1/* 2 * pcap-linux.c: Packet capture interface to the Linux kernel 3 * 4 * Copyright (c) 2000 Torsten Landschoff <torsten@debian.org> 5 * Sebastian Krahmer <krahmer@cs.uni-potsdam.de> 6 * 7 * License: BSD 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in 17 * the documentation and/or other materials provided with the 18 * distribution. 19 * 3. The names of the authors may not be used to endorse or promote 20 * products derived from this software without specific prior 21 * written permission. 22 * 23 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR 24 * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED 25 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 26 */ 27 28#ifndef lint 29static const char rcsid[] _U_ =
| 1/* 2 * pcap-linux.c: Packet capture interface to the Linux kernel 3 * 4 * Copyright (c) 2000 Torsten Landschoff <torsten@debian.org> 5 * Sebastian Krahmer <krahmer@cs.uni-potsdam.de> 6 * 7 * License: BSD 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in 17 * the documentation and/or other materials provided with the 18 * distribution. 19 * 3. The names of the authors may not be used to endorse or promote 20 * products derived from this software without specific prior 21 * written permission. 22 * 23 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR 24 * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED 25 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 26 */ 27 28#ifndef lint 29static const char rcsid[] _U_ =
|
30 "@(#) $Header: /tcpdump/master/libpcap/pcap-linux.c,v 1.110.2.6 2005/08/16 04:25:26 guy Exp $ (LBL)";
| 30 "@(#) $Header: /tcpdump/master/libpcap/pcap-linux.c,v 1.110.2.14 2006/10/12 17:26:58 guy Exp $ (LBL)";
|
31#endif 32 33/* 34 * Known problems with 2.0[.x] kernels: 35 * 36 * - The loopback device gives every packet twice; on 2.2[.x] kernels, 37 * if we use PF_PACKET, we can filter out the transmitted version 38 * of the packet by using data in the "sockaddr_ll" returned by 39 * "recvfrom()", but, on 2.0[.x] kernels, we have to use 40 * PF_INET/SOCK_PACKET, which means "recvfrom()" supplies a 41 * "sockaddr_pkt" which doesn't give us enough information to let 42 * us do that. 43 * 44 * - We have to set the interface's IFF_PROMISC flag ourselves, if 45 * we're to run in promiscuous mode, which means we have to turn 46 * it off ourselves when we're done; the kernel doesn't keep track 47 * of how many sockets are listening promiscuously, which means 48 * it won't get turned off automatically when no sockets are 49 * listening promiscuously. We catch "pcap_close()" and, for 50 * interfaces we put into promiscuous mode, take them out of 51 * promiscuous mode - which isn't necessarily the right thing to 52 * do, if another socket also requested promiscuous mode between 53 * the time when we opened the socket and the time when we close 54 * the socket. 55 * 56 * - MSG_TRUNC isn't supported, so you can't specify that "recvfrom()" 57 * return the amount of data that you could have read, rather than 58 * the amount that was returned, so we can't just allocate a buffer 59 * whose size is the snapshot length and pass the snapshot length 60 * as the byte count, and also pass MSG_TRUNC, so that the return 61 * value tells us how long the packet was on the wire. 62 * 63 * This means that, if we want to get the actual size of the packet, 64 * so we can return it in the "len" field of the packet header, 65 * we have to read the entire packet, not just the part that fits 66 * within the snapshot length, and thus waste CPU time copying data 67 * from the kernel that our caller won't see. 68 * 69 * We have to get the actual size, and supply it in "len", because 70 * otherwise, the IP dissector in tcpdump, for example, will complain 71 * about "truncated-ip", as the packet will appear to have been 72 * shorter, on the wire, than the IP header said it should have been. 73 */ 74 75 76#ifdef HAVE_CONFIG_H 77#include "config.h" 78#endif 79 80#include "pcap-int.h" 81#include "sll.h" 82 83#ifdef HAVE_DAG_API 84#include "pcap-dag.h" 85#endif /* HAVE_DAG_API */ 86 87#ifdef HAVE_SEPTEL_API 88#include "pcap-septel.h" 89#endif /* HAVE_SEPTEL_API */ 90 91#include <errno.h> 92#include <stdlib.h> 93#include <unistd.h> 94#include <fcntl.h> 95#include <string.h> 96#include <sys/socket.h> 97#include <sys/ioctl.h> 98#include <sys/utsname.h> 99#include <net/if.h> 100#include <netinet/in.h> 101#include <linux/if_ether.h> 102#include <net/if_arp.h> 103 104/* 105 * If PF_PACKET is defined, we can use {SOCK_RAW,SOCK_DGRAM}/PF_PACKET 106 * sockets rather than SOCK_PACKET sockets. 107 * 108 * To use them, we include <linux/if_packet.h> rather than 109 * <netpacket/packet.h>; we do so because 110 * 111 * some Linux distributions (e.g., Slackware 4.0) have 2.2 or 112 * later kernels and libc5, and don't provide a <netpacket/packet.h> 113 * file; 114 * 115 * not all versions of glibc2 have a <netpacket/packet.h> file 116 * that defines stuff needed for some of the 2.4-or-later-kernel 117 * features, so if the system has a 2.4 or later kernel, we 118 * still can't use those features. 