1/*
2 * pcap-linux.c: Packet capture interface to the Linux kernel
3 *
4 * Copyright (c) 2000 Torsten Landschoff <torsten@debian.org>
5 * Sebastian Krahmer <krahmer@cs.uni-potsdam.de>
6 *
7 * License: BSD
8 *
--- 13 unchanged lines hidden (view full) ---
22 *
23 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
24 * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
25 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
26 */
27
28#ifndef lint
29static const char rcsid[] _U_ =
30 "@(#) $Header: /tcpdump/master/libpcap/pcap-linux.c,v 1.110.2.14 2006/10/12 17:26:58 guy Exp $ (LBL)";
31#endif
32
33/*
34 * Known problems with 2.0[.x] kernels:
35 *
36 * - The loopback device gives every packet twice; on 2.2[.x] kernels,
37 * if we use PF_PACKET, we can filter out the transmitted version
38 * of the packet by using data in the "sockaddr_ll" returned by
--- 350 unchanged lines hidden (view full) ---
389 * This is a 2.2[.x] or later kernel (we know that
390 * either because we're not using a SOCK_PACKET
391 * socket - PF_PACKET is supported only in 2.2
392 * and later kernels - or because we checked the
393 * kernel version).
394 *
395 * We can safely pass "recvfrom()" a byte count
396 * based on the snapshot length.
397 *
398 * If we're in cooked mode, make the snapshot length
399 * large enough to hold a "cooked mode" header plus
400 * 1 byte of packet data (so we don't pass a byte
401 * count of 0 to "recvfrom()").
402 */
403 if (handle->md.cooked) {
404 if (handle->snapshot < SLL_HDR_LEN + 1)
405 handle->snapshot = SLL_HDR_LEN + 1;
406 }
407 handle->bufsize = handle->snapshot;
408 }
409
410 /* Allocate the buffer */
411
412 handle->buffer = malloc(handle->bufsize + handle->offset);
413 if (!handle->buffer) {
414 snprintf(ebuf, PCAP_ERRBUF_SIZE,
--- 107 unchanged lines hidden (view full) ---
522 "recvfrom: %s", pcap_strerror(errno));
523 return -1;
524 }
525 }
526
527#ifdef HAVE_PF_PACKET_SOCKETS
528 if (!handle->md.sock_packet) {
529 /*
530 * Unfortunately, there is a window between socket() and
531 * bind() where the kernel may queue packets from any
532 * interface. If we're bound to a particular interface,
533 * discard packets not from that interface.
534 *
535 * (If socket filters are supported, we could do the
536 * same thing we do when changing the filter; however,
537 * that won't handle packet sockets without socket
538 * filter support, and it's a bit more complicated.
539 * It would save some instructions per packet, however.)
540 */
541 if (handle->md.ifindex != -1 &&
542 from.sll_ifindex != handle->md.ifindex)
543 return 0;
544
545 /*
546 * Do checks based on packet direction.
547 * We can only do this if we're using PF_PACKET; the
548 * address returned for SOCK_PACKET is a "sockaddr_pkt"
549 * which lacks the relevant packet type information.
550 */
551 if (from.sll_pkttype == PACKET_OUTGOING) {
552 /*
553 * Outgoing packet.
--- 123 unchanged lines hidden (view full) ---
677 return 0;
678 }
679 }
680
681 /* Fill in our own header data */
682
683 if (ioctl(handle->fd, SIOCGSTAMP, &pcap_header.ts) == -1) {
684 snprintf(handle->errbuf, sizeof(handle->errbuf),
685 "SIOCGSTAMP: %s", pcap_strerror(errno));
686 return -1;
687 }
688 pcap_header.caplen = caplen;
689 pcap_header.len = packet_len;
690
691 /*
692 * Count the packet.
