing */
374
375#define DLT_ATM_CLIP 19 /* Linux Classical-IP over ATM */
376
377/*
378 * These values are defined by NetBSD; other platforms should refrain from
379 * using them for other purposes, so that NetBSD savefiles with link
380 * types of 50 or 51 can be read as this type on all platforms.
381 */
382#define DLT_PPP_SERIAL 50 /* PPP over serial with HDLC encapsulation */
383#define DLT_PPP_ETHER 51 /* PPP over Ethernet */
384
385/*
386 * The Axent Raptor firewall - now the Symantec Enterprise Firewall - uses
387 * a link-layer type of 99 for the tcpdump it supplies. The link-layer
388 * header has 6 bytes of unknown data, something that appears to be an
389 * Ethernet type, and 36 bytes that appear to be 0 in at least one capture
390 * I've seen.
391 */
392#define DLT_SYMANTEC_FIREWALL 99
393
394/*
395 * Values between 100 and 103 are used in capture file headers as
396 * link-layer header type LINKTYPE_ values corresponding to DLT_ types
397 * that differ between platforms; don't use those values for new DLT_
398 * new types.
399 */
400
401/*
402 * Values starting with 104 are used for newly-assigned link-layer
403 * header type values; for those link-layer header types, the DLT_
404 * value returned by pcap_datalink() and passed to pcap_open_dead(),
405 * and the LINKTYPE_ value that appears in capture files, are the
406 * same.
407 *
408 * DLT_MATCHING_MIN is the lowest such value; DLT_MATCHING_MAX is
409 * the highest such value.
410 */
411#define DLT_MATCHING_MIN 104
412
413/*
414 * This value was defined by libpcap 0.5; platforms that have defined
415 * it with a different value should define it here with that value -
416 * a link type of 104 in a save file will be mapped to DLT_C_HDLC,
417 * whatever value that happens to be, so programs will correctly
418 * handle files with that link type regardless of the value of
419 * DLT_C_HDLC.
420 *
421 * The name DLT_C_HDLC was used by BSD/OS; we use that name for source
422 * compatibility with programs written for BSD/OS.
423 *
424 * libpcap 0.5 defined it as DLT_CHDLC; we define DLT_CHDLC as well,
425 * for source compatibility with programs written for libpcap 0.5.
426 */
427#define DLT_C_HDLC 104 /* Cisco HDLC */
428#define DLT_CHDLC DLT_C_HDLC
429
430#define DLT_IEEE802_11 105 /* IEEE 802.11 wireless */
431
432/*
433 * Values between 106 and 107 are used in capture file headers as
434 * link-layer types corresponding to DLT_ types that might differ
435 * between platforms; don't use those values for new DLT_ new types.
436 */
437
438/*
439 * Frame Relay; BSD/OS has a DLT_FR with a value of 11, but that collides
440 * with other values.
441 * DLT_FR and DLT_FRELAY packets start with the Q.922 Frame Relay header
442 * (DLCI, etc.).
443 */
444#define DLT_FRELAY 107
445
446/*
447 * OpenBSD DLT_LOOP, for loopback devices; it's like DLT_NULL, except
448 * that the AF_ type in the link-layer header is in network byte order.
449 *
450 * OpenBSD defines it as 12, but that collides with DLT_RAW, so we
451 * define it as 108 here. If OpenBSD picks up this file, it should
452 * define DLT_LOOP as 12 in its version, as per the comment above -
453 * and should not use 108 for any purpose.
454 */
455#define DLT_LOOP 108
456
457/*
458 * Values between 109 and 112 are used in capture file headers as
459 * link-layer types corresponding to DLT_ types that might differ
460 * between platforms; don't use those values for new DLT_ new types.
461 */
462
463/*
464 * Encapsulated packets for IPsec; DLT_ENC is 13 in OpenBSD, but that's
465 * DLT_SLIP_BSDOS in NetBSD, so we don't use 13 for it in OSes other
466 * than OpenBSD.
467 */
468#define DLT_ENC 109
469
470/*
471 * This is for Linux cooked sockets.
472 */
473#define DLT_LINUX_SLL 113
474
475/*
476 * Apple LocalTalk hardware.
477 */
478#define DLT_LTALK 114
479
480/*
481 * Acorn Econet.
482 */
483#define DLT_ECONET 115
484
485/*
486 * Reserved for use with OpenBSD ipfilter.
487 */
488#define DLT_IPFILTER 116
489
490/*
491 * For use in capture-file headers as a link-layer type corresponding
492 * to OpenBSD PF (Packet Filter) log.
493 */
494#define DLT_PFLOG 117
495
496/*
497 * Registered for Cisco-internal use.
498 */
499#define DLT_CISCO_IOS 118
500
501/*
502 * Reserved for 802.11 cards using the Prism II chips, with a link-layer
503 * header including Prism monitor mode information plus an 802.11
504 * header.
505 */
506#define DLT_PRISM_HEADER 119
507
508/*
509 * Reserved for Aironet 802.11 cards, with an Aironet link-layer header
510 * (see Doug Ambrisko's FreeBSD patches).
511 */
512#define DLT_AIRONET_HEADER 120
513
514/*
515 * Reserved for Siemens HiPath HDLC. XXX
516 */
517#define DLT_HHDLC 121
518
519/*
520 * Reserved for RFC 2625 IP-over-Fibre Channel.
521 */
522#define DLT_IP_OVER_FC 122
523
524/*
525 * Reserved for Full Frontal ATM on Solaris.