119 * 120 * We're already including a number of other <linux/XXX.h> headers, and 121 * this code is Linux-specific (no other OS has PF_PACKET sockets as 122 * a raw packet capture mechanism), so it's not as if you gain any 123 * useful portability by using <netpacket/packet.h> 124 * 125 * XXX - should we just include <linux/if_packet.h> even if PF_PACKET 126 * isn't defined? It only defines one data structure in 2.0.x, so 127 * it shouldn't cause any problems. 128 */ 129#ifdef PF_PACKET 130# include <linux/if_packet.h> 131 132 /* 133 * On at least some Linux distributions (for example, Red Hat 5.2), 134 * there's no <netpacket/packet.h> file, but PF_PACKET is defined if 135 * you include <sys/socket.h>, but <linux/if_packet.h> doesn't define 136 * any of the PF_PACKET stuff such as "struct sockaddr_ll" or any of 137 * the PACKET_xxx stuff. 138 * 139 * So we check whether PACKET_HOST is defined, and assume that we have 140 * PF_PACKET sockets only if it is defined. 141 */ 142# ifdef PACKET_HOST 143# define HAVE_PF_PACKET_SOCKETS 144# endif /* PACKET_HOST */ 145#endif /* PF_PACKET */ 146 147#ifdef SO_ATTACH_FILTER 148#include <linux/types.h> 149#include <linux/filter.h> 150#endif 151 152#ifndef __GLIBC__ 153typedef int socklen_t; 154#endif 155 156#ifndef MSG_TRUNC 157/* 158 * This is being compiled on a system that lacks MSG_TRUNC; define it 159 * with the value it has in the 2.2 and later kernels, so that, on 160 * those kernels, when we pass it in the flags argument to "recvfrom()" 161 * we're passing the right value and thus get the MSG_TRUNC behavior 162 * we want. (We don't get that behavior on 2.0[.x] kernels, because 163 * they didn't support MSG_TRUNC.) 164 */ 165#define MSG_TRUNC 0x20 166#endif 167 168#ifndef SOL_PACKET 169/* 170 * This is being compiled on a system that lacks SOL_PACKET; define it 171 * with the value it has in the 2.2 and later kernels, so that we can 172 * set promiscuous mode in the good modern way rather than the old 173 * 2.0-kernel crappy way. 174 */ 175#define SOL_PACKET 263 176#endif 177 178#define MAX_LINKHEADER_SIZE 256 179 180/* 181 * When capturing on all interfaces we use this as the buffer size. 182 * Should be bigger then all MTUs that occur in real life. 183 * 64kB should be enough for now. 184 */ 185#define BIGGER_THAN_ALL_MTUS (64*1024) 186 187/* 188 * Prototypes for internal functions 189 */ 190static void map_arphrd_to_dlt(pcap_t *, int, int); 191static int live_open_old(pcap_t *, const char *, int, int, char *); 192static int live_open_new(pcap_t *, const char *, int, int, char *); 193static int pcap_read_linux(pcap_t *, int, pcap_handler, u_char *); 194static int pcap_read_packet(pcap_t *, pcap_handler, u_char *); 195static int pcap_inject_linux(pcap_t *, const void *, size_t); 196static int pcap_stats_linux(pcap_t *, struct pcap_stat *); 197static int pcap_setfilter_linux(pcap_t *, struct bpf_program *); 198static int pcap_setdirection_linux(pcap_t *, pcap_direction_t); 199static void pcap_close_linux(pcap_t *); 200 201/* 202 * Wrap some ioctl calls 203 */ 204#ifdef HAVE_PF_PACKET_SOCKETS 205static int iface_get_id(int fd, const char *device, char *ebuf); 206#endif 207static int iface_get_mtu(int fd, const char *device, char *ebuf); 208static int iface_get_arptype(int fd, const char *device, char *ebuf); 209#ifdef HAVE_PF_PACKET_SOCKETS 210static int iface_bind(int fd, int ifindex, char *ebuf); 211#endif 212static int iface_bind_old(int fd, const char *device, char *ebuf); 213 214#ifdef SO_ATTACH_FILTER 215static int fix_program(pcap_t *handle, struct sock_fprog *fcode); 216static int fix_offset(struct bpf_insn *p); 217static int set_kernel_filter(pcap_t *handle, struct sock_fprog *fcode); 218static int reset_kernel_filter(pcap_t *handle); 219 220static struct sock_filter total_insn 221 = BPF_STMT(BPF_RET | BPF_K, 0); 222static struct sock_fprog total_fcode 223 = { 1, &total_insn }; 224#endif 225 226/* 227 * Get a handle for a live capture from the given device. You can 228 * pass NULL as device to get all packages (without link level 229 * information of course). If you pass 1 as promisc the interface 230 * will be set to promiscous mode (XXX: I think this usage should 231 * be deprecated and functions be added to select that later allow 232 * modification of that values -- Torsten). 233 * 234 * See also pcap(3). 