Line | Count | Source (jump to first uncovered line) |
1 | | /* |
2 | | * Copyright (c) 1993, 1994, 1995, 1996, 1997, 1998 |
3 | | * The Regents of the University of California. All rights reserved. |
4 | | * |
5 | | * Redistribution and use in source and binary forms, with or without |
6 | | * modification, are permitted provided that the following conditions |
7 | | * are met: |
8 | | * 1. Redistributions of source code must retain the above copyright |
9 | | * notice, this list of conditions and the following disclaimer. |
10 | | * 2. Redistributions in binary form must reproduce the above copyright |
11 | | * notice, this list of conditions and the following disclaimer in the |
12 | | * documentation and/or other materials provided with the distribution. |
13 | | * 3. All advertising materials mentioning features or use of this software |
14 | | * must display the following acknowledgement: |
15 | | * This product includes software developed by the Computer Systems |
16 | | * Engineering Group at Lawrence Berkeley Laboratory. |
17 | | * 4. Neither the name of the University nor of the Laboratory may be used |
18 | | * to endorse or promote products derived from this software without |
19 | | * specific prior written permission. |
20 | | * |
21 | | * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND |
22 | | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
23 | | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE |
24 | | * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE |
25 | | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL |
26 | | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS |
27 | | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
28 | | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT |
29 | | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY |
30 | | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF |
31 | | * SUCH DAMAGE. |
32 | | */ |
33 | | |
34 | | #ifdef HAVE_CONFIG_H |
35 | | #include <config.h> |
36 | | #endif |
37 | | |
38 | | #include <pcap-types.h> |
39 | | #ifndef _WIN32 |
40 | | #include <sys/param.h> |
41 | | #ifndef MSDOS |
42 | | #include <sys/file.h> |
43 | | #endif |
44 | | #include <sys/ioctl.h> |
45 | | #include <sys/socket.h> |
46 | | #ifdef HAVE_SYS_SOCKIO_H |
47 | | #include <sys/sockio.h> |
48 | | #endif |
49 | | |
50 | | struct mbuf; /* Squelch compiler warnings on some platforms for */ |
51 | | struct rtentry; /* declarations in <net/if.h> */ |
52 | | #include <net/if.h> |
53 | | #include <netinet/in.h> |
54 | | #endif /* _WIN32 */ |
55 | | |
56 | | #include <stdio.h> |
57 | | #include <stdlib.h> |
58 | | #include <string.h> |
59 | | #if !defined(_MSC_VER) && !defined(__BORLANDC__) && !defined(__MINGW32__) |
60 | | #include <unistd.h> |
61 | | #endif |
62 | | #include <fcntl.h> |
63 | | #include <errno.h> |
64 | | #include <limits.h> |
65 | | |
66 | | #include "diag-control.h" |
67 | | |
68 | | #ifdef HAVE_OS_PROTO_H |
69 | | #include "os-proto.h" |
70 | | #endif |
71 | | |
72 | | #ifdef MSDOS |
73 | | #include "pcap-dos.h" |
74 | | #endif |
75 | | |
76 | | #include "pcap-int.h" |
77 | | |
78 | | #include "optimize.h" |
79 | | |
80 | | #ifdef HAVE_DAG_API |
81 | | #include "pcap-dag.h" |
82 | | #endif /* HAVE_DAG_API */ |
83 | | |
84 | | #ifdef HAVE_SEPTEL_API |
85 | | #include "pcap-septel.h" |
86 | | #endif /* HAVE_SEPTEL_API */ |
87 | | |
88 | | #ifdef HAVE_SNF_API |
89 | | #include "pcap-snf.h" |
90 | | #endif /* HAVE_SNF_API */ |
91 | | |
92 | | #ifdef HAVE_TC_API |
93 | | #include "pcap-tc.h" |
94 | | #endif /* HAVE_TC_API */ |
95 | | |
96 | | #ifdef PCAP_SUPPORT_LINUX_USBMON |
97 | | #include "pcap-usb-linux.h" |
98 | | #endif |
99 | | |
100 | | #ifdef PCAP_SUPPORT_BT |
101 | | #include "pcap-bt-linux.h" |
102 | | #endif |
103 | | |
104 | | #ifdef PCAP_SUPPORT_BT_MONITOR |
105 | | #include "pcap-bt-monitor-linux.h" |
106 | | #endif |
107 | | |
108 | | #ifdef PCAP_SUPPORT_NETFILTER |
109 | | #include "pcap-netfilter-linux.h" |
110 | | #endif |
111 | | |
112 | | #ifdef PCAP_SUPPORT_NETMAP |
113 | | #include "pcap-netmap.h" |
114 | | #endif |
115 | | |
116 | | #ifdef PCAP_SUPPORT_DBUS |
117 | | #include "pcap-dbus.h" |
118 | | #endif |
119 | | |
120 | | #ifdef PCAP_SUPPORT_RDMASNIFF |
121 | | #include "pcap-rdmasniff.h" |
122 | | #endif |
123 | | |
124 | | #ifdef PCAP_SUPPORT_DPDK |
125 | | #include "pcap-dpdk.h" |
126 | | #endif |
127 | | |
128 | | #ifdef HAVE_AIRPCAP_API |
129 | | #include "pcap-airpcap.h" |
130 | | #endif |
131 | | |
132 | | #ifdef _WIN32 |
133 | | /* |
134 | | * To quote the WSAStartup() documentation: |
135 | | * |
136 | | * The WSAStartup function typically leads to protocol-specific helper |
137 | | * DLLs being loaded. As a result, the WSAStartup function should not |
138 | | * be called from the DllMain function in a application DLL. This can |
139 | | * potentially cause deadlocks. |
140 | | * |
141 | | * and the WSACleanup() documentation: |
142 | | * |
143 | | * The WSACleanup function typically leads to protocol-specific helper |
144 | | * DLLs being unloaded. As a result, the WSACleanup function should not |
145 | | * be called from the DllMain function in a application DLL. This can |
146 | | * potentially cause deadlocks. |
147 | | * |
148 | | * So we don't initialize Winsock in a DllMain() routine. |
149 | | * |
150 | | * pcap_init() should be called to initialize pcap on both UN*X and |
151 | | * Windows; it will initialize Winsock on Windows. (It will also be |
152 | | * initialized as needed if pcap_init() hasn't been called.) |
153 | | */ |
154 | | |
155 | | /* |
156 | | * Start Winsock. |
157 | | * Internal routine. |
158 | | */ |
159 | | static int |
160 | | internal_wsockinit(char *errbuf) |
161 | | { |
162 | | WORD wVersionRequested; |
163 | | WSADATA wsaData; |
164 | | static int err = -1; |
165 | | static int done = 0; |
166 | | int status; |
167 | | |
168 | | if (done) |
169 | | return (err); |
170 | | |
171 | | /* |
172 | | * Versions of Windows that don't support Winsock 2.2 are |
173 | | * too old for us. |
174 | | */ |
175 | | wVersionRequested = MAKEWORD(2, 2); |
176 | | status = WSAStartup(wVersionRequested, &wsaData); |
177 | | done = 1; |
178 | | if (status != 0) { |
179 | | if (errbuf != NULL) { |
180 | | pcap_fmt_errmsg_for_win32_err(errbuf, PCAP_ERRBUF_SIZE, |
181 | | status, "WSAStartup() failed"); |
182 | | } |
183 | | return (err); |
184 | | } |
185 | | atexit ((void(*)(void))WSACleanup); |
186 | | err = 0; |
187 | | return (err); |
188 | | } |
189 | | |
190 | | /* |
191 | | * Exported in case some applications using WinPcap/Npcap called it, |
192 | | * even though it wasn't exported. |
193 | | */ |
194 | | int |
195 | | wsockinit(void) |
196 | | { |
197 | | return (internal_wsockinit(NULL)); |
198 | | } |
199 | | |
200 | | /* |
201 | | * This is the exported function; new programs should call this. |
202 | | * *Newer* programs should call pcap_init(). |
203 | | */ |
204 | | int |
205 | | pcap_wsockinit(void) |
206 | | { |
207 | | return (internal_wsockinit(NULL)); |
208 | | } |
209 | | #endif /* _WIN32 */ |
210 | | |
211 | | /* |
212 | | * Do whatever initialization is needed for libpcap. |
213 | | * |
214 | | * The argument specifies whether we use the local code page or UTF-8 |
215 | | * for strings; on UN*X, we just assume UTF-8 in places where the encoding |
216 | | * would matter, whereas, on Windows, we use the local code page for |
217 | | * PCAP_CHAR_ENC_LOCAL and UTF-8 for PCAP_CHAR_ENC_UTF_8. |
218 | | * |
219 | | * On Windows, we also disable the hack in pcap_create() to deal with |
220 | | * being handed UTF-16 strings, because if the user calls this they're |
221 | | * explicitly declaring that they will either be passing local code |
222 | | * page strings or UTF-8 strings, so we don't need to allow UTF-16LE |
223 | | * strings to be passed. For good measure, on Windows *and* UN*X, |
224 | | * we disable pcap_lookupdev(), to prevent anybody from even |
225 | | * *trying* to pass the result of pcap_lookupdev() - which might be |
226 | | * UTF-16LE on Windows, for ugly compatibility reasons - to pcap_create() |
227 | | * or pcap_open_live() or pcap_open(). |
228 | | * |
229 | | * Returns 0 on success, -1 on error. |
230 | | */ |
231 | | int pcap_new_api; /* pcap_lookupdev() always fails */ |
232 | | int pcap_utf_8_mode; /* Strings should be in UTF-8. */ |
233 | | int pcap_mmap_32bit; /* Map packet buffers with 32-bit addresses. */ |
234 | | |
235 | | int |
236 | | pcap_init(unsigned int opts, char *errbuf) |
237 | 0 | { |
238 | 0 | static int initialized; |
239 | | |
240 | | /* |
241 | | * Don't allow multiple calls that set different modes; that |
242 | | * may mean a library is initializing pcap in one mode and |
243 | | * a program using that library, or another library used by |
244 | | * that program, is initializing it in another mode. |
245 | | */ |
246 | 0 | switch (opts) { |
247 | | |
248 | 0 | case PCAP_CHAR_ENC_LOCAL: |
249 | | /* Leave "UTF-8 mode" off. */ |
250 | 0 | if (initialized) { |
251 | 0 | if (pcap_utf_8_mode) { |
252 | 0 | snprintf(errbuf, PCAP_ERRBUF_SIZE, |
253 | 0 | "Multiple pcap_init calls with different character encodings"); |
254 | 0 | return (PCAP_ERROR); |
255 | 0 | } |
256 | 0 | } |
257 | 0 | break; |
258 | | |
259 | 0 | case PCAP_CHAR_ENC_UTF_8: |
260 | | /* Turn on "UTF-8 mode". */ |
261 | 0 | if (initialized) { |
262 | 0 | if (!pcap_utf_8_mode) { |
263 | 0 | snprintf(errbuf, PCAP_ERRBUF_SIZE, |
264 | 0 | "Multiple pcap_init calls with different character encodings"); |
265 | 0 | return (PCAP_ERROR); |
266 | 0 | } |
267 | 0 | } |
268 | 0 | pcap_utf_8_mode = 1; |
269 | 0 | break; |
270 | | |
271 | 0 | case PCAP_MMAP_32BIT: |
272 | 0 | pcap_mmap_32bit = 1; |
273 | 0 | break; |
274 | | |
275 | 0 | default: |
276 | 0 | snprintf(errbuf, PCAP_ERRBUF_SIZE, "Unknown options specified"); |
277 | 0 | return (PCAP_ERROR); |
278 | 0 | } |
279 | | |
280 | | /* |
281 | | * Turn the appropriate mode on for error messages; those routines |
282 | | * are also used in rpcapd, which has no access to pcap's internal |
283 | | * UTF-8 mode flag, so we have to call a routine to set its |
284 | | * UTF-8 mode flag. |
285 | | */ |
286 | 0 | pcap_fmt_set_encoding(opts); |
287 | |
|
288 | 0 | if (initialized) { |
289 | | /* |
290 | | * Nothing more to do; for example, on Windows, we've |
291 | | * already initialized Winsock. |
292 | | */ |
293 | 0 | return (0); |
294 | 0 | } |
295 | | |
296 | | #ifdef _WIN32 |
297 | | /* |
298 | | * Now set up Winsock. |
299 | | */ |
300 | | if (internal_wsockinit(errbuf) == -1) { |
301 | | /* Failed. */ |
302 | | return (PCAP_ERROR); |
303 | | } |
304 | | #endif |
305 | | |
306 | | /* |
307 | | * We're done. |
308 | | */ |
309 | 0 | initialized = 1; |
310 | 0 | pcap_new_api = 1; |
311 | 0 | return (0); |
312 | 0 | } |
313 | | |
314 | | /* |
315 | | * String containing the library version. |
316 | | * Not explicitly exported via a header file - the right API to use |
317 | | * is pcap_lib_version() - but some programs included it, so we |
318 | | * provide it. |
319 | | * |
320 | | * We declare it here, right before defining it, to squelch any |
321 | | * warnings we might get from compilers about the lack of a |
322 | | * declaration. |
323 | | */ |
324 | | PCAP_API char pcap_version[]; |
325 | | PCAP_API_DEF char pcap_version[] = PACKAGE_VERSION; |
326 | | |
327 | | static void |
328 | | pcap_set_not_initialized_message(pcap_t *pcap) |
329 | 0 | { |
330 | 0 | if (pcap->activated) { |
331 | | /* A module probably forgot to set the function pointer */ |
332 | 0 | (void)snprintf(pcap->errbuf, sizeof(pcap->errbuf), |
333 | 0 | "This operation isn't properly handled by that device"); |
334 | 0 | return; |
335 | 0 | } |
336 | | /* in case the caller doesn't check for PCAP_ERROR_NOT_ACTIVATED */ |
337 | 0 | (void)snprintf(pcap->errbuf, sizeof(pcap->errbuf), |
338 | 0 | "This handle hasn't been activated yet"); |
339 | 0 | } |
340 | | |
341 | | static int |
342 | | pcap_read_not_initialized(pcap_t *pcap, int cnt _U_, pcap_handler callback _U_, |
343 | | u_char *user _U_) |
344 | 0 | { |
345 | 0 | pcap_set_not_initialized_message(pcap); |
346 | | /* this means 'not initialized' */ |
347 | 0 | return (PCAP_ERROR_NOT_ACTIVATED); |
348 | 0 | } |
349 | | |
350 | | static int |
351 | | pcap_inject_not_initialized(pcap_t *pcap, const void * buf _U_, int size _U_) |
352 | 0 | { |
353 | 0 | pcap_set_not_initialized_message(pcap); |
354 | | /* this means 'not initialized' */ |
355 | 0 | return (PCAP_ERROR_NOT_ACTIVATED); |
356 | 0 | } |
357 | | |
358 | | static int |
359 | | pcap_setfilter_not_initialized(pcap_t *pcap, struct bpf_program *fp _U_) |
360 | 0 | { |
361 | 0 | pcap_set_not_initialized_message(pcap); |
362 | | /* this means 'not initialized' */ |
363 | 0 | return (PCAP_ERROR_NOT_ACTIVATED); |
364 | 0 | } |
365 | | |
366 | | static int |
367 | | pcap_setdirection_not_initialized(pcap_t *pcap, pcap_direction_t d _U_) |
368 | 0 | { |
369 | 0 | pcap_set_not_initialized_message(pcap); |
370 | | /* this means 'not initialized' */ |
371 | 0 | return (PCAP_ERROR_NOT_ACTIVATED); |
372 | 0 | } |
373 | | |
374 | | static int |
375 | | pcap_set_datalink_not_initialized(pcap_t *pcap, int dlt _U_) |
376 | 0 | { |
377 | 0 | pcap_set_not_initialized_message(pcap); |
378 | | /* this means 'not initialized' */ |
379 | 0 | return (PCAP_ERROR_NOT_ACTIVATED); |
380 | 0 | } |
381 | | |
382 | | static int |
383 | | pcap_getnonblock_not_initialized(pcap_t *pcap) |
384 | 0 | { |
385 | 0 | pcap_set_not_initialized_message(pcap); |
386 | | /* this means 'not initialized' */ |
387 | 0 | return (PCAP_ERROR_NOT_ACTIVATED); |
388 | 0 | } |
389 | | |
390 | | static int |
391 | | pcap_stats_not_initialized(pcap_t *pcap, struct pcap_stat *ps _U_) |
392 | 0 | { |
393 | 0 | pcap_set_not_initialized_message(pcap); |
394 | | /* this means 'not initialized' */ |
395 | 0 | return (PCAP_ERROR_NOT_ACTIVATED); |
396 | 0 | } |
397 | | |
398 | | #ifdef _WIN32 |
399 | | static struct pcap_stat * |
400 | | pcap_stats_ex_not_initialized(pcap_t *pcap, int *pcap_stat_size _U_) |
401 | | { |
402 | | pcap_set_not_initialized_message(pcap); |
403 | | return (NULL); |
404 | | } |
405 | | |
406 | | static int |
407 | | pcap_setbuff_not_initialized(pcap_t *pcap, int dim _U_) |
408 | | { |
409 | | pcap_set_not_initialized_message(pcap); |
410 | | /* this means 'not initialized' */ |
411 | | return (PCAP_ERROR_NOT_ACTIVATED); |
412 | | } |
413 | | |
414 | | static int |
415 | | pcap_setmode_not_initialized(pcap_t *pcap, int mode _U_) |
416 | | { |
417 | | pcap_set_not_initialized_message(pcap); |
418 | | /* this means 'not initialized' */ |
419 | | return (PCAP_ERROR_NOT_ACTIVATED); |
420 | | } |
421 | | |
422 | | static int |
423 | | pcap_setmintocopy_not_initialized(pcap_t *pcap, int size _U_) |
424 | | { |
425 | | pcap_set_not_initialized_message(pcap); |
426 | | /* this means 'not initialized' */ |
427 | | return (PCAP_ERROR_NOT_ACTIVATED); |
428 | | } |
429 | | |
430 | | static HANDLE |
431 | | pcap_getevent_not_initialized(pcap_t *pcap) |
432 | | { |
433 | | pcap_set_not_initialized_message(pcap); |
434 | | return (INVALID_HANDLE_VALUE); |
435 | | } |
436 | | |
437 | | static int |
438 | | pcap_oid_get_request_not_initialized(pcap_t *pcap, bpf_u_int32 oid _U_, |
439 | | void *data _U_, size_t *lenp _U_) |
440 | | { |
441 | | pcap_set_not_initialized_message(pcap); |
442 | | return (PCAP_ERROR_NOT_ACTIVATED); |
443 | | } |
444 | | |
445 | | static int |
446 | | pcap_oid_set_request_not_initialized(pcap_t *pcap, bpf_u_int32 oid _U_, |
447 | | const void *data _U_, size_t *lenp _U_) |
448 | | { |
449 | | pcap_set_not_initialized_message(pcap); |
450 | | return (PCAP_ERROR_NOT_ACTIVATED); |
451 | | } |
452 | | |
453 | | static u_int |
454 | | pcap_sendqueue_transmit_not_initialized(pcap_t *pcap, pcap_send_queue* queue _U_, |
455 | | int sync _U_) |
456 | | { |
457 | | pcap_set_not_initialized_message(pcap); |
458 | | return (0); |
459 | | } |
460 | | |
461 | | static int |
462 | | pcap_setuserbuffer_not_initialized(pcap_t *pcap, int size _U_) |
463 | | { |
464 | | pcap_set_not_initialized_message(pcap); |
465 | | return (PCAP_ERROR_NOT_ACTIVATED); |
466 | | } |
467 | | |
468 | | static int |
469 | | pcap_live_dump_not_initialized(pcap_t *pcap, char *filename _U_, int maxsize _U_, |
470 | | int maxpacks _U_) |
471 | | { |
472 | | pcap_set_not_initialized_message(pcap); |
473 | | return (PCAP_ERROR_NOT_ACTIVATED); |
474 | | } |
475 | | |
476 | | static int |
477 | | pcap_live_dump_ended_not_initialized(pcap_t *pcap, int sync _U_) |
478 | | { |
479 | | pcap_set_not_initialized_message(pcap); |
480 | | return (PCAP_ERROR_NOT_ACTIVATED); |
481 | | } |
482 | | |
483 | | static PAirpcapHandle |
484 | | pcap_get_airpcap_handle_not_initialized(pcap_t *pcap) |
485 | | { |
486 | | pcap_set_not_initialized_message(pcap); |
487 | | return (NULL); |
488 | | } |
489 | | #endif |
490 | | |
491 | | /* |
492 | | * Returns 1 if rfmon mode can be set on the pcap_t, 0 if it can't, |
493 | | * a PCAP_ERROR value on an error. |
494 | | */ |
495 | | int |
496 | | pcap_can_set_rfmon(pcap_t *p) |
497 | 0 | { |
498 | 0 | return (p->can_set_rfmon_op(p)); |
499 | 0 | } |
500 | | |
501 | | /* |
502 | | * For systems where rfmon mode is never supported. |
503 | | */ |
504 | | static int |
505 | | pcap_cant_set_rfmon(pcap_t *p _U_) |
506 | 0 | { |
507 | 0 | return (0); |
508 | 0 | } |
509 | | |
510 | | /* |
511 | | * Sets *tstamp_typesp to point to an array 1 or more supported time stamp |
512 | | * types; the return value is the number of supported time stamp types. |
513 | | * The list should be freed by a call to pcap_free_tstamp_types() when |
514 | | * you're done with it. |
515 | | * |
516 | | * A return value of 0 means "you don't get a choice of time stamp type", |
517 | | * in which case *tstamp_typesp is set to null. |
518 | | * |
519 | | * PCAP_ERROR is returned on error. |
520 | | */ |
521 | | int |
522 | | pcap_list_tstamp_types(pcap_t *p, int **tstamp_typesp) |
523 | 0 | { |
524 | 0 | if (p->tstamp_type_count == 0) { |
525 | | /* |
526 | | * We don't support multiple time stamp types. |
527 | | * That means the only type we support is PCAP_TSTAMP_HOST; |
528 | | * set up a list containing only that type. |
529 | | */ |
530 | 0 | *tstamp_typesp = (int*)malloc(sizeof(**tstamp_typesp)); |
531 | 0 | if (*tstamp_typesp == NULL) { |
532 | 0 | pcap_fmt_errmsg_for_errno(p->errbuf, sizeof(p->errbuf), |
533 | 0 | errno, "malloc"); |
534 | 0 | return (PCAP_ERROR); |
535 | 0 | } |
536 | 0 | **tstamp_typesp = PCAP_TSTAMP_HOST; |
537 | 0 | return (1); |
538 | 0 | } else { |
539 | 0 | *tstamp_typesp = (int*)calloc(sizeof(**tstamp_typesp), |
540 | 0 | p->tstamp_type_count); |
541 | 0 | if (*tstamp_typesp == NULL) { |
542 | 0 | pcap_fmt_errmsg_for_errno(p->errbuf, sizeof(p->errbuf), |
543 | 0 | errno, "malloc"); |
544 | 0 | return (PCAP_ERROR); |
545 | 0 | } |
546 | 0 | (void)memcpy(*tstamp_typesp, p->tstamp_type_list, |
547 | 0 | sizeof(**tstamp_typesp) * p->tstamp_type_count); |
548 | 0 | return (p->tstamp_type_count); |
549 | 0 | } |
550 | 0 | } |
551 | | |
552 | | /* |
553 | | * In Windows, you might have a library built with one version of the |
554 | | * C runtime library and an application built with another version of |
555 | | * the C runtime library, which means that the library might use one |
556 | | * version of malloc() and free() and the application might use another |
557 | | * version of malloc() and free(). If so, that means something |
558 | | * allocated by the library cannot be freed by the application, so we |
559 | | * need to have a pcap_free_tstamp_types() routine to free up the list |
560 | | * allocated by pcap_list_tstamp_types(), even though it's just a wrapper |
561 | | * around free(). |
562 | | */ |
563 | | void |
564 | | pcap_free_tstamp_types(int *tstamp_type_list) |
565 | 0 | { |
566 | 0 | free(tstamp_type_list); |
567 | 0 | } |
568 | | |
569 | | /* |
570 | | * Default one-shot callback; overridden for capture types where the |
571 | | * packet data cannot be guaranteed to be available after the callback |
572 | | * returns, so that a copy must be made. |
573 | | */ |
574 | | void |
575 | | pcap_oneshot(u_char *user, const struct pcap_pkthdr *h, const u_char *pkt) |