526 */
527#define DLT_SUNATM 123
528
529/*
530 * Reserved as per request from Kent Dahlgren <kent@praesum.com>
531 * for private use.
532 */
533#define DLT_RIO 124 /* RapidIO */
534#define DLT_PCI_EXP 125 /* PCI Express */
535#define DLT_AURORA 126 /* Xilinx Aurora link layer */
536
537/*
538 * BSD header for 802.11 plus a number of bits of link-layer information
539 * including radio information.
540 */
541#ifndef DLT_IEEE802_11_RADIO
542#define DLT_IEEE802_11_RADIO 127
543#endif
544
545/*
546 * Reserved for TZSP encapsulation.
547 */
548#define DLT_TZSP 128 /* Tazmen Sniffer Protocol */
549
550/*
551 * Reserved for Linux ARCNET.
552 */
553#define DLT_ARCNET_LINUX 129
554
555/*
556 * Juniper-private data link types.
557 */
558#define DLT_JUNIPER_MLPPP 130
559#define DLT_JUNIPER_MLFR 131
560#define DLT_JUNIPER_ES 132
561#define DLT_JUNIPER_GGSN 133
562#define DLT_JUNIPER_MFR 134
563#define DLT_JUNIPER_ATM2 135
564#define DLT_JUNIPER_SERVICES 136
565#define DLT_JUNIPER_ATM1 137
566
567/*
568 * Apple IP-over-IEEE 1394, as per a request from Dieter Siegmund
569 * <dieter@apple.com>. The header that's presented is an Ethernet-like
570 * header:
571 *
572 * #define FIREWIRE_EUI64_LEN 8
573 * struct firewire_header {
574 * u_char firewire_dhost[FIREWIRE_EUI64_LEN];
575 * u_char firewire_shost[FIREWIRE_EUI64_LEN];
576 * u_short firewire_type;
577 * };
578 *
579 * with "firewire_type" being an Ethernet type value, rather than,
580 * for example, raw GASP frames being handed up.
581 */
582#define DLT_APPLE_IP_OVER_IEEE1394 138
583
584/*
585 * Various SS7 encapsulations, as per a request from Jeff Morriss
586 * <jeff.morriss[AT]ulticom.com> and subsequent discussions.
587 */
588#define DLT_MTP2_WITH_PHDR 139 /* pseudo-header with various info, followed by MTP2 */
589#define DLT_MTP2 140 /* MTP2, without pseudo-header */
590#define DLT_MTP3 141 /* MTP3, without pseudo-header or MTP2 */
591#define DLT_SCCP 142 /* SCCP, without pseudo-header or MTP2 or MTP3 */
592
593/*
594 * Reserved for DOCSIS.
595 */
596#define DLT_DOCSIS 143
597
598/*
599 * Reserved for Linux IrDA.
600 */
601#define DLT_LINUX_IRDA 144
602
603/*
604 * Reserved for IBM SP switch and IBM Next Federation switch.
605 */
606#define DLT_IBM_SP 145
607#define DLT_IBM_SN 146
608
609/*
610 * Reserved for private use. If you have some link-layer header type
611 * that you want to use within your organization, with the capture files
612 * using that link-layer header type not ever be sent outside your
613 * organization, you can use these values.
614 *
615 * No libpcap release will use these for any purpose, nor will any
616 * tcpdump release use them, either.
617 *
618 * Do *NOT* use these in capture files that you expect anybody not using
619 * your private versions of capture-file-reading tools to read; in
620 * particular, do *NOT* use them in products, otherwise you may find that
621 * people won't be able to use tcpdump, or snort, or Ethereal, or... to
622 * read capture files from your firewall/intrusion detection/traffic
623 * monitoring/etc. appliance, or whatever product uses that DLT_ value,
624 * and you may also find that the developers of those applications will
625 * not accept patches to let them read those files.
626 *
627 * Also, do not use them if somebody might send you a capture using them
628 * for *their* private type and tools using them for *your* private type
629 * would have to read them.
630 *
631 * Instead, ask "tcpdump-workers@tcpdump.org" for a new DLT_ value,
632 * as per the comment above, and use the type you're given.
633 */
634#define DLT_USER0 147
635#define DLT_USER1 148
636#define DLT_USER2 149
637#define DLT_USER3 150
638#define DLT_USER4 151
639#define DLT_USER5 152
640#define DLT_USER6 153
641#define DLT_USER7 154
642#define DLT_USER8 155
643#define DLT_USER9 156
644#define DLT_USER10 157
645#define DLT_USER11 158
646#define DLT_USER12 159
647#define DLT_USER13 160
648#define DLT_USER14 161
649#define DLT_USER15 162
650
651#ifdef PRIVATE
652/*
653 * For Apple private usage
654 */
655#define DLT_USER0_APPLE_INTERNAL DLT_USER0 /* rdar://12019509 */
656#define DLT_USER1_APPLE_INTERNAL DLT_USER1 /* rdar://12019509 */
657#define DLT_PKTAP DLT_USER2 /* rdar://11779467 */
658#define DLT_USER3_APPLE_INTERNAL DLT_USER3 /* rdar://19614531 */
659#define DLT_USER4_APPLE_INTERNAL DLT_USER4 /* rdar://19614531 */
660#endif /* PRIVATE */
661
662/*
663 * For future use with 802.11 captures - defined by AbsoluteValue
664 * Systems to store a number of bits of link-layer information
665 * including radio information:
666 *
667 * http://www.shaftnet.org/~pizza/software/capturefrm.txt
668 *
669 * but it might be used by some non-AVS drivers now or in the
670 * future.