235 */ 236pcap_t * 237pcap_open_live(const char *device, int snaplen, int promisc, int to_ms, 238 char *ebuf) 239{ 240 pcap_t *handle; 241 int mtu; 242 int err; 243 int live_open_ok = 0; 244 struct utsname utsname; 245 246#ifdef HAVE_DAG_API 247 if (strstr(device, "dag")) { 248 return dag_open_live(device, snaplen, promisc, to_ms, ebuf); 249 } 250#endif /* HAVE_DAG_API */ 251 252#ifdef HAVE_SEPTEL_API 253 if (strstr(device, "septel")) { 254 return septel_open_live(device, snaplen, promisc, to_ms, ebuf); 255 } 256#endif /* HAVE_SEPTEL_API */ 257 258 /* Allocate a handle for this session. */ 259 260 handle = malloc(sizeof(*handle)); 261 if (handle == NULL) { 262 snprintf(ebuf, PCAP_ERRBUF_SIZE, "malloc: %s", 263 pcap_strerror(errno)); 264 return NULL; 265 } 266 267 /* Initialize some components of the pcap structure. */ 268 269 memset(handle, 0, sizeof(*handle)); 270 handle->snapshot = snaplen; 271 handle->md.timeout = to_ms; 272 273 /* 274 * NULL and "any" are special devices which give us the hint to 275 * monitor all devices. 276 */ 277 if (!device || strcmp(device, "any") == 0) { 278 device = NULL; 279 handle->md.device = strdup("any"); 280 if (promisc) { 281 promisc = 0; 282 /* Just a warning. */ 283 snprintf(ebuf, PCAP_ERRBUF_SIZE, 284 "Promiscuous mode not supported on the \"any\" device"); 285 } 286 287 } else 288 handle->md.device = strdup(device); 289 290 if (handle->md.device == NULL) { 291 snprintf(ebuf, PCAP_ERRBUF_SIZE, "strdup: %s", 292 pcap_strerror(errno) ); 293 free(handle); 294 return NULL; 295 } 296 297 /* 298 * Current Linux kernels use the protocol family PF_PACKET to 299 * allow direct access to all packets on the network while 300 * older kernels had a special socket type SOCK_PACKET to 301 * implement this feature. 302 * While this old implementation is kind of obsolete we need 303 * to be compatible with older kernels for a while so we are 304 * trying both methods with the newer method preferred. 305 */ 306 307 if ((err = live_open_new(handle, device, promisc, to_ms, ebuf)) == 1) 308 live_open_ok = 1; 309 else if (err == 0) { 310 /* Non-fatal error; try old way */ 311 if (live_open_old(handle, device, promisc, to_ms, ebuf)) 312 live_open_ok = 1; 313 } 314 if (!live_open_ok) { 315 /* 316 * Both methods to open the packet socket failed. Tidy 317 * up and report our failure (ebuf is expected to be 318 * set by the functions above). 319 */ 320 321 if (handle->md.device != NULL) 322 free(handle->md.device); 323 free(handle); 324 return NULL; 325 } 326 327 /* 328 * Compute the buffer size. 329 * 330 * If we're using SOCK_PACKET, this might be a 2.0[.x] kernel, 331 * and might require special handling - check. 332 */ 333 if (handle->md.sock_packet && (uname(&utsname) < 0 || 334 strncmp(utsname.release, "2.0", 3) == 0)) { 335 /* 336 * We're using a SOCK_PACKET structure, and either 337 * we couldn't find out what kernel release this is, 338 * or it's a 2.0[.x] kernel. 339 * 340 * In the 2.0[.x] kernel, a "recvfrom()" on 341 * a SOCK_PACKET socket, with MSG_TRUNC set, will 342 * return the number of bytes read, so if we pass 343 * a length based on the snapshot length, it'll 344 * return the number of bytes from the packet 345 * copied to userland, not the actual length 346 * of the packet. 347 * 348 * This means that, for example, the IP dissector 349 * in tcpdump will get handed a packet length less 350 * than the length in the IP header, and will 351 * complain about "truncated-ip". 352 * 353 * So we don't bother trying to copy from the 354 * kernel only the bytes in which we're interested, 355 * but instead copy them all, just as the older 356 * versions of libpcap for Linux did. 357 * 358 * The buffer therefore needs to be big enough to 359 * hold the largest packet we can get from this 360 * device. Unfortunately, we can't get the MRU 361 * of the network; we can only get the MTU. The 362 * MTU may be too small, in which case a packet larger 363 * than the buffer size will be truncated *and* we 364 * won't get the actual packet size. 365 * 366 * However, if the snapshot length is larger than 367 * the buffer size based on the MTU, we use the 368 * snapshot length as the buffer size, instead; 369 * this means that with a sufficiently large snapshot 370 * length we won't artificially truncate packets 371 * to the MTU-based size. 372 * 373 * This mess just one of many problems with packet 374 * capture on 2.0[.x] kernels; you really want a 375 * 2.2[.x] or later kernel if you want packet capture 376 * to work well. 377 */ 378 mtu = iface_get_mtu(handle->fd, device, ebuf); 379 if (mtu == -1) { 380 pcap_close_linux(handle); 381 free(handle); 382 return NULL; 383 } 384 handle->bufsize = MAX_LINKHEADER_SIZE + mtu; 385 if (handle->bufsize < handle->snapshot) 386 handle->bufsize = handle->snapshot; 387 } else { 388 /* 389 * This is a 2.2[.x] or later kernel (we know that 390 * either because we're not using a SOCK_PACKET 391 * socket - PF_PACKET is supported only in 2.2 392 * and later kernels - or because we checked the 393 * kernel version). 394 * 395 * We can safely pass "recvfrom()" a byte count 396 * based on the snapshot length.
