1 | /* |
2 | * Copyright (c) 2012-2017 Apple Inc. All rights reserved. |
3 | * |
4 | * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ |
5 | * |
6 | * This file contains Original Code and/or Modifications of Original Code |
7 | * as defined in and that are subject to the Apple Public Source License |
8 | * Version 2.0 (the 'License'). You may not use this file except in |
9 | * compliance with the License. The rights granted to you under the License |
10 | * may not be used to create, or enable the creation or redistribution of, |
11 | * unlawful or unlicensed copies of an Apple operating system, or to |
12 | * circumvent, violate, or enable the circumvention or violation of, any |
13 | * terms of an Apple operating system software license agreement. |
14 | * |
15 | * Please obtain a copy of the License at |
16 | * http://www.opensource.apple.com/apsl/ and read it before using this file. |
17 | * |
18 | * The Original Code and all software distributed under the License are |
19 | * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER |
20 | * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, |
21 | * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, |
22 | * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. |
23 | * Please see the License for the specific language governing rights and |
24 | * limitations under the License. |
25 | * |
26 | * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ |
27 | */ |
28 | |
29 | #ifndef _NET_PKTAP_H_ |
30 | #define _NET_PKTAP_H_ |
31 | |
32 | #include <sys/_types/_timeval32.h> |
33 | #include <stdint.h> |
34 | #include <net/if.h> |
35 | #include <uuid/uuid.h> |
36 | #include <string.h> |
37 | |
38 | #ifdef PRIVATE |
39 | |
40 | #define PKTAP_IFNAME "pktap" |
41 | |
42 | /* To store interface name + unit */ |
43 | #define PKTAP_IFXNAMESIZE (IF_NAMESIZE + 8) |
44 | |
45 | /* |
46 | * Commands via SIOCGDRVSPEC/SIOCSDRVSPEC |
47 | */ |
48 | #define PKTP_CMD_FILTER_GET 1 /* array of PKTAP_MAX_FILTERS * struct pktap_filter */ |
49 | #define PKTP_CMD_FILTER_SET 3 /* array of PKTAP_MAX_FILTERS * struct pktap_filter */ |
50 | #define PKTP_CMD_TAP_COUNT 4 /* uint32_t number of active bpf tap on the interface */ |
51 | |
52 | /* |
53 | * Filtering is currently based on network interface properties -- |
54 | * the interface type and the interface name -- and has two types of |
55 | * operations -- pass and skip. |
56 | * By default only interfaces of type IFT_ETHER and IFT_CELLULAR pass |
57 | * the filter. |
58 | * It's possible to include other interfaces by type or by name |
59 | * The interface type is evaluated before the interface name |
60 | * The first matching rule stops the evaluation. |
61 | * A rule with interface type 0 (zero) matches any interfaces |
62 | */ |
63 | #define PKTAP_FILTER_OP_NONE 0 /* For inactive entries at the end of the list */ |
64 | #define PKTAP_FILTER_OP_PASS 1 |
65 | #define PKTAP_FILTER_OP_SKIP 2 |
66 | |
67 | #define PKTAP_FILTER_PARAM_NONE 0 |
68 | #define PKTAP_FILTER_PARAM_IF_TYPE 1 |
69 | #define PKTAP_FILTER_PARAM_IF_NAME 2 |
70 | |
71 | #ifdef BSD_KERNEL_PRIVATE |
72 | struct pktap_filter { |
73 | uint32_t filter_op; |
74 | uint32_t filter_param; |
75 | union { |
76 | uint32_t _filter_if_type; |
77 | char _filter_if_name[PKTAP_IFXNAMESIZE]; |
78 | } param_; |
79 | size_t filter_ifname_prefix_len; |
80 | }; |
81 | |