671 */
672#define DLT_IEEE802_11_RADIO_AVS 163 /* 802.11 plus AVS radio header */
673
674/*
675 * Juniper-private data link type, as per request from
676 * Hannes Gredler <hannes@juniper.net>. The DLT_s are used
677 * for passing on chassis-internal metainformation such as
678 * QOS profiles, etc..
679 */
680#define DLT_JUNIPER_MONITOR 164
681
682/*
683 * Reserved for BACnet MS/TP.
684 */
685#define DLT_BACNET_MS_TP 165
686
687/*
688 * Another PPP variant as per request from Karsten Keil <kkeil@suse.de>.
689 *
690 * This is used in some OSes to allow a kernel socket filter to distinguish
691 * between incoming and outgoing packets, on a socket intended to
692 * supply pppd with outgoing packets so it can do dial-on-demand and
693 * hangup-on-lack-of-demand; incoming packets are filtered out so they
694 * don't cause pppd to hold the connection up (you don't want random
695 * input packets such as port scans, packets from old lost connections,
696 * etc. to force the connection to stay up).
697 *
698 * The first byte of the PPP header (0xff03) is modified to accomodate
699 * the direction - 0x00 = IN, 0x01 = OUT.
700 */
701#define DLT_PPP_PPPD 166
702
703/*
704 * Names for backwards compatibility with older versions of some PPP
705 * software; new software should use DLT_PPP_PPPD.
706 */
707#define DLT_PPP_WITH_DIRECTION DLT_PPP_PPPD
708#define DLT_LINUX_PPP_WITHDIRECTION DLT_PPP_PPPD
709
710/*
711 * Juniper-private data link type, as per request from
712 * Hannes Gredler <hannes@juniper.net>. The DLT_s are used
713 * for passing on chassis-internal metainformation such as
714 * QOS profiles, cookies, etc..
715 */
716#define DLT_JUNIPER_PPPOE 167
717#define DLT_JUNIPER_PPPOE_ATM 168
718
719#define DLT_GPRS_LLC 169 /* GPRS LLC */
720#define DLT_GPF_T 170 /* GPF-T (ITU-T G.7041/Y.1303) */
721#define DLT_GPF_F 171 /* GPF-F (ITU-T G.7041/Y.1303) */
722
723/*
724 * Requested by Oolan Zimmer <oz@gcom.com> for use in Gcom's T1/E1 line
725 * monitoring equipment.
726 */
727#define DLT_GCOM_T1E1 172
728#define DLT_GCOM_SERIAL 173
729
730/*
731 * Juniper-private data link type, as per request from
732 * Hannes Gredler <hannes@juniper.net>. The DLT_ is used
733 * for internal communication to Physical Interface Cards (PIC)
734 */
735#define DLT_JUNIPER_PIC_PEER 174
736
737/*
738 * Link types requested by Gregor Maier <gregor@endace.com> of Endace
739 * Measurement Systems. They add an ERF header (see
740 * http://www.endace.com/support/EndaceRecordFormat.pdf) in front of
741 * the link-layer header.
742 */
743#define DLT_ERF_ETH 175 /* Ethernet */
744#define DLT_ERF_POS 176 /* Packet-over-SONET */
745
746/*
747 * Requested by Daniele Orlandi <daniele@orlandi.com> for raw LAPD
748 * for vISDN (http://www.orlandi.com/visdn/). Its link-layer header
749 * includes additional information before the LAPD header, so it's
750 * not necessarily a generic LAPD header.
751 */
752#define DLT_LINUX_LAPD 177
753
754/*
755 * Juniper-private data link type, as per request from
756 * Hannes Gredler <hannes@juniper.net>.
757 * The DLT_ are used for prepending meta-information
758 * like interface index, interface name
759 * before standard Ethernet, PPP, Frelay & C-HDLC Frames
760 */
761#define DLT_JUNIPER_ETHER 178
762#define DLT_JUNIPER_PPP 179
763#define DLT_JUNIPER_FRELAY 180
764#define DLT_JUNIPER_CHDLC 181
765
766/*
767 * Multi Link Frame Relay (FRF.16)
768 */
769#define DLT_MFR 182
770
771/*
772 * Juniper-private data link type, as per request from
773 * Hannes Gredler <hannes@juniper.net>.
774 * The DLT_ is used for internal communication with a
775 * voice Adapter Card (PIC)
776 */
777#define DLT_JUNIPER_VP 183
778
779/*
780 * Arinc 429 frames.
781 * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>.
782 * Every frame contains a 32bit A429 label.
783 * More documentation on Arinc 429 can be found at
784 * http://www.condoreng.com/support/downloads/tutorials/ARINCTutorial.pdf
785 */
786#define DLT_A429 184
787
788/*
789 * Arinc 653 Interpartition Communication messages.
790 * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>.
791 * Please refer to the A653-1 standard for more information.
792 */
793#define DLT_A653_ICM 185
794
795/*
796 * USB packets, beginning with a USB setup header; requested by
797 * Paolo Abeni <paolo.abeni@email.it>.
798 */
799#define DLT_USB 186
800
801/*
802 * Bluetooth HCI UART transport layer (part H:4); requested by
803 * Paolo Abeni.
804 */
805#define DLT_BLUETOOTH_HCI_H4 187
806
807/*
808 * IEEE 802.16 MAC Common Part Sublayer; requested by Maria Cruz
809 * <cruz_petagay@bah.com>.