693 *
--- 21 unchanged lines hidden (view full) ---
715 * might be running on a 2.2[.x] kernel without Alexey
716 * Kuznetzov's turbopacket patches, and thus the kernel
717 * might not be able to supply those statistics). We
718 * could, I guess, try, when opening the socket, to get
719 * the statistics, and if we can not increment the count
720 * here, but it's not clear that always incrementing
721 * the count is more expensive than always testing a flag
722 * in memory.
723 *
724 * We keep the count in "md.packets_read", and use that for
725 * "ps_recv" if we can't get the statistics from the kernel.
726 * We do that because, if we *can* get the statistics from
727 * the kernel, we use "md.stat.ps_recv" and "md.stat.ps_drop"
728 * as running counts, as reading the statistics from the
729 * kernel resets the kernel statistics, and if we directly
730 * increment "md.stat.ps_recv" here, that means it will
731 * count packets *twice* on systems where we can get kernel
732 * statistics - once here, and once in pcap_stats_linux().
733 */
734 handle->md.packets_read++;
735
736 /* Call the user supplied callback function */
737 callback(userdata, &pcap_header, bp);
738
739 return 1;
740}
741
742static int
--- 57 unchanged lines hidden (view full) ---
800
801#ifdef HAVE_TPACKET_STATS
802 /*
803 * Try to get the packet counts from the kernel.
804 */
805 if (getsockopt(handle->fd, SOL_PACKET, PACKET_STATISTICS,
806 &kstats, &len) > -1) {
807 /*
808 * On systems where the PACKET_STATISTICS "getsockopt()"
809 * argument is supported on PF_PACKET sockets:
810 *
811 * "ps_recv" counts only packets that *passed* the
812 * filter, not packets that didn't pass the filter.
813 * This includes packets later dropped because we
814 * ran out of buffer space.
815 *
816 * "ps_drop" counts packets dropped because we ran
817 * out of buffer space. It doesn't count packets
818 * dropped by the interface driver. It counts only
819 * packets that passed the filter.
820 *
821 * Both statistics include packets not yet read from
822 * the kernel by libpcap, and thus not yet seen by
823 * the application.
824 *
825 * In "linux/net/packet/af_packet.c", at least in the
826 * 2.4.9 kernel, "tp_packets" is incremented for every
827 * packet that passes the packet filter *and* is
828 * successfully queued on the socket; "tp_drops" is
829 * incremented for every packet dropped because there's
830 * not enough free space in the socket buffer.
831 *
832 * When the statistics are returned for a PACKET_STATISTICS
--- 13 unchanged lines hidden (view full) ---
846 * as the count of drops.
847 *
848 * Keep a running total because each call to
849 * getsockopt(handle->fd, SOL_PACKET, PACKET_STATISTICS, ....
850 * resets the counters to zero.
851 */
852 handle->md.stat.ps_recv += kstats.tp_packets;
853 handle->md.stat.ps_drop += kstats.tp_drops;
854 *stats = handle->md.stat;
855 return 0;
856 }
857 else
858 {
859 /*
860 * If the error was EOPNOTSUPP, fall through, so that
861 * if you build the library on a system with
862 * "struct tpacket_stats" and run it on a system
863 * that doesn't, it works as it does if the library
864 * is built on a system without "struct tpacket_stats".
865 */
866 if (errno != EOPNOTSUPP) {
867 snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
868 "pcap_stats: %s", pcap_strerror(errno));
869 return -1;
870 }
871 }
872#endif
873 /*
874 * On systems where the PACKET_STATISTICS "getsockopt()" argument
875 * is not supported on PF_PACKET sockets:
876 *
877 * "ps_recv" counts only packets that *passed* the filter,
878 * not packets that didn't pass the filter. It does not
879 * count packets dropped because we ran out of buffer
880 * space.
881 *
882 * "ps_drop" is not supported.
883 *
884 * "ps_recv" doesn't include packets not yet read from
885 * the kernel by libpcap.
886 *
887 * We maintain the count of packets processed by libpcap in
888 * "md.packets_read", for reasons described in the comment
889 * at the end of pcap_read_packet(). We have no idea how many
890 * packets were dropped.