82 | struct x_pktap_filter { |
83 | #else |
84 | struct pktap_filter { |
85 | #endif /* BSD_KERNEL_PRIVATE */ |
86 | uint32_t filter_op; |
87 | uint32_t filter_param; |
88 | union { |
89 | uint32_t _filter_if_type; |
90 | char _filter_if_name[PKTAP_IFXNAMESIZE]; |
91 | } param_; |
92 | }; |
93 | #define filter_param_if_type param_._filter_if_type |
94 | #define filter_param_if_name param_._filter_if_name |
95 | |
96 | #define PKTAP_MAX_FILTERS 8 |
97 | |
98 | /* |
99 | * Header for DLT_PKTAP |
100 | * |
101 | * In theory, there could be several types of blocks in a chain before the actual packet |
102 | */ |
103 | struct { |
104 | uint32_t ; /* length of this header */ |
105 | uint32_t ; /* type of data following */ |
106 | uint32_t ; /* DLT of packet */ |
107 | char [PKTAP_IFXNAMESIZE]; /* interface name */ |
108 | uint32_t ; /* flags */ |
109 | uint32_t ; |
110 | uint32_t ; |
111 | uint32_t ; |
112 | pid_t ; /* process ID */ |
113 | char [MAXCOMLEN+1]; /* process name */ |
114 | uint32_t ; /* service class */ |
115 | uint16_t ; |
116 | uint16_t ; |
117 | pid_t ; /* effective process ID */ |
118 | char [MAXCOMLEN+1]; /* effective command name */ |
119 | uint32_t ; |
120 | uint32_t ; |
121 | struct timeval32 ; |
122 | uuid_t ; |
123 | uuid_t ; |
124 | }; |
125 | |
126 | /* |
127 | * The original version 1 of the pktap_header structure always had the field |
128 | * pth_type_next set to PTH_TYPE_PACKET |
129 | */ |
130 | #define PTH_TYPE_NONE 0 /* No more data following */ |
131 | #define PTH_TYPE_PACKET 1 /* Actual captured packet data */ |
132 | |
133 | /* |
134 | * Size of buffer that can contain any pktap header |
135 | * followed by the optional 4 bytes protocol field |
136 | * or 16 bytes link layer header |
137 | */ |
138 | union { |
139 | uint8_t [16]; |
140 | uint32_t ; |
141 | }; |
142 | |
143 | /* |
144 | * Version 2 version of the header |
145 | * |
146 | * The field pth_flags is at the same offset as the orignal pktap_header and |
147 | * the flag PTH_FLAG_V2_HDR allows to differentiate the header version. |
148 | */ |
149 | |
150 | #define PKTAP_MAX_COMM_SIZE (MAXCOMLEN + 1) |
151 | |
152 | struct pktap_v2_hdr { |
153 | uint8_t pth_length; /* length of this header */ |
154 | uint8_t pth_uuid_offset; /* max size: sizeof(uuid_t) */ |
155 | uint8_t pth_e_uuid_offset; /* max size: sizeof(uuid_t) */ |
156 | uint8_t pth_ifname_offset; /* max size: PKTAP_IFXNAMESIZE*/ |
157 | uint8_t pth_comm_offset; /* max size: PKTAP_MAX_COMM_SIZE */ |
158 | uint8_t pth_e_comm_offset; /* max size: PKTAP_MAX_COMM_SIZE */ |
159 | uint16_t pth_dlt; /* DLT of packet */ |
160 | uint16_t pth_frame_pre_length; |
161 | uint16_t pth_frame_post_length; |
162 | uint16_t pth_iftype; |
163 | uint16_t pth_ipproto; |
164 | uint32_t pth_protocol_family; |
165 | uint32_t pth_svc; /* service class */ |
166 | uint32_t pth_flowid; |
167 | pid_t pth_pid; /* process ID */ |
168 | pid_t pth_e_pid; /* effective process ID */ |
169 | uint32_t pth_flags; /* flags */ |
170 | }; |
171 | |
172 | struct pktap_v2_hdr_space { |
173 | struct pktap_v2_hdr pth_hdr; |
174 | uint8_t pth_uuid[sizeof(uuid_t)]; |
175 | uint8_t pth_e_uuid[sizeof(uuid_t)]; |
176 | uint8_t pth_ifname[PKTAP_IFXNAMESIZE]; |
177 | uint8_t pth_comm[PKTAP_MAX_COMM_SIZE]; |
178 | uint8_t pth_e_comm[PKTAP_MAX_COMM_SIZE]; |
179 | }; |
180 | |
181 | struct { |
182 | struct pktap_v2_hdr_space ; |