576 | 898k | { |
577 | 898k | struct oneshot_userdata *sp = (struct oneshot_userdata *)user; |
578 | | |
579 | 898k | *sp->hdr = *h; |
580 | 898k | *sp->pkt = pkt; |
581 | 898k | } |
582 | | |
583 | | const u_char * |
584 | | pcap_next(pcap_t *p, struct pcap_pkthdr *h) |
585 | 915k | { |
586 | 915k | struct oneshot_userdata s; |
587 | 915k | const u_char *pkt; |
588 | | |
589 | 915k | s.hdr = h; |
590 | 915k | s.pkt = &pkt; |
591 | 915k | s.pd = p; |
592 | 915k | if (pcap_dispatch(p, 1, p->oneshot_callback, (u_char *)&s) <= 0) |
593 | 16.8k | return (0); |
594 | 898k | return (pkt); |
595 | 915k | } |
596 | | |
597 | | int |
598 | | pcap_next_ex(pcap_t *p, struct pcap_pkthdr **pkt_header, |
599 | | const u_char **pkt_data) |
600 | 0 | { |
601 | 0 | struct oneshot_userdata s; |
602 | |
|
603 | 0 | s.hdr = &p->pcap_header; |
604 | 0 | s.pkt = pkt_data; |
605 | 0 | s.pd = p; |
606 | | |
607 | | /* Saves a pointer to the packet headers */ |
608 | 0 | *pkt_header= &p->pcap_header; |
609 | |
|
610 | 0 | if (p->rfile != NULL) { |
611 | 0 | int status; |
612 | | |
613 | | /* We are on an offline capture */ |
614 | 0 | status = pcap_offline_read(p, 1, p->oneshot_callback, |
615 | 0 | (u_char *)&s); |
616 | | |
617 | | /* |
618 | | * Return codes for pcap_offline_read() are: |
619 | | * - 0: EOF |
620 | | * - -1: error |
621 | | * - >0: OK - result is number of packets read, so |
622 | | * it will be 1 in this case, as we've passed |
623 | | * a maximum packet count of 1 |
624 | | * The first one ('0') conflicts with the return code of |
625 | | * 0 from pcap_read() meaning "no packets arrived before |
626 | | * the timeout expired", so we map it to -2 so you can |
627 | | * distinguish between an EOF from a savefile and a |
628 | | * "no packets arrived before the timeout expired, try |
629 | | * again" from a live capture. |
630 | | */ |
631 | 0 | if (status == 0) |
632 | 0 | return (-2); |
633 | 0 | else |
634 | 0 | return (status); |
635 | 0 | } |
636 | | |
637 | | /* |
638 | | * Return codes for pcap_read() are: |
639 | | * - 0: timeout |
640 | | * - -1: error |
641 | | * - -2: loop was broken out of with pcap_breakloop() |
642 | | * - >0: OK, result is number of packets captured, so |
643 | | * it will be 1 in this case, as we've passed |
644 | | * a maximum packet count of 1 |
645 | | * The first one ('0') conflicts with the return code of 0 from |
646 | | * pcap_offline_read() meaning "end of file". |
647 | | */ |
648 | 0 | return (p->read_op(p, 1, p->oneshot_callback, (u_char *)&s)); |
649 | 0 | } |
650 | | |
651 | | /* |
652 | | * Implementation of a pcap_if_list_t. |
653 | | */ |
654 | | struct pcap_if_list { |
655 | | pcap_if_t *beginning; |
656 | | }; |
657 | | |
658 | | static struct capture_source_type { |
659 | | int (*findalldevs_op)(pcap_if_list_t *, char *); |
660 | | pcap_t *(*create_op)(const char *, char *, int *); |
661 | | } capture_source_types[] = { |
662 | | #ifdef HAVE_DAG_API |
663 | | { dag_findalldevs, dag_create }, |
664 | | #endif |
665 | | #ifdef HAVE_SEPTEL_API |
666 | | { septel_findalldevs, septel_create }, |
667 | | #endif |
668 | | #ifdef HAVE_SNF_API |
669 | | { snf_findalldevs, snf_create }, |
670 | | #endif |
671 | | #ifdef HAVE_TC_API |
672 | | { TcFindAllDevs, TcCreate }, |
673 | | #endif |
674 | | #ifdef PCAP_SUPPORT_BT |
675 | | { bt_findalldevs, bt_create }, |
676 | | #endif |
677 | | #ifdef PCAP_SUPPORT_BT_MONITOR |
678 | | { bt_monitor_findalldevs, bt_monitor_create }, |
679 | | #endif |
680 | | #ifdef PCAP_SUPPORT_LINUX_USBMON |
681 | | { usb_findalldevs, usb_create }, |
682 | | #endif |
683 | | #ifdef PCAP_SUPPORT_NETFILTER |
684 | | { netfilter_findalldevs, netfilter_create }, |
685 | | #endif |
686 | | #ifdef PCAP_SUPPORT_NETMAP |
687 | | { pcap_netmap_findalldevs, pcap_netmap_create }, |
688 | | #endif |
689 | | #ifdef PCAP_SUPPORT_DBUS |
690 | | { dbus_findalldevs, dbus_create }, |
691 | | #endif |
692 | | #ifdef PCAP_SUPPORT_RDMASNIFF |
693 | | { rdmasniff_findalldevs, rdmasniff_create }, |
694 | | #endif |
695 | | #ifdef PCAP_SUPPORT_DPDK |
696 | | { pcap_dpdk_findalldevs, pcap_dpdk_create }, |
697 | | #endif |
698 | | #ifdef HAVE_AIRPCAP_API |
699 | | { airpcap_findalldevs, airpcap_create }, |
700 | | #endif |
701 | | { NULL, NULL } |
702 | | }; |
703 | | |
704 | | /* |
705 | | * Get a list of all capture sources that are up and that we can open. |
706 | | * Returns -1 on error, 0 otherwise. |
707 | | * The list, as returned through "alldevsp", may be null if no interfaces |
708 | | * were up and could be opened. |
709 | | */ |
710 | | int |
711 | | pcap_findalldevs(pcap_if_t **alldevsp, char *errbuf) |
712 | 0 | { |
713 | 0 | size_t i; |
714 | 0 | pcap_if_list_t devlist; |
715 | | |
716 | | /* |
717 | | * Find all the local network interfaces on which we |
718 | | * can capture. |
719 | | */ |
720 | 0 | devlist.beginning = NULL; |
721 | 0 | if (pcap_platform_finddevs(&devlist, errbuf) == -1) { |
722 | | /* |
723 | | * Failed - free all of the entries we were given |
724 | | * before we failed. |
725 | | */ |
726 | 0 | if (devlist.beginning != NULL) |
727 | 0 | pcap_freealldevs(devlist.beginning); |
728 | 0 | *alldevsp = NULL; |
729 | 0 | return (-1); |
730 | 0 | } |
731 | | |
732 | | /* |
733 | | * Ask each of the non-local-network-interface capture |
734 | | * source types what interfaces they have. |
735 | | */ |
736 | 0 | for (i = 0; capture_source_types[i].findalldevs_op != NULL; i++) { |
737 | 0 | if (capture_source_types[i].findalldevs_op(&devlist, errbuf) == -1) { |
738 | | /* |
739 | | * We had an error; free the list we've been |
740 | | * constructing. |
741 | | */ |
742 | 0 | if (devlist.beginning != NULL) |
743 | 0 | pcap_freealldevs(devlist.beginning); |
744 | 0 | *alldevsp = NULL; |
745 | 0 | return (-1); |
746 | 0 | } |
747 | 0 | } |
748 | | |
749 | | /* |
750 | | * Return the first entry of the list of all devices. |
751 | | */ |
752 | 0 | *alldevsp = devlist.beginning; |
753 | 0 | return (0); |
754 | 0 | } |
755 | | |
756 | | static struct sockaddr * |
757 | | dup_sockaddr(struct sockaddr *sa, size_t sa_length) |
758 | 0 | { |
759 | 0 | struct sockaddr *newsa; |
760 | |
|
761 | 0 | if ((newsa = malloc(sa_length)) == NULL) |
762 | 0 | return (NULL); |
763 | 0 | return (memcpy(newsa, sa, sa_length)); |
764 | 0 | } |
765 | | |
766 | | /* |
767 | | * Construct a "figure of merit" for an interface, for use when sorting |
768 | | * the list of interfaces, in which interfaces that are up are superior |
769 | | * to interfaces that aren't up, interfaces that are up and running are |
770 | | * superior to interfaces that are up but not running, and non-loopback |
771 | | * interfaces that are up and running are superior to loopback interfaces, |
772 | | * and interfaces with the same flags have a figure of merit that's higher |
773 | | * the lower the instance number. |
774 | | * |
775 | | * The goal is to try to put the interfaces most likely to be useful for |
776 | | * capture at the beginning of the list. |
777 | | * |
778 | | * The figure of merit, which is lower the "better" the interface is, |
779 | | * has the uppermost bit set if the interface isn't running, the bit |
780 | | * below that set if the interface isn't up, the bit below that |
781 | | * set if the interface is a loopback interface, and the bit below |
782 | | * that set if it's the "any" interface. |
783 | | * |
784 | | * Note: we don't sort by unit number because 1) not all interfaces have |
785 | | * a unit number (systemd, for example, might assign interface names |
786 | | * based on the interface's MAC address or on the physical location of |
787 | | * the adapter's connector), and 2) if the name does end with a simple |
788 | | * unit number, it's not a global property of the interface, it's only |
789 | | * useful as a sort key for device names with the same prefix, so xyz0 |
790 | | * shouldn't necessarily sort before abc2. This means that interfaces |
791 | | * with the same figure of merit will be sorted by the order in which |
792 | | * the mechanism from which we're getting the interfaces supplies them. |
793 | | */ |
794 | | static u_int |
795 | | get_figure_of_merit(pcap_if_t *dev) |
796 | 0 | { |
797 | 0 | u_int n; |
798 | |
|
799 | 0 | n = 0; |
800 | 0 | if (!(dev->flags & PCAP_IF_RUNNING)) |
801 | 0 | n |= 0x80000000; |
802 | 0 | if (!(dev->flags & PCAP_IF_UP)) |
803 | 0 | n |= 0x40000000; |
804 | | |
805 | | /* |
806 | | * Give non-wireless interfaces that aren't disconnected a better |
807 | | * figure of merit than interfaces that are disconnected, as |
808 | | * "disconnected" should indicate that the interface isn't |
809 | | * plugged into a network and thus won't give you any traffic. |
810 | | * |
811 | | * For wireless interfaces, it means "associated with a network", |
812 | | * which we presume not to necessarily prevent capture, as you |
813 | | * might run the adapter in some flavor of monitor mode. |
814 | | */ |
815 | 0 | if (!(dev->flags & PCAP_IF_WIRELESS) && |
816 | 0 | (dev->flags & PCAP_IF_CONNECTION_STATUS) == PCAP_IF_CONNECTION_STATUS_DISCONNECTED) |
817 | 0 | n |= 0x20000000; |
818 | | |
819 | | /* |
820 | | * Sort loopback devices after non-loopback devices, *except* for |
821 | | * disconnected devices. |
822 | | */ |
823 | 0 | if (dev->flags & PCAP_IF_LOOPBACK) |
824 | 0 | n |= 0x10000000; |
825 | | |
826 | | /* |
827 | | * Sort the "any" device before loopback and disconnected devices, |
828 | | * but after all other devices. |
829 | | */ |
830 | 0 | if (strcmp(dev->name, "any") == 0) |
831 | 0 | n |= 0x08000000; |
832 | |
|
833 | 0 | return (n); |
834 | 0 | } |
835 | | |
836 | | #ifndef _WIN32 |
837 | | /* |
838 | | * Try to get a description for a given device. |
839 | | * Returns a mallocated description if it could and NULL if it couldn't. |
840 | | * |
841 | | * XXX - on FreeBSDs that support it, should it get the sysctl named |
842 | | * "dev.{adapter family name}.{adapter unit}.%desc" to get a description |
843 | | * of the adapter? Note that "dev.an.0.%desc" is "Aironet PC4500/PC4800" |
844 | | * with my Cisco 350 card, so the name isn't entirely descriptive. The |
845 | | * "dev.an.0.%pnpinfo" has a better description, although one might argue |
846 | | * that the problem is really a driver bug - if it can find out that it's |
847 | | * a Cisco 340 or 350, rather than an old Aironet card, it should use |
848 | | * that in the description. |
849 | | * |
850 | | * Do NetBSD, DragonflyBSD, or OpenBSD support this as well? FreeBSD |
851 | | * and OpenBSD let you get a description, but it's not generated by the OS, |
852 | | * it's set with another ioctl that ifconfig supports; we use that to get |
853 | | * a description in FreeBSD and OpenBSD, but if there is no such |
854 | | * description available, it still might be nice to get some description |
855 | | * string based on the device type or something such as that. |
856 | | * |
857 | | * In macOS, the System Configuration framework can apparently return |
858 | | * names in 10.4 and later. |
859 | | * |
860 | | * It also appears that freedesktop.org's HAL offers an "info.product" |
861 | | * string, but the HAL specification says it "should not be used in any |
862 | | * UI" and "subsystem/capability specific properties" should be used |
863 | | * instead and, in any case, I think HAL is being deprecated in |
864 | | * favor of other stuff such as DeviceKit. DeviceKit doesn't appear |
865 | | * to have any obvious product information for devices, but maybe |
866 | | * I haven't looked hard enough. |
867 | | * |
868 | | * Using the System Configuration framework, or HAL, or DeviceKit, or |
869 | | * whatever, would require that libpcap applications be linked with |
870 | | * the frameworks/libraries in question. That shouldn't be a problem |
871 | | * for programs linking with the shared version of libpcap (unless |
872 | | * you're running on AIX - which I think is the only UN*X that doesn't |
873 | | * support linking a shared library with other libraries on which it |
874 | | * depends, and having an executable linked only with the first shared |
875 | | * library automatically pick up the other libraries when started - |
876 | | * and using HAL or whatever). Programs linked with the static |
877 | | * version of libpcap would have to use pcap-config with the --static |
878 | | * flag in order to get the right linker flags in order to pick up |
879 | | * the additional libraries/frameworks; those programs need that anyway |
880 | | * for libpcap 1.1 and beyond on Linux, as, by default, it requires |
881 | | * -lnl. |
882 | | * |
883 | | * Do any other UN*Xes, or desktop environments support getting a |
884 | | * description? |
885 | | */ |
886 | | static char * |
887 | | #ifdef SIOCGIFDESCR |
888 | | get_if_description(const char *name) |
889 | | { |
890 | | char *description = NULL; |
891 | | int s; |
892 | | struct ifreq ifrdesc; |
893 | | #ifndef IFDESCRSIZE |
894 | | size_t descrlen = 64; |
895 | | #else |
896 | | size_t descrlen = IFDESCRSIZE; |
897 | | #endif /* IFDESCRSIZE */ |
898 | | |
899 | | /* |
900 | | * Get the description for the interface. |
901 | | */ |
902 | | memset(&ifrdesc, 0, sizeof ifrdesc); |
903 | | pcap_strlcpy(ifrdesc.ifr_name, name, sizeof ifrdesc.ifr_name); |
904 | | s = socket(AF_INET, SOCK_DGRAM, 0); |
905 | | if (s >= 0) { |
906 | | #ifdef __FreeBSD__ |
907 | | /* |
908 | | * On FreeBSD, if the buffer isn't big enough for the |
909 | | * description, the ioctl succeeds, but the description |
910 | | * isn't copied, ifr_buffer.length is set to the description |
911 | | * length, and ifr_buffer.buffer is set to NULL. |
912 | | */ |
913 | | for (;;) { |
914 | | free(description); |
915 | | if ((description = malloc(descrlen)) != NULL) { |
916 | | ifrdesc.ifr_buffer.buffer = description; |
917 | | ifrdesc.ifr_buffer.length = descrlen; |
918 | | if (ioctl(s, SIOCGIFDESCR, &ifrdesc) == 0) { |
919 | | if (ifrdesc.ifr_buffer.buffer == |
920 | | description) |
921 | | break; |
922 | | else |
923 | | descrlen = ifrdesc.ifr_buffer.length; |
924 | | } else { |
925 | | /* |
926 | | * Failed to get interface description. |
927 | | */ |
928 | | free(description); |
929 | | description = NULL; |
930 | | break; |
931 | | } |
932 | | } else |
933 | | break; |
934 | | } |
935 | | #else /* __FreeBSD__ */ |
936 | | /* |
937 | | * The only other OS that currently supports |
938 | | * SIOCGIFDESCR is OpenBSD, and it has no way |
939 | | * to get the description length - it's clamped |
940 | | * to a maximum of IFDESCRSIZE. |
941 | | */ |
942 | | if ((description = malloc(descrlen)) != NULL) { |
943 | | ifrdesc.ifr_data = (caddr_t)description; |
944 | | if (ioctl(s, SIOCGIFDESCR, &ifrdesc) != 0) { |
945 | | /* |
946 | | * Failed to get interface description. |
947 | | */ |
948 | | free(description); |
949 | | description = NULL; |
950 | | } |
951 | | } |
952 | | #endif /* __FreeBSD__ */ |
953 | | close(s); |
954 | | if (description != NULL && description[0] == '\0') { |
955 | | /* |
956 | | * Description is empty, so discard it. |
957 | | */ |
958 | | free(description); |
959 | | description = NULL; |
960 | | } |
961 | | } |
962 | | |
963 | | #ifdef __FreeBSD__ |
964 | | /* |
965 | | * For FreeBSD, if we didn't get a description, and this is |
966 | | * a device with a name of the form usbusN, label it as a USB |
967 | | * bus. |
968 | | */ |
969 | | if (description == NULL) { |
970 | | if (strncmp(name, "usbus", 5) == 0) { |
971 | | /* |
972 | | * OK, it begins with "usbus". |
973 | | */ |
974 | | long busnum; |
975 | | char *p; |
976 | | |
977 | | errno = 0; |
978 | | busnum = strtol(name + 5, &p, 10); |
979 | | if (errno == 0 && p != name + 5 && *p == '\0' && |
980 | | busnum >= 0 && busnum <= INT_MAX) { |
981 | | /* |
982 | | * OK, it's a valid number that's not |
983 | | * bigger than INT_MAX. Construct |
984 | | * a description from it. |
985 | | * (If that fails, we don't worry about |
986 | | * it, we just return NULL.) |
987 | | */ |
988 | | if (pcap_asprintf(&description, |
989 | | "USB bus number %ld", busnum) == -1) { |
990 | | /* Failed. */ |
991 | | description = NULL; |
992 | | } |
993 | | } |
994 | | } |
995 | | } |
996 | | #endif |
997 | | return (description); |
998 | | #else /* SIOCGIFDESCR */ |
999 | | get_if_description(const char *name _U_) |
1000 | 0 | { |
1001 | 0 | return (NULL); |
1002 | 0 | #endif /* SIOCGIFDESCR */ |
1003 | 0 | } |
1004 | | |
1005 | | /* |
1006 | | * Look for a given device in the specified list of devices. |
1007 | | * |
1008 | | * If we find it, return a pointer to its entry. |
1009 | | * |
1010 | | * If we don't find it, attempt to add an entry for it, with the specified |
1011 | | * IFF_ flags and description, and, if that succeeds, return a pointer to |
1012 | | * the new entry, otherwise return NULL and set errbuf to an error message. |
1013 | | */ |
1014 | | pcap_if_t * |
1015 | | find_or_add_if(pcap_if_list_t *devlistp, const char *name, |
1016 | | bpf_u_int32 if_flags, get_if_flags_func get_flags_func, char *errbuf) |
1017 | 0 | { |
1018 | 0 | bpf_u_int32 pcap_flags; |
1019 | | |
1020 | | /* |
1021 | | * Convert IFF_ flags to pcap flags. |
1022 | | */ |
1023 | 0 | pcap_flags = 0; |
1024 | 0 | #ifdef IFF_LOOPBACK |
1025 | 0 | if (if_flags & IFF_LOOPBACK) |
1026 | 0 | pcap_flags |= PCAP_IF_LOOPBACK; |
1027 | | #else |
1028 | | /* |
1029 | | * We don't have IFF_LOOPBACK, so look at the device name to |
1030 | | * see if it looks like a loopback device. |
1031 | | */ |
1032 | | if (name[0] == 'l' && name[1] == 'o' && |
1033 | | (PCAP_ISDIGIT(name[2]) || name[2] == '\0')) |
1034 | | pcap_flags |= PCAP_IF_LOOPBACK; |
1035 | | #endif |
1036 | 0 | #ifdef IFF_UP |
1037 | 0 | if (if_flags & IFF_UP) |
1038 | 0 | pcap_flags |= PCAP_IF_UP; |
1039 | 0 | #endif |
1040 | 0 | #ifdef IFF_RUNNING |
1041 | 0 | if (if_flags & IFF_RUNNING) |
1042 | 0 | pcap_flags |= PCAP_IF_RUNNING; |
1043 | 0 | #endif |
1044 | | |
1045 | | /* |
1046 | | * Attempt to find an entry for this device; if we don't find one, |
1047 | | * attempt to add one. |
1048 | | */ |
1049 | 0 | return (find_or_add_dev(devlistp, name, pcap_flags, |
1050 | 0 | get_flags_func, get_if_description(name), errbuf)); |
1051 | 0 | } |
1052 | | |
1053 | | /* |
1054 | | * Look for a given device in the specified list of devices. |
1055 | | * |
1056 | | * If we find it, then, if the specified address isn't null, add it to |
1057 | | * the list of addresses for the device and return 0. |
1058 | | * |
1059 | | * If we don't find it, attempt to add an entry for it, with the specified |
1060 | | * IFF_ flags and description, and, if that succeeds, add the specified |
1061 | | * address to its list of addresses if that address is non-null, and |
1062 | | * return 0, otherwise return -1 and set errbuf to an error message. |
1063 | | * |
1064 | | * (We can get called with a null address because we might get a list |
1065 | | * of interface name/address combinations from the underlying OS, with |
1066 | | * the address being absent in some cases, rather than a list of |
1067 | | * interfaces with each interface having a list of addresses, so this |
1068 | | * call may be the only call made to add to the list, and we want to |
1069 | | * add interfaces even if they have no addresses.) |
1070 | | */ |
1071 | | int |
1072 | | add_addr_to_if(pcap_if_list_t *devlistp, const char *name, |
1073 | | bpf_u_int32 if_flags, get_if_flags_func get_flags_func, |
1074 | | struct sockaddr *addr, size_t addr_size, |
1075 | | struct sockaddr *netmask, size_t netmask_size, |
1076 | | struct sockaddr *broadaddr, size_t broadaddr_size, |
1077 | | struct sockaddr *dstaddr, size_t dstaddr_size, |
1078 | | char *errbuf) |
1079 | 0 | { |
1080 | 0 | pcap_if_t *curdev; |
1081 | | |
1082 | | /* |
1083 | | * Check whether the device exists and, if not, add it. |
1084 | | */ |
1085 | 0 | curdev = find_or_add_if(devlistp, name, if_flags, get_flags_func, |
1086 | 0 | errbuf); |
1087 | 0 | if (curdev == NULL) { |
1088 | | /* |
1089 | | * Error - give up. |
1090 | | */ |
1091 | 0 | return (-1); |
1092 | 0 | } |
1093 | | |
1094 | 0 | if (addr == NULL) { |
1095 | | /* |
1096 | | * There's no address to add; this entry just meant |
1097 | | * "here's a new interface". |
1098 | | */ |
1099 | 0 | return (0); |