891 */
892 stats->ps_recv = handle->md.packets_read;
893 stats->ps_drop = 0;
894 return 0;
895}
896
897/*
898 * Description string for the "any" device.
899 */
900static const char any_descr[] = "Pseudo-device that captures on all interfaces";
901
--- 55 unchanged lines hidden (view full) ---
957 if (handle->fcode.bf_len > USHRT_MAX) {
958 /*
959 * fcode.len is an unsigned short for current kernel.
960 * I have yet to see BPF-Code with that much
961 * instructions but still it is possible. So for the
962 * sake of correctness I added this check.
963 */
964 fprintf(stderr, "Warning: Filter too complex for kernel\n");
965 fcode.len = 0;
966 fcode.filter = NULL;
967 can_filter_in_kernel = 0;
968 } else
969#endif /* USHRT_MAX */
970 {
971 /*
972 * Oh joy, the Linux kernel uses struct sock_fprog instead
973 * of struct bpf_program and of course the length field is
--- 382 unchanged lines hidden (view full) ---
1356 case ARPHRD_IRDA:
1357 /* Don't expect IP packet out of this interfaces... */
1358 handle->linktype = DLT_LINUX_IRDA;
1359 /* We need to save packet direction for IrDA decoding,
1360 * so let's use "Linux-cooked" mode. Jean II */
1361 //handle->md.cooked = 1;
1362 break;
1363
1364 /* ARPHRD_LAPD is unofficial and randomly allocated, if reallocation
1365 * is needed, please report it to <daniele@orlandi.com> */
1366#ifndef ARPHRD_LAPD
1367#define ARPHRD_LAPD 8445
1368#endif
1369 case ARPHRD_LAPD:
1370 /* Don't expect IP packet out of this interfaces... */
1371 handle->linktype = DLT_LINUX_LAPD;
1372 break;
1373
1374 default:
1375 handle->linktype = -1;
1376 break;
1377 }
1378}
1379
1380/* ===== Functions to interface to the newer kernels ================== */
1381
--- 65 unchanged lines hidden (view full) ---
1447 if (arptype == -1) {
1448 fatal_err = 1;
1449 break;
1450 }
1451 map_arphrd_to_dlt(handle, arptype, 1);
1452 if (handle->linktype == -1 ||
1453 handle->linktype == DLT_LINUX_SLL ||
1454 handle->linktype == DLT_LINUX_IRDA ||
1455 handle->linktype == DLT_LINUX_LAPD ||
1456 (handle->linktype == DLT_EN10MB &&
1457 (strncmp("isdn", device, 4) == 0 ||
1458 strncmp("isdY", device, 4) == 0))) {
1459 /*
1460 * Unknown interface type (-1), or a
1461 * device we explicitly chose to run
1462 * in cooked mode (e.g., PPP devices),
1463 * or an ISDN device (whose link-layer
--- 37 unchanged lines hidden (view full) ---
1501 "arptype %d not "
1502 "supported by libpcap - "
1503 "falling back to cooked "
1504 "socket",
1505 arptype);
1506 }
1507 /* IrDA capture is not a real "cooked" capture,
1508 * it's IrLAP frames, not IP packets. */
1509 if (handle->linktype != DLT_LINUX_IRDA &&
1510 handle->linktype != DLT_LINUX_LAPD)
1511 handle->linktype = DLT_LINUX_SLL;
1512 }
1513
1514 handle->md.ifindex = iface_get_id(sock_fd, device, ebuf);
1515 if (handle->md.ifindex == -1)
1516 break;
1517
1518 if ((err = iface_bind(sock_fd, handle->md.ifindex,
--- 91 unchanged lines hidden (view full) ---
1610{
1611 struct ifreq ifr;
1612
1613 memset(&ifr, 0, sizeof(ifr));
1614 strncpy(ifr.ifr_name, device, sizeof(ifr.ifr_name));
1615
1616 if (ioctl(fd, SIOCGIFINDEX, &ifr) == -1) {
1617 snprintf(ebuf, PCAP_ERRBUF_SIZE,
1618 "SIOCGIFINDEX: %s", pcap_strerror(errno));
1619 return -1;
1620 }
1621
1622 return ifr.ifr_ifindex;
1623}
1624
1625/*
1626 * Bind the socket associated with FD to the given device.