183 | union pktap_header_extra ; |
184 | }; |
185 | |
186 | #define COPY_PKTAP_COMMON_FIELDS_TO_V2(pktap_v2_hdr_dst, pktap_header_src) { \ |
187 | (pktap_v2_hdr_dst)->pth_length = sizeof(struct pktap_v2_hdr); \ |
188 | (pktap_v2_hdr_dst)->pth_uuid_offset = 0; \ |
189 | (pktap_v2_hdr_dst)->pth_e_uuid_offset = 0; \ |
190 | (pktap_v2_hdr_dst)->pth_ifname_offset = 0; \ |
191 | (pktap_v2_hdr_dst)->pth_comm_offset = 0; \ |
192 | (pktap_v2_hdr_dst)->pth_e_comm_offset = 0; \ |
193 | (pktap_v2_hdr_dst)->pth_dlt = (pktap_header_src)->pth_dlt; \ |
194 | (pktap_v2_hdr_dst)->pth_frame_pre_length = (pktap_header_src)->pth_frame_pre_length; \ |
195 | (pktap_v2_hdr_dst)->pth_frame_post_length = (pktap_header_src)->pth_frame_post_length; \ |
196 | (pktap_v2_hdr_dst)->pth_iftype = (pktap_header_src)->pth_iftype; \ |
197 | (pktap_v2_hdr_dst)->pth_ipproto = (pktap_header_src)->pth_ipproto; \ |
198 | (pktap_v2_hdr_dst)->pth_protocol_family = (pktap_header_src)->pth_protocol_family; \ |
199 | (pktap_v2_hdr_dst)->pth_svc = (pktap_header_src)->pth_svc; \ |
200 | (pktap_v2_hdr_dst)->pth_flowid = (pktap_header_src)->pth_flowid; \ |
201 | (pktap_v2_hdr_dst)->pth_pid = (pktap_header_src)->pth_pid; \ |
202 | (pktap_v2_hdr_dst)->pth_e_pid = (pktap_header_src)->pth_epid; \ |
203 | (pktap_v2_hdr_dst)->pth_flags = (pktap_header_src)->pth_flags; \ |
204 | (pktap_v2_hdr_dst)->pth_flags |= PTH_FLAG_V2_HDR; \ |
205 | } |
206 | |
207 | /* |
208 | * Values for field pth_flags |
209 | */ |
210 | #define PTH_FLAG_DIR_IN 0x00000001 /* Outgoing packet */ |
211 | #define PTH_FLAG_DIR_OUT 0x00000002 /* Incoming packet */ |
212 | #define PTH_FLAG_PROC_DELEGATED 0x00000004 /* Process delegated */ |
213 | #define PTH_FLAG_IF_DELEGATED 0x00000008 /* Interface delegated */ |
214 | #ifdef BSD_KERNEL_PRIVATE |
215 | #define PTH_FLAG_DELAY_PKTAP 0x00001000 /* Finalize pktap header on read */ |
216 | #endif /* BSD_KERNEL_PRIVATE */ |
217 | #define PTH_FLAG_TSTAMP 0x00002000 /* Has time stamp */ |
218 | #define PTH_FLAG_NEW_FLOW 0x00004000 /* Packet from a new flow */ |
219 | #define PTH_FLAG_REXMIT 0x00008000 /* Packet is a retransmission */ |
220 | #define PTH_FLAG_KEEP_ALIVE 0x00010000 /* Is keep alive packet */ |
221 | #define PTH_FLAG_SOCKET 0x00020000 /* Packet on a Socket */ |
222 | #define PTH_FLAG_NEXUS_CHAN 0x00040000 /* Packet on a nexus channel */ |
223 | #define PTH_FLAG_V2_HDR 0x00080000 /* Version 2 of pktap */ |
224 | |
225 | #ifdef BSD_KERNEL_PRIVATE |
226 | |
227 | #include <net/bpf.h> |
228 | |
229 | struct { |
230 | struct pktap_header ; |
231 | union pktap_header_extra ; |
232 | } ; |
233 | |
234 | extern uint32_t pktap_total_tap_count; |
235 | |
236 | extern void pktap_init(void); |
237 | extern void pktap_input(struct ifnet *, protocol_family_t, struct mbuf *, char *); |
238 | extern void pktap_output(struct ifnet *, protocol_family_t, struct mbuf *, |
239 | u_int32_t, u_int32_t); |
240 | extern void pktap_fill_proc_info(struct pktap_header *, protocol_family_t , |
241 | struct mbuf *, u_int32_t , int , struct ifnet *); |
242 | extern void pktap_finalize_proc_info(struct pktap_header *); |
243 | extern void pktap_v2_finalize_proc_info(struct pktap_v2_hdr *); |
244 | extern void (struct bpf_packet *bpf_pkt, bool truncate); |
245 | #endif /* BSD_KERNEL_PRIVATE */ |
246 | #endif /* PRIVATE */ |
247 | |
248 | #endif /* _NET_PKTAP_H_ */ |
249 | |