810 */
811#define DLT_IEEE802_16_MAC_CPS 188
812
813/*
814 * USB packets, beginning with a Linux USB header; requested by
815 * Paolo Abeni <paolo.abeni@email.it>.
816 */
817#define DLT_USB_LINUX 189
818
819/*
820 * Controller Area Network (CAN) v. 2.0B packets.
821 * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>.
822 * Used to dump CAN packets coming from a CAN Vector board.
823 * More documentation on the CAN v2.0B frames can be found at
824 * http://www.can-cia.org/downloads/?269
825 */
826#define DLT_CAN20B 190
827
828/*
829 * IEEE 802.15.4, with address fields padded, as is done by Linux
830 * drivers; requested by Juergen Schimmer.
831 */
832#define DLT_IEEE802_15_4_LINUX 191
833
834/*
835 * Per Packet Information encapsulated packets.
836 * DLT_ requested by Gianluca Varenni <gianluca.varenni@cacetech.com>.
837 */
838#define DLT_PPI 192
839
840/*
841 * Header for 802.16 MAC Common Part Sublayer plus a radiotap radio header;
842 * requested by Charles Clancy.
843 */
844#define DLT_IEEE802_16_MAC_CPS_RADIO 193
845
846/*
847 * Juniper-private data link type, as per request from
848 * Hannes Gredler <hannes@juniper.net>.
849 * The DLT_ is used for internal communication with a
850 * integrated service module (ISM).
851 */
852#define DLT_JUNIPER_ISM 194
853
854/*
855 * IEEE 802.15.4, exactly as it appears in the spec (no padding, no
856 * nothing); requested by Mikko Saarnivala <mikko.saarnivala@sensinode.com>.
857 */
858#define DLT_IEEE802_15_4 195
859
860/*
861 * Various link-layer types, with a pseudo-header, for SITA
862 * (http://www.sita.aero/); requested by Fulko Hew (fulko.hew@gmail.com).
863 */
864#define DLT_SITA 196
865
866/*
867 * Various link-layer types, with a pseudo-header, for Endace DAG cards;
868 * encapsulates Endace ERF records. Requested by Stephen Donnelly
869 * <stephen@endace.com>.
870 */
871#define DLT_ERF 197
872
873/*
874 * Special header prepended to Ethernet packets when capturing from a
875 * u10 Networks board. Requested by Phil Mulholland
876 * <phil@u10networks.com>.
877 */
878#define DLT_RAIF1 198
879
880/*
881 * IPMB packet for IPMI, beginning with the I2C slave address, followed
882 * by the netFn and LUN, etc.. Requested by Chanthy Toeung
883 * <chanthy.toeung@ca.kontron.com>.
884 */
885#define DLT_IPMB 199
886
887/*
888 * Juniper-private data link type, as per request from
889 * Hannes Gredler <hannes@juniper.net>.
890 * The DLT_ is used for capturing data on a secure tunnel interface.
891 */
892#define DLT_JUNIPER_ST 200
893
894/*
895 * Bluetooth HCI UART transport layer (part H:4), with pseudo-header
896 * that includes direction information; requested by Paolo Abeni.
897 */
898#define DLT_BLUETOOTH_HCI_H4_WITH_PHDR 201
899
900/*
901 * AX.25 packet with a 1-byte KISS header; see
902 *
903 * http://www.ax25.net/kiss.htm
904 *
905 * as per Richard Stearn <richard@rns-stearn.demon.co.uk>.
906 */
907#define DLT_AX25_KISS 202
908
909/*
910 * LAPD packets from an ISDN channel, starting with the address field,
911 * with no pseudo-header.
912 * Requested by Varuna De Silva <varunax@gmail.com>.
913 */
914#define DLT_LAPD 203
915
916/*
917 * Variants of various link-layer headers, with a one-byte direction
918 * pseudo-header prepended - zero means "received by this host",
919 * non-zero (any non-zero value) means "sent by this host" - as per
920 * Will Barker <w.barker@zen.co.uk>.
921 */
922#define DLT_PPP_WITH_DIR 204 /* PPP - don't confuse with DLT_PPP_WITH_DIRECTION */
923#define DLT_C_HDLC_WITH_DIR 205 /* Cisco HDLC */
924#define DLT_FRELAY_WITH_DIR 206 /* Frame Relay */
925#define DLT_LAPB_WITH_DIR 207 /* LAPB */
926
927/*
928 * 208 is reserved for an as-yet-unspecified proprietary link-layer
929 * type, as requested by Will Barker.
930 */
931
932/*
933 * IPMB with a Linux-specific pseudo-header; as requested by Alexey Neyman
934 * <avn@pigeonpoint.com>.
935 */
936#define DLT_IPMB_LINUX 209
937
938/*
939 * FlexRay automotive bus - http://www.flexray.com/ - as requested
940 * by Hannes Kaelber <hannes.kaelber@x2e.de>.
941 */
942#define DLT_FLEXRAY 210
943
944/*
945 * Media Oriented Systems Transport (MOST) bus for multimedia
946 * transport - http://www.mostcooperation.com/ - as requested
947 * by Hannes Kaelber <hannes.kaelber@x2e.de>.
948 */
949#define DLT_MOST 211
950
951/*
952 * Local Interconnect Network (LIN) bus for vehicle networks -
953 * http://www.lin-subbus.org/ - as requested by Hannes Kaelber
954 * <hannes.kaelber@x2e.de>.