--- 200 unchanged lines hidden (view full) ---
1827
1828 /* Go to promisc mode if requested */
1829
1830 if (promisc) {
1831 memset(&ifr, 0, sizeof(ifr));
1832 strncpy(ifr.ifr_name, device, sizeof(ifr.ifr_name));
1833 if (ioctl(handle->fd, SIOCGIFFLAGS, &ifr) == -1) {
1834 snprintf(ebuf, PCAP_ERRBUF_SIZE,
1835 "SIOCGIFFLAGS: %s", pcap_strerror(errno));
1836 break;
1837 }
1838 if ((ifr.ifr_flags & IFF_PROMISC) == 0) {
1839 /*
1840 * Promiscuous mode isn't currently on,
1841 * so turn it on, and remember that
1842 * we should turn it off when the
1843 * pcap_t is closed.
--- 17 unchanged lines hidden (view full) ---
1861 break;
1862 }
1863 did_atexit = 1;
1864 }
1865
1866 ifr.ifr_flags |= IFF_PROMISC;
1867 if (ioctl(handle->fd, SIOCSIFFLAGS, &ifr) == -1) {
1868 snprintf(ebuf, PCAP_ERRBUF_SIZE,
1869 "SIOCSIFFLAGS: %s",
1870 pcap_strerror(errno));
1871 break;
1872 }
1873 handle->md.clear_promisc = 1;
1874
1875 /*
1876 * Add this to the list of pcaps
1877 * to close when we exit.
--- 67 unchanged lines hidden (view full) ---
1945 if (!device)
1946 return BIGGER_THAN_ALL_MTUS;
1947
1948 memset(&ifr, 0, sizeof(ifr));
1949 strncpy(ifr.ifr_name, device, sizeof(ifr.ifr_name));
1950
1951 if (ioctl(fd, SIOCGIFMTU, &ifr) == -1) {
1952 snprintf(ebuf, PCAP_ERRBUF_SIZE,
1953 "SIOCGIFMTU: %s", pcap_strerror(errno));
1954 return -1;
1955 }
1956
1957 return ifr.ifr_mtu;
1958}
1959
1960/*
1961 * Get the hardware type of the given interface as ARPHRD_xxx constant.
1962 */
1963static int
1964iface_get_arptype(int fd, const char *device, char *ebuf)
1965{
1966 struct ifreq ifr;
1967
1968 memset(&ifr, 0, sizeof(ifr));
1969 strncpy(ifr.ifr_name, device, sizeof(ifr.ifr_name));
1970
1971 if (ioctl(fd, SIOCGIFHWADDR, &ifr) == -1) {
1972 snprintf(ebuf, PCAP_ERRBUF_SIZE,
1973 "SIOCGIFHWADDR: %s", pcap_strerror(errno));
1974 return -1;
1975 }
1976
1977 return ifr.ifr_hwaddr.sa_family;
1978}
1979
1980#ifdef SO_ATTACH_FILTER
1981static int
--- 220 unchanged lines hidden (view full) ---
2202 errno = save_errno;
2203 }
2204 return ret;
2205}
2206
2207static int
2208reset_kernel_filter(pcap_t *handle)
2209{
2210 /*
2211 * setsockopt() barfs unless it get a dummy parameter.
2212 * valgrind whines unless the value is initialized,
2213 * as it has no idea that setsockopt() ignores its
2214 * parameter.