1100 | 0 | } |
1101 | | |
1102 | | /* |
1103 | | * "curdev" is an entry for this interface, and we have an |
1104 | | * address for it; add an entry for that address to the |
1105 | | * interface's list of addresses. |
1106 | | */ |
1107 | 0 | return (add_addr_to_dev(curdev, addr, addr_size, netmask, |
1108 | 0 | netmask_size, broadaddr, broadaddr_size, dstaddr, |
1109 | 0 | dstaddr_size, errbuf)); |
1110 | 0 | } |
1111 | | #endif /* _WIN32 */ |
1112 | | |
1113 | | /* |
1114 | | * Add an entry to the list of addresses for an interface. |
1115 | | * "curdev" is the entry for that interface. |
1116 | | */ |
1117 | | int |
1118 | | add_addr_to_dev(pcap_if_t *curdev, |
1119 | | struct sockaddr *addr, size_t addr_size, |
1120 | | struct sockaddr *netmask, size_t netmask_size, |
1121 | | struct sockaddr *broadaddr, size_t broadaddr_size, |
1122 | | struct sockaddr *dstaddr, size_t dstaddr_size, |
1123 | | char *errbuf) |
1124 | 0 | { |
1125 | 0 | pcap_addr_t *curaddr, *prevaddr, *nextaddr; |
1126 | | |
1127 | | /* |
1128 | | * Allocate the new entry and fill it in. |
1129 | | */ |
1130 | 0 | curaddr = (pcap_addr_t *)malloc(sizeof(pcap_addr_t)); |
1131 | 0 | if (curaddr == NULL) { |
1132 | 0 | pcap_fmt_errmsg_for_errno(errbuf, PCAP_ERRBUF_SIZE, |
1133 | 0 | errno, "malloc"); |
1134 | 0 | return (-1); |
1135 | 0 | } |
1136 | | |
1137 | 0 | curaddr->next = NULL; |
1138 | 0 | if (addr != NULL && addr_size != 0) { |
1139 | 0 | curaddr->addr = (struct sockaddr *)dup_sockaddr(addr, addr_size); |
1140 | 0 | if (curaddr->addr == NULL) { |
1141 | 0 | pcap_fmt_errmsg_for_errno(errbuf, PCAP_ERRBUF_SIZE, |
1142 | 0 | errno, "malloc"); |
1143 | 0 | free(curaddr); |
1144 | 0 | return (-1); |
1145 | 0 | } |
1146 | 0 | } else |
1147 | 0 | curaddr->addr = NULL; |
1148 | | |
1149 | 0 | if (netmask != NULL && netmask_size != 0) { |
1150 | 0 | curaddr->netmask = (struct sockaddr *)dup_sockaddr(netmask, netmask_size); |
1151 | 0 | if (curaddr->netmask == NULL) { |
1152 | 0 | pcap_fmt_errmsg_for_errno(errbuf, PCAP_ERRBUF_SIZE, |
1153 | 0 | errno, "malloc"); |
1154 | 0 | if (curaddr->addr != NULL) |
1155 | 0 | free(curaddr->addr); |
1156 | 0 | free(curaddr); |
1157 | 0 | return (-1); |
1158 | 0 | } |
1159 | 0 | } else |
1160 | 0 | curaddr->netmask = NULL; |
1161 | | |
1162 | 0 | if (broadaddr != NULL && broadaddr_size != 0) { |
1163 | 0 | curaddr->broadaddr = (struct sockaddr *)dup_sockaddr(broadaddr, broadaddr_size); |
1164 | 0 | if (curaddr->broadaddr == NULL) { |
1165 | 0 | pcap_fmt_errmsg_for_errno(errbuf, PCAP_ERRBUF_SIZE, |
1166 | 0 | errno, "malloc"); |
1167 | 0 | if (curaddr->netmask != NULL) |
1168 | 0 | free(curaddr->netmask); |
1169 | 0 | if (curaddr->addr != NULL) |
1170 | 0 | free(curaddr->addr); |
1171 | 0 | free(curaddr); |
1172 | 0 | return (-1); |
1173 | 0 | } |
1174 | 0 | } else |
1175 | 0 | curaddr->broadaddr = NULL; |
1176 | | |
1177 | 0 | if (dstaddr != NULL && dstaddr_size != 0) { |
1178 | 0 | curaddr->dstaddr = (struct sockaddr *)dup_sockaddr(dstaddr, dstaddr_size); |
1179 | 0 | if (curaddr->dstaddr == NULL) { |
1180 | 0 | pcap_fmt_errmsg_for_errno(errbuf, PCAP_ERRBUF_SIZE, |
1181 | 0 | errno, "malloc"); |
1182 | 0 | if (curaddr->broadaddr != NULL) |
1183 | 0 | free(curaddr->broadaddr); |
1184 | 0 | if (curaddr->netmask != NULL) |
1185 | 0 | free(curaddr->netmask); |
1186 | 0 | if (curaddr->addr != NULL) |
1187 | 0 | free(curaddr->addr); |
1188 | 0 | free(curaddr); |
1189 | 0 | return (-1); |
1190 | 0 | } |
1191 | 0 | } else |
1192 | 0 | curaddr->dstaddr = NULL; |
1193 | | |
1194 | | /* |
1195 | | * Find the end of the list of addresses. |
1196 | | */ |
1197 | 0 | for (prevaddr = curdev->addresses; prevaddr != NULL; prevaddr = nextaddr) { |
1198 | 0 | nextaddr = prevaddr->next; |
1199 | 0 | if (nextaddr == NULL) { |
1200 | | /* |
1201 | | * This is the end of the list. |
1202 | | */ |
1203 | 0 | break; |
1204 | 0 | } |
1205 | 0 | } |
1206 | |
|
1207 | 0 | if (prevaddr == NULL) { |
1208 | | /* |
1209 | | * The list was empty; this is the first member. |
1210 | | */ |
1211 | 0 | curdev->addresses = curaddr; |
1212 | 0 | } else { |
1213 | | /* |
1214 | | * "prevaddr" is the last member of the list; append |
1215 | | * this member to it. |
1216 | | */ |
1217 | 0 | prevaddr->next = curaddr; |
1218 | 0 | } |
1219 | |
|
1220 | 0 | return (0); |
1221 | 0 | } |
1222 | | |
1223 | | /* |
1224 | | * Look for a given device in the specified list of devices. |
1225 | | * |
1226 | | * If we find it, return 0 and set *curdev_ret to point to it. |
1227 | | * |
1228 | | * If we don't find it, attempt to add an entry for it, with the specified |
1229 | | * flags and description, and, if that succeeds, return 0, otherwise |
1230 | | * return -1 and set errbuf to an error message. |
1231 | | */ |
1232 | | pcap_if_t * |
1233 | | find_or_add_dev(pcap_if_list_t *devlistp, const char *name, bpf_u_int32 flags, |
1234 | | get_if_flags_func get_flags_func, const char *description, char *errbuf) |
1235 | 0 | { |
1236 | 0 | pcap_if_t *curdev; |
1237 | | |
1238 | | /* |
1239 | | * Is there already an entry in the list for this device? |
1240 | | */ |
1241 | 0 | curdev = find_dev(devlistp, name); |
1242 | 0 | if (curdev != NULL) { |
1243 | | /* |
1244 | | * Yes, return it. |
1245 | | */ |
1246 | 0 | return (curdev); |
1247 | 0 | } |
1248 | | |
1249 | | /* |
1250 | | * No, we didn't find it. |
1251 | | */ |
1252 | | |
1253 | | /* |
1254 | | * Try to get additional flags for the device. |
1255 | | */ |
1256 | 0 | if ((*get_flags_func)(name, &flags, errbuf) == -1) { |
1257 | | /* |
1258 | | * Failed. |
1259 | | */ |
1260 | 0 | return (NULL); |
1261 | 0 | } |
1262 | | |
1263 | | /* |
1264 | | * Now, try to add it to the list of devices. |
1265 | | */ |
1266 | 0 | return (add_dev(devlistp, name, flags, description, errbuf)); |
1267 | 0 | } |
1268 | | |
1269 | | /* |
1270 | | * Look for a given device in the specified list of devices, and return |
1271 | | * the entry for it if we find it or NULL if we don't. |
1272 | | */ |
1273 | | pcap_if_t * |
1274 | | find_dev(pcap_if_list_t *devlistp, const char *name) |
1275 | 0 | { |
1276 | 0 | pcap_if_t *curdev; |
1277 | | |
1278 | | /* |
1279 | | * Is there an entry in the list for this device? |
1280 | | */ |
1281 | 0 | for (curdev = devlistp->beginning; curdev != NULL; |
1282 | 0 | curdev = curdev->next) { |
1283 | 0 | if (strcmp(name, curdev->name) == 0) { |
1284 | | /* |
1285 | | * We found it, so, yes, there is. No need to |
1286 | | * add it. Provide the entry we found to our |
1287 | | * caller. |
1288 | | */ |
1289 | 0 | return (curdev); |
1290 | 0 | } |
1291 | 0 | } |
1292 | | |
1293 | | /* |
1294 | | * No. |
1295 | | */ |
1296 | 0 | return (NULL); |
1297 | 0 | } |
1298 | | |
1299 | | /* |
1300 | | * Attempt to add an entry for a device, with the specified flags |
1301 | | * and description, and, if that succeeds, return 0 and return a pointer |
1302 | | * to the new entry, otherwise return NULL and set errbuf to an error |
1303 | | * message. |
1304 | | * |
1305 | | * If we weren't given a description, try to get one. |
1306 | | */ |
1307 | | pcap_if_t * |
1308 | | add_dev(pcap_if_list_t *devlistp, const char *name, bpf_u_int32 flags, |
1309 | | const char *description, char *errbuf) |
1310 | 0 | { |
1311 | 0 | pcap_if_t *curdev, *prevdev, *nextdev; |
1312 | 0 | u_int this_figure_of_merit, nextdev_figure_of_merit; |
1313 | |
|
1314 | 0 | curdev = malloc(sizeof(pcap_if_t)); |
1315 | 0 | if (curdev == NULL) { |
1316 | 0 | pcap_fmt_errmsg_for_errno(errbuf, PCAP_ERRBUF_SIZE, |
1317 | 0 | errno, "malloc"); |
1318 | 0 | return (NULL); |
1319 | 0 | } |
1320 | | |
1321 | | /* |
1322 | | * Fill in the entry. |
1323 | | */ |
1324 | 0 | curdev->next = NULL; |
1325 | 0 | curdev->name = strdup(name); |
1326 | 0 | if (curdev->name == NULL) { |
1327 | 0 | pcap_fmt_errmsg_for_errno(errbuf, PCAP_ERRBUF_SIZE, |
1328 | 0 | errno, "malloc"); |
1329 | 0 | free(curdev); |
1330 | 0 | return (NULL); |
1331 | 0 | } |
1332 | 0 | if (description == NULL) { |
1333 | | /* |
1334 | | * We weren't handed a description for the interface. |
1335 | | */ |
1336 | 0 | curdev->description = NULL; |
1337 | 0 | } else { |
1338 | | /* |
1339 | | * We were handed a description; make a copy. |
1340 | | */ |
1341 | 0 | curdev->description = strdup(description); |
1342 | 0 | if (curdev->description == NULL) { |
1343 | 0 | pcap_fmt_errmsg_for_errno(errbuf, PCAP_ERRBUF_SIZE, |
1344 | 0 | errno, "malloc"); |
1345 | 0 | free(curdev->name); |
1346 | 0 | free(curdev); |
1347 | 0 | return (NULL); |
1348 | 0 | } |
1349 | 0 | } |
1350 | 0 | curdev->addresses = NULL; /* list starts out as empty */ |
1351 | 0 | curdev->flags = flags; |
1352 | | |
1353 | | /* |
1354 | | * Add it to the list, in the appropriate location. |
1355 | | * First, get the "figure of merit" for this interface. |
1356 | | */ |
1357 | 0 | this_figure_of_merit = get_figure_of_merit(curdev); |
1358 | | |
1359 | | /* |
1360 | | * Now look for the last interface with an figure of merit |
1361 | | * less than or equal to the new interface's figure of merit. |
1362 | | * |
1363 | | * We start with "prevdev" being NULL, meaning we're before |
1364 | | * the first element in the list. |
1365 | | */ |
1366 | 0 | prevdev = NULL; |
1367 | 0 | for (;;) { |
1368 | | /* |
1369 | | * Get the interface after this one. |
1370 | | */ |
1371 | 0 | if (prevdev == NULL) { |
1372 | | /* |
1373 | | * The next element is the first element. |
1374 | | */ |
1375 | 0 | nextdev = devlistp->beginning; |
1376 | 0 | } else |
1377 | 0 | nextdev = prevdev->next; |
1378 | | |
1379 | | /* |
1380 | | * Are we at the end of the list? |
1381 | | */ |
1382 | 0 | if (nextdev == NULL) { |
1383 | | /* |
1384 | | * Yes - we have to put the new entry after "prevdev". |
1385 | | */ |
1386 | 0 | break; |
1387 | 0 | } |
1388 | | |
1389 | | /* |
1390 | | * Is the new interface's figure of merit less |
1391 | | * than the next interface's figure of merit, |
1392 | | * meaning that the new interface is better |
1393 | | * than the next interface? |
1394 | | */ |
1395 | 0 | nextdev_figure_of_merit = get_figure_of_merit(nextdev); |
1396 | 0 | if (this_figure_of_merit < nextdev_figure_of_merit) { |
1397 | | /* |
1398 | | * Yes - we should put the new entry |
1399 | | * before "nextdev", i.e. after "prevdev". |
1400 | | */ |
1401 | 0 | break; |
1402 | 0 | } |
1403 | | |
1404 | 0 | prevdev = nextdev; |
1405 | 0 | } |
1406 | | |
1407 | | /* |
1408 | | * Insert before "nextdev". |
1409 | | */ |
1410 | 0 | curdev->next = nextdev; |
1411 | | |
1412 | | /* |
1413 | | * Insert after "prevdev" - unless "prevdev" is null, |
1414 | | * in which case this is the first interface. |
1415 | | */ |
1416 | 0 | if (prevdev == NULL) { |
1417 | | /* |
1418 | | * This is the first interface. Make it |
1419 | | * the first element in the list of devices. |
1420 | | */ |
1421 | 0 | devlistp->beginning = curdev; |
1422 | 0 | } else |
1423 | 0 | prevdev->next = curdev; |
1424 | 0 | return (curdev); |
1425 | 0 | } |
1426 | | |
1427 | | /* |
1428 | | * Free a list of interfaces. |
1429 | | */ |
1430 | | void |
1431 | | pcap_freealldevs(pcap_if_t *alldevs) |
1432 | 0 | { |
1433 | 0 | pcap_if_t *curdev, *nextdev; |
1434 | 0 | pcap_addr_t *curaddr, *nextaddr; |
1435 | |
|
1436 | 0 | for (curdev = alldevs; curdev != NULL; curdev = nextdev) { |
1437 | 0 | nextdev = curdev->next; |
1438 | | |
1439 | | /* |
1440 | | * Free all addresses. |
1441 | | */ |
1442 | 0 | for (curaddr = curdev->addresses; curaddr != NULL; curaddr = nextaddr) { |
1443 | 0 | nextaddr = curaddr->next; |
1444 | 0 | if (curaddr->addr) |
1445 | 0 | free(curaddr->addr); |
1446 | 0 | if (curaddr->netmask) |
1447 | 0 | free(curaddr->netmask); |
1448 | 0 | if (curaddr->broadaddr) |
1449 | 0 | free(curaddr->broadaddr); |
1450 | 0 | if (curaddr->dstaddr) |
1451 | 0 | free(curaddr->dstaddr); |
1452 | 0 | free(curaddr); |
1453 | 0 | } |
1454 | | |
1455 | | /* |
1456 | | * Free the name string. |
1457 | | */ |
1458 | 0 | free(curdev->name); |
1459 | | |
1460 | | /* |
1461 | | * Free the description string, if any. |
1462 | | */ |
1463 | 0 | if (curdev->description != NULL) |
1464 | 0 | free(curdev->description); |
1465 | | |
1466 | | /* |
1467 | | * Free the interface. |
1468 | | */ |
1469 | 0 | free(curdev); |
1470 | 0 | } |
1471 | 0 | } |
1472 | | |
1473 | | /* |
1474 | | * pcap-npf.c has its own pcap_lookupdev(), for compatibility reasons, as |
1475 | | * it actually returns the names of all interfaces, with a NUL separator |
1476 | | * between them; some callers may depend on that. |
1477 | | * |
1478 | | * MS-DOS has its own pcap_lookupdev(), but that might be useful only |
1479 | | * as an optimization. |
1480 | | * |
1481 | | * In all other cases, we just use pcap_findalldevs() to get a list of |
1482 | | * devices, and pick from that list. |
1483 | | */ |
1484 | | #if !defined(HAVE_PACKET32) && !defined(MSDOS) |
1485 | | /* |
1486 | | * Return the name of a network interface attached to the system, or NULL |
1487 | | * if none can be found. The interface must be configured up; the |
1488 | | * lowest unit number is preferred; loopback is ignored. |
1489 | | */ |
1490 | | char * |
1491 | | pcap_lookupdev(char *errbuf) |
1492 | 0 | { |
1493 | 0 | pcap_if_t *alldevs; |
1494 | | #ifdef _WIN32 |
1495 | | /* |
1496 | | * Windows - use the same size as the old WinPcap 3.1 code. |
1497 | | * XXX - this is probably bigger than it needs to be. |
1498 | | */ |
1499 | | #define IF_NAMESIZE 8192 |
1500 | | #else |
1501 | | /* |
1502 | | * UN*X - use the system's interface name size. |
1503 | | * XXX - that might not be large enough for capture devices |
1504 | | * that aren't regular network interfaces. |
1505 | | */ |
1506 | | /* for old BSD systems, including bsdi3 */ |
1507 | | #ifndef IF_NAMESIZE |
1508 | | #define IF_NAMESIZE IFNAMSIZ |
1509 | | #endif |
1510 | 0 | #endif |
1511 | 0 | static char device[IF_NAMESIZE + 1]; |
1512 | 0 | char *ret; |
1513 | | |
1514 | | /* |
1515 | | * We disable this in "new API" mode, because 1) in WinPcap/Npcap, |
1516 | | * it may return UTF-16 strings, for backwards-compatibility |
1517 | | * reasons, and we're also disabling the hack to make that work, |
1518 | | * for not-going-past-the-end-of-a-string reasons, and 2) we |
1519 | | * want its behavior to be consistent. |
1520 | | * |
1521 | | * In addition, it's not thread-safe, so we've marked it as |
1522 | | * deprecated. |
1523 | | */ |
1524 | 0 | if (pcap_new_api) { |
1525 | 0 | snprintf(errbuf, PCAP_ERRBUF_SIZE, |
1526 | 0 | "pcap_lookupdev() is deprecated and is not supported in programs calling pcap_init()"); |
1527 | 0 | return (NULL); |
1528 | 0 | } |
1529 | | |
1530 | 0 | if (pcap_findalldevs(&alldevs, errbuf) == -1) |
1531 | 0 | return (NULL); |
1532 | | |
1533 | 0 | if (alldevs == NULL || (alldevs->flags & PCAP_IF_LOOPBACK)) { |
1534 | | /* |
1535 | | * There are no devices on the list, or the first device |
1536 | | * on the list is a loopback device, which means there |
1537 | | * are no non-loopback devices on the list. This means |
1538 | | * we can't return any device. |
1539 | | * |
1540 | | * XXX - why not return a loopback device? If we can't |
1541 | | * capture on it, it won't be on the list, and if it's |
1542 | | * on the list, there aren't any non-loopback devices, |
1543 | | * so why not just supply it as the default device? |
1544 | | */ |
1545 | 0 | (void)pcap_strlcpy(errbuf, "no suitable device found", |
1546 | 0 | PCAP_ERRBUF_SIZE); |
1547 | 0 | ret = NULL; |
1548 | 0 | } else { |
1549 | | /* |
1550 | | * Return the name of the first device on the list. |
1551 | | */ |
1552 | 0 | (void)pcap_strlcpy(device, alldevs->name, sizeof(device)); |
1553 | 0 | ret = device; |
1554 | 0 | } |
1555 | |
|
1556 | 0 | pcap_freealldevs(alldevs); |
1557 | 0 | return (ret); |
1558 | 0 | } |
1559 | | #endif /* !defined(HAVE_PACKET32) && !defined(MSDOS) */ |
1560 | | |
1561 | | #if !defined(_WIN32) && !defined(MSDOS) |
1562 | | /* |
1563 | | * We don't just fetch the entire list of devices, search for the |
1564 | | * particular device, and use its first IPv4 address, as that's too |
1565 | | * much work to get just one device's netmask. |
1566 | | * |
1567 | | * If we had an API to get attributes for a given device, we could |
1568 | | * use that. |
1569 | | */ |
1570 | | int |
1571 | | pcap_lookupnet(const char *device, bpf_u_int32 *netp, bpf_u_int32 *maskp, |
1572 | | char *errbuf) |
1573 | 0 | { |
1574 | 0 | register int fd; |
1575 | 0 | register struct sockaddr_in *sin4; |
1576 | 0 | struct ifreq ifr; |
1577 | | |
1578 | | /* |
1579 | | * The pseudo-device "any" listens on all interfaces and therefore |
1580 | | * has the network address and -mask "0.0.0.0" therefore catching |
1581 | | * all traffic. Using NULL for the interface is the same as "any". |
1582 | | */ |
1583 | 0 | if (!device || strcmp(device, "any") == 0 |
1584 | | #ifdef HAVE_DAG_API |
1585 | | || strstr(device, "dag") != NULL |
1586 | | #endif |
1587 | | #ifdef HAVE_SEPTEL_API |
1588 | | || strstr(device, "septel") != NULL |
1589 | | #endif |
1590 | | #ifdef PCAP_SUPPORT_BT |
1591 | | || strstr(device, "bluetooth") != NULL |
1592 | | #endif |
1593 | 0 | #ifdef PCAP_SUPPORT_LINUX_USBMON |
1594 | 0 | || strstr(device, "usbmon") != NULL |
1595 | 0 | #endif |
1596 | | #ifdef HAVE_SNF_API |
1597 | | || strstr(device, "snf") != NULL |
1598 | | #endif |
1599 | | #ifdef PCAP_SUPPORT_NETMAP |
1600 | | || strncmp(device, "netmap:", 7) == 0 |
1601 | | || strncmp(device, "vale", 4) == 0 |
1602 | | #endif |
1603 | | #ifdef PCAP_SUPPORT_DPDK |
1604 | | || strncmp(device, "dpdk:", 5) == 0 |
1605 | | #endif |
1606 | 0 | ) { |
1607 | 0 | *netp = *maskp = 0; |
1608 | 0 | return 0; |
1609 | 0 | } |
1610 | | |
1611 | 0 | fd = socket(AF_INET, SOCK_DGRAM, 0); |
1612 | 0 | if (fd < 0) { |
1613 | 0 | pcap_fmt_errmsg_for_errno(errbuf, PCAP_ERRBUF_SIZE, |
1614 | 0 | errno, "socket"); |
1615 | 0 | return (-1); |
1616 | 0 | } |
1617 | 0 | memset(&ifr, 0, sizeof(ifr)); |
1618 | 0 | #ifdef linux |
1619 | | /* XXX Work around Linux kernel bug */ |
1620 | 0 | ifr.ifr_addr.sa_family = AF_INET; |
1621 | 0 | #endif |
1622 | 0 | (void)pcap_strlcpy(ifr.ifr_name, device, sizeof(ifr.ifr_name)); |
1623 | 0 | if (ioctl(fd, SIOCGIFADDR, (char *)&ifr) < 0) { |
1624 | 0 | if (errno == EADDRNOTAVAIL) { |
1625 | 0 | (void)snprintf(errbuf, PCAP_ERRBUF_SIZE, |
1626 | 0 | "%s: no IPv4 address assigned", device); |
1627 | 0 | } else { |
1628 | 0 | pcap_fmt_errmsg_for_errno(errbuf, PCAP_ERRBUF_SIZE, |
1629 | 0 | errno, "SIOCGIFADDR: %s", device); |
1630 | 0 | } |
1631 | 0 | (void)close(fd); |
1632 | 0 | return (-1); |
1633 | 0 | } |
1634 | 0 | sin4 = (struct sockaddr_in *)&ifr.ifr_addr; |
1635 | 0 | *netp = sin4->sin_addr.s_addr; |
1636 | 0 | memset(&ifr, 0, sizeof(ifr)); |
1637 | 0 | #ifdef linux |
1638 | | /* XXX Work around Linux kernel bug */ |
1639 | 0 | ifr.ifr_addr.sa_family = AF_INET; |
1640 | 0 | #endif |
1641 | 0 | (void)pcap_strlcpy(ifr.ifr_name, device, sizeof(ifr.ifr_name)); |
1642 | 0 | if (ioctl(fd, SIOCGIFNETMASK, (char *)&ifr) < 0) { |
1643 | 0 | pcap_fmt_errmsg_for_errno(errbuf, PCAP_ERRBUF_SIZE, |
1644 | 0 | errno, "SIOCGIFNETMASK: %s", device); |
1645 | 0 | (void)close(fd); |
1646 | 0 | return (-1); |
1647 | 0 | } |
1648 | 0 | (void)close(fd); |
1649 | 0 | *maskp = sin4->sin_addr.s_addr; |
1650 | 0 | if (*maskp == 0) { |
1651 | 0 | if (IN_CLASSA(*netp)) |
1652 | 0 | *maskp = IN_CLASSA_NET; |
1653 | 0 | else if (IN_CLASSB(*netp)) |
1654 | 0 | *maskp = IN_CLASSB_NET; |
1655 | 0 | else if (IN_CLASSC(*netp)) |
1656 | 0 | *maskp = IN_CLASSC_NET; |
1657 | 0 | else { |
1658 | 0 | (void)snprintf(errbuf, PCAP_ERRBUF_SIZE, |
1659 | 0 | "inet class for 0x%x unknown", *netp); |
1660 | 0 | return (-1); |
1661 | 0 | } |
1662 | 0 | } |
1663 | 0 | *netp &= *maskp; |
1664 | 0 | return (0); |
1665 | 0 | } |
1666 | | #endif /* !defined(_WIN32) && !defined(MSDOS) */ |
1667 | | |
1668 | | #ifdef ENABLE_REMOTE |
1669 | | #include "pcap-rpcap.h" |
1670 | | |
1671 | | /* |
1672 | | * Extract a substring from a string. |
1673 | | */ |
1674 | | static char * |
1675 | | get_substring(const char *p, size_t len, char *ebuf) |
1676 | | { |
1677 | | char *token; |
1678 | | |
1679 | | token = malloc(len + 1); |
1680 | | if (token == NULL) { |
1681 | | pcap_fmt_errmsg_for_errno(ebuf, PCAP_ERRBUF_SIZE, |