955 */
956#define DLT_LIN 212
957
958/*
959 * X2E-private data link type used for serial line capture,
960 * as requested by Hannes Kaelber <hannes.kaelber@x2e.de>.
961 */
962#define DLT_X2E_SERIAL 213
963
964/*
965 * X2E-private data link type used for the Xoraya data logger
966 * family, as requested by Hannes Kaelber <hannes.kaelber@x2e.de>.
967 */
968#define DLT_X2E_XORAYA 214
969
970/*
971 * IEEE 802.15.4, exactly as it appears in the spec (no padding, no
972 * nothing), but with the PHY-level data for non-ASK PHYs (4 octets
973 * of 0 as preamble, one octet of SFD, one octet of frame length+
974 * reserved bit, and then the MAC-layer data, starting with the
975 * frame control field).
976 *
977 * Requested by Max Filippov <jcmvbkbc@gmail.com>.
978 */
979#define DLT_IEEE802_15_4_NONASK_PHY 215
980
981/*
982 * David Gibson <david@gibson.dropbear.id.au> requested this for
983 * captures from the Linux kernel /dev/input/eventN devices. This
984 * is used to communicate keystrokes and mouse movements from the
985 * Linux kernel to display systems, such as Xorg.
986 */
987#define DLT_LINUX_EVDEV 216
988
989/*
990 * GSM Um and Abis interfaces, preceded by a "gsmtap" header.
991 *
992 * Requested by Harald Welte <laforge@gnumonks.org>.
993 */
994#define DLT_GSMTAP_UM 217
995#define DLT_GSMTAP_ABIS 218
996
997/*
998 * MPLS, with an MPLS label as the link-layer header.
999 * Requested by Michele Marchetto <michele@openbsd.org> on behalf
1000 * of OpenBSD.
1001 */
1002#define DLT_MPLS 219
1003
1004/*
1005 * USB packets, beginning with a Linux USB header, with the USB header
1006 * padded to 64 bytes; required for memory-mapped access.
1007 */
1008#define DLT_USB_LINUX_MMAPPED 220
1009
1010/*
1011 * DECT packets, with a pseudo-header; requested by
1012 * Matthias Wenzel <tcpdump@mazzoo.de>.
1013 */
1014#define DLT_DECT 221
1015
1016/*
1017 * From: "Lidwa, Eric (GSFC-582.0)[SGT INC]" <eric.lidwa-1@nasa.gov>
1018 * Date: Mon, 11 May 2009 11:18:30 -0500
1019 *
1020 * DLT_AOS. We need it for AOS Space Data Link Protocol.
1021 * I have already written dissectors for but need an OK from
1022 * legal before I can submit a patch.
1023 *
1024 */
1025#define DLT_AOS 222
1026
1027/*
1028 * Wireless HART (Highway Addressable Remote Transducer)
1029 * From the HART Communication Foundation
1030 * IES/PAS 62591
1031 *
1032 * Requested by Sam Roberts <vieuxtech@gmail.com>.
1033 */
1034#define DLT_WIHART 223
1035
1036/*
1037 * Fibre Channel FC-2 frames, beginning with a Frame_Header.
1038 * Requested by Kahou Lei <kahou82@gmail.com>.
1039 */
1040#define DLT_FC_2 224
1041
1042/*
1043 * Fibre Channel FC-2 frames, beginning with an encoding of the
1044 * SOF, and ending with an encoding of the EOF.
1045 *
1046 * The encodings represent the frame delimiters as 4-byte sequences
1047 * representing the corresponding ordered sets, with K28.5
1048 * represented as 0xBC, and the D symbols as the corresponding
1049 * byte values; for example, SOFi2, which is K28.5 - D21.5 - D1.2 - D21.2,
1050 * is represented as 0xBC 0xB5 0x55 0x55.
1051 *
1052 * Requested by Kahou Lei <kahou82@gmail.com>.
1053 */
1054#define DLT_FC_2_WITH_FRAME_DELIMS 225
1055
1056/*
1057 * Solaris ipnet pseudo-header; requested by Darren Reed <Darren.Reed@Sun.COM>.
1058 *
1059 * The pseudo-header starts with a one-byte version number; for version 2,
1060 * the pseudo-header is:
1061 *
1062 * struct dl_ipnetinfo {
1063 * u_int8_t dli_version;
1064 * u_int8_t dli_family;
1065 * u_int16_t dli_htype;
1066 * u_int32_t dli_pktlen;
1067 * u_int32_t dli_ifindex;
1068 * u_int32_t dli_grifindex;
1069 * u_int32_t dli_zsrc;
1070 * u_int32_t dli_zdst;
1071 * };
1072 *
1073 * dli_version is 2 for the current version of the pseudo-header.
1074 *
1075 * dli_family is a Solaris address family value, so it's 2 for IPv4
1076 * and 26 for IPv6.
1077 *
1078 * dli_htype is a "hook type" - 0 for incoming packets, 1 for outgoing
1079 * packets, and 2 for packets arriving from another zone on the same
1080 * machine.
1081 *
1082 * dli_pktlen is the length of the packet data following the pseudo-header
1083 * (so the captured length minus dli_pktlen is the length of the
1084 * pseudo-header, assuming the entire pseudo-header was captured).
1085 *
1086 * dli_ifindex is the interface index of the interface on which the
1087 * packet arrived.
1088 *
1089 * dli_grifindex is the group interface index number (for IPMP interfaces).