| 31#endif 32 33/* 34 * Known problems with 2.0[.x] kernels: 35 * 36 * - The loopback device gives every packet twice; on 2.2[.x] kernels, 37 * if we use PF_PACKET, we can filter out the transmitted version 38 * of the packet by using data in the "sockaddr_ll" returned by 39 * "recvfrom()", but, on 2.0[.x] kernels, we have to use 40 * PF_INET/SOCK_PACKET, which means "recvfrom()" supplies a 41 * "sockaddr_pkt" which doesn't give us enough information to let 42 * us do that. 43 * 44 * - We have to set the interface's IFF_PROMISC flag ourselves, if 45 * we're to run in promiscuous mode, which means we have to turn 46 * it off ourselves when we're done; the kernel doesn't keep track 47 * of how many sockets are listening promiscuously, which means 48 * it won't get turned off automatically when no sockets are 49 * listening promiscuously. We catch "pcap_close()" and, for 50 * interfaces we put into promiscuous mode, take them out of 51 * promiscuous mode - which isn't necessarily the right thing to 52 * do, if another socket also requested promiscuous mode between 53 * the time when we opened the socket and the time when we close 54 * the socket. 55 * 56 * - MSG_TRUNC isn't supported, so you can't specify that "recvfrom()" 57 * return the amount of data that you could have read, rather than 58 * the amount that was returned, so we can't just allocate a buffer 59 * whose size is the snapshot length and pass the snapshot length 60 * as the byte count, and also pass MSG_TRUNC, so that the return 61 * value tells us how long the packet was on the wire. 62 * 63 * This means that, if we want to get the actual size of the packet, 64 * so we can return it in the "len" field of the packet header, 65 * we have to read the entire packet, not just the part that fits 66 * within the snapshot length, and thus waste CPU time copying data 67 * from the kernel that our caller won't see. 68 * 69 * We have to get the actual size, and supply it in "len", because 70 * otherwise, the IP dissector in tcpdump, for example, will complain 71 * about "truncated-ip", as the packet will appear to have been 72 * shorter, on the wire, than the IP header said it should have been. 73 */ 74 75 76#ifdef HAVE_CONFIG_H 77#include "config.h" 78#endif 79 80#include "pcap-int.h" 81#include "sll.h" 82 83#ifdef HAVE_DAG_API 84#include "pcap-dag.h" 85#endif /* HAVE_DAG_API */ 86 87#ifdef HAVE_SEPTEL_API 88#include "pcap-septel.h" 89#endif /* HAVE_SEPTEL_API */ 90 91#include <errno.h> 92#include <stdlib.h> 93#include <unistd.h> 94#include <fcntl.h> 95#include <string.h> 96#include <sys/socket.h> 97#include <sys/ioctl.h> 98#include <sys/utsname.h> 99#include <net/if.h> 100#include <netinet/in.h> 101#include <linux/if_ether.h> 102#include <net/if_arp.h> 103 104/* 105 * If PF_PACKET is defined, we can use {SOCK_RAW,SOCK_DGRAM}/PF_PACKET 106 * sockets rather than SOCK_PACKET sockets. 107 * 108 * To use them, we include <linux/if_packet.h> rather than 109 * <netpacket/packet.h>; we do so because 110 * 111 * some Linux distributions (e.g., Slackware 4.0) have 2.2 or 112 * later kernels and libc5, and don't provide a <netpacket/packet.h> 113 * file; 114 * 115 * not all versions of glibc2 have a <netpacket/packet.h> file 116 * that defines stuff needed for some of the 2.4-or-later-kernel 117 * features, so if the system has a 2.4 or later kernel, we 118 * still can't use those features. 119 * 120 * We're already including a number of other <linux/XXX.h> headers, and 121 * this code is Linux-specific (no other OS has PF_PACKET sockets as 122 * a raw packet capture mechanism), so it's not as if you gain any 123 * useful portability by using <netpacket/packet.h> 124 * 125 * XXX - should we just include <linux/if_packet.h> even if PF_PACKET 126 * isn't defined? It only defines one data structure in 2.0.x, so 127 * it shouldn't cause any problems. 128 */ 129#ifdef PF_PACKET 130# include <linux/if_packet.h> 131 132 /* 133 * On at least some Linux distributions (for example, Red Hat 5.2), 134 * there's no <netpacket/packet.h> file, but PF_PACKET is defined if 135 * you include <sys/socket.h>, but <linux/if_packet.h> doesn't define 136 * any of the PF_PACKET stuff such as "struct sockaddr_ll" or any of 137 * the PACKET_xxx stuff. 138 * 139 * So we check whether PACKET_HOST is defined, and assume that we have 140 * PF_PACKET sockets only if it is defined. 141 */ 142# ifdef PACKET_HOST 143# define HAVE_PF_PACKET_SOCKETS 144# endif /* PACKET_HOST */ 145#endif /* PF_PACKET */ 146 147#ifdef SO_ATTACH_FILTER 148#include <linux/types.h> 149#include <linux/filter.h> 150#endif 151 152#ifndef __GLIBC__ 153typedef int socklen_t; 154#endif 155 156#ifndef MSG_TRUNC 157/* 158 * This is being compiled on a system that lacks MSG_TRUNC; define it 159 * with the value it has in the 2.2 and later kernels, so that, on 160 * those kernels, when we pass it in the flags argument to "recvfrom()" 161 * we're passing the right value and thus get the MSG_TRUNC behavior 162 * we want. (We don't get that behavior on 2.0[.x] kernels, because 163 * they didn't support MSG_TRUNC.) 164 */ 165#define MSG_TRUNC 0x20 166#endif 167 168#ifndef SOL_PACKET 169/* 170 * This is being compiled on a system that lacks SOL_PACKET; define it 171 * with the value it has in the 2.2 and later kernels, so that we can 172 * set promiscuous mode in the good modern way rather than the old 173 * 2.0-kernel crappy way. 174 */ 175#define SOL_PACKET 263 176#endif 177 178#define MAX_LINKHEADER_SIZE 256 179 180/* 181 * When capturing on all interfaces we use this as the buffer size. 182 * Should be bigger then all MTUs that occur in real life. 183 * 64kB should be enough for now. 184 */ 185#define BIGGER_THAN_ALL_MTUS (64*1024) 186 187/* 188 * Prototypes for internal functions 189 */ 190static void map_arphrd_to_dlt(pcap_t *, int, int); 191static int live_open_old(pcap_t *, const char *, int, int, char *); 192static int live_open_new(pcap_t *, const char *, int, int, char *); 193static int pcap_read_linux(pcap_t *, int, pcap_handler, u_char *); 194static int pcap_read_packet(pcap_t *, pcap_handler, u_char *); 195static int pcap_inject_linux(pcap_t *, const void *, size_t); 196static int pcap_stats_linux(pcap_t *, struct pcap_stat *); 197static int pcap_setfilter_linux(pcap_t *, struct bpf_program *); 198static int pcap_setdirection_linux(pcap_t *, pcap_direction_t); 199static void pcap_close_linux(pcap_t *); 200 201/* 202 * Wrap some ioctl