1682 | | errno, "malloc"); |
1683 | | return (NULL); |
1684 | | } |
1685 | | memcpy(token, p, len); |
1686 | | token[len] = '\0'; |
1687 | | return (token); |
1688 | | } |
1689 | | |
1690 | | /* |
1691 | | * Parse a capture source that might be a URL. |
1692 | | * |
1693 | | * If the source is not a URL, *schemep, *userinfop, *hostp, and *portp |
1694 | | * are set to NULL, *pathp is set to point to the source, and 0 is |
1695 | | * returned. |
1696 | | * |
1697 | | * If source is a URL, and the URL refers to a local device (a special |
1698 | | * case of rpcap:), *schemep, *userinfop, *hostp, and *portp are set |
1699 | | * to NULL, *pathp is set to point to the device name, and 0 is returned. |
1700 | | * |
1701 | | * If source is a URL, and it's not a special case that refers to a local |
1702 | | * device, and the parse succeeds: |
1703 | | * |
1704 | | * *schemep is set to point to an allocated string containing the scheme; |
1705 | | * |
1706 | | * if user information is present in the URL, *userinfop is set to point |
1707 | | * to an allocated string containing the user information, otherwise |
1708 | | * it's set to NULL; |
1709 | | * |
1710 | | * if host information is present in the URL, *hostp is set to point |
1711 | | * to an allocated string containing the host information, otherwise |
1712 | | * it's set to NULL; |
1713 | | * |
1714 | | * if a port number is present in the URL, *portp is set to point |
1715 | | * to an allocated string containing the port number, otherwise |
1716 | | * it's set to NULL; |
1717 | | * |
1718 | | * *pathp is set to point to an allocated string containing the |
1719 | | * path; |
1720 | | * |
1721 | | * and 0 is returned. |
1722 | | * |
1723 | | * If the parse fails, ebuf is set to an error string, and -1 is returned. |
1724 | | */ |
1725 | | static int |
1726 | | pcap_parse_source(const char *source, char **schemep, char **userinfop, |
1727 | | char **hostp, char **portp, char **pathp, char *ebuf) |
1728 | | { |
1729 | | char *colonp; |
1730 | | size_t scheme_len; |
1731 | | char *scheme; |
1732 | | const char *endp; |
1733 | | size_t authority_len; |
1734 | | char *authority; |
1735 | | char *parsep, *atsignp, *bracketp; |
1736 | | char *userinfo, *host, *port, *path; |
1737 | | |
1738 | | /* |
1739 | | * Start out returning nothing. |
1740 | | */ |
1741 | | *schemep = NULL; |
1742 | | *userinfop = NULL; |
1743 | | *hostp = NULL; |
1744 | | *portp = NULL; |
1745 | | *pathp = NULL; |
1746 | | |
1747 | | /* |
1748 | | * RFC 3986 says: |
1749 | | * |
1750 | | * URI = scheme ":" hier-part [ "?" query ] [ "#" fragment ] |
1751 | | * |
1752 | | * hier-part = "//" authority path-abempty |
1753 | | * / path-absolute |
1754 | | * / path-rootless |
1755 | | * / path-empty |
1756 | | * |
1757 | | * authority = [ userinfo "@" ] host [ ":" port ] |
1758 | | * |
1759 | | * userinfo = *( unreserved / pct-encoded / sub-delims / ":" ) |
1760 | | * |
1761 | | * Step 1: look for the ":" at the end of the scheme. |
1762 | | * A colon in the source is *NOT* sufficient to indicate that |
1763 | | * this is a URL, as interface names on some platforms might |
1764 | | * include colons (e.g., I think some Solaris interfaces |
1765 | | * might). |
1766 | | */ |
1767 | | colonp = strchr(source, ':'); |
1768 | | if (colonp == NULL) { |
1769 | | /* |
1770 | | * The source is the device to open. |
1771 | | * Return a NULL pointer for the scheme, user information, |
1772 | | * host, and port, and return the device as the path. |
1773 | | */ |
1774 | | *pathp = strdup(source); |
1775 | | if (*pathp == NULL) { |
1776 | | pcap_fmt_errmsg_for_errno(ebuf, PCAP_ERRBUF_SIZE, |
1777 | | errno, "malloc"); |
1778 | | return (-1); |
1779 | | } |
1780 | | return (0); |
1781 | | } |
1782 | | |
1783 | | /* |
1784 | | * All schemes must have "//" after them, i.e. we only support |
1785 | | * hier-part = "//" authority path-abempty, not |
1786 | | * hier-part = path-absolute |
1787 | | * hier-part = path-rootless |
1788 | | * hier-part = path-empty |
1789 | | * |
1790 | | * We need that in order to distinguish between a local device |
1791 | | * name that happens to contain a colon and a URI. |
1792 | | */ |
1793 | | if (strncmp(colonp + 1, "//", 2) != 0) { |
1794 | | /* |
1795 | | * The source is the device to open. |
1796 | | * Return a NULL pointer for the scheme, user information, |
1797 | | * host, and port, and return the device as the path. |
1798 | | */ |
1799 | | *pathp = strdup(source); |
1800 | | if (*pathp == NULL) { |
1801 | | pcap_fmt_errmsg_for_errno(ebuf, PCAP_ERRBUF_SIZE, |
1802 | | errno, "malloc"); |
1803 | | return (-1); |
1804 | | } |
1805 | | return (0); |
1806 | | } |
1807 | | |
1808 | | /* |
1809 | | * XXX - check whether the purported scheme could be a scheme? |
1810 | | */ |
1811 | | |
1812 | | /* |
1813 | | * OK, this looks like a URL. |
1814 | | * Get the scheme. |
1815 | | */ |
1816 | | scheme_len = colonp - source; |
1817 | | scheme = malloc(scheme_len + 1); |
1818 | | if (scheme == NULL) { |
1819 | | pcap_fmt_errmsg_for_errno(ebuf, PCAP_ERRBUF_SIZE, |
1820 | | errno, "malloc"); |
1821 | | return (-1); |
1822 | | } |
1823 | | memcpy(scheme, source, scheme_len); |
1824 | | scheme[scheme_len] = '\0'; |
1825 | | |
1826 | | /* |
1827 | | * Treat file: specially - take everything after file:// as |
1828 | | * the pathname. |
1829 | | */ |
1830 | | if (pcap_strcasecmp(scheme, "file") == 0) { |
1831 | | *pathp = strdup(colonp + 3); |
1832 | | if (*pathp == NULL) { |
1833 | | pcap_fmt_errmsg_for_errno(ebuf, PCAP_ERRBUF_SIZE, |
1834 | | errno, "malloc"); |
1835 | | free(scheme); |
1836 | | return (-1); |
1837 | | } |
1838 | | *schemep = scheme; |
1839 | | return (0); |
1840 | | } |
1841 | | |
1842 | | /* |
1843 | | * The WinPcap documentation says you can specify a local |
1844 | | * interface with "rpcap://{device}"; we special-case |
1845 | | * that here. If the scheme is "rpcap", and there are |
1846 | | * no slashes past the "//", we just return the device. |
1847 | | * |
1848 | | * XXX - %-escaping? |
1849 | | */ |
1850 | | if ((pcap_strcasecmp(scheme, "rpcap") == 0 || |
1851 | | pcap_strcasecmp(scheme, "rpcaps") == 0) && |
1852 | | strchr(colonp + 3, '/') == NULL) { |
1853 | | /* |
1854 | | * Local device. |
1855 | | * |
1856 | | * Return a NULL pointer for the scheme, user information, |
1857 | | * host, and port, and return the device as the path. |
1858 | | */ |
1859 | | free(scheme); |
1860 | | *pathp = strdup(colonp + 3); |
1861 | | if (*pathp == NULL) { |
1862 | | pcap_fmt_errmsg_for_errno(ebuf, PCAP_ERRBUF_SIZE, |
1863 | | errno, "malloc"); |
1864 | | return (-1); |
1865 | | } |
1866 | | return (0); |
1867 | | } |
1868 | | |
1869 | | /* |
1870 | | * OK, now start parsing the authority. |
1871 | | * Get token, terminated with / or terminated at the end of |
1872 | | * the string. |
1873 | | */ |
1874 | | authority_len = strcspn(colonp + 3, "/"); |
1875 | | authority = get_substring(colonp + 3, authority_len, ebuf); |
1876 | | if (authority == NULL) { |
1877 | | /* |
1878 | | * Error. |
1879 | | */ |
1880 | | free(scheme); |
1881 | | return (-1); |
1882 | | } |
1883 | | endp = colonp + 3 + authority_len; |
1884 | | |
1885 | | /* |
1886 | | * Now carve the authority field into its components. |
1887 | | */ |
1888 | | parsep = authority; |
1889 | | |
1890 | | /* |
1891 | | * Is there a userinfo field? |
1892 | | */ |
1893 | | atsignp = strchr(parsep, '@'); |
1894 | | if (atsignp != NULL) { |
1895 | | /* |
1896 | | * Yes. |
1897 | | */ |
1898 | | size_t userinfo_len; |
1899 | | |
1900 | | userinfo_len = atsignp - parsep; |
1901 | | userinfo = get_substring(parsep, userinfo_len, ebuf); |
1902 | | if (userinfo == NULL) { |
1903 | | /* |
1904 | | * Error. |
1905 | | */ |
1906 | | free(authority); |
1907 | | free(scheme); |
1908 | | return (-1); |
1909 | | } |
1910 | | parsep = atsignp + 1; |
1911 | | } else { |
1912 | | /* |
1913 | | * No. |
1914 | | */ |
1915 | | userinfo = NULL; |
1916 | | } |
1917 | | |
1918 | | /* |
1919 | | * Is there a host field? |
1920 | | */ |
1921 | | if (*parsep == '\0') { |
1922 | | /* |
1923 | | * No; there's no host field or port field. |
1924 | | */ |
1925 | | host = NULL; |
1926 | | port = NULL; |
1927 | | } else { |
1928 | | /* |
1929 | | * Yes. |
1930 | | */ |
1931 | | size_t host_len; |
1932 | | |
1933 | | /* |
1934 | | * Is it an IP-literal? |
1935 | | */ |
1936 | | if (*parsep == '[') { |
1937 | | /* |
1938 | | * Yes. |
1939 | | * Treat verything up to the closing square |
1940 | | * bracket as the IP-Literal; we don't worry |
1941 | | * about whether it's a valid IPv6address or |
1942 | | * IPvFuture (or an IPv4address, for that |
1943 | | * matter, just in case we get handed a |
1944 | | * URL with an IPv4 IP-Literal, of the sort |
1945 | | * that pcap_createsrcstr() used to generate, |
1946 | | * and that pcap_parsesrcstr(), in the original |
1947 | | * WinPcap code, accepted). |
1948 | | */ |
1949 | | bracketp = strchr(parsep, ']'); |
1950 | | if (bracketp == NULL) { |
1951 | | /* |
1952 | | * There's no closing square bracket. |
1953 | | */ |
1954 | | snprintf(ebuf, PCAP_ERRBUF_SIZE, |
1955 | | "IP-literal in URL doesn't end with ]"); |
1956 | | free(userinfo); |
1957 | | free(authority); |
1958 | | free(scheme); |
1959 | | return (-1); |
1960 | | } |
1961 | | if (*(bracketp + 1) != '\0' && |
1962 | | *(bracketp + 1) != ':') { |
1963 | | /* |
1964 | | * There's extra crud after the |
1965 | | * closing square bracketn. |
1966 | | */ |
1967 | | snprintf(ebuf, PCAP_ERRBUF_SIZE, |
1968 | | "Extra text after IP-literal in URL"); |
1969 | | free(userinfo); |
1970 | | free(authority); |
1971 | | free(scheme); |
1972 | | return (-1); |
1973 | | } |
1974 | | host_len = (bracketp - 1) - parsep; |
1975 | | host = get_substring(parsep + 1, host_len, ebuf); |
1976 | | if (host == NULL) { |
1977 | | /* |
1978 | | * Error. |
1979 | | */ |
1980 | | free(userinfo); |
1981 | | free(authority); |
1982 | | free(scheme); |
1983 | | return (-1); |
1984 | | } |
1985 | | parsep = bracketp + 1; |
1986 | | } else { |
1987 | | /* |
1988 | | * No. |
1989 | | * Treat everything up to a : or the end of |
1990 | | * the string as the host. |
1991 | | */ |
1992 | | host_len = strcspn(parsep, ":"); |
1993 | | host = get_substring(parsep, host_len, ebuf); |
1994 | | if (host == NULL) { |
1995 | | /* |
1996 | | * Error. |
1997 | | */ |
1998 | | free(userinfo); |
1999 | | free(authority); |
2000 | | free(scheme); |
2001 | | return (-1); |
2002 | | } |
2003 | | parsep = parsep + host_len; |
2004 | | } |
2005 | | |
2006 | | /* |
2007 | | * Is there a port field? |
2008 | | */ |
2009 | | if (*parsep == ':') { |
2010 | | /* |
2011 | | * Yes. It's the rest of the authority field. |
2012 | | */ |
2013 | | size_t port_len; |
2014 | | |
2015 | | parsep++; |
2016 | | port_len = strlen(parsep); |
2017 | | port = get_substring(parsep, port_len, ebuf); |
2018 | | if (port == NULL) { |
2019 | | /* |
2020 | | * Error. |
2021 | | */ |
2022 | | free(host); |
2023 | | free(userinfo); |
2024 | | free(authority); |
2025 | | free(scheme); |
2026 | | return (-1); |
2027 | | } |
2028 | | } else { |
2029 | | /* |
2030 | | * No. |
2031 | | */ |
2032 | | port = NULL; |
2033 | | } |
2034 | | } |
2035 | | free(authority); |
2036 | | |
2037 | | /* |
2038 | | * Everything else is the path. Strip off the leading /. |
2039 | | */ |
2040 | | if (*endp == '\0') |
2041 | | path = strdup(""); |
2042 | | else |
2043 | | path = strdup(endp + 1); |
2044 | | if (path == NULL) { |
2045 | | pcap_fmt_errmsg_for_errno(ebuf, PCAP_ERRBUF_SIZE, |
2046 | | errno, "malloc"); |
2047 | | free(port); |
2048 | | free(host); |
2049 | | free(userinfo); |
2050 | | free(scheme); |
2051 | | return (-1); |
2052 | | } |
2053 | | *schemep = scheme; |
2054 | | *userinfop = userinfo; |
2055 | | *hostp = host; |
2056 | | *portp = port; |
2057 | | *pathp = path; |
2058 | | return (0); |
2059 | | } |
2060 | | |
2061 | | int |
2062 | | pcap_createsrcstr_ex(char *source, int type, const char *userinfo, const char *host, |
2063 | | const char *port, const char *name, unsigned char uses_ssl, char *errbuf) |
2064 | | { |
2065 | | switch (type) { |
2066 | | |
2067 | | case PCAP_SRC_FILE: |
2068 | | pcap_strlcpy(source, PCAP_SRC_FILE_STRING, PCAP_BUF_SIZE); |
2069 | | if (name != NULL && *name != '\0') { |
2070 | | pcap_strlcat(source, name, PCAP_BUF_SIZE); |
2071 | | return (0); |
2072 | | } else { |
2073 | | snprintf(errbuf, PCAP_ERRBUF_SIZE, |
2074 | | "The file name cannot be NULL."); |
2075 | | return (-1); |
2076 | | } |
2077 | | |
2078 | | case PCAP_SRC_IFREMOTE: |
2079 | | pcap_strlcpy(source, |
2080 | | (uses_ssl ? "rpcaps://" : PCAP_SRC_IF_STRING), |
2081 | | PCAP_BUF_SIZE); |
2082 | | if (host != NULL && *host != '\0') { |
2083 | | if (userinfo != NULL && *userinfo != '\0') { |
2084 | | pcap_strlcat(source, userinfo, PCAP_BUF_SIZE); |
2085 | | pcap_strlcat(source, "@", PCAP_BUF_SIZE); |
2086 | | } |
2087 | | |
2088 | | if (strchr(host, ':') != NULL) { |
2089 | | /* |
2090 | | * The host name contains a colon, so it's |
2091 | | * probably an IPv6 address, and needs to |
2092 | | * be included in square brackets. |
2093 | | */ |
2094 | | pcap_strlcat(source, "[", PCAP_BUF_SIZE); |
2095 | | pcap_strlcat(source, host, PCAP_BUF_SIZE); |
2096 | | pcap_strlcat(source, "]", PCAP_BUF_SIZE); |
2097 | | } else |
2098 | | pcap_strlcat(source, host, PCAP_BUF_SIZE); |
2099 | | |
2100 | | if (port != NULL && *port != '\0') { |
2101 | | pcap_strlcat(source, ":", PCAP_BUF_SIZE); |
2102 | | pcap_strlcat(source, port, PCAP_BUF_SIZE); |
2103 | | } |
2104 | | |
2105 | | pcap_strlcat(source, "/", PCAP_BUF_SIZE); |
2106 | | } else { |
2107 | | snprintf(errbuf, PCAP_ERRBUF_SIZE, |
2108 | | "The host name cannot be NULL."); |
2109 | | return (-1); |
2110 | | } |
2111 | | |
2112 | | if (name != NULL && *name != '\0') |
2113 | | pcap_strlcat(source, name, PCAP_BUF_SIZE); |
2114 | | |
2115 | | return (0); |
2116 | | |
2117 | | case PCAP_SRC_IFLOCAL: |
2118 | | pcap_strlcpy(source, PCAP_SRC_IF_STRING, PCAP_BUF_SIZE); |
2119 | | |
2120 | | if (name != NULL && *name != '\0') |
2121 | | pcap_strlcat(source, name, PCAP_BUF_SIZE); |
2122 | | |
2123 | | return (0); |
2124 | | |
2125 | | default: |
2126 | | snprintf(errbuf, PCAP_ERRBUF_SIZE, |
2127 | | "The interface type is not valid."); |
2128 | | return (-1); |
2129 | | } |
2130 | | } |
2131 | | |
2132 | | |
2133 | | int |
2134 | | pcap_createsrcstr(char *source, int type, const char *host, const char *port, |
2135 | | const char *name, char *errbuf) |
2136 | | { |
2137 | | return (pcap_createsrcstr_ex(source, type, NULL, host, port, name, 0, errbuf)); |
2138 | | } |
2139 | | |
2140 | | int |
2141 | | pcap_parsesrcstr_ex(const char *source, int *type, char *userinfo, char *host, |
2142 | | char *port, char *name, unsigned char *uses_ssl, char *errbuf) |
2143 | | { |
2144 | | char *scheme, *tmpuserinfo, *tmphost, *tmpport, *tmppath; |
2145 | | |
2146 | | /* Initialization stuff */ |
2147 | | if (userinfo) |
2148 | | *userinfo = '\0'; |
2149 | | if (host) |
2150 | | *host = '\0'; |
2151 | | if (port) |
2152 | | *port = '\0'; |
2153 | | if (name) |
2154 | | *name = '\0'; |
2155 | | if (uses_ssl) |
2156 | | *uses_ssl = 0; |
2157 | | |
2158 | | /* Parse the source string */ |
2159 | | if (pcap_parse_source(source, &scheme, &tmpuserinfo, &tmphost, |
2160 | | &tmpport, &tmppath, errbuf) == -1) { |
2161 | | /* |
2162 | | * Fail. |
2163 | | */ |
2164 | | return (-1); |
2165 | | } |
2166 | | |
2167 | | if (scheme == NULL) { |
2168 | | /* |
2169 | | * Local device. |
2170 | | */ |
2171 | | if (name && tmppath) |
2172 | | pcap_strlcpy(name, tmppath, PCAP_BUF_SIZE); |
2173 | | if (type) |
2174 | | *type = PCAP_SRC_IFLOCAL; |
2175 | | free(tmppath); |
2176 | | free(tmpport); |
2177 | | free(tmphost); |
2178 | | free(tmpuserinfo); |
2179 | | return (0); |
2180 | | } |
2181 | | |
2182 | | int is_rpcap = 0; |
2183 | | if (strcmp(scheme, "rpcaps") == 0) { |
2184 | | is_rpcap = 1; |
2185 | | if (uses_ssl) *uses_ssl = 1; |
2186 | | } else if (strcmp(scheme, "rpcap") == 0) { |
2187 | | is_rpcap = 1; |
2188 | | } |
2189 | | |
2190 | | if (is_rpcap) { |
2191 | | /* |
2192 | | * rpcap[s]:// |
2193 | | * |
2194 | | * pcap_parse_source() has already handled the case of |
2195 | | * rpcap[s]://device |
2196 | | */ |
2197 | | if (userinfo && tmpuserinfo) |
2198 | | pcap_strlcpy(userinfo, tmpuserinfo, PCAP_BUF_SIZE); |
2199 | | if (host && tmphost) |
2200 | | pcap_strlcpy(host, tmphost, PCAP_BUF_SIZE); |
2201 | | if (port && tmpport) |
2202 | | pcap_strlcpy(port, tmpport, PCAP_BUF_SIZE); |
2203 | | if (name && tmppath) |
2204 | | pcap_strlcpy(name, tmppath, PCAP_BUF_SIZE); |
2205 | | if (type) |
2206 | | *type = PCAP_SRC_IFREMOTE; |
2207 | | free(tmppath); |
2208 | | free(tmpport); |
2209 | | free(tmphost); |
2210 | | free(tmpuserinfo); |
2211 | | free(scheme); |
2212 | | return (0); |
2213 | | } |
2214 | | |
2215 | | if (strcmp(scheme, "file") == 0) { |
2216 | | /* |
2217 | | * file:// |
2218 | | */ |
2219 | | if (name && tmppath) |
2220 | | pcap_strlcpy(name, tmppath, PCAP_BUF_SIZE); |
2221 | | if (type) |
2222 | | *type = PCAP_SRC_FILE; |
2223 | | free(tmppath); |
2224 | | free(tmpport); |
2225 | | free(tmphost); |
2226 | | free(tmpuserinfo); |
2227 | | free(scheme); |
2228 | | return (0); |
2229 | | } |
2230 | | |
2231 | | /* |
2232 | | * Neither rpcap: nor file:; just treat the entire string |
2233 | | * as a local device. |
2234 | | */ |
2235 | | if (name) |
2236 | | pcap_strlcpy(name, source, PCAP_BUF_SIZE); |
2237 | | if (type) |
2238 | | *type = PCAP_SRC_IFLOCAL; |
2239 | | free(tmppath); |
2240 | | free(tmpport); |
2241 | | free(tmphost); |
2242 | | free(tmpuserinfo); |
2243 | | free(scheme); |
2244 | | return (0); |
2245 | | } |
2246 | | |
2247 | | int |
2248 | | pcap_parsesrcstr(const char *source, int *type, char *host, char *port, |
2249 | | char *name, char *errbuf) |
2250 | | { |
2251 | | return (pcap_parsesrcstr_ex(source, type, NULL, host, port, name, NULL, errbuf)); |
2252 | | } |
2253 | | #endif |
2254 | | |
2255 | | pcap_t * |
2256 | | pcap_create(const char *device, char *errbuf) |
2257 | 0 | { |
2258 | 0 | size_t i; |
2259 | 0 | int is_theirs; |
2260 | 0 | pcap_t *p; |
2261 | 0 | char *device_str; |
2262 | | |
2263 | | /* |
2264 | | * A null device name is equivalent to the "any" device - |
2265 | | * which might not be supported on this platform, but |
2266 | | * this means that you'll get a "not supported" error |
2267 | | * rather than, say, a crash when we try to dereference |
2268 | | * the null pointer. |
2269 | | */ |
2270 | 0 | if (device == NULL) |
2271 | 0 | device_str = strdup("any"); |
2272 | 0 | else { |
2273 | | #ifdef _WIN32 |
2274 | | /* |
2275 | | * On Windows, for backwards compatibility reasons, |
2276 | | * pcap_lookupdev() returns a pointer to a sequence of |
2277 | | * pairs of UTF-16LE device names and local code page |
2278 | | * description strings. |
2279 | | * |
2280 | | * This means that if a program uses pcap_lookupdev() |
2281 | | * to get a default device, and hands that to an API |
2282 | | * that opens devices, we'll get handed a UTF-16LE |
2283 | | * string, not a string in the local code page. |
2284 | | * |
2285 | | * To work around that, we check whether the string |
2286 | | * looks as if it might be a UTF-16LE string and, if |
2287 | | * so, convert it back to the local code page's |
2288 | | * extended ASCII. |
2289 | | * |
2290 | | * We disable that check in "new API" mode, because: |
2291 | | * |
2292 | | * 1) You *cannot* reliably detect whether a |
2293 | | * string is UTF-16LE or not; "a" could either |
2294 | | * be a one-character ASCII string or the first |
2295 | | * character of a UTF-16LE string. |
2296 | | * |
2297 | | * 2) Doing that test can run past the end of |
2298 | | * the string, if it's a 1-character ASCII |
2299 | | * string |
2300 | | * |
2301 | | * This particular version of this heuristic dates |
2302 | | * back to WinPcap 4.1.1; PacketOpenAdapter() does |
2303 | | * uses the same heuristic, with the exact same |
2304 | | * vulnerability. |
2305 | | * |
2306 | | * That's why we disable this in "new API" mode. |
2307 | | * We keep it around in legacy mode for backwards |
2308 | | * compatibility. |
2309 | | */ |
2310 | | if (!pcap_new_api && device[0] != '\0' && device[1] == '\0') { |