1090 *
1091 * dli_zsrc is the zone identifier for the source of the packet.
1092 *
1093 * dli_zdst is the zone identifier for the destination of the packet.
1094 *
1095 * A zone number of 0 is the global zone; a zone number of 0xffffffff
1096 * means that the packet arrived from another host on the network, not
1097 * from another zone on the same machine.
1098 *
1099 * An IPv4 or IPv6 datagram follows the pseudo-header; dli_family indicates
1100 * which of those it is.
1101 */
1102#define DLT_IPNET 226
1103
1104/*
1105 * CAN (Controller Area Network) frames, with a pseudo-header as supplied
1106 * by Linux SocketCAN. See Documentation/networking/can.txt in the Linux
1107 * source.
1108 *
1109 * Requested by Felix Obenhuber <felix@obenhuber.de>.
1110 */
1111#define DLT_CAN_SOCKETCAN 227
1112
1113/*
1114 * Raw IPv4/IPv6; different from DLT_RAW in that the DLT_ value specifies
1115 * whether it's v4 or v6. Requested by Darren Reed <Darren.Reed@Sun.COM>.
1116 */
1117#define DLT_IPV4 228
1118#define DLT_IPV6 229
1119
1120/*
1121 * IEEE 802.15.4, exactly as it appears in the spec (no padding, no
1122 * nothing), and with no FCS at the end of the frame; requested by
1123 * Jon Smirl <jonsmirl@gmail.com>.
1124 */
1125#define DLT_IEEE802_15_4_NOFCS 230
1126
1127/*
1128 * Raw D-Bus:
1129 *
1130 * http://www.freedesktop.org/wiki/Software/dbus
1131 *
1132 * messages:
1133 *
1134 * http://dbus.freedesktop.org/doc/dbus-specification.html#message-protocol-messages
1135 *
1136 * starting with the endianness flag, followed by the message type, etc.,
1137 * but without the authentication handshake before the message sequence:
1138 *
1139 * http://dbus.freedesktop.org/doc/dbus-specification.html#auth-protocol
1140 *
1141 * Requested by Martin Vidner <martin@vidner.net>.
1142 */
1143#define DLT_DBUS 231
1144
1145/*
1146 * Juniper-private data link type, as per request from
1147 * Hannes Gredler <hannes@juniper.net>.
1148 */
1149#define DLT_JUNIPER_VS 232
1150#define DLT_JUNIPER_SRX_E2E 233
1151#define DLT_JUNIPER_FIBRECHANNEL 234
1152
1153/*
1154 * DVB-CI (DVB Common Interface for communication between a PC Card
1155 * module and a DVB receiver). See
1156 *
1157 * http://www.kaiser.cx/pcap-dvbci.html
1158 *
1159 * for the specification.
1160 *
1161 * Requested by Martin Kaiser <martin@kaiser.cx>.
1162 */
1163#define DLT_DVB_CI 235
1164
1165/*
1166 * Variant of 3GPP TS 27.010 multiplexing protocol (similar to, but
1167 * *not* the same as, 27.010). Requested by Hans-Christoph Schemmel
1168 * <hans-christoph.schemmel@cinterion.com>.
1169 */
1170#define DLT_MUX27010 236
1171
1172/*
1173 * STANAG 5066 D_PDUs. Requested by M. Baris Demiray
1174 * <barisdemiray@gmail.com>.
1175 */
1176#define DLT_STANAG_5066_D_PDU 237
1177
1178/*
1179 * Juniper-private data link type, as per request from
1180 * Hannes Gredler <hannes@juniper.net>.
1181 */
1182#define DLT_JUNIPER_ATM_CEMIC 238
1183
1184/*
1185 * NetFilter LOG messages
1186 * (payload of netlink NFNL_SUBSYS_ULOG/NFULNL_MSG_PACKET packets)
1187 *
1188 * Requested by Jakub Zawadzki <darkjames-ws@darkjames.pl>
1189 */
1190#define DLT_NFLOG 239
1191
1192/*
1193 * Hilscher Gesellschaft fuer Systemautomation mbH link-layer type
1194 * for Ethernet packets with a 4-byte pseudo-header and always
1195 * with the payload including the FCS, as supplied by their
1196 * netANALYZER hardware and software.
1197 *
1198 * Requested by Holger P. Frommer <HPfrommer@hilscher.com>
1199 */
1200#define DLT_NETANALYZER 240
1201
1202/*
1203 * Hilscher Gesellschaft fuer Systemautomation mbH link-layer type
1204 * for Ethernet packets with a 4-byte pseudo-header and FCS and
1205 * with the Ethernet header preceded by 7 bytes of preamble and
1206 * 1 byte of SFD, as supplied by their netANALYZER hardware and
1207 * software.
1208 *
1209 * Requested by Holger P. Frommer <HPfrommer@hilscher.com>
1210 */
1211#define DLT_NETANALYZER_TRANSPARENT 241
1212
1213/*
1214 * IP-over-Infiniband, as specified by RFC 4391.
1215 *
1216 * Requested by Petr Sumbera <petr.sumbera@oracle.com>.
1217 */
1218#define DLT_IPOIB 242
1219
1220/*
1221 * MPEG-2 transport stream (ISO 13818-1/ITU-T H.222.0).
1222 *
1223 * Requested by Guy Martin <gmsoft@tuxicoman.be>.