calls 203 */ 204#ifdef HAVE_PF_PACKET_SOCKETS 205static int iface_get_id(int fd, const char *device, char *ebuf); 206#endif 207static int iface_get_mtu(int fd, const char *device, char *ebuf); 208static int iface_get_arptype(int fd, const char *device, char *ebuf); 209#ifdef HAVE_PF_PACKET_SOCKETS 210static int iface_bind(int fd, int ifindex, char *ebuf); 211#endif 212static int iface_bind_old(int fd, const char *device, char *ebuf); 213 214#ifdef SO_ATTACH_FILTER 215static int fix_program(pcap_t *handle, struct sock_fprog *fcode); 216static int fix_offset(struct bpf_insn *p); 217static int set_kernel_filter(pcap_t *handle, struct sock_fprog *fcode); 218static int reset_kernel_filter(pcap_t *handle); 219 220static struct sock_filter total_insn 221 = BPF_STMT(BPF_RET | BPF_K, 0); 222static struct sock_fprog total_fcode 223 = { 1, &total_insn }; 224#endif 225 226/* 227 * Get a handle for a live capture from the given device. You can 228 * pass NULL as device to get all packages (without link level 229 * information of course). If you pass 1 as promisc the interface 230 * will be set to promiscous mode (XXX: I think this usage should 231 * be deprecated and functions be added to select that later allow 232 * modification of that values -- Torsten). 233 * 234 * See also pcap(3). 235 */ 236pcap_t * 237pcap_open_live(const char *device, int snaplen, int promisc, int to_ms, 238 char *ebuf) 239{ 240 pcap_t *handle; 241 int mtu; 242 int err; 243 int live_open_ok = 0; 244 struct utsname utsname; 245 246#ifdef HAVE_DAG_API 247 if (strstr(device, "dag")) { 248 return dag_open_live(device, snaplen, promisc, to_ms, ebuf); 249 } 250#endif /* HAVE_DAG_API */ 251 252#ifdef HAVE_SEPTEL_API 253 if (strstr(device, "septel")) { 254 return septel_open_live(device, snaplen, promisc, to_ms, ebuf); 255 } 256#endif /* HAVE_SEPTEL_API */ 257 258 /* Allocate a handle for this session. */ 259 260 handle = malloc(sizeof(*handle)); 261 if (handle == NULL) { 262 snprintf(ebuf, PCAP_ERRBUF_SIZE, "malloc: %s", 263 pcap_strerror(errno)); 264 return NULL; 265 } 266 267 /* Initialize some components of the pcap structure. */ 268 269 memset(handle, 0, sizeof(*handle)); 270 handle->snapshot = snaplen; 271 handle->md.timeout = to_ms; 272 273 /* 274 * NULL and "any" are special devices which give us the hint to 275 * monitor all devices. 276 */ 277 if (!device || strcmp(device, "any") == 0) { 278 device = NULL; 279 handle->md.device = strdup("any"); 280 if (promisc) { 281 promisc = 0; 282 /* Just a warning. */ 283 snprintf(ebuf, PCAP_ERRBUF_SIZE, 284 "Promiscuous mode not supported on the \"any\" device"); 285 } 286 287 } else 288 handle->md.device = strdup(device); 289 290 if (handle->md.device == NULL) { 291 snprintf(ebuf, PCAP_ERRBUF_SIZE, "strdup: %s", 292 pcap_strerror(errno) ); 293 free(handle); 294 return NULL; 295 } 296 297 /* 298 * Current Linux kernels use the protocol family PF_PACKET to 299 * allow direct access to all packets on the network while 300 * older kernels had a special socket type SOCK_PACKET to 301 * implement this feature. 302 * While this old implementation is kind of obsolete we need 303 * to be compatible with older kernels for a while so we are 304 * trying both methods with the newer method preferred. 305 */ 306 307 if ((err = live_open_new(handle, device, promisc, to_ms, ebuf)) == 1) 308 live_open_ok = 1; 309 else if (err == 0) { 310 /* Non-fatal error; try old way */ 311 if (live_open_old(handle, device, promisc, to_ms, ebuf)) 312 live_open_ok = 1; 313 } 314 if (!live_open_ok) { 315 /* 316 * Both methods to open the packet socket failed. Tidy 317 * up and report our failure (ebuf is expected to be 318 * set by the functions above). 319 */ 320 321 if (handle->md.device != NULL) 322 free(handle->md.device); 323 free(handle); 324 return NULL; 325 } 326 327 /* 328 * Compute the buffer size. 329 * 330 * If we're using SOCK_PACKET, this might be a 2.0[.x] kernel, 331 * and might require special handling - check. 332 */ 333 if (handle->md.sock_packet && (uname(&utsname) < 0 || 334 strncmp(utsname.release, "2.0", 3) == 0)) { 335 /* 336 * We're using a SOCK_PACKET structure, and either 337 * we couldn't find out what kernel release this is, 338 * or it's a 2.0[.x] kernel. 339 * 340 * In the 2.0[.x] kernel, a "recvfrom()" on 341 * a SOCK_PACKET socket, with MSG_TRUNC set, will 342 * return the number of bytes read, so if we pass 343 * a length based on the snapshot length, it'll 344 * return the number of bytes from the packet 345 * copied to userland, not the actual length 346 * of the packet. 347 * 348 * This means that, for example, the IP dissector 349 * in tcpdump will get handed a packet length less 350 * than the length in the IP header, and will 351 * complain about "truncated-ip". 352 * 353 * So we don't bother trying to copy from the 354 * kernel only the bytes in which we're interested, 355 * but instead copy them all, just as the older 356 * versions of libpcap for Linux did. 357 * 358 * The buffer therefore needs to be big enough to 359 * hold the largest packet we can get from this 360 * device. Unfortunately, we can't get the MRU 361 * of the network; we can only get the MTU. The 362 * MTU may be too small, in which case a packet larger 363 * than the buffer size will be truncated *and* we 364 * won't get the actual packet size. 365 * 366 * However, if the snapshot length is larger than 367 * the buffer size based on the MTU, we use the 368 * snapshot length as the buffer size, instead; 369 * this means that with a sufficiently large snapshot 370 * length we won't artificially truncate packets 371 * to the MTU-based size. 372 * 373 * This mess just one of many problems with packet 374 * capture on 2.0[.x] kernels; you really want a 375 * 2.2[.x] or later kernel if you want packet capture 376 * to work well. 377 */ 378 mtu = iface_get_mtu(handle->fd, device, ebuf); 379 if (mtu == -1) { 380 pcap_close_linux(handle); 381 free(handle); 382 return NULL; 383 } 384 handle->bufsize = MAX_LINKHEADER_SIZE + mtu; 385 if (handle->bufsize < handle->snapshot) 386 handle->bufsize = handle->snapshot; 387 } else { 388 /* 389 * This is a 2.2[.x] or later kernel (we know that 390 * either because we're not using a SOCK_PACKET 391 * socket - PF_PACKET is supported only in 2.2 392 * and later kernels - or because we checked the 393 * kernel version). 394 * 395 * We can safely pass "recvfrom()" a byte count 396 * based on the snapshot length.