2311 | | size_t length; |
2312 | | |
2313 | | length = wcslen((wchar_t *)device); |
2314 | | device_str = (char *)malloc(length + 1); |
2315 | | if (device_str == NULL) { |
2316 | | pcap_fmt_errmsg_for_errno(errbuf, |
2317 | | PCAP_ERRBUF_SIZE, errno, |
2318 | | "malloc"); |
2319 | | return (NULL); |
2320 | | } |
2321 | | |
2322 | | snprintf(device_str, length + 1, "%ws", |
2323 | | (const wchar_t *)device); |
2324 | | } else |
2325 | | #endif |
2326 | 0 | device_str = strdup(device); |
2327 | 0 | } |
2328 | 0 | if (device_str == NULL) { |
2329 | 0 | pcap_fmt_errmsg_for_errno(errbuf, PCAP_ERRBUF_SIZE, |
2330 | 0 | errno, "malloc"); |
2331 | 0 | return (NULL); |
2332 | 0 | } |
2333 | | |
2334 | | /* |
2335 | | * Try each of the non-local-network-interface capture |
2336 | | * source types until we find one that works for this |
2337 | | * device or run out of types. |
2338 | | */ |
2339 | 0 | for (i = 0; capture_source_types[i].create_op != NULL; i++) { |
2340 | 0 | is_theirs = 0; |
2341 | 0 | p = capture_source_types[i].create_op(device_str, errbuf, |
2342 | 0 | &is_theirs); |
2343 | 0 | if (is_theirs) { |
2344 | | /* |
2345 | | * The device name refers to a device of the |
2346 | | * type in question; either it succeeded, |
2347 | | * in which case p refers to a pcap_t to |
2348 | | * later activate for the device, or it |
2349 | | * failed, in which case p is null and we |
2350 | | * should return that to report the failure |
2351 | | * to create. |
2352 | | */ |
2353 | 0 | if (p == NULL) { |
2354 | | /* |
2355 | | * We assume the caller filled in errbuf. |
2356 | | */ |
2357 | 0 | free(device_str); |
2358 | 0 | return (NULL); |
2359 | 0 | } |
2360 | 0 | p->opt.device = device_str; |
2361 | 0 | return (p); |
2362 | 0 | } |
2363 | 0 | } |
2364 | | |
2365 | | /* |
2366 | | * OK, try it as a regular network interface. |
2367 | | */ |
2368 | 0 | p = pcap_create_interface(device_str, errbuf); |
2369 | 0 | if (p == NULL) { |
2370 | | /* |
2371 | | * We assume the caller filled in errbuf. |
2372 | | */ |
2373 | 0 | free(device_str); |
2374 | 0 | return (NULL); |
2375 | 0 | } |
2376 | 0 | p->opt.device = device_str; |
2377 | 0 | return (p); |
2378 | 0 | } |
2379 | | |
2380 | | /* |
2381 | | * Set nonblocking mode on an unactivated pcap_t; this sets a flag |
2382 | | * checked by pcap_activate(), which sets the mode after calling |
2383 | | * the activate routine. |
2384 | | */ |
2385 | | static int |
2386 | | pcap_setnonblock_unactivated(pcap_t *p, int nonblock) |
2387 | 0 | { |
2388 | 0 | p->opt.nonblock = nonblock; |
2389 | 0 | return (0); |
2390 | 0 | } |
2391 | | |
2392 | | static void |
2393 | | initialize_ops(pcap_t *p) |
2394 | 0 | { |
2395 | | /* |
2396 | | * Set operation pointers for operations that only work on |
2397 | | * an activated pcap_t to point to a routine that returns |
2398 | | * a "this isn't activated" error. |
2399 | | */ |
2400 | 0 | p->read_op = pcap_read_not_initialized; |
2401 | 0 | p->inject_op = pcap_inject_not_initialized; |
2402 | 0 | p->setfilter_op = pcap_setfilter_not_initialized; |
2403 | 0 | p->setdirection_op = pcap_setdirection_not_initialized; |
2404 | 0 | p->set_datalink_op = pcap_set_datalink_not_initialized; |
2405 | 0 | p->getnonblock_op = pcap_getnonblock_not_initialized; |
2406 | 0 | p->stats_op = pcap_stats_not_initialized; |
2407 | | #ifdef _WIN32 |
2408 | | p->stats_ex_op = pcap_stats_ex_not_initialized; |
2409 | | p->setbuff_op = pcap_setbuff_not_initialized; |
2410 | | p->setmode_op = pcap_setmode_not_initialized; |
2411 | | p->setmintocopy_op = pcap_setmintocopy_not_initialized; |
2412 | | p->getevent_op = pcap_getevent_not_initialized; |
2413 | | p->oid_get_request_op = pcap_oid_get_request_not_initialized; |
2414 | | p->oid_set_request_op = pcap_oid_set_request_not_initialized; |
2415 | | p->sendqueue_transmit_op = pcap_sendqueue_transmit_not_initialized; |
2416 | | p->setuserbuffer_op = pcap_setuserbuffer_not_initialized; |
2417 | | p->live_dump_op = pcap_live_dump_not_initialized; |
2418 | | p->live_dump_ended_op = pcap_live_dump_ended_not_initialized; |
2419 | | p->get_airpcap_handle_op = pcap_get_airpcap_handle_not_initialized; |
2420 | | #endif |
2421 | | |
2422 | | /* |
2423 | | * Default cleanup operation - implementations can override |
2424 | | * this, but should call pcap_cleanup_live_common() after |
2425 | | * doing their own additional cleanup. |
2426 | | */ |
2427 | 0 | p->cleanup_op = pcap_cleanup_live_common; |
2428 | | |
2429 | | /* |
2430 | | * In most cases, the standard one-shot callback can |
2431 | | * be used for pcap_next()/pcap_next_ex(). |
2432 | | */ |
2433 | 0 | p->oneshot_callback = pcap_oneshot; |
2434 | | |
2435 | | /* |
2436 | | * Default breakloop operation - implementations can override |
2437 | | * this, but should call pcap_breakloop_common() before doing |
2438 | | * their own logic. |
2439 | | */ |
2440 | 0 | p->breakloop_op = pcap_breakloop_common; |
2441 | 0 | } |
2442 | | |
2443 | | static pcap_t * |
2444 | | pcap_alloc_pcap_t(char *ebuf, size_t total_size, size_t private_offset) |
2445 | 17.3k | { |
2446 | 17.3k | char *chunk; |
2447 | 17.3k | pcap_t *p; |
2448 | | |
2449 | | /* |
2450 | | * total_size is the size of a structure containing a pcap_t |
2451 | | * followed by a private structure. |
2452 | | */ |
2453 | 17.3k | chunk = calloc(total_size, 1); |
2454 | 17.3k | if (chunk == NULL) { |
2455 | 0 | pcap_fmt_errmsg_for_errno(ebuf, PCAP_ERRBUF_SIZE, |
2456 | 0 | errno, "malloc"); |
2457 | 0 | return (NULL); |
2458 | 0 | } |
2459 | | |
2460 | | /* |
2461 | | * Get a pointer to the pcap_t at the beginning. |
2462 | | */ |
2463 | 17.3k | p = (pcap_t *)chunk; |
2464 | | |
2465 | | #ifdef _WIN32 |
2466 | | p->handle = INVALID_HANDLE_VALUE; /* not opened yet */ |
2467 | | #else /* _WIN32 */ |
2468 | 17.3k | p->fd = -1; /* not opened yet */ |
2469 | 17.3k | #ifndef MSDOS |
2470 | 17.3k | p->selectable_fd = -1; |
2471 | 17.3k | p->required_select_timeout = NULL; |
2472 | 17.3k | #endif /* MSDOS */ |
2473 | 17.3k | #endif /* _WIN32 */ |
2474 | | |
2475 | | /* |
2476 | | * private_offset is the offset, in bytes, of the private |
2477 | | * data from the beginning of the structure. |
2478 | | * |
2479 | | * Set the pointer to the private data; that's private_offset |
2480 | | * bytes past the pcap_t. |
2481 | | */ |
2482 | 17.3k | p->priv = (void *)(chunk + private_offset); |
2483 | | |
2484 | 17.3k | return (p); |
2485 | 17.3k | } |
2486 | | |
2487 | | pcap_t * |
2488 | | pcap_create_common(char *ebuf, size_t total_size, size_t private_offset) |
2489 | 0 | { |
2490 | 0 | pcap_t *p; |
2491 | |
|
2492 | 0 | p = pcap_alloc_pcap_t(ebuf, total_size, private_offset); |
2493 | 0 | if (p == NULL) |
2494 | 0 | return (NULL); |
2495 | | |
2496 | | /* |
2497 | | * Default to "can't set rfmon mode"; if it's supported by |
2498 | | * a platform, the create routine that called us can set |
2499 | | * the op to its routine to check whether a particular |
2500 | | * device supports it. |
2501 | | */ |
2502 | 0 | p->can_set_rfmon_op = pcap_cant_set_rfmon; |
2503 | | |
2504 | | /* |
2505 | | * If pcap_setnonblock() is called on a not-yet-activated |
2506 | | * pcap_t, default to setting a flag and turning |
2507 | | * on non-blocking mode when activated. |
2508 | | */ |
2509 | 0 | p->setnonblock_op = pcap_setnonblock_unactivated; |
2510 | |
|
2511 | 0 | initialize_ops(p); |
2512 | | |
2513 | | /* put in some defaults*/ |
2514 | 0 | p->snapshot = 0; /* max packet size unspecified */ |
2515 | 0 | p->opt.timeout = 0; /* no timeout specified */ |
2516 | 0 | p->opt.buffer_size = 0; /* use the platform's default */ |
2517 | 0 | p->opt.promisc = 0; |
2518 | 0 | p->opt.rfmon = 0; |
2519 | 0 | p->opt.immediate = 0; |
2520 | 0 | p->opt.tstamp_type = -1; /* default to not setting time stamp type */ |
2521 | 0 | p->opt.tstamp_precision = PCAP_TSTAMP_PRECISION_MICRO; |
2522 | | /* |
2523 | | * Platform-dependent options. |
2524 | | */ |
2525 | 0 | #ifdef __linux__ |
2526 | 0 | p->opt.protocol = 0; |
2527 | 0 | #endif |
2528 | | #ifdef _WIN32 |
2529 | | p->opt.nocapture_local = 0; |
2530 | | #endif |
2531 | | |
2532 | | /* |
2533 | | * Start out with no BPF code generation flags set. |
2534 | | */ |
2535 | 0 | p->bpf_codegen_flags = 0; |
2536 | |
|
2537 | 0 | return (p); |
2538 | 0 | } |
2539 | | |
2540 | | int |
2541 | | pcap_check_activated(pcap_t *p) |
2542 | 0 | { |
2543 | 0 | if (p->activated) { |
2544 | 0 | snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "can't perform " |
2545 | 0 | " operation on activated capture"); |
2546 | 0 | return (-1); |
2547 | 0 | } |
2548 | 0 | return (0); |
2549 | 0 | } |
2550 | | |
2551 | | int |
2552 | | pcap_set_snaplen(pcap_t *p, int snaplen) |
2553 | 0 | { |
2554 | 0 | if (pcap_check_activated(p)) |
2555 | 0 | return (PCAP_ERROR_ACTIVATED); |
2556 | 0 | p->snapshot = snaplen; |
2557 | 0 | return (0); |
2558 | 0 | } |
2559 | | |
2560 | | int |
2561 | | pcap_set_promisc(pcap_t *p, int promisc) |
2562 | 0 | { |
2563 | 0 | if (pcap_check_activated(p)) |
2564 | 0 | return (PCAP_ERROR_ACTIVATED); |
2565 | 0 | p->opt.promisc = promisc; |
2566 | 0 | return (0); |
2567 | 0 | } |
2568 | | |
2569 | | int |
2570 | | pcap_set_rfmon(pcap_t *p, int rfmon) |
2571 | 0 | { |
2572 | 0 | if (pcap_check_activated(p)) |
2573 | 0 | return (PCAP_ERROR_ACTIVATED); |
2574 | 0 | p->opt.rfmon = rfmon; |
2575 | 0 | return (0); |
2576 | 0 | } |
2577 | | |
2578 | | int |
2579 | | pcap_set_timeout(pcap_t *p, int timeout_ms) |
2580 | 0 | { |
2581 | 0 | if (pcap_check_activated(p)) |
2582 | 0 | return (PCAP_ERROR_ACTIVATED); |
2583 | 0 | p->opt.timeout = timeout_ms; |
2584 | 0 | return (0); |
2585 | 0 | } |
2586 | | |
2587 | | int |
2588 | | pcap_set_tstamp_type(pcap_t *p, int tstamp_type) |
2589 | 0 | { |
2590 | 0 | int i; |
2591 | |
|
2592 | 0 | if (pcap_check_activated(p)) |
2593 | 0 | return (PCAP_ERROR_ACTIVATED); |
2594 | | |
2595 | | /* |
2596 | | * The argument should have been u_int, but that's too late |
2597 | | * to change now - it's an API. |
2598 | | */ |
2599 | 0 | if (tstamp_type < 0) |
2600 | 0 | return (PCAP_WARNING_TSTAMP_TYPE_NOTSUP); |
2601 | | |
2602 | | /* |
2603 | | * If p->tstamp_type_count is 0, we only support PCAP_TSTAMP_HOST; |
2604 | | * the default time stamp type is PCAP_TSTAMP_HOST. |
2605 | | */ |
2606 | 0 | if (p->tstamp_type_count == 0) { |
2607 | 0 | if (tstamp_type == PCAP_TSTAMP_HOST) { |
2608 | 0 | p->opt.tstamp_type = tstamp_type; |
2609 | 0 | return (0); |
2610 | 0 | } |
2611 | 0 | } else { |
2612 | | /* |
2613 | | * Check whether we claim to support this type of time stamp. |
2614 | | */ |
2615 | 0 | for (i = 0; i < p->tstamp_type_count; i++) { |
2616 | 0 | if (p->tstamp_type_list[i] == (u_int)tstamp_type) { |
2617 | | /* |
2618 | | * Yes. |
2619 | | */ |
2620 | 0 | p->opt.tstamp_type = tstamp_type; |
2621 | 0 | return (0); |
2622 | 0 | } |
2623 | 0 | } |
2624 | 0 | } |
2625 | | |
2626 | | /* |
2627 | | * We don't support this type of time stamp. |
2628 | | */ |
2629 | 0 | return (PCAP_WARNING_TSTAMP_TYPE_NOTSUP); |
2630 | 0 | } |
2631 | | |
2632 | | int |
2633 | | pcap_set_immediate_mode(pcap_t *p, int immediate) |
2634 | 0 | { |
2635 | 0 | if (pcap_check_activated(p)) |
2636 | 0 | return (PCAP_ERROR_ACTIVATED); |
2637 | 0 | p->opt.immediate = immediate; |
2638 | 0 | return (0); |
2639 | 0 | } |
2640 | | |
2641 | | int |
2642 | | pcap_set_buffer_size(pcap_t *p, int buffer_size) |
2643 | 0 | { |
2644 | 0 | if (pcap_check_activated(p)) |
2645 | 0 | return (PCAP_ERROR_ACTIVATED); |
2646 | 0 | if (buffer_size <= 0) { |
2647 | | /* |
2648 | | * Silently ignore invalid values. |
2649 | | */ |
2650 | 0 | return (0); |
2651 | 0 | } |
2652 | 0 | p->opt.buffer_size = buffer_size; |
2653 | 0 | return (0); |
2654 | 0 | } |
2655 | | |
2656 | | int |
2657 | | pcap_set_tstamp_precision(pcap_t *p, int tstamp_precision) |
2658 | 0 | { |
2659 | 0 | int i; |
2660 | |
|
2661 | 0 | if (pcap_check_activated(p)) |
2662 | 0 | return (PCAP_ERROR_ACTIVATED); |
2663 | | |
2664 | | /* |
2665 | | * The argument should have been u_int, but that's too late |
2666 | | * to change now - it's an API. |
2667 | | */ |
2668 | 0 | if (tstamp_precision < 0) |
2669 | 0 | return (PCAP_ERROR_TSTAMP_PRECISION_NOTSUP); |
2670 | | |
2671 | | /* |
2672 | | * If p->tstamp_precision_count is 0, we only support setting |
2673 | | * the time stamp precision to microsecond precision; every |
2674 | | * pcap module *MUST* support microsecond precision, even if |
2675 | | * it does so by converting the native precision to |
2676 | | * microseconds. |
2677 | | */ |
2678 | 0 | if (p->tstamp_precision_count == 0) { |
2679 | 0 | if (tstamp_precision == PCAP_TSTAMP_PRECISION_MICRO) { |
2680 | 0 | p->opt.tstamp_precision = tstamp_precision; |
2681 | 0 | return (0); |
2682 | 0 | } |
2683 | 0 | } else { |
2684 | | /* |
2685 | | * Check whether we claim to support this precision of |
2686 | | * time stamp. |
2687 | | */ |
2688 | 0 | for (i = 0; i < p->tstamp_precision_count; i++) { |
2689 | 0 | if (p->tstamp_precision_list[i] == (u_int)tstamp_precision) { |
2690 | | /* |
2691 | | * Yes. |
2692 | | */ |
2693 | 0 | p->opt.tstamp_precision = tstamp_precision; |
2694 | 0 | return (0); |
2695 | 0 | } |
2696 | 0 | } |
2697 | 0 | } |
2698 | | |
2699 | | /* |
2700 | | * We don't support this time stamp precision. |
2701 | | */ |
2702 | 0 | return (PCAP_ERROR_TSTAMP_PRECISION_NOTSUP); |
2703 | 0 | } |
2704 | | |
2705 | | int |
2706 | | pcap_get_tstamp_precision(pcap_t *p) |
2707 | 0 | { |
2708 | 0 | return (p->opt.tstamp_precision); |
2709 | 0 | } |
2710 | | |
2711 | | int |
2712 | | pcap_activate(pcap_t *p) |
2713 | 0 | { |
2714 | 0 | int status; |
2715 | | |
2716 | | /* |
2717 | | * Catch attempts to re-activate an already-activated |
2718 | | * pcap_t; this should, for example, catch code that |
2719 | | * calls pcap_open_live() followed by pcap_activate(), |
2720 | | * as some code that showed up in a Stack Exchange |
2721 | | * question did. |
2722 | | */ |
2723 | 0 | if (pcap_check_activated(p)) |
2724 | 0 | return (PCAP_ERROR_ACTIVATED); |
2725 | 0 | status = p->activate_op(p); |
2726 | 0 | if (status >= 0) { |
2727 | | /* |
2728 | | * If somebody requested non-blocking mode before |
2729 | | * calling pcap_activate(), turn it on now. |
2730 | | */ |
2731 | 0 | if (p->opt.nonblock) { |
2732 | 0 | status = p->setnonblock_op(p, 1); |
2733 | 0 | if (status < 0) { |
2734 | | /* |
2735 | | * Failed. Undo everything done by |
2736 | | * the activate operation. |
2737 | | */ |
2738 | 0 | p->cleanup_op(p); |
2739 | 0 | initialize_ops(p); |
2740 | 0 | return (status); |
2741 | 0 | } |
2742 | 0 | } |
2743 | 0 | p->activated = 1; |
2744 | 0 | } else { |
2745 | 0 | if (p->errbuf[0] == '\0') { |
2746 | | /* |
2747 | | * No error message supplied by the activate routine; |
2748 | | * for the benefit of programs that don't specially |
2749 | | * handle errors other than PCAP_ERROR, return the |
2750 | | * error message corresponding to the status. |
2751 | | */ |
2752 | 0 | snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "%s", |
2753 | 0 | pcap_statustostr(status)); |
2754 | 0 | } |
2755 | | |
2756 | | /* |
2757 | | * Undo any operation pointer setting, etc. done by |
2758 | | * the activate operation. |
2759 | | */ |
2760 | 0 | initialize_ops(p); |
2761 | 0 | } |
2762 | 0 | return (status); |
2763 | 0 | } |
2764 | | |
2765 | | pcap_t * |
2766 | | pcap_open_live(const char *device, int snaplen, int promisc, int to_ms, char *errbuf) |
2767 | 0 | { |
2768 | 0 | pcap_t *p; |
2769 | 0 | int status; |
2770 | | #ifdef ENABLE_REMOTE |
2771 | | char host[PCAP_BUF_SIZE + 1]; |
2772 | | char port[PCAP_BUF_SIZE + 1]; |
2773 | | char name[PCAP_BUF_SIZE + 1]; |
2774 | | int srctype; |
2775 | | |
2776 | | /* |
2777 | | * A null device name is equivalent to the "any" device - |
2778 | | * which might not be supported on this platform, but |
2779 | | * this means that you'll get a "not supported" error |
2780 | | * rather than, say, a crash when we try to dereference |
2781 | | * the null pointer. |
2782 | | */ |
2783 | | if (device == NULL) |
2784 | | device = "any"; |
2785 | | |
2786 | | /* |
2787 | | * Retrofit - we have to make older applications compatible with |
2788 | | * remote capture. |
2789 | | * So we're calling pcap_open_remote() from here; this is a very |
2790 | | * dirty hack. |
2791 | | * Obviously, we cannot exploit all the new features; for instance, |
2792 | | * we cannot send authentication, we cannot use a UDP data connection, |
2793 | | * and so on. |
2794 | | */ |
2795 | | if (pcap_parsesrcstr(device, &srctype, host, port, name, errbuf)) |
2796 | | return (NULL); |
2797 | | |
2798 | | if (srctype == PCAP_SRC_IFREMOTE) { |
2799 | | /* |
2800 | | * Although we already have host, port and iface, we prefer |
2801 | | * to pass only 'device' to pcap_open_rpcap(), so that it has |
2802 | | * to call pcap_parsesrcstr() again. |
2803 | | * This is less optimized, but much clearer. |
2804 | | */ |
2805 | | return (pcap_open_rpcap(device, snaplen, |
2806 | | promisc ? PCAP_OPENFLAG_PROMISCUOUS : 0, to_ms, |
2807 | | NULL, errbuf)); |
2808 | | } |
2809 | | if (srctype == PCAP_SRC_FILE) { |
2810 | | snprintf(errbuf, PCAP_ERRBUF_SIZE, "unknown URL scheme \"file\""); |
2811 | | return (NULL); |
2812 | | } |
2813 | | if (srctype == PCAP_SRC_IFLOCAL) { |
2814 | | /* |
2815 | | * If it starts with rpcap://, that refers to a local device |
2816 | | * (no host part in the URL). Remove the rpcap://, and |
2817 | | * fall through to the regular open path. |
2818 | | */ |
2819 | | if (strncmp(device, PCAP_SRC_IF_STRING, strlen(PCAP_SRC_IF_STRING)) == 0) { |
2820 | | size_t len = strlen(device) - strlen(PCAP_SRC_IF_STRING) + 1; |
2821 | | |
2822 | | if (len > 0) |
2823 | | device += strlen(PCAP_SRC_IF_STRING); |
2824 | | } |
2825 | | } |
2826 | | #endif /* ENABLE_REMOTE */ |
2827 | |
|
2828 | 0 | p = pcap_create(device, errbuf); |
2829 | 0 | if (p == NULL) |
2830 | 0 | return (NULL); |
2831 | 0 | status = pcap_set_snaplen(p, snaplen); |
2832 | 0 | if (status < 0) |
2833 | 0 | goto fail; |
2834 | 0 | status = pcap_set_promisc(p, promisc); |
2835 | 0 | if (status < 0) |
2836 | 0 | goto fail; |
2837 | 0 | status = pcap_set_timeout(p, to_ms); |
2838 | 0 | if (status < 0) |
2839 | 0 | goto fail; |
2840 | | /* |
2841 | | * Mark this as opened with pcap_open_live(), so that, for |
2842 | | * example, we show the full list of DLT_ values, rather |
2843 | | * than just the ones that are compatible with capturing |
2844 | | * when not in monitor mode. That allows existing applications |
2845 | | * to work the way they used to work, but allows new applications |
2846 | | * that know about the new open API to, for example, find out the |
2847 | | * DLT_ values that they can select without changing whether |
2848 | | * the adapter is in monitor mode or not. |
2849 | | */ |
2850 | 0 | p->oldstyle = 1; |
2851 | 0 | status = pcap_activate(p); |
2852 | 0 | if (status < 0) |
2853 | 0 | goto fail; |
2854 | 0 | return (p); |
2855 | 0 | fail: |
2856 | 0 | if (status == PCAP_ERROR) { |
2857 | | /* |
2858 | | * Another buffer is a bit cumbersome, but it avoids |
2859 | | * -Wformat-truncation. |
2860 | | */ |
2861 | 0 | char trimbuf[PCAP_ERRBUF_SIZE - 5]; /* 2 bytes shorter */ |
2862 | |
|
2863 | 0 | pcap_strlcpy(trimbuf, p->errbuf, sizeof(trimbuf)); |
2864 | 0 | snprintf(errbuf, PCAP_ERRBUF_SIZE, "%s: %.*s", device, |
2865 | 0 | PCAP_ERRBUF_SIZE - 3, trimbuf); |
2866 | 0 | } else if (status == PCAP_ERROR_NO_SUCH_DEVICE || |
2867 | 0 | status == PCAP_ERROR_PERM_DENIED || |
2868 | 0 | status == PCAP_ERROR_PROMISC_PERM_DENIED) { |
2869 | | /* |
2870 | | * Only show the additional message if it's not |
2871 | | * empty. |
2872 | | */ |
2873 | 0 | if (p->errbuf[0] != '\0') { |
2874 | | /* |
2875 | | * Idem. |
2876 | | */ |
2877 | 0 | char trimbuf[PCAP_ERRBUF_SIZE - 8]; /* 2 bytes shorter */ |
2878 | |
|
2879 | 0 | pcap_strlcpy(trimbuf, p->errbuf, sizeof(trimbuf)); |
2880 | 0 | snprintf(errbuf, PCAP_ERRBUF_SIZE, "%s: %s (%.*s)", |
2881 | 0 | device, pcap_statustostr(status), |
2882 | 0 | PCAP_ERRBUF_SIZE - 6, trimbuf); |
2883 | 0 | } else { |
2884 | 0 | snprintf(errbuf, PCAP_ERRBUF_SIZE, "%s: %s", |
2885 | 0 | device, pcap_statustostr(status)); |
2886 | 0 | } |
2887 | 0 | } else { |