2215 */
2216 int dummy = 0;
2217
2218 return setsockopt(handle->fd, SOL_SOCKET, SO_DETACH_FILTER,
2219 &dummy, sizeof(dummy));
2220}
2221#endif
2 * pcap-linux.c: Packet capture interface to the Linux kernel
3 *
4 * Copyright (c) 2000 Torsten Landschoff <torsten@debian.org>
5 * Sebastian Krahmer <krahmer@cs.uni-potsdam.de>
6 *
7 * License: BSD
8 *
--- 13 unchanged lines hidden (view full) ---
22 *
23 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
24 * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
25 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
26 */
27
28#ifndef lint
29static const char rcsid[] _U_ =
30 "@(#) $Header: /tcpdump/master/libpcap/pcap-linux.c,v 1.110.2.14 2006/10/12 17:26:58 guy Exp $ (LBL)";
31#endif
32
33/*
34 * Known problems with 2.0[.x] kernels:
35 *
36 * - The loopback device gives every packet twice; on 2.2[.x] kernels,
37 * if we use PF_PACKET, we can filter out the transmitted version
38 * of the packet by using data in the "sockaddr_ll" returned by
--- 350 unchanged lines hidden (view full) ---
389 * This is a 2.2[.x] or later kernel (we know that
390 * either because we're not using a SOCK_PACKET
391 * socket - PF_PACKET is supported only in 2.2
392 * and later kernels - or because we checked the
393 * kernel version).
394 *
395 * We can safely pass "recvfrom()" a byte count
396 * based on the snapshot length.
397 *
398 * If we're in cooked mode, make the snapshot length
399 * large enough to hold a "cooked mode" header plus
400 * 1 byte of packet data (so we don't pass a byte
401 * count of 0 to "recvfrom()").
402 */
403 if (handle->md.cooked) {
404 if (handle->snapshot < SLL_HDR_LEN + 1)
405 handle->snapshot = SLL_HDR_LEN + 1;
406 }
407 handle->bufsize = handle->snapshot;
408 }
409
410 /* Allocate the buffer */
411
412 handle->buffer = malloc(handle->bufsize + handle->offset);
413 if (!handle->buffer) {
414 snprintf(ebuf, PCAP_ERRBUF_SIZE,
--- 107 unchanged lines hidden (view full) ---
522 "recvfrom: %s", pcap_strerror(errno));
523 return -1;
524 }
525 }
526
527#ifdef HAVE_PF_PACKET_SOCKETS
528 if (!handle->md.sock_packet) {
529 /*
530 * Unfortunately, there is a window between socket() and
531 * bind() where the kernel may queue packets from any
532 * interface. If we're bound to a particular interface,
533 * discard packets not from that interface.
534 *
535 * (If socket filters are supported, we could do the
536 * same thing we do when changing the filter; however,
537 * that won't handle packet sockets without socket
538 * filter support, and it's a bit more complicated.
539 * It would save some instructions per packet, however.)
540 */
541 if (handle->md.ifindex != -1 &&
542 from.sll_ifindex != handle->md.ifindex)
543 return 0;
544
545 /*
546 * Do checks based on packet direction.
547 * We can only do this if we're using PF_PACKET; the
548 * address returned for SOCK_PACKET is a "sockaddr_pkt"
549 * which lacks the relevant packet type information.
550 */
551 if (from.sll_pkttype == PACKET_OUTGOING) {
552 /*
553 * Outgoing packet.
--- 123 unchanged lines hidden (view full) ---
677 return 0;
678 }
679 }
680
681 /* Fill in our own header data */
682
683 if (ioctl(handle->fd, SIOCGSTAMP, &pcap_header.ts) == -1) {
684 snprintf(handle->errbuf, sizeof(handle->errbuf),
685 "SIOCGSTAMP: %s", pcap_strerror(errno));
686 return -1;
687 }
688 pcap_header.caplen = caplen;
689 pcap_header.len = packet_len;
690
691 /*
692 * Count the packet.