|
| 397 * 398 * If we're in cooked mode, make the snapshot length 399 * large enough to hold a "cooked mode" header plus 400 * 1 byte of packet data (so we don't pass a byte 401 * count of 0 to "recvfrom()").
|
397 */
| 402 */
|
| 403 if (handle->md.cooked) { 404 if (handle->snapshot < SLL_HDR_LEN + 1) 405 handle->snapshot = SLL_HDR_LEN + 1; 406 }
|
398 handle->bufsize = handle->snapshot; 399 } 400 401 /* Allocate the buffer */ 402 403 handle->buffer = malloc(handle->bufsize + handle->offset); 404 if (!handle->buffer) { 405 snprintf(ebuf, PCAP_ERRBUF_SIZE, 406 "malloc: %s", pcap_strerror(errno)); 407 pcap_close_linux(handle); 408 free(handle); 409 return NULL; 410 } 411 412 /* 413 * "handle->fd" is a socket, so "select()" and "poll()" 414 * should work on it. 415 */ 416 handle->selectable_fd = handle->fd; 417 418 handle->read_op = pcap_read_linux; 419 handle->inject_op = pcap_inject_linux; 420 handle->setfilter_op = pcap_setfilter_linux; 421 handle->setdirection_op = pcap_setdirection_linux; 422 handle->set_datalink_op = NULL; /* can't change data link type */ 423 handle->getnonblock_op = pcap_getnonblock_fd; 424 handle->setnonblock_op = pcap_setnonblock_fd; 425 handle->stats_op = pcap_stats_linux; 426 handle->close_op = pcap_close_linux; 427 428 return handle; 429} 430 431/* 432 * Read at most max_packets from the capture stream and call the callback 433 * for each of them. Returns the number of packets handled or -1 if an 434 * error occured. 435 */ 436static int 437pcap_read_linux(pcap_t *handle, int max_packets, pcap_handler callback, u_char *user) 438{ 439 /* 440 * Currently, on Linux only one packet is delivered per read, 441 * so we don't loop. 442 */ 443 return pcap_read_packet(handle, callback, user); 444} 445 446/* 447 * Read a packet from the socket calling the handler provided by 448 * the user. Returns the number of packets received or -1 if an 449 * error occured. 450 */ 451static int 452pcap_read_packet(pcap_t *handle, pcap_handler callback, u_char *userdata) 453{ 454 u_char *bp; 455 int offset; 456#ifdef HAVE_PF_PACKET_SOCKETS 457 struct sockaddr_ll from; 458 struct sll_header *hdrp; 459#else 460 struct sockaddr from; 461#endif 462 socklen_t fromlen; 463 int packet_len, caplen; 464 struct pcap_pkthdr pcap_header; 465 466#ifdef HAVE_PF_PACKET_SOCKETS 467 /* 468 * If this is a cooked device, leave extra room for a 469 * fake packet header. 470 */ 471 if (handle->md.cooked) 472 offset = SLL_HDR_LEN; 473 else 474 offset = 0; 475#else 476 /* 477 * This system doesn't have PF_PACKET sockets, so it doesn't 478 * support cooked devices. 479 */ 480 offset = 0; 481#endif 482 483 /* Receive a single packet from the kernel */ 484 485 bp = handle->buffer + handle->offset; 486 do { 487 /* 488 * Has "pcap_breakloop()" been called? 489 */ 490 if (handle->break_loop) { 491 /* 492 * Yes - clear the flag that indicates that it 493 * has, and return -2 as an indication that we 494 * were told to break out of the loop. 495 */ 496 handle->break_loop = 0; 497 return -2; 498 } 499 fromlen = sizeof(from); 500 packet_len = recvfrom( 501 handle->fd, bp + offset, 502 handle->bufsize - offset, MSG_TRUNC, 503 (struct sockaddr *) &from, &fromlen); 504 } while (packet_len == -1 && errno == EINTR); 505 506 /* Check if an error occured */ 507 508 if (packet_len == -1) { 509 if (errno == EAGAIN) 510 return 0; /* no packet there */ 511 else { 512 snprintf(handle->errbuf, sizeof(handle->errbuf), 513 "recvfrom: %s", pcap_strerror(errno)); 514 return -1; 515 } 516 } 517 518#ifdef HAVE_PF_PACKET_SOCKETS 519 if (!handle->md.sock_packet) { 520 /*
| 407 handle->bufsize = handle->snapshot; 408 } 409 410 /* Allocate the buffer */ 411 412 handle->buffer = malloc(handle->bufsize + handle->offset); 413 if (!handle->buffer) { 414 snprintf(ebuf, PCAP_ERRBUF_SIZE, 415 "malloc: %s", pcap_strerror(errno)); 416 pcap_close_linux(handle); 417 free(handle); 418 return NULL; 419 } 420 421 /* 422 * "handle->fd" is a socket, so "select()" and "poll()" 423 * should work on it. 424 */ 425 handle->selectable_fd = handle->fd; 426 427 handle->read_op = pcap_read_linux; 428 handle->inject_op = pcap_inject_linux; 429 handle->setfilter_op = pcap_setfilter_linux; 430 handle->setdirection_op = pcap_setdirection_linux; 431 handle->set_datalink_op = NULL; /* can't change data link type */ 432 handle->getnonblock_op = pcap_getnonblock_fd; 433 handle->setnonblock_op = pcap_setnonblock_fd; 434 handle->stats_op = pcap_stats_linux; 435 handle->close_op = pcap_close_linux; 436 437 return handle; 438} 439 440/* 441 * Read at most max_packets from the capture stream and call the callback 442 * for each of them. Returns the number of packets handled or -1 if an 443 * error occured. 