2888 | 0 | snprintf(errbuf, PCAP_ERRBUF_SIZE, "%s: %s", device, |
2889 | 0 | pcap_statustostr(status)); |
2890 | 0 | } |
2891 | 0 | pcap_close(p); |
2892 | 0 | return (NULL); |
2893 | 0 | } |
2894 | | |
2895 | | pcap_t * |
2896 | | pcap_open_offline_common(char *ebuf, size_t total_size, size_t private_offset) |
2897 | 17.3k | { |
2898 | 17.3k | pcap_t *p; |
2899 | | |
2900 | 17.3k | p = pcap_alloc_pcap_t(ebuf, total_size, private_offset); |
2901 | 17.3k | if (p == NULL) |
2902 | 0 | return (NULL); |
2903 | | |
2904 | 17.3k | p->opt.tstamp_precision = PCAP_TSTAMP_PRECISION_MICRO; |
2905 | | |
2906 | 17.3k | return (p); |
2907 | 17.3k | } |
2908 | | |
2909 | | int |
2910 | | pcap_dispatch(pcap_t *p, int cnt, pcap_handler callback, u_char *user) |
2911 | 915k | { |
2912 | 915k | return (p->read_op(p, cnt, callback, user)); |
2913 | 915k | } |
2914 | | |
2915 | | int |
2916 | | pcap_loop(pcap_t *p, int cnt, pcap_handler callback, u_char *user) |
2917 | 0 | { |
2918 | 0 | register int n; |
2919 | |
|
2920 | 0 | for (;;) { |
2921 | 0 | if (p->rfile != NULL) { |
2922 | | /* |
2923 | | * 0 means EOF, so don't loop if we get 0. |
2924 | | */ |
2925 | 0 | n = pcap_offline_read(p, cnt, callback, user); |
2926 | 0 | } else { |
2927 | | /* |
2928 | | * XXX keep reading until we get something |
2929 | | * (or an error occurs) |
2930 | | */ |
2931 | 0 | do { |
2932 | 0 | n = p->read_op(p, cnt, callback, user); |
2933 | 0 | } while (n == 0); |
2934 | 0 | } |
2935 | 0 | if (n <= 0) |
2936 | 0 | return (n); |
2937 | 0 | if (!PACKET_COUNT_IS_UNLIMITED(cnt)) { |
2938 | 0 | cnt -= n; |
2939 | 0 | if (cnt <= 0) |
2940 | 0 | return (0); |
2941 | 0 | } |
2942 | 0 | } |
2943 | 0 | } |
2944 | | |
2945 | | /* |
2946 | | * Force the loop in "pcap_read()" or "pcap_read_offline()" to terminate. |
2947 | | */ |
2948 | | void |
2949 | | pcap_breakloop(pcap_t *p) |
2950 | 0 | { |
2951 | 0 | p->breakloop_op(p); |
2952 | 0 | } |
2953 | | |
2954 | | int |
2955 | | pcap_datalink(pcap_t *p) |
2956 | 16.9k | { |
2957 | 16.9k | if (!p->activated) |
2958 | 0 | return (PCAP_ERROR_NOT_ACTIVATED); |
2959 | 16.9k | return (p->linktype); |
2960 | 16.9k | } |
2961 | | |
2962 | | int |
2963 | | pcap_datalink_ext(pcap_t *p) |
2964 | 0 | { |
2965 | 0 | if (!p->activated) |
2966 | 0 | return (PCAP_ERROR_NOT_ACTIVATED); |
2967 | 0 | return (p->linktype_ext); |
2968 | 0 | } |
2969 | | |
2970 | | int |
2971 | | pcap_list_datalinks(pcap_t *p, int **dlt_buffer) |
2972 | 0 | { |
2973 | 0 | if (!p->activated) |
2974 | 0 | return (PCAP_ERROR_NOT_ACTIVATED); |
2975 | 0 | if (p->dlt_count == 0) { |
2976 | | /* |
2977 | | * We couldn't fetch the list of DLTs, which means |
2978 | | * this platform doesn't support changing the |
2979 | | * DLT for an interface. Return a list of DLTs |
2980 | | * containing only the DLT this device supports. |
2981 | | */ |
2982 | 0 | *dlt_buffer = (int*)malloc(sizeof(**dlt_buffer)); |
2983 | 0 | if (*dlt_buffer == NULL) { |
2984 | 0 | pcap_fmt_errmsg_for_errno(p->errbuf, sizeof(p->errbuf), |
2985 | 0 | errno, "malloc"); |
2986 | 0 | return (PCAP_ERROR); |
2987 | 0 | } |
2988 | 0 | **dlt_buffer = p->linktype; |
2989 | 0 | return (1); |
2990 | 0 | } else { |
2991 | 0 | *dlt_buffer = (int*)calloc(sizeof(**dlt_buffer), p->dlt_count); |
2992 | 0 | if (*dlt_buffer == NULL) { |
2993 | 0 | pcap_fmt_errmsg_for_errno(p->errbuf, sizeof(p->errbuf), |
2994 | 0 | errno, "malloc"); |
2995 | 0 | return (PCAP_ERROR); |
2996 | 0 | } |
2997 | 0 | (void)memcpy(*dlt_buffer, p->dlt_list, |
2998 | 0 | sizeof(**dlt_buffer) * p->dlt_count); |
2999 | 0 | return (p->dlt_count); |
3000 | 0 | } |
3001 | 0 | } |
3002 | | |
3003 | | /* |
3004 | | * In Windows, you might have a library built with one version of the |
3005 | | * C runtime library and an application built with another version of |
3006 | | * the C runtime library, which means that the library might use one |
3007 | | * version of malloc() and free() and the application might use another |
3008 | | * version of malloc() and free(). If so, that means something |
3009 | | * allocated by the library cannot be freed by the application, so we |
3010 | | * need to have a pcap_free_datalinks() routine to free up the list |
3011 | | * allocated by pcap_list_datalinks(), even though it's just a wrapper |
3012 | | * around free(). |
3013 | | */ |
3014 | | void |
3015 | | pcap_free_datalinks(int *dlt_list) |
3016 | 0 | { |
3017 | 0 | free(dlt_list); |
3018 | 0 | } |
3019 | | |
3020 | | int |
3021 | | pcap_set_datalink(pcap_t *p, int dlt) |
3022 | 0 | { |
3023 | 0 | int i; |
3024 | 0 | const char *dlt_name; |
3025 | |
|
3026 | 0 | if (dlt < 0) |
3027 | 0 | goto unsupported; |
3028 | | |
3029 | 0 | if (p->dlt_count == 0 || p->set_datalink_op == NULL) { |
3030 | | /* |
3031 | | * We couldn't fetch the list of DLTs, or we don't |
3032 | | * have a "set datalink" operation, which means |
3033 | | * this platform doesn't support changing the |
3034 | | * DLT for an interface. Check whether the new |
3035 | | * DLT is the one this interface supports. |
3036 | | */ |
3037 | 0 | if (p->linktype != dlt) |
3038 | 0 | goto unsupported; |
3039 | | |
3040 | | /* |
3041 | | * It is, so there's nothing we need to do here. |
3042 | | */ |
3043 | 0 | return (0); |
3044 | 0 | } |
3045 | 0 | for (i = 0; i < p->dlt_count; i++) |
3046 | 0 | if (p->dlt_list[i] == (u_int)dlt) |
3047 | 0 | break; |
3048 | 0 | if (i >= p->dlt_count) |
3049 | 0 | goto unsupported; |
3050 | 0 | if (p->dlt_count == 2 && p->dlt_list[0] == DLT_EN10MB && |
3051 | 0 | dlt == DLT_DOCSIS) { |
3052 | | /* |
3053 | | * This is presumably an Ethernet device, as the first |
3054 | | * link-layer type it offers is DLT_EN10MB, and the only |
3055 | | * other type it offers is DLT_DOCSIS. That means that |
3056 | | * we can't tell the driver to supply DOCSIS link-layer |
3057 | | * headers - we're just pretending that's what we're |
3058 | | * getting, as, presumably, we're capturing on a dedicated |
3059 | | * link to a Cisco Cable Modem Termination System, and |
3060 | | * it's putting raw DOCSIS frames on the wire inside low-level |
3061 | | * Ethernet framing. |
3062 | | */ |
3063 | 0 | p->linktype = dlt; |
3064 | 0 | return (0); |
3065 | 0 | } |
3066 | 0 | if (p->set_datalink_op(p, dlt) == -1) |
3067 | 0 | return (-1); |
3068 | 0 | p->linktype = dlt; |
3069 | 0 | return (0); |
3070 | | |
3071 | 0 | unsupported: |
3072 | 0 | dlt_name = pcap_datalink_val_to_name(dlt); |
3073 | 0 | if (dlt_name != NULL) { |
3074 | 0 | (void) snprintf(p->errbuf, sizeof(p->errbuf), |
3075 | 0 | "%s is not one of the DLTs supported by this device", |
3076 | 0 | dlt_name); |
3077 | 0 | } else { |
3078 | 0 | (void) snprintf(p->errbuf, sizeof(p->errbuf), |
3079 | 0 | "DLT %d is not one of the DLTs supported by this device", |
3080 | 0 | dlt); |
3081 | 0 | } |
3082 | 0 | return (-1); |
3083 | 0 | } |
3084 | | |
3085 | | /* |
3086 | | * This array is designed for mapping upper and lower case letter |
3087 | | * together for a case independent comparison. The mappings are |
3088 | | * based upon ascii character sequences. |
3089 | | */ |
3090 | | static const u_char charmap[] = { |
3091 | | (u_char)'\000', (u_char)'\001', (u_char)'\002', (u_char)'\003', |
3092 | | (u_char)'\004', (u_char)'\005', (u_char)'\006', (u_char)'\007', |
3093 | | (u_char)'\010', (u_char)'\011', (u_char)'\012', (u_char)'\013', |
3094 | | (u_char)'\014', (u_char)'\015', (u_char)'\016', (u_char)'\017', |
3095 | | (u_char)'\020', (u_char)'\021', (u_char)'\022', (u_char)'\023', |
3096 | | (u_char)'\024', (u_char)'\025', (u_char)'\026', (u_char)'\027', |
3097 | | (u_char)'\030', (u_char)'\031', (u_char)'\032', (u_char)'\033', |
3098 | | (u_char)'\034', (u_char)'\035', (u_char)'\036', (u_char)'\037', |
3099 | | (u_char)'\040', (u_char)'\041', (u_char)'\042', (u_char)'\043', |
3100 | | (u_char)'\044', (u_char)'\045', (u_char)'\046', (u_char)'\047', |
3101 | | (u_char)'\050', (u_char)'\051', (u_char)'\052', (u_char)'\053', |
3102 | | (u_char)'\054', (u_char)'\055', (u_char)'\056', (u_char)'\057', |
3103 | | (u_char)'\060', (u_char)'\061', (u_char)'\062', (u_char)'\063', |
3104 | | (u_char)'\064', (u_char)'\065', (u_char)'\066', (u_char)'\067', |
3105 | | (u_char)'\070', (u_char)'\071', (u_char)'\072', (u_char)'\073', |
3106 | | (u_char)'\074', (u_char)'\075', (u_char)'\076', (u_char)'\077', |
3107 | | (u_char)'\100', (u_char)'\141', (u_char)'\142', (u_char)'\143', |
3108 | | (u_char)'\144', (u_char)'\145', (u_char)'\146', (u_char)'\147', |
3109 | | (u_char)'\150', (u_char)'\151', (u_char)'\152', (u_char)'\153', |
3110 | | (u_char)'\154', (u_char)'\155', (u_char)'\156', (u_char)'\157', |
3111 | | (u_char)'\160', (u_char)'\161', (u_char)'\162', (u_char)'\163', |
3112 | | (u_char)'\164', (u_char)'\165', (u_char)'\166', (u_char)'\167', |
3113 | | (u_char)'\170', (u_char)'\171', (u_char)'\172', (u_char)'\133', |
3114 | | (u_char)'\134', (u_char)'\135', (u_char)'\136', (u_char)'\137', |
3115 | | (u_char)'\140', (u_char)'\141', (u_char)'\142', (u_char)'\143', |
3116 | | (u_char)'\144', (u_char)'\145', (u_char)'\146', (u_char)'\147', |
3117 | | (u_char)'\150', (u_char)'\151', (u_char)'\152', (u_char)'\153', |
3118 | | (u_char)'\154', (u_char)'\155', (u_char)'\156', (u_char)'\157', |
3119 | | (u_char)'\160', (u_char)'\161', (u_char)'\162', (u_char)'\163', |
3120 | | (u_char)'\164', (u_char)'\165', (u_char)'\166', (u_char)'\167', |
3121 | | (u_char)'\170', (u_char)'\171', (u_char)'\172', (u_char)'\173', |
3122 | | (u_char)'\174', (u_char)'\175', (u_char)'\176', (u_char)'\177', |
3123 | | (u_char)'\200', (u_char)'\201', (u_char)'\202', (u_char)'\203', |
3124 | | (u_char)'\204', (u_char)'\205', (u_char)'\206', (u_char)'\207', |
3125 | | (u_char)'\210', (u_char)'\211', (u_char)'\212', (u_char)'\213', |
3126 | | (u_char)'\214', (u_char)'\215', (u_char)'\216', (u_char)'\217', |
3127 | | (u_char)'\220', (u_char)'\221', (u_char)'\222', (u_char)'\223', |
3128 | | (u_char)'\224', (u_char)'\225', (u_char)'\226', (u_char)'\227', |
3129 | | (u_char)'\230', (u_char)'\231', (u_char)'\232', (u_char)'\233', |
3130 | | (u_char)'\234', (u_char)'\235', (u_char)'\236', (u_char)'\237', |
3131 | | (u_char)'\240', (u_char)'\241', (u_char)'\242', (u_char)'\243', |
3132 | | (u_char)'\244', (u_char)'\245', (u_char)'\246', (u_char)'\247', |
3133 | | (u_char)'\250', (u_char)'\251', (u_char)'\252', (u_char)'\253', |
3134 | | (u_char)'\254', (u_char)'\255', (u_char)'\256', (u_char)'\257', |
3135 | | (u_char)'\260', (u_char)'\261', (u_char)'\262', (u_char)'\263', |
3136 | | (u_char)'\264', (u_char)'\265', (u_char)'\266', (u_char)'\267', |
3137 | | (u_char)'\270', (u_char)'\271', (u_char)'\272', (u_char)'\273', |
3138 | | (u_char)'\274', (u_char)'\275', (u_char)'\276', (u_char)'\277', |
3139 | | (u_char)'\300', (u_char)'\341', (u_char)'\342', (u_char)'\343', |
3140 | | (u_char)'\344', (u_char)'\345', (u_char)'\346', (u_char)'\347', |
3141 | | (u_char)'\350', (u_char)'\351', (u_char)'\352', (u_char)'\353', |
3142 | | (u_char)'\354', (u_char)'\355', (u_char)'\356', (u_char)'\357', |
3143 | | (u_char)'\360', (u_char)'\361', (u_char)'\362', (u_char)'\363', |
3144 | | (u_char)'\364', (u_char)'\365', (u_char)'\366', (u_char)'\367', |
3145 | | (u_char)'\370', (u_char)'\371', (u_char)'\372', (u_char)'\333', |
3146 | | (u_char)'\334', (u_char)'\335', (u_char)'\336', (u_char)'\337', |
3147 | | (u_char)'\340', (u_char)'\341', (u_char)'\342', (u_char)'\343', |
3148 | | (u_char)'\344', (u_char)'\345', (u_char)'\346', (u_char)'\347', |
3149 | | (u_char)'\350', (u_char)'\351', (u_char)'\352', (u_char)'\353', |
3150 | | (u_char)'\354', (u_char)'\355', (u_char)'\356', (u_char)'\357', |
3151 | | (u_char)'\360', (u_char)'\361', (u_char)'\362', (u_char)'\363', |
3152 | | (u_char)'\364', (u_char)'\365', (u_char)'\366', (u_char)'\367', |
3153 | | (u_char)'\370', (u_char)'\371', (u_char)'\372', (u_char)'\373', |
3154 | | (u_char)'\374', (u_char)'\375', (u_char)'\376', (u_char)'\377', |
3155 | | }; |
3156 | | |
3157 | | int |
3158 | | pcap_strcasecmp(const char *s1, const char *s2) |
3159 | 0 | { |
3160 | 0 | register const u_char *cm = charmap, |
3161 | 0 | *us1 = (const u_char *)s1, |
3162 | 0 | *us2 = (const u_char *)s2; |
3163 | |
|
3164 | 0 | while (cm[*us1] == cm[*us2++]) |
3165 | 0 | if (*us1++ == '\0') |
3166 | 0 | return(0); |
3167 | 0 | return (cm[*us1] - cm[*--us2]); |
3168 | 0 | } |
3169 | | |
3170 | | struct dlt_choice { |
3171 | | const char *name; |
3172 | | const char *description; |
3173 | | int dlt; |
3174 | | }; |
3175 | | |
3176 | | #define DLT_CHOICE(code, description) { #code, description, DLT_ ## code } |
3177 | | #define DLT_CHOICE_SENTINEL { NULL, NULL, 0 } |
3178 | | |
3179 | | static struct dlt_choice dlt_choices[] = { |
3180 | | DLT_CHOICE(NULL, "BSD loopback"), |
3181 | | DLT_CHOICE(EN10MB, "Ethernet"), |
3182 | | DLT_CHOICE(IEEE802, "Token ring"), |
3183 | | DLT_CHOICE(ARCNET, "BSD ARCNET"), |
3184 | | DLT_CHOICE(SLIP, "SLIP"), |
3185 | | DLT_CHOICE(PPP, "PPP"), |
3186 | | DLT_CHOICE(FDDI, "FDDI"), |
3187 | | DLT_CHOICE(ATM_RFC1483, "RFC 1483 LLC-encapsulated ATM"), |
3188 | | DLT_CHOICE(RAW, "Raw IP"), |
3189 | | DLT_CHOICE(SLIP_BSDOS, "BSD/OS SLIP"), |
3190 | | DLT_CHOICE(PPP_BSDOS, "BSD/OS PPP"), |
3191 | | DLT_CHOICE(ATM_CLIP, "Linux Classical IP over ATM"), |
3192 | | DLT_CHOICE(PPP_SERIAL, "PPP over serial"), |
3193 | | DLT_CHOICE(PPP_ETHER, "PPPoE"), |
3194 | | DLT_CHOICE(SYMANTEC_FIREWALL, "Symantec Firewall"), |
3195 | | DLT_CHOICE(C_HDLC, "Cisco HDLC"), |
3196 | | DLT_CHOICE(IEEE802_11, "802.11"), |
3197 | | DLT_CHOICE(FRELAY, "Frame Relay"), |
3198 | | DLT_CHOICE(LOOP, "OpenBSD loopback"), |
3199 | | DLT_CHOICE(ENC, "OpenBSD encapsulated IP"), |
3200 | | DLT_CHOICE(LINUX_SLL, "Linux cooked v1"), |
3201 | | DLT_CHOICE(LTALK, "Localtalk"), |
3202 | | DLT_CHOICE(PFLOG, "OpenBSD pflog file"), |
3203 | | DLT_CHOICE(PFSYNC, "Packet filter state syncing"), |
3204 | | DLT_CHOICE(PRISM_HEADER, "802.11 plus Prism header"), |
3205 | | DLT_CHOICE(IP_OVER_FC, "RFC 2625 IP-over-Fibre Channel"), |
3206 | | DLT_CHOICE(SUNATM, "Sun raw ATM"), |
3207 | | DLT_CHOICE(IEEE802_11_RADIO, "802.11 plus radiotap header"), |
3208 | | DLT_CHOICE(ARCNET_LINUX, "Linux ARCNET"), |
3209 | | DLT_CHOICE(JUNIPER_MLPPP, "Juniper Multi-Link PPP"), |
3210 | | DLT_CHOICE(JUNIPER_MLFR, "Juniper Multi-Link Frame Relay"), |
3211 | | DLT_CHOICE(JUNIPER_ES, "Juniper Encryption Services PIC"), |
3212 | | DLT_CHOICE(JUNIPER_GGSN, "Juniper GGSN PIC"), |
3213 | | DLT_CHOICE(JUNIPER_MFR, "Juniper FRF.16 Frame Relay"), |
3214 | | DLT_CHOICE(JUNIPER_ATM2, "Juniper ATM2 PIC"), |
3215 | | DLT_CHOICE(JUNIPER_SERVICES, "Juniper Advanced Services PIC"), |
3216 | | DLT_CHOICE(JUNIPER_ATM1, "Juniper ATM1 PIC"), |
3217 | | DLT_CHOICE(APPLE_IP_OVER_IEEE1394, "Apple IP-over-IEEE 1394"), |
3218 | | DLT_CHOICE(MTP2_WITH_PHDR, "SS7 MTP2 with Pseudo-header"), |
3219 | | DLT_CHOICE(MTP2, "SS7 MTP2"), |
3220 | | DLT_CHOICE(MTP3, "SS7 MTP3"), |
3221 | | DLT_CHOICE(SCCP, "SS7 SCCP"), |
3222 | | DLT_CHOICE(DOCSIS, "DOCSIS"), |
3223 | | DLT_CHOICE(LINUX_IRDA, "Linux IrDA"), |
3224 | | DLT_CHOICE(IEEE802_11_RADIO_AVS, "802.11 plus AVS radio information header"), |
3225 | | DLT_CHOICE(JUNIPER_MONITOR, "Juniper Passive Monitor PIC"), |
3226 | | DLT_CHOICE(BACNET_MS_TP, "BACnet MS/TP"), |
3227 | | DLT_CHOICE(PPP_PPPD, "PPP for pppd, with direction flag"), |
3228 | | DLT_CHOICE(JUNIPER_PPPOE, "Juniper PPPoE"), |
3229 | | DLT_CHOICE(JUNIPER_PPPOE_ATM, "Juniper PPPoE/ATM"), |
3230 | | DLT_CHOICE(GPRS_LLC, "GPRS LLC"), |
3231 | | DLT_CHOICE(GPF_T, "GPF-T"), |
3232 | | DLT_CHOICE(GPF_F, "GPF-F"), |
3233 | | DLT_CHOICE(JUNIPER_PIC_PEER, "Juniper PIC Peer"), |
3234 | | DLT_CHOICE(ERF_ETH, "Ethernet with Endace ERF header"), |
3235 | | DLT_CHOICE(ERF_POS, "Packet-over-SONET with Endace ERF header"), |
3236 | | DLT_CHOICE(LINUX_LAPD, "Linux vISDN LAPD"), |
3237 | | DLT_CHOICE(JUNIPER_ETHER, "Juniper Ethernet"), |
3238 | | DLT_CHOICE(JUNIPER_PPP, "Juniper PPP"), |
3239 | | DLT_CHOICE(JUNIPER_FRELAY, "Juniper Frame Relay"), |
3240 | | DLT_CHOICE(JUNIPER_CHDLC, "Juniper C-HDLC"), |
3241 | | DLT_CHOICE(MFR, "FRF.16 Frame Relay"), |
3242 | | DLT_CHOICE(JUNIPER_VP, "Juniper Voice PIC"), |
3243 | | DLT_CHOICE(A429, "Arinc 429"), |
3244 | | DLT_CHOICE(A653_ICM, "Arinc 653 Interpartition Communication"), |
3245 | | DLT_CHOICE(USB_FREEBSD, "USB with FreeBSD header"), |
3246 | | DLT_CHOICE(BLUETOOTH_HCI_H4, "Bluetooth HCI UART transport layer"), |
3247 | | DLT_CHOICE(IEEE802_16_MAC_CPS, "IEEE 802.16 MAC Common Part Sublayer"), |
3248 | | DLT_CHOICE(USB_LINUX, "USB with Linux header"), |
3249 | | DLT_CHOICE(CAN20B, "Controller Area Network (CAN) v. 2.0B"), |
3250 | | DLT_CHOICE(IEEE802_15_4_LINUX, "IEEE 802.15.4 with Linux padding"), |
3251 | | DLT_CHOICE(PPI, "Per-Packet Information"), |
3252 | | DLT_CHOICE(IEEE802_16_MAC_CPS_RADIO, "IEEE 802.16 MAC Common Part Sublayer plus radiotap header"), |
3253 | | DLT_CHOICE(JUNIPER_ISM, "Juniper Integrated Service Module"), |
3254 | | DLT_CHOICE(IEEE802_15_4, "IEEE 802.15.4 with FCS"), |
3255 | | DLT_CHOICE(SITA, "SITA pseudo-header"), |
3256 | | DLT_CHOICE(ERF, "Endace ERF header"), |
3257 | | DLT_CHOICE(RAIF1, "Ethernet with u10 Networks pseudo-header"), |
3258 | | DLT_CHOICE(IPMB_KONTRON, "IPMB with Kontron pseudo-header"), |
3259 | | DLT_CHOICE(JUNIPER_ST, "Juniper Secure Tunnel"), |
3260 | | DLT_CHOICE(BLUETOOTH_HCI_H4_WITH_PHDR, "Bluetooth HCI UART transport layer plus pseudo-header"), |
3261 | | DLT_CHOICE(AX25_KISS, "AX.25 with KISS header"), |
3262 | | DLT_CHOICE(IPMB_LINUX, "IPMB with Linux/Pigeon Point pseudo-header"), |
3263 | | DLT_CHOICE(IEEE802_15_4_NONASK_PHY, "IEEE 802.15.4 with non-ASK PHY data"), |
3264 | | DLT_CHOICE(MPLS, "MPLS with label as link-layer header"), |
3265 | | DLT_CHOICE(LINUX_EVDEV, "Linux evdev events"), |
3266 | | DLT_CHOICE(USB_LINUX_MMAPPED, "USB with padded Linux header"), |
3267 | | DLT_CHOICE(DECT, "DECT"), |
3268 | | DLT_CHOICE(AOS, "AOS Space Data Link protocol"), |
3269 | | DLT_CHOICE(WIHART, "WirelessHART"), |
3270 | | DLT_CHOICE(FC_2, "Fibre Channel FC-2"), |
3271 | | DLT_CHOICE(FC_2_WITH_FRAME_DELIMS, "Fibre Channel FC-2 with frame delimiters"), |
3272 | | DLT_CHOICE(IPNET, "Solaris ipnet"), |
3273 | | DLT_CHOICE(CAN_SOCKETCAN, "CAN-bus with SocketCAN headers"), |
3274 | | DLT_CHOICE(IPV4, "Raw IPv4"), |
3275 | | DLT_CHOICE(IPV6, "Raw IPv6"), |
3276 | | DLT_CHOICE(IEEE802_15_4_NOFCS, "IEEE 802.15.4 without FCS"), |
3277 | | DLT_CHOICE(DBUS, "D-Bus"), |
3278 | | DLT_CHOICE(JUNIPER_VS, "Juniper Virtual Server"), |
3279 | | DLT_CHOICE(JUNIPER_SRX_E2E, "Juniper SRX E2E"), |
3280 | | DLT_CHOICE(JUNIPER_FIBRECHANNEL, "Juniper Fibre Channel"), |
3281 | | DLT_CHOICE(DVB_CI, "DVB-CI"), |
3282 | | DLT_CHOICE(MUX27010, "MUX27010"), |
3283 | | DLT_CHOICE(STANAG_5066_D_PDU, "STANAG 5066 D_PDUs"), |
3284 | | DLT_CHOICE(JUNIPER_ATM_CEMIC, "Juniper ATM CEMIC"), |
3285 | | DLT_CHOICE(NFLOG, "Linux netfilter log messages"), |
3286 | | DLT_CHOICE(NETANALYZER, "Ethernet with Hilscher netANALYZER pseudo-header"), |
3287 | | DLT_CHOICE(NETANALYZER_TRANSPARENT, "Ethernet with Hilscher netANALYZER pseudo-header and with preamble and SFD"), |
3288 | | DLT_CHOICE(IPOIB, "RFC 4391 IP-over-Infiniband"), |
3289 | | DLT_CHOICE(MPEG_2_TS, "MPEG-2 transport stream"), |
3290 | | DLT_CHOICE(NG40, "ng40 protocol tester Iub/Iur"), |
3291 | | DLT_CHOICE(NFC_LLCP, "NFC LLCP PDUs with pseudo-header"), |
3292 | | DLT_CHOICE(INFINIBAND, "InfiniBand"), |
3293 | | DLT_CHOICE(SCTP, "SCTP"), |
3294 | | DLT_CHOICE(USBPCAP, "USB with USBPcap header"), |
3295 | | DLT_CHOICE(RTAC_SERIAL, "Schweitzer Engineering Laboratories RTAC packets"), |
3296 | | DLT_CHOICE(BLUETOOTH_LE_LL, "Bluetooth Low Energy air interface"), |
3297 | | DLT_CHOICE(NETLINK, "Linux netlink"), |
3298 | | DLT_CHOICE(BLUETOOTH_LINUX_MONITOR, "Bluetooth Linux Monitor"), |
3299 | | DLT_CHOICE(BLUETOOTH_BREDR_BB, "Bluetooth Basic Rate/Enhanced Data Rate baseband packets"), |
3300 | | DLT_CHOICE(BLUETOOTH_LE_LL_WITH_PHDR, "Bluetooth Low Energy air interface with pseudo-header"), |
3301 | | DLT_CHOICE(PROFIBUS_DL, "PROFIBUS data link layer"), |
3302 | | DLT_CHOICE(PKTAP, "Apple DLT_PKTAP"), |
3303 | | DLT_CHOICE(EPON, "Ethernet with 802.3 Clause 65 EPON preamble"), |
3304 | | DLT_CHOICE(IPMI_HPM_2, "IPMI trace packets"), |