1224 */
1225#define DLT_MPEG_2_TS 243
1226
1227/*
1228 * ng4T GmbH's UMTS Iub/Iur-over-ATM and Iub/Iur-over-IP format as
1229 * used by their ng40 protocol tester.
1230 *
1231 * Requested by Jens Grimmer <jens.grimmer@ng4t.com>.
1232 */
1233#define DLT_NG40 244
1234
1235/*
1236 * Pseudo-header giving adapter number and flags, followed by an NFC
1237 * (Near-Field Communications) Logical Link Control Protocol (LLCP) PDU,
1238 * as specified by NFC Forum Logical Link Control Protocol Technical
1239 * Specification LLCP 1.1.
1240 *
1241 * Requested by Mike Wakerly <mikey@google.com>.
1242 */
1243#define DLT_NFC_LLCP 245
1244
1245/*
1246 * USB packets, beginning with a Darwin (macOS, etc.) USB header.
1247 */
1248#define DLT_USB_DARWIN 266
1249
1250#define DLT_MATCHING_MAX 266 /* highest value in the "matching" range */
1251
1252/*
1253 * The instruction encodings.
1254 */
1255/* instruction classes */
1256#define BPF_CLASS(code) ((code) & 0x07)
1257#define BPF_LD 0x00
1258#define BPF_LDX 0x01
1259#define BPF_ST 0x02
1260#define BPF_STX 0x03
1261#define BPF_ALU 0x04
1262#define BPF_JMP 0x05
1263#define BPF_RET 0x06
1264#define BPF_MISC 0x07
1265
1266/* ld/ldx fields */
1267#define BPF_SIZE(code) ((code) & 0x18)
1268#define BPF_W 0x00
1269#define BPF_H 0x08
1270#define BPF_B 0x10
1271#define BPF_MODE(code) ((code) & 0xe0)
1272#define BPF_IMM 0x00
1273#define BPF_ABS 0x20
1274#define BPF_IND 0x40
1275#define BPF_MEM 0x60
1276#define BPF_LEN 0x80
1277#define BPF_MSH 0xa0
1278
1279/* alu/jmp fields */
1280#define BPF_OP(code) ((code) & 0xf0)
1281#define BPF_ADD 0x00
1282#define BPF_SUB 0x10
1283#define BPF_MUL 0x20
1284#define BPF_DIV 0x30
1285#define BPF_OR 0x40
1286#define BPF_AND 0x50
1287#define BPF_LSH 0x60
1288#define BPF_RSH 0x70
1289#define BPF_NEG 0x80
1290#define BPF_JA 0x00
1291#define BPF_JEQ 0x10
1292#define BPF_JGT 0x20
1293#define BPF_JGE 0x30
1294#define BPF_JSET 0x40
1295#define BPF_SRC(code) ((code) & 0x08)
1296#define BPF_K 0x00
1297#define BPF_X 0x08
1298
1299/* ret - BPF_K and BPF_X also apply */
1300#define BPF_RVAL(code) ((code) & 0x18)
1301#define BPF_A 0x10
1302
1303/* misc */
1304#define BPF_MISCOP(code) ((code) & 0xf8)
1305#define BPF_TAX 0x00
1306#define BPF_TXA 0x80
1307
1308/*
1309 * The instruction data structure.
1310 */
1311struct bpf_insn {
1312 u_short code;
1313 u_char jt;
1314 u_char jf;
1315 bpf_u_int32 k;
1316};
1317
1318/*
1319 * Macros for insn array initializers.
1320 */
1321#define BPF_STMT(code, k) { (u_short)(code), 0, 0, k }
1322#define BPF_JUMP(code, k, jt, jf) { (u_short)(code), jt, jf, k }
1323
1324#pragma pack(4)
1325
1326/*
1327 * Structure to retrieve available DLTs for the interface.
1328 */
1329struct bpf_dltlist {
1330 u_int32_t bfl_len; /* number of bfd_list array */
1331 union {
1332 u_int32_t *bflu_list; /* array of DLTs */
1333 u_int64_t bflu_pad;
1334 } bfl_u;
1335};
1336#define bfl_list bfl_u.bflu_list
1337
1338#pragma pack()
1339
1340#ifdef KERNEL_PRIVATE
1341#define BPF_MIN_PKT_SIZE 40
1342#define PORT_DNS 53
1343#define PORT_BOOTPS 67
1344#define PORT_BOOTPC 68
1345#define PORT_ISAKMP 500
1346#define PORT_ISAKMP_NATT 4500 /* rfc3948 */
1347
1348/* Forward declerations */
1349struct ifnet;
1350struct mbuf;
1351
1352#define BPF_PACKET_TYPE_MBUF 0
1353
1354struct bpf_packet {
1355 int bpfp_type;
1356 void * bpfp_header; /* optional */
1357 size_t bpfp_header_length;
1358 union {
1359 struct mbuf *bpfpu_mbuf;
1360 void * bpfpu_ptr;
1361 } bpfp_u;
1362#define bpfp_mbuf bpfp_u.bpfpu_mbuf
1363#define bpfp_ptr bpfp_u.bpfpu_ptr
1364 size_t bpfp_total_length; /* length including optional header */
1365};
1366
1367extern int bpf_validate(const struct bpf_insn *, int);
1368extern void bpfdetach(struct ifnet *);
1369extern void bpfilterattach(int);
1370extern u_int bpf_filter(const struct bpf_insn *, u_char *, u_int, u_int);
1371#endif /* KERNEL_PRIVATE */
1372
1373#ifdef KERNEL
1374#ifndef BPF_TAP_MODE_T
1375#define BPF_TAP_MODE_T
1376/*!