444 */ 445static int 446pcap_read_linux(pcap_t *handle, int max_packets, pcap_handler callback, u_char *user) 447{ 448 /* 449 * Currently, on Linux only one packet is delivered per read, 450 * so we don't loop. 451 */ 452 return pcap_read_packet(handle, callback, user); 453} 454 455/* 456 * Read a packet from the socket calling the handler provided by 457 * the user. Returns the number of packets received or -1 if an 458 * error occured. 459 */ 460static int 461pcap_read_packet(pcap_t *handle, pcap_handler callback, u_char *userdata) 462{ 463 u_char *bp; 464 int offset; 465#ifdef HAVE_PF_PACKET_SOCKETS 466 struct sockaddr_ll from; 467 struct sll_header *hdrp; 468#else 469 struct sockaddr from; 470#endif 471 socklen_t fromlen; 472 int packet_len, caplen; 473 struct pcap_pkthdr pcap_header; 474 475#ifdef HAVE_PF_PACKET_SOCKETS 476 /* 477 * If this is a cooked device, leave extra room for a 478 * fake packet header. 479 */ 480 if (handle->md.cooked) 481 offset = SLL_HDR_LEN; 482 else 483 offset = 0; 484#else 485 /* 486 * This system doesn't have PF_PACKET sockets, so it doesn't 487 * support cooked devices. 488 */ 489 offset = 0; 490#endif 491 492 /* Receive a single packet from the kernel */ 493 494 bp = handle->buffer + handle->offset; 495 do { 496 /* 497 * Has "pcap_breakloop()" been called? 498 */ 499 if (handle->break_loop) { 500 /* 501 * Yes - clear the flag that indicates that it 502 * has, and return -2 as an indication that we 503 * were told to break out of the loop. 504 */ 505 handle->break_loop = 0; 506 return -2; 507 } 508 fromlen = sizeof(from); 509 packet_len = recvfrom( 510 handle->fd, bp + offset, 511 handle->bufsize - offset, MSG_TRUNC, 512 (struct sockaddr *) &from, &fromlen); 513 } while (packet_len == -1 && errno == EINTR); 514 515 /* Check if an error occured */ 516 517 if (packet_len == -1) { 518 if (errno == EAGAIN) 519 return 0; /* no packet there */ 520 else { 521 snprintf(handle->errbuf, sizeof(handle->errbuf), 522 "recvfrom: %s", pcap_strerror(errno)); 523 return -1; 524 } 525 } 526 527#ifdef HAVE_PF_PACKET_SOCKETS 528 if (!handle->md.sock_packet) { 529 /*
|
| 530 * Unfortunately, there is a window between socket() and 531 * bind() where the kernel may queue packets from any 532 * interface. If we're bound to a particular interface, 533 * discard packets not from that interface. 534 * 535 * (If socket filters are supported, we could do the 536 * same thing we do when changing the filter; however, 537 * that won't handle packet sockets without socket 538 * filter support, and it's a bit more complicated. 539 * It would save some instructions per packet, however.) 540 */ 541 if (handle->md.ifindex != -1 && 542 from.sll_ifindex != handle->md.ifindex) 543 return 0; 544 545 /*
|
521 * Do checks based on packet direction. 522 * We can only do this if we're using PF_PACKET; the 523 * address returned for SOCK_PACKET is a "sockaddr_pkt" 524 * which lacks the relevant packet type information. 525 */ 526 if (from.sll_pkttype == PACKET_OUTGOING) { 527 /* 528 * Outgoing packet. 529 * If this is from the loopback device, reject it; 530 * we'll see the packet as an incoming packet as well, 531 * and we don't want to see it twice. 532 */ 533 if (from.sll_ifindex == handle->md.lo_ifindex) 534 return 0; 535 536 /* 537 * If the user only wants incoming packets, reject it. 538 */ 539 if (handle->direction == PCAP_D_IN) 540 return 0; 541 } else { 542 /* 543 * Incoming packet. 544 * If the user only wants outgoing packets, reject it. 545 */ 546 if (handle->direction == PCAP_D_OUT) 547 return 0; 548 } 549 } 550#endif 551 552#ifdef HAVE_PF_PACKET_SOCKETS 553 /* 554 * If this is a cooked device, fill in the fake packet header. 555 */ 556 if (handle->md.cooked) { 557 /* 558 * Add the length of the fake header to the length 559 * of packet data we read. 560 */ 561 packet_len += SLL_HDR_LEN; 562 563 hdrp = (struct sll_header *)bp; 564 565 /* 566 * Map the PACKET_ value to a LINUX_SLL_ value; we 567 * want the same numerical value to be used in 568 * the link-layer header even if the numerical values 569 * for the PACKET_ #defines change, so that programs 570 * that look at the packet type field will always be 571 * able to handle DLT_LINUX_SLL captures. 