3305 | | DLT_CHOICE(ZWAVE_R1_R2, "Z-Wave RF profile R1 and R2 packets"), |
3306 | | DLT_CHOICE(ZWAVE_R3, "Z-Wave RF profile R3 packets"), |
3307 | | DLT_CHOICE(WATTSTOPPER_DLM, "WattStopper Digital Lighting Management (DLM) and Legrand Nitoo Open protocol"), |
3308 | | DLT_CHOICE(ISO_14443, "ISO 14443 messages"), |
3309 | | DLT_CHOICE(RDS, "IEC 62106 Radio Data System groups"), |
3310 | | DLT_CHOICE(USB_DARWIN, "USB with Darwin header"), |
3311 | | DLT_CHOICE(OPENFLOW, "OpenBSD DLT_OPENFLOW"), |
3312 | | DLT_CHOICE(SDLC, "IBM SDLC frames"), |
3313 | | DLT_CHOICE(TI_LLN_SNIFFER, "TI LLN sniffer frames"), |
3314 | | DLT_CHOICE(VSOCK, "Linux vsock"), |
3315 | | DLT_CHOICE(NORDIC_BLE, "Nordic Semiconductor Bluetooth LE sniffer frames"), |
3316 | | DLT_CHOICE(DOCSIS31_XRA31, "Excentis XRA-31 DOCSIS 3.1 RF sniffer frames"), |
3317 | | DLT_CHOICE(ETHERNET_MPACKET, "802.3br mPackets"), |
3318 | | DLT_CHOICE(DISPLAYPORT_AUX, "DisplayPort AUX channel monitoring data"), |
3319 | | DLT_CHOICE(LINUX_SLL2, "Linux cooked v2"), |
3320 | | DLT_CHOICE(OPENVIZSLA, "OpenVizsla USB"), |
3321 | | DLT_CHOICE(EBHSCR, "Elektrobit High Speed Capture and Replay (EBHSCR)"), |
3322 | | DLT_CHOICE(VPP_DISPATCH, "VPP graph dispatch tracer"), |
3323 | | DLT_CHOICE(DSA_TAG_BRCM, "Broadcom tag"), |
3324 | | DLT_CHOICE(DSA_TAG_BRCM_PREPEND, "Broadcom tag (prepended)"), |
3325 | | DLT_CHOICE(IEEE802_15_4_TAP, "IEEE 802.15.4 with pseudo-header"), |
3326 | | DLT_CHOICE(DSA_TAG_DSA, "Marvell DSA"), |
3327 | | DLT_CHOICE(DSA_TAG_EDSA, "Marvell EDSA"), |
3328 | | DLT_CHOICE(ELEE, "ELEE lawful intercept packets"), |
3329 | | DLT_CHOICE(Z_WAVE_SERIAL, "Z-Wave serial frames between host and chip"), |
3330 | | DLT_CHOICE(USB_2_0, "USB 2.0/1.1/1.0 as transmitted over the cable"), |
3331 | | DLT_CHOICE(ATSC_ALP, "ATSC Link-Layer Protocol packets"), |
3332 | | DLT_CHOICE(ETW, "Event Tracing for Windows messages"), |
3333 | | DLT_CHOICE(NETANALYZER_NG, "Hilscher netANALYZER NG pseudo-footer"), |
3334 | | DLT_CHOICE(ZBOSS_NCP, "ZBOSS NCP protocol with pseudo-header"), |
3335 | | DLT_CHOICE(USB_2_0_LOW_SPEED, "Low-Speed USB 2.0/1.1/1.0 as transmitted over the cable"), |
3336 | | DLT_CHOICE(USB_2_0_FULL_SPEED, "Full-Speed USB 2.0/1.1/1.0 as transmitted over the cable"), |
3337 | | DLT_CHOICE(USB_2_0_HIGH_SPEED, "High-Speed USB 2.0 as transmitted over the cable"), |
3338 | | DLT_CHOICE_SENTINEL |
3339 | | }; |
3340 | | |
3341 | | int |
3342 | | pcap_datalink_name_to_val(const char *name) |
3343 | 0 | { |
3344 | 0 | int i; |
3345 | |
|
3346 | 0 | for (i = 0; dlt_choices[i].name != NULL; i++) { |
3347 | 0 | if (pcap_strcasecmp(dlt_choices[i].name, name) == 0) |
3348 | 0 | return (dlt_choices[i].dlt); |
3349 | 0 | } |
3350 | 0 | return (-1); |
3351 | 0 | } |
3352 | | |
3353 | | const char * |
3354 | | pcap_datalink_val_to_name(int dlt) |
3355 | 0 | { |
3356 | 0 | int i; |
3357 | |
|
3358 | 0 | for (i = 0; dlt_choices[i].name != NULL; i++) { |
3359 | 0 | if (dlt_choices[i].dlt == dlt) |
3360 | 0 | return (dlt_choices[i].name); |
3361 | 0 | } |
3362 | 0 | return (NULL); |
3363 | 0 | } |
3364 | | |
3365 | | const char * |
3366 | | pcap_datalink_val_to_description(int dlt) |
3367 | 0 | { |
3368 | 0 | int i; |
3369 | |
|
3370 | 0 | for (i = 0; dlt_choices[i].name != NULL; i++) { |
3371 | 0 | if (dlt_choices[i].dlt == dlt) |
3372 | 0 | return (dlt_choices[i].description); |
3373 | 0 | } |
3374 | 0 | return (NULL); |
3375 | 0 | } |
3376 | | |
3377 | | const char * |
3378 | | pcap_datalink_val_to_description_or_dlt(int dlt) |
3379 | 0 | { |
3380 | 0 | static char unkbuf[40]; |
3381 | 0 | const char *description; |
3382 | |
|
3383 | 0 | description = pcap_datalink_val_to_description(dlt); |
3384 | 0 | if (description != NULL) { |
3385 | 0 | return description; |
3386 | 0 | } else { |
3387 | 0 | (void)snprintf(unkbuf, sizeof(unkbuf), "DLT %d", dlt); |
3388 | 0 | return unkbuf; |
3389 | 0 | } |
3390 | 0 | } |
3391 | | |
3392 | | struct tstamp_type_choice { |
3393 | | const char *name; |
3394 | | const char *description; |
3395 | | int type; |
3396 | | }; |
3397 | | |
3398 | | static struct tstamp_type_choice tstamp_type_choices[] = { |
3399 | | { "host", "Host", PCAP_TSTAMP_HOST }, |
3400 | | { "host_lowprec", "Host, low precision", PCAP_TSTAMP_HOST_LOWPREC }, |
3401 | | { "host_hiprec", "Host, high precision", PCAP_TSTAMP_HOST_HIPREC }, |
3402 | | { "adapter", "Adapter", PCAP_TSTAMP_ADAPTER }, |
3403 | | { "adapter_unsynced", "Adapter, not synced with system time", PCAP_TSTAMP_ADAPTER_UNSYNCED }, |
3404 | | { "host_hiprec_unsynced", "Host, high precision, not synced with system time", PCAP_TSTAMP_HOST_HIPREC_UNSYNCED }, |
3405 | | { NULL, NULL, 0 } |
3406 | | }; |
3407 | | |
3408 | | int |
3409 | | pcap_tstamp_type_name_to_val(const char *name) |
3410 | 0 | { |
3411 | 0 | int i; |
3412 | |
|
3413 | 0 | for (i = 0; tstamp_type_choices[i].name != NULL; i++) { |
3414 | 0 | if (pcap_strcasecmp(tstamp_type_choices[i].name, name) == 0) |
3415 | 0 | return (tstamp_type_choices[i].type); |
3416 | 0 | } |
3417 | 0 | return (PCAP_ERROR); |
3418 | 0 | } |
3419 | | |
3420 | | const char * |
3421 | | pcap_tstamp_type_val_to_name(int tstamp_type) |
3422 | 0 | { |
3423 | 0 | int i; |
3424 | |
|
3425 | 0 | for (i = 0; tstamp_type_choices[i].name != NULL; i++) { |
3426 | 0 | if (tstamp_type_choices[i].type == tstamp_type) |
3427 | 0 | return (tstamp_type_choices[i].name); |
3428 | 0 | } |
3429 | 0 | return (NULL); |
3430 | 0 | } |
3431 | | |
3432 | | const char * |
3433 | | pcap_tstamp_type_val_to_description(int tstamp_type) |
3434 | 0 | { |
3435 | 0 | int i; |
3436 | |
|
3437 | 0 | for (i = 0; tstamp_type_choices[i].name != NULL; i++) { |
3438 | 0 | if (tstamp_type_choices[i].type == tstamp_type) |
3439 | 0 | return (tstamp_type_choices[i].description); |
3440 | 0 | } |
3441 | 0 | return (NULL); |
3442 | 0 | } |
3443 | | |
3444 | | int |
3445 | | pcap_snapshot(pcap_t *p) |
3446 | 0 | { |
3447 | 0 | if (!p->activated) |
3448 | 0 | return (PCAP_ERROR_NOT_ACTIVATED); |
3449 | 0 | return (p->snapshot); |
3450 | 0 | } |
3451 | | |
3452 | | int |
3453 | | pcap_is_swapped(pcap_t *p) |
3454 | 0 | { |
3455 | 0 | if (!p->activated) |
3456 | 0 | return (PCAP_ERROR_NOT_ACTIVATED); |
3457 | 0 | return (p->swapped); |
3458 | 0 | } |
3459 | | |
3460 | | int |
3461 | | pcap_major_version(pcap_t *p) |
3462 | 0 | { |
3463 | 0 | if (!p->activated) |
3464 | 0 | return (PCAP_ERROR_NOT_ACTIVATED); |
3465 | 0 | return (p->version_major); |
3466 | 0 | } |
3467 | | |
3468 | | int |
3469 | | pcap_minor_version(pcap_t *p) |
3470 | 0 | { |
3471 | 0 | if (!p->activated) |
3472 | 0 | return (PCAP_ERROR_NOT_ACTIVATED); |
3473 | 0 | return (p->version_minor); |
3474 | 0 | } |
3475 | | |
3476 | | int |
3477 | | pcap_bufsize(pcap_t *p) |
3478 | 0 | { |
3479 | 0 | if (!p->activated) |
3480 | 0 | return (PCAP_ERROR_NOT_ACTIVATED); |
3481 | 0 | return (p->bufsize); |
3482 | 0 | } |
3483 | | |
3484 | | FILE * |
3485 | | pcap_file(pcap_t *p) |
3486 | 0 | { |
3487 | 0 | return (p->rfile); |
3488 | 0 | } |
3489 | | |
3490 | | #ifdef _WIN32 |
3491 | | int |
3492 | | pcap_fileno(pcap_t *p) |
3493 | | { |
3494 | | if (p->handle != INVALID_HANDLE_VALUE) { |
3495 | | /* |
3496 | | * This is a bogus and now-deprecated API; we |
3497 | | * squelch the narrowing warning for the cast |
3498 | | * from HANDLE to intptr_t. If Windows programmmers |
3499 | | * need to get at the HANDLE for a pcap_t, *if* |
3500 | | * there is one, they should request such a |
3501 | | * routine (and be prepared for it to return |
3502 | | * INVALID_HANDLE_VALUE). |
3503 | | */ |
3504 | | DIAG_OFF_NARROWING |
3505 | | return ((int)(intptr_t)p->handle); |
3506 | | DIAG_ON_NARROWING |
3507 | | } else |
3508 | | return (PCAP_ERROR); |
3509 | | } |
3510 | | #else /* _WIN32 */ |
3511 | | int |
3512 | | pcap_fileno(pcap_t *p) |
3513 | 0 | { |
3514 | 0 | return (p->fd); |
3515 | 0 | } |
3516 | | #endif /* _WIN32 */ |
3517 | | |
3518 | | #if !defined(_WIN32) && !defined(MSDOS) |
3519 | | int |
3520 | | pcap_get_selectable_fd(pcap_t *p) |
3521 | 0 | { |
3522 | 0 | return (p->selectable_fd); |
3523 | 0 | } |
3524 | | |
3525 | | const struct timeval * |
3526 | | pcap_get_required_select_timeout(pcap_t *p) |
3527 | 0 | { |
3528 | 0 | return (p->required_select_timeout); |
3529 | 0 | } |
3530 | | #endif |
3531 | | |
3532 | | void |
3533 | | pcap_perror(pcap_t *p, const char *prefix) |
3534 | 0 | { |
3535 | 0 | fprintf(stderr, "%s: %s\n", prefix, p->errbuf); |
3536 | 0 | } |
3537 | | |
3538 | | char * |
3539 | | pcap_geterr(pcap_t *p) |
3540 | 0 | { |
3541 | 0 | return (p->errbuf); |
3542 | 0 | } |
3543 | | |
3544 | | int |
3545 | | pcap_getnonblock(pcap_t *p, char *errbuf) |
3546 | 0 | { |
3547 | 0 | int ret; |
3548 | |
|
3549 | 0 | ret = p->getnonblock_op(p); |
3550 | 0 | if (ret == -1) { |
3551 | | /* |
3552 | | * The get nonblock operation sets p->errbuf; this |
3553 | | * function *shouldn't* have had a separate errbuf |
3554 | | * argument, as it didn't need one, but I goofed |
3555 | | * when adding it. |
3556 | | * |
3557 | | * We copy the error message to errbuf, so callers |
3558 | | * can find it in either place. |
3559 | | */ |
3560 | 0 | pcap_strlcpy(errbuf, p->errbuf, PCAP_ERRBUF_SIZE); |
3561 | 0 | } |
3562 | 0 | return (ret); |
3563 | 0 | } |
3564 | | |
3565 | | /* |
3566 | | * Get the current non-blocking mode setting, under the assumption that |
3567 | | * it's just the standard POSIX non-blocking flag. |
3568 | | */ |
3569 | | #if !defined(_WIN32) && !defined(MSDOS) |
3570 | | int |
3571 | | pcap_getnonblock_fd(pcap_t *p) |
3572 | 0 | { |
3573 | 0 | int fdflags; |
3574 | |
|
3575 | 0 | fdflags = fcntl(p->fd, F_GETFL, 0); |
3576 | 0 | if (fdflags == -1) { |
3577 | 0 | pcap_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE, |
3578 | 0 | errno, "F_GETFL"); |
3579 | 0 | return (-1); |
3580 | 0 | } |
3581 | 0 | if (fdflags & O_NONBLOCK) |
3582 | 0 | return (1); |
3583 | 0 | else |
3584 | 0 | return (0); |
3585 | 0 | } |
3586 | | #endif |
3587 | | |
3588 | | int |
3589 | | pcap_setnonblock(pcap_t *p, int nonblock, char *errbuf) |
3590 | 0 | { |
3591 | 0 | int ret; |
3592 | |
|
3593 | 0 | ret = p->setnonblock_op(p, nonblock); |
3594 | 0 | if (ret == -1) { |
3595 | | /* |
3596 | | * The set nonblock operation sets p->errbuf; this |
3597 | | * function *shouldn't* have had a separate errbuf |
3598 | | * argument, as it didn't need one, but I goofed |
3599 | | * when adding it. |
3600 | | * |
3601 | | * We copy the error message to errbuf, so callers |
3602 | | * can find it in either place. |
3603 | | */ |
3604 | 0 | pcap_strlcpy(errbuf, p->errbuf, PCAP_ERRBUF_SIZE); |
3605 | 0 | } |
3606 | 0 | return (ret); |
3607 | 0 | } |
3608 | | |
3609 | | #if !defined(_WIN32) && !defined(MSDOS) |
3610 | | /* |
3611 | | * Set non-blocking mode, under the assumption that it's just the |
3612 | | * standard POSIX non-blocking flag. (This can be called by the |
3613 | | * per-platform non-blocking-mode routine if that routine also |
3614 | | * needs to do some additional work.) |
3615 | | */ |
3616 | | int |
3617 | | pcap_setnonblock_fd(pcap_t *p, int nonblock) |
3618 | 0 | { |
3619 | 0 | int fdflags; |
3620 | |
|
3621 | 0 | fdflags = fcntl(p->fd, F_GETFL, 0); |
3622 | 0 | if (fdflags == -1) { |
3623 | 0 | pcap_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE, |
3624 | 0 | errno, "F_GETFL"); |
3625 | 0 | return (-1); |
3626 | 0 | } |
3627 | 0 | if (nonblock) |
3628 | 0 | fdflags |= O_NONBLOCK; |
3629 | 0 | else |
3630 | 0 | fdflags &= ~O_NONBLOCK; |
3631 | 0 | if (fcntl(p->fd, F_SETFL, fdflags) == -1) { |
3632 | 0 | pcap_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE, |
3633 | 0 | errno, "F_SETFL"); |
3634 | 0 | return (-1); |
3635 | 0 | } |
3636 | 0 | return (0); |
3637 | 0 | } |
3638 | | #endif |
3639 | | |
3640 | | /* |
3641 | | * Generate error strings for PCAP_ERROR_ and PCAP_WARNING_ values. |
3642 | | */ |
3643 | | const char * |
3644 | | pcap_statustostr(int errnum) |
3645 | 0 | { |
3646 | 0 | static char ebuf[15+10+1]; |
3647 | |
|
3648 | 0 | switch (errnum) { |
3649 | | |
3650 | 0 | case PCAP_WARNING: |
3651 | 0 | return("Generic warning"); |
3652 | | |
3653 | 0 | case PCAP_WARNING_TSTAMP_TYPE_NOTSUP: |
3654 | 0 | return ("That type of time stamp is not supported by that device"); |
3655 | | |
3656 | 0 | case PCAP_WARNING_PROMISC_NOTSUP: |
3657 | 0 | return ("That device doesn't support promiscuous mode"); |
3658 | | |
3659 | 0 | case PCAP_ERROR: |
3660 | 0 | return("Generic error"); |
3661 | | |
3662 | 0 | case PCAP_ERROR_BREAK: |
3663 | 0 | return("Loop terminated by pcap_breakloop"); |
3664 | | |
3665 | 0 | case PCAP_ERROR_NOT_ACTIVATED: |
3666 | 0 | return("The pcap_t has not been activated"); |
3667 | | |
3668 | 0 | case PCAP_ERROR_ACTIVATED: |
3669 | 0 | return ("The setting can't be changed after the pcap_t is activated"); |
3670 | | |
3671 | 0 | case PCAP_ERROR_NO_SUCH_DEVICE: |
3672 | 0 | return ("No such device exists"); |
3673 | | |
3674 | 0 | case PCAP_ERROR_RFMON_NOTSUP: |
3675 | 0 | return ("That device doesn't support monitor mode"); |
3676 | | |
3677 | 0 | case PCAP_ERROR_NOT_RFMON: |
3678 | 0 | return ("That operation is supported only in monitor mode"); |
3679 | | |
3680 | 0 | case PCAP_ERROR_PERM_DENIED: |
3681 | 0 | return ("You don't have permission to perform this capture on that device"); |
3682 | | |
3683 | 0 | case PCAP_ERROR_IFACE_NOT_UP: |
3684 | 0 | return ("That device is not up"); |
3685 | | |
3686 | 0 | case PCAP_ERROR_CANTSET_TSTAMP_TYPE: |
3687 | 0 | return ("That device doesn't support setting the time stamp type"); |
3688 | | |
3689 | 0 | case PCAP_ERROR_PROMISC_PERM_DENIED: |
3690 | 0 | return ("You don't have permission to capture in promiscuous mode on that device"); |
3691 | | |
3692 | 0 | case PCAP_ERROR_TSTAMP_PRECISION_NOTSUP: |
3693 | 0 | return ("That device doesn't support that time stamp precision"); |
3694 | 0 | } |
3695 | 0 | (void)snprintf(ebuf, sizeof ebuf, "Unknown error: %d", errnum); |
3696 | 0 | return(ebuf); |
3697 | 0 | } |
3698 | | |
3699 | | /* |
3700 | | * Not all systems have strerror(). |
3701 | | */ |
3702 | | const char * |
3703 | | pcap_strerror(int errnum) |
3704 | 0 | { |
3705 | 0 | #ifdef HAVE_STRERROR |
3706 | | #ifdef _WIN32 |
3707 | | static char errbuf[PCAP_ERRBUF_SIZE]; |
3708 | | errno_t err = strerror_s(errbuf, PCAP_ERRBUF_SIZE, errnum); |
3709 | | |
3710 | | if (err != 0) /* err = 0 if successful */ |
3711 | | pcap_strlcpy(errbuf, "strerror_s() error", PCAP_ERRBUF_SIZE); |
3712 | | return (errbuf); |
3713 | | #else |
3714 | 0 | return (strerror(errnum)); |
3715 | 0 | #endif /* _WIN32 */ |
3716 | | #else |
3717 | | extern int sys_nerr; |
3718 | | extern const char *const sys_errlist[]; |
3719 | | static char errbuf[PCAP_ERRBUF_SIZE]; |
3720 | | |
3721 | | if ((unsigned int)errnum < sys_nerr) |
3722 | | return ((char *)sys_errlist[errnum]); |
3723 | | (void)snprintf(errbuf, sizeof errbuf, "Unknown error: %d", errnum); |
3724 | | return (errbuf); |
3725 | | #endif |
3726 | 0 | } |
3727 | | |
3728 | | int |
3729 | | pcap_setfilter(pcap_t *p, struct bpf_program *fp) |
3730 | 0 | { |
3731 | 0 | return (p->setfilter_op(p, fp)); |
3732 | 0 | } |
3733 | | |
3734 | | /* |
3735 | | * Set direction flag, which controls whether we accept only incoming |
3736 | | * packets, only outgoing packets, or both. |
3737 | | * Note that, depending on the platform, some or all direction arguments |
3738 | | * might not be supported. |
3739 | | */ |
3740 | | int |
3741 | | pcap_setdirection(pcap_t *p, pcap_direction_t d) |
3742 | 0 | { |
3743 | 0 | if (p->setdirection_op == NULL) { |
3744 | 0 | snprintf(p->errbuf, PCAP_ERRBUF_SIZE, |
3745 | 0 | "Setting direction is not supported on this device"); |
3746 | 0 | return (-1); |
3747 | 0 | } else { |
3748 | 0 | switch (d) { |
3749 | | |
3750 | 0 | case PCAP_D_IN: |
3751 | 0 | case PCAP_D_OUT: |
3752 | 0 | case PCAP_D_INOUT: |
3753 | | /* |
3754 | | * Valid direction. |
3755 | | */ |
3756 | 0 | return (p->setdirection_op(p, d)); |
3757 | | |
3758 | 0 | default: |
3759 | | /* |
3760 | | * Invalid direction. |
3761 | | */ |
3762 | 0 | snprintf(p->errbuf, sizeof(p->errbuf), |
3763 | 0 | "Invalid direction"); |
3764 | 0 | return (-1); |
3765 | 0 | } |
3766 | 0 | } |
3767 | 0 | } |
3768 | | |
3769 | | int |
3770 | | pcap_stats(pcap_t *p, struct pcap_stat *ps) |
3771 | 0 | { |
3772 | 0 | return (p->stats_op(p, ps)); |
3773 | 0 | } |
3774 | | |
3775 | | #ifdef _WIN32 |
3776 | | struct pcap_stat * |
3777 | | pcap_stats_ex(pcap_t *p, int *pcap_stat_size) |
3778 | | { |
3779 | | return (p->stats_ex_op(p, pcap_stat_size)); |
3780 | | } |
3781 | | |
3782 | | int |
3783 | | pcap_setbuff(pcap_t *p, int dim) |
3784 | | { |
3785 | | return (p->setbuff_op(p, dim)); |
3786 | | } |
3787 | | |
3788 | | int |
3789 | | pcap_setmode(pcap_t *p, int mode) |
3790 | | { |
3791 | | return (p->setmode_op(p, mode)); |
3792 | | } |
3793 | | |
3794 | | int |
3795 | | pcap_setmintocopy(pcap_t *p, int size) |
3796 | | { |
3797 | | return (p->setmintocopy_op(p, size)); |
3798 | | } |
3799 | | |
3800 | | HANDLE |
3801 | | pcap_getevent(pcap_t *p) |
3802 | | { |
3803 | | return (p->getevent_op(p)); |
3804 | | } |
3805 | | |
3806 | | int |
3807 | | pcap_oid_get_request(pcap_t *p, bpf_u_int32 oid, void *data, size_t *lenp) |
3808 | | { |
3809 | | return (p->oid_get_request_op(p, oid, data, lenp)); |
3810 | | } |
3811 | | |
3812 | | int |
3813 | | pcap_oid_set_request(pcap_t *p, bpf_u_int32 oid, const void *data, size_t *lenp) |
3814 | | { |
3815 | | return (p->oid_set_request_op(p, oid, data, lenp)); |
3816 | | } |
3817 | | |
3818 | | pcap_send_queue * |
3819 | | pcap_sendqueue_alloc(u_int memsize) |
3820 | | { |
3821 | | pcap_send_queue *tqueue; |
3822 | | |
3823 | | /* Allocate the queue */ |
3824 | | tqueue = (pcap_send_queue *)malloc(sizeof(pcap_send_queue)); |
3825 | | if (tqueue == NULL){ |
3826 | | return (NULL); |
3827 | | } |
3828 | | |
3829 | | /* Allocate the buffer */ |
3830 | | tqueue->buffer = (char *)malloc(memsize); |
3831 | | if (tqueue->buffer == NULL) { |
3832 | | free(tqueue); |
3833 | | return (NULL); |
3834 | | } |
3835 | | |
3836 | | tqueue->maxlen = memsize; |
3837 | | tqueue->len = 0; |
3838 | | |
3839 | | return (tqueue); |
3840 | | } |
3841 | | |
3842 | | void |
3843 | | pcap_sendqueue_destroy(pcap_send_queue *queue) |
3844 | | { |
3845 | | free(queue->buffer); |
3846 | | free(queue); |
3847 | | } |
3848 | | |
3849 | | int |
3850 | | pcap_sendqueue_queue(pcap_send_queue *queue, const struct pcap_pkthdr *pkt_header, const u_char *pkt_data) |
3851 | | { |
3852 | | if (queue->len + sizeof(struct pcap_pkthdr) + pkt_header->caplen > queue->maxlen){ |
3853 | | return (-1); |
3854 | | } |
3855 | | |
3856 | | /* Copy the pcap_pkthdr header*/ |
3857 | | memcpy(queue->buffer + queue->len, pkt_header, sizeof(struct pcap_pkthdr)); |
3858 | | queue->len += sizeof(struct pcap_pkthdr); |
3859 | | |
3860 | | /* copy the packet */ |
3861 | | memcpy(queue->buffer + queue->len, pkt_data, pkt_header->caplen); |
3862 | | queue->len += pkt_header->caplen; |
3863 | | |
3864 | | return (0); |
3865 | | } |
3866 | | |
3867 | | u_int |
3868 | | pcap_sendqueue_transmit(pcap_t *p, pcap_send_queue *queue, int sync) |
3869 | | { |
3870 | | return (p->sendqueue_transmit_op(p, queue, sync)); |
3871 | | } |
3872 | | |
3873 | | int |
3874 | | pcap_setuserbuffer(pcap_t *p, int size) |
3875 | | { |
3876 | | return (p->setuserbuffer_op(p, size)); |
3877 | | } |
3878 | | |
3879 | | int |
3880 | | pcap_live_dump(pcap_t *p, char *filename, int maxsize, int maxpacks) |
3881 | | { |
3882 | | return (p->live_dump_op(p, filename, maxsize, maxpacks)); |
3883 | | } |
3884 | | |
3885 | | int |
3886 | | pcap_live_dump_ended(pcap_t *p, int sync) |
3887 | | { |
3888 | | return (p->live_dump_ended_op(p, sync)); |
3889 | | } |
3890 | | |
3891 | | PAirpcapHandle |
3892 | | pcap_get_airpcap_handle(pcap_t *p) |
3893 | | { |
3894 | | PAirpcapHandle handle; |
3895 | | |
3896 | | handle = p->get_airpcap_handle_op(p); |
3897 | | if (handle == NULL) { |
3898 | | (void)snprintf(p->errbuf, sizeof(p->errbuf), |
3899 | | "This isn't an AirPcap device"); |
3900 | | } |
3901 | | return (handle); |
3902 | | } |
3903 | | #endif |
3904 | | |
3905 | | /* |
3906 | | * On some platforms, we need to clean up promiscuous or monitor mode |