1377 @enum BPF tap mode
1378 @abstract Constants defining interface families.
1379 @constant BPF_MODE_DISABLED Disable bpf.
1380 @constant BPF_MODE_INPUT Enable input only.
1381 @constant BPF_MODE_OUTPUT Enable output only.
1382 @constant BPF_MODE_INPUT_OUTPUT Enable input and output.
1383*/
1384
1385enum {
1386 BPF_MODE_DISABLED = 0,
1387 BPF_MODE_INPUT = 1,
1388 BPF_MODE_OUTPUT = 2,
1389 BPF_MODE_INPUT_OUTPUT = 3
1390};
1391/*!
1392 @typedef bpf_tap_mode
1393 @abstract Mode for tapping. BPF_MODE_DISABLED/BPF_MODE_INPUT_OUTPUT etc.
1394*/
1395typedef u_int32_t bpf_tap_mode;
1396#endif /* !BPF_TAP_MODE_T */
1397
1398/*!
1399 @typedef bpf_send_func
1400 @discussion bpf_send_func is called when a bpf file descriptor is
1401 used to send a raw packet on the interface. The mbuf and data
1402 link type are specified. The callback is responsible for
1403 releasing the mbuf whether or not it returns an error.
1404 @param interface The interface the packet is being sent on.
1405 @param data_link_type The data link type the bpf device is attached to.
1406 @param packet The packet to be sent.
1407 */
1408typedef errno_t (*bpf_send_func)(ifnet_t interface, u_int32_t data_link_type,
1409 mbuf_t packet);
1410
1411/*!
1412 @typedef bpf_tap_func
1413 @discussion bpf_tap_func is called when the tap state of the
1414 interface changes. This happens when a bpf device attaches to an
1415 interface or detaches from an interface. The tap mode will join
1416 together (bit or) the modes of all bpf devices using that
1417 interface for that dlt. If you return an error from this
1418 function, the bpf device attach attempt that triggered the tap
1419 will fail. If this function was called bacuse the tap state was
1420 decreasing (tap in or out is stopping), the error will be
1421 ignored.
1422 @param interface The interface being tapped.
1423 @param data_link_type The data link type being tapped.
1424 @param direction The direction of the tap.
1425 */
1426typedef errno_t (*bpf_tap_func)(ifnet_t interface, u_int32_t data_link_type,
1427 bpf_tap_mode direction);
1428
1429/*!
1430 @function bpfattach
1431 @discussion Registers an interface with BPF. This allows bpf devices
1432 to attach to your interface to capture packets. Your interface
1433 will be unregistered automatically when your interface is
1434 detached.
1435 @param interface The interface to register with BPF.
1436 @param data_link_type The data link type of the interface. See the
1437 DLT_* defines in bpf.h.
1438 @param header_length The length, in bytes, of the data link header.
1439 */
1440extern void bpfattach(ifnet_t interface, u_int data_link_type,
1441 u_int header_length);
1442
1443/*!
1444 @function bpf_attach
1445 @discussion Registers an interface with BPF. This allows bpf devices
1446 to attach to your interface to capture and transmit packets.
1447 Your interface will be unregistered automatically when your
1448 interface is detached. You may register multiple times with
1449 different data link types. An 802.11 interface would use this to
1450 allow clients to pick whether they want just an ethernet style
1451 frame or the 802.11 wireless headers as well. The first dlt you
1452 register will be considered the default. Any bpf device attaches
1453 that do not specify a data link type will use the default.
1454 @param interface The interface to register with BPF.
1455 @param data_link_type The data link type of the interface. See the
1456 DLT_* defines in bpf.h.
1457 @param header_length The length, in bytes, of the data link header.
1458 @param send See the bpf_send_func described above.
1459 @param tap See the bpf_tap_func described above.
1460 */
1461extern errno_t bpf_attach(ifnet_t interface, u_int32_t data_link_type,
1462 u_int32_t header_length, bpf_send_func send, bpf_tap_func tap);
1463
1464/*!
1465 @function bpf_tap_in
1466 @discussion Call this function when your interface receives a
1467 packet. This function will check if any bpf devices need a
1468 a copy of the packet.
1469 @param interface The interface the packet was received on.
1470 @param dlt The data link type of the packet.
1471 @param packet The packet received.
1472 @param header An optional pointer to a header that will be prepended.
1473 @param header_len If the header was specified, the length of the header.
1474 */
1475extern void bpf_tap_in(ifnet_t interface, u_int32_t dlt, mbuf_t packet,
1476 void *header, size_t header_len);
1477
1478/*!
1479 @function bpf_tap_out
1480 @discussion Call this function when your interface transmits a
1481 packet. This function will check if any bpf devices need a
1482 a copy of the packet.
1483 @param interface The interface the packet was or will be transmitted on.
1484 @param dlt The data link type of the packet.
1485 @param packet The packet received.
1486 @param header An optional pointer to a header that will be prepended.
1487 @param header_len If the header was specified, the length of the header.
1488 */
1489extern void bpf_tap_out(ifnet_t interface, u_int32_t dlt, mbuf_t packet,
1490 void *header, size_t header_len);
1491
1492#endif /* KERNEL */
1493
1494/*
1495 * Number of scratch memory words (for BPF_LD|BPF_MEM and BPF_ST).
1496 */
1497#define BPF_MEMWORDS 16
1498
1499#endif /* _NET_BPF_H_ */
1500