693 *
--- 21 unchanged lines hidden (view full) ---
715 * might be running on a 2.2[.x] kernel without Alexey
716 * Kuznetzov's turbopacket patches, and thus the kernel
717 * might not be able to supply those statistics). We
718 * could, I guess, try, when opening the socket, to get
719 * the statistics, and if we can not increment the count
720 * here, but it's not clear that always incrementing
721 * the count is more expensive than always testing a flag
722 * in memory.
723 *
724 * We keep the count in "md.packets_read", and use that for
725 * "ps_recv" if we can't get the statistics from the kernel.
726 * We do that because, if we *can* get the statistics from
727 * the kernel, we use "md.stat.ps_recv" and "md.stat.ps_drop"
728 * as running counts, as reading the statistics from the
729 * kernel resets the kernel statistics, and if we directly
730 * increment "md.stat.ps_recv" here, that means it will
731 * count packets *twice* on systems where we can get kernel
732 * statistics - once here, and once in pcap_stats_linux().
733 */
734 handle->md.packets_read++;
735
736 /* Call the user supplied callback function */
737 callback(userdata, &pcap_header, bp);
738
739 return 1;
740}
741
742static int
--- 57 unchanged lines hidden (view full) ---
800
801#ifdef HAVE_TPACKET_STATS
802 /*
803 * Try to get the packet counts from the kernel.
804 */
805 if (getsockopt(handle->fd, SOL_PACKET, PACKET_STATISTICS,
806 &kstats, &len) > -1) {
807 /*
808 * On systems where the PACKET_STATISTICS "getsockopt()"
809 * argument is supported on PF_PACKET sockets:
810 *
811 * "ps_recv" counts only packets that *passed* the
812 * filter, not packets that didn't pass the filter.
813 * This includes packets later dropped because we
814 * ran out of buffer space.
815 *
816 * "ps_drop" counts packets dropped because we ran
817 * out of buffer space. It doesn't count packets
818 * dropped by the interface driver. It counts only
819 * packets that passed the filter.
820 *
821 * Both statistics include packets not yet read from
822 * the kernel by libpcap, and thus not yet seen by
823 * the application.
824 *
825 * In "linux/net/packet/af_packet.c", at least in the
826 * 2.4.9 kernel, "tp_packets" is incremented for every
827 * packet that passes the packet filter *and* is
828 * successfully queued on the socket; "tp_drops" is
829 * incremented for every packet dropped because there's
830 * not enough free space in the socket buffer.
831 *
832 * When the statistics are returned for a PACKET_STATISTICS
--- 13 unchanged lines hidden (view full) ---
846 * as the count of drops.
847 *
848 * Keep a running total because each call to
849 * getsockopt(handle->fd, SOL_PACKET, PACKET_STATISTICS, ....
850 * resets the counters to zero.
851 */
852 handle->md.stat.ps_recv += kstats.tp_packets;
853 handle->md.stat.ps_drop += kstats.tp_drops;
854 *stats = handle->md.stat;
855 return 0;
856 }
857 else
858 {
859 /*
860 * If the error was EOPNOTSUPP, fall through, so that
861 * if you build the library on a system with
862 * "struct tpacket_stats" and run it on a system
863 * that doesn't, it works as it does if the library
864 * is built on a system without "struct tpacket_stats".
865 */
866 if (errno != EOPNOTSUPP) {
867 snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
868 "pcap_stats: %s", pcap_strerror(errno));
869 return -1;
870 }
871 }
872#endif
873 /*
874 * On systems where the PACKET_STATISTICS "getsockopt()" argument
875 * is not supported on PF_PACKET sockets:
876 *
877 * "ps_recv" counts only packets that *passed* the filter,
878 * not packets that didn't pass the filter. It does not
879 * count packets dropped because we ran out of buffer
880 * space.
881 *
882 * "ps_drop" is not supported.
883 *
884 * "ps_recv" doesn't include packets not yet read from
885 * the kernel by libpcap.
886 *
887 * We maintain the count of packets processed by libpcap in
888 * "md.packets_read", for reasons described in the comment
889 * at the end of pcap_read_packet(). We have no idea how many
890 * packets were dropped.