3907 | | * when we close a device - and we want that to happen even if the |
3908 | | * application just exits without explicitl closing devices. |
3909 | | * On those platforms, we need to register a "close all the pcaps" |
3910 | | * routine to be called when we exit, and need to maintain a list of |
3911 | | * pcaps that need to be closed to clean up modes. |
3912 | | * |
3913 | | * XXX - not thread-safe. |
3914 | | */ |
3915 | | |
3916 | | /* |
3917 | | * List of pcaps on which we've done something that needs to be |
3918 | | * cleaned up. |
3919 | | * If there are any such pcaps, we arrange to call "pcap_close_all()" |
3920 | | * when we exit, and have it close all of them. |
3921 | | */ |
3922 | | static struct pcap *pcaps_to_close; |
3923 | | |
3924 | | /* |
3925 | | * TRUE if we've already called "atexit()" to cause "pcap_close_all()" to |
3926 | | * be called on exit. |
3927 | | */ |
3928 | | static int did_atexit; |
3929 | | |
3930 | | static void |
3931 | | pcap_close_all(void) |
3932 | 0 | { |
3933 | 0 | struct pcap *handle; |
3934 | |
|
3935 | 0 | while ((handle = pcaps_to_close) != NULL) { |
3936 | 0 | pcap_close(handle); |
3937 | | |
3938 | | /* |
3939 | | * If a pcap module adds a pcap_t to the "close all" |
3940 | | * list by calling pcap_add_to_pcaps_to_close(), it |
3941 | | * must have a cleanup routine that removes it from the |
3942 | | * list, by calling pcap_remove_from_pcaps_to_close(), |
3943 | | * and must make that cleanup routine the cleanup_op |
3944 | | * for the pcap_t. |
3945 | | * |
3946 | | * That means that, after pcap_close() - which calls |
3947 | | * the cleanup_op for the pcap_t - the pcap_t must |
3948 | | * have been removed from the list, so pcaps_to_close |
3949 | | * must not be equal to handle. |
3950 | | * |
3951 | | * We check for that, and abort if handle is still |
3952 | | * at the head of the list, to prevent infinite loops. |
3953 | | */ |
3954 | 0 | if (pcaps_to_close == handle) |
3955 | 0 | abort(); |
3956 | 0 | } |
3957 | 0 | } |
3958 | | |
3959 | | int |
3960 | | pcap_do_addexit(pcap_t *p) |
3961 | 0 | { |
3962 | | /* |
3963 | | * If we haven't already done so, arrange to have |
3964 | | * "pcap_close_all()" called when we exit. |
3965 | | */ |
3966 | 0 | if (!did_atexit) { |
3967 | 0 | if (atexit(pcap_close_all) != 0) { |
3968 | | /* |
3969 | | * "atexit()" failed; let our caller know. |
3970 | | */ |
3971 | 0 | pcap_strlcpy(p->errbuf, "atexit failed", PCAP_ERRBUF_SIZE); |
3972 | 0 | return (0); |
3973 | 0 | } |
3974 | 0 | did_atexit = 1; |
3975 | 0 | } |
3976 | 0 | return (1); |
3977 | 0 | } |
3978 | | |
3979 | | void |
3980 | | pcap_add_to_pcaps_to_close(pcap_t *p) |
3981 | 0 | { |
3982 | 0 | p->next = pcaps_to_close; |
3983 | 0 | pcaps_to_close = p; |
3984 | 0 | } |
3985 | | |
3986 | | void |
3987 | | pcap_remove_from_pcaps_to_close(pcap_t *p) |
3988 | 0 | { |
3989 | 0 | pcap_t *pc, *prevpc; |
3990 | |
|
3991 | 0 | for (pc = pcaps_to_close, prevpc = NULL; pc != NULL; |
3992 | 0 | prevpc = pc, pc = pc->next) { |
3993 | 0 | if (pc == p) { |
3994 | | /* |
3995 | | * Found it. Remove it from the list. |
3996 | | */ |
3997 | 0 | if (prevpc == NULL) { |
3998 | | /* |
3999 | | * It was at the head of the list. |
4000 | | */ |
4001 | 0 | pcaps_to_close = pc->next; |
4002 | 0 | } else { |
4003 | | /* |
4004 | | * It was in the middle of the list. |
4005 | | */ |
4006 | 0 | prevpc->next = pc->next; |
4007 | 0 | } |
4008 | 0 | break; |
4009 | 0 | } |
4010 | 0 | } |
4011 | 0 | } |
4012 | | |
4013 | | void |
4014 | | pcap_breakloop_common(pcap_t *p) |
4015 | 0 | { |
4016 | 0 | p->break_loop = 1; |
4017 | 0 | } |
4018 | | |
4019 | | |
4020 | | void |
4021 | | pcap_cleanup_live_common(pcap_t *p) |
4022 | 0 | { |
4023 | 0 | if (p->opt.device != NULL) { |
4024 | 0 | free(p->opt.device); |
4025 | 0 | p->opt.device = NULL; |
4026 | 0 | } |
4027 | 0 | if (p->buffer != NULL) { |
4028 | 0 | free(p->buffer); |
4029 | 0 | p->buffer = NULL; |
4030 | 0 | } |
4031 | 0 | if (p->dlt_list != NULL) { |
4032 | 0 | free(p->dlt_list); |
4033 | 0 | p->dlt_list = NULL; |
4034 | 0 | p->dlt_count = 0; |
4035 | 0 | } |
4036 | 0 | if (p->tstamp_type_list != NULL) { |
4037 | 0 | free(p->tstamp_type_list); |
4038 | 0 | p->tstamp_type_list = NULL; |
4039 | 0 | p->tstamp_type_count = 0; |
4040 | 0 | } |
4041 | 0 | if (p->tstamp_precision_list != NULL) { |
4042 | 0 | free(p->tstamp_precision_list); |
4043 | 0 | p->tstamp_precision_list = NULL; |
4044 | 0 | p->tstamp_precision_count = 0; |
4045 | 0 | } |
4046 | 0 | pcap_freecode(&p->fcode); |
4047 | 0 | #if !defined(_WIN32) && !defined(MSDOS) |
4048 | 0 | if (p->fd >= 0) { |
4049 | 0 | close(p->fd); |
4050 | 0 | p->fd = -1; |
4051 | 0 | } |
4052 | 0 | p->selectable_fd = -1; |
4053 | 0 | #endif |
4054 | 0 | } |
4055 | | |
4056 | | /* |
4057 | | * API compatible with WinPcap's "send a packet" routine - returns -1 |
4058 | | * on error, 0 otherwise. |
4059 | | * |
4060 | | * XXX - what if we get a short write? |
4061 | | */ |
4062 | | int |
4063 | | pcap_sendpacket(pcap_t *p, const u_char *buf, int size) |
4064 | 0 | { |
4065 | 0 | if (size <= 0) { |
4066 | 0 | pcap_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE, |
4067 | 0 | errno, "The number of bytes to be sent must be positive"); |
4068 | 0 | return (PCAP_ERROR); |
4069 | 0 | } |
4070 | | |
4071 | 0 | if (p->inject_op(p, buf, size) == -1) |
4072 | 0 | return (-1); |
4073 | 0 | return (0); |
4074 | 0 | } |
4075 | | |
4076 | | /* |
4077 | | * API compatible with OpenBSD's "send a packet" routine - returns -1 on |
4078 | | * error, number of bytes written otherwise. |
4079 | | */ |
4080 | | int |
4081 | | pcap_inject(pcap_t *p, const void *buf, size_t size) |
4082 | 0 | { |
4083 | | /* |
4084 | | * We return the number of bytes written, so the number of |
4085 | | * bytes to write must fit in an int. |
4086 | | */ |
4087 | 0 | if (size > INT_MAX) { |
4088 | 0 | pcap_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE, |
4089 | 0 | errno, "More than %d bytes cannot be injected", INT_MAX); |
4090 | 0 | return (PCAP_ERROR); |
4091 | 0 | } |
4092 | | |
4093 | 0 | if (size == 0) { |
4094 | 0 | pcap_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE, |
4095 | 0 | errno, "The number of bytes to be injected must not be zero"); |
4096 | 0 | return (PCAP_ERROR); |
4097 | 0 | } |
4098 | | |
4099 | 0 | return (p->inject_op(p, buf, (int)size)); |
4100 | 0 | } |
4101 | | |
4102 | | void |
4103 | | pcap_close(pcap_t *p) |
4104 | 16.9k | { |
4105 | 16.9k | p->cleanup_op(p); |
4106 | 16.9k | free(p); |
4107 | 16.9k | } |
4108 | | |
4109 | | /* |
4110 | | * Helpers for safely loading code at run time. |
4111 | | * Currently Windows-only. |
4112 | | */ |
4113 | | #ifdef _WIN32 |
4114 | | // |
4115 | | // This wrapper around loadlibrary appends the system folder (usually |
4116 | | // C:\Windows\System32) to the relative path of the DLL, so that the DLL |
4117 | | // is always loaded from an absolute path (it's no longer possible to |
4118 | | // load modules from the application folder). |
4119 | | // This solves the DLL Hijacking issue discovered in August 2010: |
4120 | | // |
4121 | | // https://blog.rapid7.com/2010/08/23/exploiting-dll-hijacking-flaws/ |
4122 | | // https://blog.rapid7.com/2010/08/23/application-dll-load-hijacking/ |
4123 | | // (the purported Rapid7 blog post link in the first of those two links |
4124 | | // is broken; the second of those links works.) |
4125 | | // |
4126 | | // If any links there are broken from all the content shuffling Rapid& |
4127 | | // did, see archived versions of the posts at their original homes, at |
4128 | | // |
4129 | | // https://web.archive.org/web/20110122175058/http://blog.metasploit.com/2010/08/exploiting-dll-hijacking-flaws.html |
4130 | | // https://web.archive.org/web/20100828112111/http://blog.rapid7.com/?p=5325 |
4131 | | // |
4132 | | pcap_code_handle_t |
4133 | | pcap_load_code(const char *name) |
4134 | | { |
4135 | | /* |
4136 | | * XXX - should this work in UTF-16LE rather than in the local |
4137 | | * ANSI code page? |
4138 | | */ |
4139 | | CHAR path[MAX_PATH]; |
4140 | | CHAR fullFileName[MAX_PATH]; |
4141 | | UINT res; |
4142 | | HMODULE hModule = NULL; |
4143 | | |
4144 | | do |
4145 | | { |
4146 | | res = GetSystemDirectoryA(path, MAX_PATH); |
4147 | | |
4148 | | if (res == 0) { |
4149 | | // |
4150 | | // some bad failure occurred; |
4151 | | // |
4152 | | break; |
4153 | | } |
4154 | | |
4155 | | if (res > MAX_PATH) { |
4156 | | // |
4157 | | // the buffer was not big enough |
4158 | | // |
4159 | | SetLastError(ERROR_INSUFFICIENT_BUFFER); |
4160 | | break; |
4161 | | } |
4162 | | |
4163 | | if (res + 1 + strlen(name) + 1 < MAX_PATH) { |
4164 | | memcpy(fullFileName, path, res * sizeof(TCHAR)); |
4165 | | fullFileName[res] = '\\'; |
4166 | | memcpy(&fullFileName[res + 1], name, (strlen(name) + 1) * sizeof(TCHAR)); |
4167 | | |
4168 | | hModule = LoadLibraryA(fullFileName); |
4169 | | } else |
4170 | | SetLastError(ERROR_INSUFFICIENT_BUFFER); |
4171 | | |
4172 | | } while(FALSE); |
4173 | | |
4174 | | return hModule; |
4175 | | } |
4176 | | |
4177 | | pcap_funcptr_t |
4178 | | pcap_find_function(pcap_code_handle_t code, const char *func) |
4179 | | { |
4180 | | return (GetProcAddress(code, func)); |
4181 | | } |
4182 | | #endif |
4183 | | |
4184 | | /* |
4185 | | * Given a BPF program, a pcap_pkthdr structure for a packet, and the raw |
4186 | | * data for the packet, check whether the packet passes the filter. |
4187 | | * Returns the return value of the filter program, which will be zero if |
4188 | | * the packet doesn't pass and non-zero if the packet does pass. |
4189 | | */ |
4190 | | int |
4191 | | pcap_offline_filter(const struct bpf_program *fp, const struct pcap_pkthdr *h, |
4192 | | const u_char *pkt) |
4193 | 0 | { |
4194 | 0 | const struct bpf_insn *fcode = fp->bf_insns; |
4195 | |
|
4196 | 0 | if (fcode != NULL) |
4197 | 0 | return (pcap_filter(fcode, pkt, h->len, h->caplen)); |
4198 | 0 | else |
4199 | 0 | return (0); |
4200 | 0 | } |
4201 | | |
4202 | | static int |
4203 | | pcap_can_set_rfmon_dead(pcap_t *p) |
4204 | 0 | { |
4205 | 0 | snprintf(p->errbuf, PCAP_ERRBUF_SIZE, |
4206 | 0 | "Rfmon mode doesn't apply on a pcap_open_dead pcap_t"); |
4207 | 0 | return (PCAP_ERROR); |
4208 | 0 | } |
4209 | | |
4210 | | static int |
4211 | | pcap_read_dead(pcap_t *p, int cnt _U_, pcap_handler callback _U_, |
4212 | | u_char *user _U_) |
4213 | 0 | { |
4214 | 0 | snprintf(p->errbuf, PCAP_ERRBUF_SIZE, |
4215 | 0 | "Packets aren't available from a pcap_open_dead pcap_t"); |
4216 | 0 | return (-1); |
4217 | 0 | } |
4218 | | |
4219 | | static void |
4220 | | pcap_breakloop_dead(pcap_t *p _U_) |
4221 | 0 | { |
4222 | | /* |
4223 | | * A "dead" pcap_t is just a placeholder to use in order to |
4224 | | * compile a filter to BPF code or to open a savefile for |
4225 | | * writing. It doesn't support any operations, including |
4226 | | * capturing or reading packets, so there will never be a |
4227 | | * get-packets loop in progress to break out *of*. |
4228 | | * |
4229 | | * As such, this routine doesn't need to do anything. |
4230 | | */ |
4231 | 0 | } |
4232 | | |
4233 | | static int |
4234 | | pcap_inject_dead(pcap_t *p, const void *buf _U_, int size _U_) |
4235 | 0 | { |
4236 | 0 | snprintf(p->errbuf, PCAP_ERRBUF_SIZE, |
4237 | 0 | "Packets can't be sent on a pcap_open_dead pcap_t"); |
4238 | 0 | return (-1); |
4239 | 0 | } |
4240 | | |
4241 | | static int |
4242 | | pcap_setfilter_dead(pcap_t *p, struct bpf_program *fp _U_) |
4243 | 0 | { |
4244 | 0 | snprintf(p->errbuf, PCAP_ERRBUF_SIZE, |
4245 | 0 | "A filter cannot be set on a pcap_open_dead pcap_t"); |
4246 | 0 | return (-1); |
4247 | 0 | } |
4248 | | |
4249 | | static int |
4250 | | pcap_setdirection_dead(pcap_t *p, pcap_direction_t d _U_) |
4251 | 0 | { |
4252 | 0 | snprintf(p->errbuf, PCAP_ERRBUF_SIZE, |
4253 | 0 | "The packet direction cannot be set on a pcap_open_dead pcap_t"); |
4254 | 0 | return (-1); |
4255 | 0 | } |
4256 | | |
4257 | | static int |
4258 | | pcap_set_datalink_dead(pcap_t *p, int dlt _U_) |
4259 | 0 | { |
4260 | 0 | snprintf(p->errbuf, PCAP_ERRBUF_SIZE, |
4261 | 0 | "The link-layer header type cannot be set on a pcap_open_dead pcap_t"); |
4262 | 0 | return (-1); |
4263 | 0 | } |
4264 | | |
4265 | | static int |
4266 | | pcap_getnonblock_dead(pcap_t *p) |
4267 | 0 | { |
4268 | 0 | snprintf(p->errbuf, PCAP_ERRBUF_SIZE, |
4269 | 0 | "A pcap_open_dead pcap_t does not have a non-blocking mode setting"); |
4270 | 0 | return (-1); |
4271 | 0 | } |
4272 | | |
4273 | | static int |
4274 | | pcap_setnonblock_dead(pcap_t *p, int nonblock _U_) |
4275 | 0 | { |
4276 | 0 | snprintf(p->errbuf, PCAP_ERRBUF_SIZE, |
4277 | 0 | "A pcap_open_dead pcap_t does not have a non-blocking mode setting"); |
4278 | 0 | return (-1); |
4279 | 0 | } |
4280 | | |
4281 | | static int |
4282 | | pcap_stats_dead(pcap_t *p, struct pcap_stat *ps _U_) |
4283 | 0 | { |
4284 | 0 | snprintf(p->errbuf, PCAP_ERRBUF_SIZE, |
4285 | 0 | "Statistics aren't available from a pcap_open_dead pcap_t"); |
4286 | 0 | return (-1); |
4287 | 0 | } |
4288 | | |
4289 | | #ifdef _WIN32 |
4290 | | static struct pcap_stat * |
4291 | | pcap_stats_ex_dead(pcap_t *p, int *pcap_stat_size _U_) |
4292 | | { |
4293 | | snprintf(p->errbuf, PCAP_ERRBUF_SIZE, |
4294 | | "Statistics aren't available from a pcap_open_dead pcap_t"); |
4295 | | return (NULL); |
4296 | | } |
4297 | | |
4298 | | static int |
4299 | | pcap_setbuff_dead(pcap_t *p, int dim _U_) |
4300 | | { |
4301 | | snprintf(p->errbuf, PCAP_ERRBUF_SIZE, |
4302 | | "The kernel buffer size cannot be set on a pcap_open_dead pcap_t"); |
4303 | | return (-1); |
4304 | | } |
4305 | | |
4306 | | static int |
4307 | | pcap_setmode_dead(pcap_t *p, int mode _U_) |
4308 | | { |
4309 | | snprintf(p->errbuf, PCAP_ERRBUF_SIZE, |
4310 | | "impossible to set mode on a pcap_open_dead pcap_t"); |
4311 | | return (-1); |
4312 | | } |
4313 | | |
4314 | | static int |
4315 | | pcap_setmintocopy_dead(pcap_t *p, int size _U_) |
4316 | | { |
4317 | | snprintf(p->errbuf, PCAP_ERRBUF_SIZE, |
4318 | | "The mintocopy parameter cannot be set on a pcap_open_dead pcap_t"); |
4319 | | return (-1); |
4320 | | } |
4321 | | |
4322 | | static HANDLE |
4323 | | pcap_getevent_dead(pcap_t *p) |
4324 | | { |
4325 | | snprintf(p->errbuf, PCAP_ERRBUF_SIZE, |
4326 | | "A pcap_open_dead pcap_t has no event handle"); |
4327 | | return (INVALID_HANDLE_VALUE); |
4328 | | } |
4329 | | |
4330 | | static int |
4331 | | pcap_oid_get_request_dead(pcap_t *p, bpf_u_int32 oid _U_, void *data _U_, |
4332 | | size_t *lenp _U_) |
4333 | | { |
4334 | | snprintf(p->errbuf, PCAP_ERRBUF_SIZE, |
4335 | | "An OID get request cannot be performed on a pcap_open_dead pcap_t"); |
4336 | | return (PCAP_ERROR); |
4337 | | } |
4338 | | |
4339 | | static int |
4340 | | pcap_oid_set_request_dead(pcap_t *p, bpf_u_int32 oid _U_, const void *data _U_, |
4341 | | size_t *lenp _U_) |
4342 | | { |
4343 | | snprintf(p->errbuf, PCAP_ERRBUF_SIZE, |
4344 | | "An OID set request cannot be performed on a pcap_open_dead pcap_t"); |
4345 | | return (PCAP_ERROR); |
4346 | | } |
4347 | | |
4348 | | static u_int |
4349 | | pcap_sendqueue_transmit_dead(pcap_t *p, pcap_send_queue *queue _U_, |
4350 | | int sync _U_) |
4351 | | { |
4352 | | snprintf(p->errbuf, PCAP_ERRBUF_SIZE, |
4353 | | "Packets cannot be transmitted on a pcap_open_dead pcap_t"); |
4354 | | return (0); |
4355 | | } |
4356 | | |
4357 | | static int |
4358 | | pcap_setuserbuffer_dead(pcap_t *p, int size _U_) |
4359 | | { |
4360 | | snprintf(p->errbuf, PCAP_ERRBUF_SIZE, |
4361 | | "The user buffer cannot be set on a pcap_open_dead pcap_t"); |
4362 | | return (-1); |
4363 | | } |
4364 | | |
4365 | | static int |
4366 | | pcap_live_dump_dead(pcap_t *p, char *filename _U_, int maxsize _U_, |
4367 | | int maxpacks _U_) |
4368 | | { |
4369 | | snprintf(p->errbuf, PCAP_ERRBUF_SIZE, |
4370 | | "Live packet dumping cannot be performed on a pcap_open_dead pcap_t"); |
4371 | | return (-1); |
4372 | | } |
4373 | | |
4374 | | static int |
4375 | | pcap_live_dump_ended_dead(pcap_t *p, int sync _U_) |
4376 | | { |
4377 | | snprintf(p->errbuf, PCAP_ERRBUF_SIZE, |
4378 | | "Live packet dumping cannot be performed on a pcap_open_dead pcap_t"); |
4379 | | return (-1); |
4380 | | } |
4381 | | |
4382 | | static PAirpcapHandle |
4383 | | pcap_get_airpcap_handle_dead(pcap_t *p _U_) |
4384 | | { |
4385 | | return (NULL); |
4386 | | } |
4387 | | #endif /* _WIN32 */ |
4388 | | |
4389 | | static void |
4390 | | pcap_cleanup_dead(pcap_t *p _U_) |
4391 | 0 | { |
4392 | | /* Nothing to do. */ |
4393 | 0 | } |
4394 | | |
4395 | | pcap_t * |
4396 | | pcap_open_dead_with_tstamp_precision(int linktype, int snaplen, u_int precision) |
4397 | 0 | { |
4398 | 0 | pcap_t *p; |
4399 | |
|
4400 | 0 | switch (precision) { |
4401 | | |
4402 | 0 | case PCAP_TSTAMP_PRECISION_MICRO: |
4403 | 0 | case PCAP_TSTAMP_PRECISION_NANO: |
4404 | 0 | break; |
4405 | | |
4406 | 0 | default: |
4407 | | /* |
4408 | | * This doesn't really matter, but we don't have any way |
4409 | | * to report particular errors, so the only failure we |
4410 | | * should have is a memory allocation failure. Just |
4411 | | * pick microsecond precision. |
4412 | | */ |
4413 | 0 | precision = PCAP_TSTAMP_PRECISION_MICRO; |
4414 | 0 | break; |
4415 | 0 | } |
4416 | 0 | p = malloc(sizeof(*p)); |
4417 | 0 | if (p == NULL) |
4418 | 0 | return NULL; |
4419 | 0 | memset (p, 0, sizeof(*p)); |
4420 | 0 | p->snapshot = snaplen; |
4421 | 0 | p->linktype = linktype; |
4422 | 0 | p->opt.tstamp_precision = precision; |
4423 | 0 | p->can_set_rfmon_op = pcap_can_set_rfmon_dead; |
4424 | 0 | p->read_op = pcap_read_dead; |
4425 | 0 | p->inject_op = pcap_inject_dead; |
4426 | 0 | p->setfilter_op = pcap_setfilter_dead; |
4427 | 0 | p->setdirection_op = pcap_setdirection_dead; |
4428 | 0 | p->set_datalink_op = pcap_set_datalink_dead; |
4429 | 0 | p->getnonblock_op = pcap_getnonblock_dead; |
4430 | 0 | p->setnonblock_op = pcap_setnonblock_dead; |
4431 | 0 | p->stats_op = pcap_stats_dead; |
4432 | | #ifdef _WIN32 |
4433 | | p->stats_ex_op = pcap_stats_ex_dead; |
4434 | | p->setbuff_op = pcap_setbuff_dead; |
4435 | | p->setmode_op = pcap_setmode_dead; |
4436 | | p->setmintocopy_op = pcap_setmintocopy_dead; |
4437 | | p->getevent_op = pcap_getevent_dead; |
4438 | | p->oid_get_request_op = pcap_oid_get_request_dead; |
4439 | | p->oid_set_request_op = pcap_oid_set_request_dead; |
4440 | | p->sendqueue_transmit_op = pcap_sendqueue_transmit_dead; |
4441 | | p->setuserbuffer_op = pcap_setuserbuffer_dead; |
4442 | | p->live_dump_op = pcap_live_dump_dead; |
4443 | | p->live_dump_ended_op = pcap_live_dump_ended_dead; |
4444 | | p->get_airpcap_handle_op = pcap_get_airpcap_handle_dead; |
4445 | | #endif |
4446 | 0 | p->breakloop_op = pcap_breakloop_dead; |
4447 | 0 | p->cleanup_op = pcap_cleanup_dead; |
4448 | | |
4449 | | /* |
4450 | | * A "dead" pcap_t never requires special BPF code generation. |
4451 | | */ |
4452 | 0 | p->bpf_codegen_flags = 0; |
4453 | |
|
4454 | 0 | p->activated = 1; |
4455 | 0 | return (p); |
4456 | 0 | } |
4457 | | |
4458 | | pcap_t * |
4459 | | pcap_open_dead(int linktype, int snaplen) |
4460 | 0 | { |
4461 | 0 | return (pcap_open_dead_with_tstamp_precision(linktype, snaplen, |
4462 | 0 | PCAP_TSTAMP_PRECISION_MICRO)); |
4463 | 0 | } |
4464 | | |
4465 | | #ifdef YYDEBUG |
4466 | | /* |
4467 | | * Set the internal "debug printout" flag for the filter expression parser. |
4468 | | * The code to print that stuff is present only if YYDEBUG is defined, so |
4469 | | * the flag, and the routine to set it, are defined only if YYDEBUG is |
4470 | | * defined. |
4471 | | * |
4472 | | * This is intended for libpcap developers, not for general use. |
4473 | | * If you want to set these in a program, you'll have to declare this |
4474 | | * routine yourself, with the appropriate DLL import attribute on Windows; |
4475 | | * it's not declared in any header file, and won't be declared in any |
4476 | | * header file provided by libpcap. |
4477 | | */ |
4478 | | PCAP_API void pcap_set_parser_debug(int value); |
4479 | | |
4480 | | PCAP_API_DEF void |
4481 | | pcap_set_parser_debug(int value) |
4482 | | { |
4483 | | pcap_debug = value; |
4484 | | } |
4485 | | #endif |