891 */
892 stats->ps_recv = handle->md.packets_read;
893 stats->ps_drop = 0;
894 return 0;
895}
896
897/*
898 * Description string for the "any" device.
899 */
900static const char any_descr[] = "Pseudo-device that captures on all interfaces";
901
--- 55 unchanged lines hidden (view full) ---
957 if (handle->fcode.bf_len > USHRT_MAX) {
958 /*
959 * fcode.len is an unsigned short for current kernel.
960 * I have yet to see BPF-Code with that much
961 * instructions but still it is possible. So for the
962 * sake of correctness I added this check.
963 */
964 fprintf(stderr, "Warning: Filter too complex for kernel\n");
965 fcode.len = 0;
966 fcode.filter = NULL;
967 can_filter_in_kernel = 0;
968 } else
969#endif /* USHRT_MAX */
970 {
971 /*
972 * Oh joy, the Linux kernel uses struct sock_fprog instead
973 * of struct bpf_program and of course the length field is
--- 382 unchanged lines hidden (view full) ---
1356 case ARPHRD_IRDA:
1357 /* Don't expect IP packet out of this interfaces... */
1358 handle->linktype = DLT_LINUX_IRDA;
1359 /* We need to save packet direction for IrDA decoding,
1360 * so let's use "Linux-cooked" mode. Jean II */
1361 //handle->md.cooked = 1;
1362 break;
1363
1364 /* ARPHRD_LAPD is unofficial and randomly allocated, if reallocation
1365 * is needed, please report it to <daniele@orlandi.com> */
1366#ifndef ARPHRD_LAPD
1367#define ARPHRD_LAPD 8445
1368#endif
1369 case ARPHRD_LAPD:
1370 /* Don't expect IP packet out of this interfaces... */
1371 handle->linktype = DLT_LINUX_LAPD;
1372 break;
1373
1374 default:
1375 handle->linktype = -1;
1376 break;
1377 }
1378}
1379
1380/* ===== Functions to interface to the newer kernels ================== */
1381
--- 65 unchanged lines hidden (view full) ---
1447 if (arptype == -1) {
1448 fatal_err = 1;
1449 break;
1450 }
1451 map_arphrd_to_dlt(handle, arptype, 1);
1452 if (handle->linktype == -1 ||
1453 handle->linktype == DLT_LINUX_SLL ||
1454 handle->linktype == DLT_LINUX_IRDA ||
1455 handle->linktype == DLT_LINUX_LAPD ||
1456 (handle->linktype == DLT_EN10MB &&
1457 (strncmp("isdn", device, 4) == 0 ||
1458 strncmp("isdY", device, 4) == 0))) {
1459 /*
1460 * Unknown interface type (-1), or a
1461 * device we explicitly chose to run
1462 * in cooked mode (e.g., PPP devices),
1463 * or an ISDN device (whose link-layer
--- 37 unchanged lines hidden (view full) ---
1501 "arptype %d not "
1502 "supported by libpcap - "
1503 "falling back to cooked "
1504 "socket",
1505 arptype);
1506 }
1507 /* IrDA capture is not a real "cooked" capture,
1508 * it's IrLAP frames, not IP packets. */
1509 if (handle->linktype != DLT_LINUX_IRDA &&
1510 handle->linktype != DLT_LINUX_LAPD)
1511 handle->linktype = DLT_LINUX_SLL;
1512 }
1513
1514 handle->md.ifindex = iface_get_id(sock_fd, device, ebuf);
1515 if (handle->md.ifindex == -1)
1516 break;
1517
1518 if ((err = iface_bind(sock_fd, handle->md.ifindex,
--- 91 unchanged lines hidden (view full) ---
1610{
1611 struct ifreq ifr;
1612
1613 memset(&ifr, 0, sizeof(ifr));
1614 strncpy(ifr.ifr_name, device, sizeof(ifr.ifr_name));
1615
1616 if (ioctl(fd, SIOCGIFINDEX, &ifr) == -1) {
1617 snprintf(ebuf, PCAP_ERRBUF_SIZE,
1618 "SIOCGIFINDEX: %s", pcap_strerror(errno));
1619 return -1;
1620 }
1621
1622 return ifr.ifr_ifindex;
1623}
1624
1625/*
1626 * Bind the socket associated with FD to the given device.
--- 200 unchanged lines hidden (view full) ---
1827
1828 /* Go to promisc mode if requested */
1829
1830 if (promisc) {
1831 memset(&ifr, 0, sizeof(ifr));
1832 strncpy(ifr.ifr_name, device, sizeof(ifr.ifr_name));
1833 if (ioctl(handle->fd, SIOCGIFFLAGS, &ifr) == -1) {
1834 snprintf(ebuf, PCAP_ERRBUF_SIZE,
1835 "SIOCGIFFLAGS: %s", pcap_strerror(errno));
1836 break;
1837 }
1838 if ((ifr.ifr_flags & IFF_PROMISC) == 0) {
1839 /*
1840 * Promiscuous mode isn't currently on,
1841 * so turn it on, and remember that
1842 * we should turn it off when the
1843 * pcap_t is closed.
--- 17 unchanged lines hidden (view full) ---
1861 break;
1862 }
1863 did_atexit = 1;
1864 }
1865
1866 ifr.ifr_flags |= IFF_PROMISC;
1867 if (ioctl(handle->fd, SIOCSIFFLAGS, &ifr) == -1) {
1868 snprintf(ebuf, PCAP_ERRBUF_SIZE,
1869 "SIOCSIFFLAGS: %s",
1870 pcap_strerror(errno));
1871 break;
1872 }
1873 handle->md.clear_promisc = 1;
1874
1875 /*
1876 * Add this to the list of pcaps
1877 * to close when we exit.
--- 67 unchanged lines hidden (view full) ---
1945 if (!device)
1946 return BIGGER_THAN_ALL_MTUS;
1947
1948 memset(&ifr, 0, sizeof(ifr));
1949 strncpy(ifr.ifr_name, device, sizeof(ifr.ifr_name));
1950
1951 if (ioctl(fd, SIOCGIFMTU, &ifr) == -1) {
1952 snprintf(ebuf, PCAP_ERRBUF_SIZE,
1953 "SIOCGIFMTU: %s", pcap_strerror(errno));
1954 return -1;
1955 }
1956
1957 return ifr.ifr_mtu;
1958}
1959
1960/*
1961 * Get the hardware type of the given interface as ARPHRD_xxx constant.
1962 */
1963static int
1964iface_get_arptype(int fd, const char *device, char *ebuf)
1965{
1966 struct ifreq ifr;
1967
1968 memset(&ifr, 0, sizeof(ifr));
1969 strncpy(ifr.ifr_name, device, sizeof(ifr.ifr_name));
1970
1971 if (ioctl(fd, SIOCGIFHWADDR, &ifr) == -1) {
1972 snprintf(ebuf, PCAP_ERRBUF_SIZE,
1973 "SIOCGIFHWADDR: %s", pcap_strerror(errno));
1974 return -1;
1975 }
1976
1977 return ifr.ifr_hwaddr.sa_family;
1978}
1979
1980#ifdef SO_ATTACH_FILTER
1981static int
--- 220 unchanged lines hidden (view full) ---
2202 errno = save_errno;
2203 }
2204 return ret;
2205}
2206
2207static int
2208reset_kernel_filter(pcap_t *handle)
2209{
2210 /*
2211 * setsockopt() barfs unless it get a dummy parameter.
2212 * valgrind whines unless the value is initialized,
2213 * as it has no idea that setsockopt() ignores its
2214 * parameter.
2215 */
2216 int dummy = 0;
2217
2218 return setsockopt(handle->fd, SOL_SOCKET, SO_DETACH_FILTER,
2219 &dummy, sizeof(dummy));
2220}
2221#endif