572 */ 573 switch (from.sll_pkttype) { 574 575 case PACKET_HOST: 576 hdrp->sll_pkttype = htons(LINUX_SLL_HOST); 577 break; 578 579 case PACKET_BROADCAST: 580 hdrp->sll_pkttype = htons(LINUX_SLL_BROADCAST); 581 break; 582 583 case PACKET_MULTICAST: 584 hdrp->sll_pkttype = htons(LINUX_SLL_MULTICAST); 585 break; 586 587 case PACKET_OTHERHOST: 588 hdrp->sll_pkttype = htons(LINUX_SLL_OTHERHOST); 589 break; 590 591 case PACKET_OUTGOING: 592 hdrp->sll_pkttype = htons(LINUX_SLL_OUTGOING); 593 break; 594 595 default: 596 hdrp->sll_pkttype = -1; 597 break; 598 } 599 600 hdrp->sll_hatype = htons(from.sll_hatype); 601 hdrp->sll_halen = htons(from.sll_halen); 602 memcpy(hdrp->sll_addr, from.sll_addr, 603 (from.sll_halen > SLL_ADDRLEN) ? 604 SLL_ADDRLEN : 605 from.sll_halen); 606 hdrp->sll_protocol = from.sll_protocol; 607 } 608#endif 609 610 /* 611 * XXX: According to the kernel source we should get the real 612 * packet len if calling recvfrom with MSG_TRUNC set. It does 613 * not seem to work here :(, but it is supported by this code 614 * anyway. 615 * To be honest the code RELIES on that feature so this is really 616 * broken with 2.2.x kernels. 617 * I spend a day to figure out what's going on and I found out 618 * that the following is happening: 619 * 620 * The packet comes from a random interface and the packet_rcv 621 * hook is called with a clone of the packet. That code inserts 622 * the packet into the receive queue of the packet socket. 623 * If a filter is attached to that socket that filter is run 624 * first - and there lies the problem. The default filter always 625 * cuts the packet at the snaplen: 626 * 627 * # tcpdump -d 628 * (000) ret #68 629 * 630 * So the packet filter cuts down the packet. The recvfrom call 631 * says "hey, it's only 68 bytes, it fits into the buffer" with 632 * the result that we don't get the real packet length. This 633 * is valid at least until kernel 2.2.17pre6. 634 * 635 * We currently handle this by making a copy of the filter 636 * program, fixing all "ret" instructions with non-zero 637 * operands to have an operand of 65535 so that the filter 638 * doesn't truncate the packet, and supplying that modified 639 * filter to the kernel. 640 */ 641 642 caplen = packet_len; 643 if (caplen > handle->snapshot) 644 caplen = handle->snapshot; 645 646 /* Run the packet filter if not using kernel filter */ 647 if (!handle->md.use_bpf && handle->fcode.bf_insns) { 648 if (bpf_filter(handle->fcode.bf_insns, bp, 649 packet_len, caplen) == 0) 650 { 651 /* rejected by filter */ 652 return 0; 653 } 654 } 655 656 /* Fill in our own header data */ 657 658 if (ioctl(handle->fd, SIOCGSTAMP, &pcap_header.ts) == -1) { 659 snprintf(handle->errbuf, sizeof(handle->errbuf),
| 546 * Do checks based on packet direction. 547 * We can only do this if we're using PF_PACKET; the 548 * address returned for SOCK_PACKET is a "sockaddr_pkt" 549 * which lacks the relevant packet type information. 550 */ 551 if (from.sll_pkttype == PACKET_OUTGOING) { 552 /* 553 * Outgoing packet. 554 * If this is from the loopback device, reject it; 555 * we'll see the packet as an incoming packet as well, 556 * and we don't want to see it twice. 557 */ 558 if (from.sll_ifindex == handle->md.lo_ifindex) 559 return 0; 560 561 /* 562 * If the user only wants incoming packets, reject it. 563 */ 564 if (handle->direction == PCAP_D_IN) 565 return 0; 566 } else { 567 /* 568 * Incoming packet. 569 * If the user only wants outgoing packets, reject it. 570 */ 571 if (handle->direction == PCAP_D_OUT) 572 return 0; 573 } 574 } 575#endif 576 577#ifdef HAVE_PF_PACKET_SOCKETS 578 /* 579 * If this is a cooked device, fill in the fake packet header. 580 */ 581 if (handle->md.cooked) { 582 /* 583 * Add the length of the fake header to the length 584 * of packet data we read. 585 */ 586 packet_len += SLL_HDR_LEN; 587 588 hdrp = (struct sll_header *)bp; 589 590 /* 591 * Map the PACKET_ value to a LINUX_SLL_ value; we 592 * want the same numerical value to be used in 593 * the link-layer header even if the numerical values 594 * for the PACKET_ #defines change, so that programs 595 * that look at the packet type field will always be 596 * able to handle DLT_LINUX_SLL captures. 597 */ 598 switch (from.sll_pkttype) { 599 600 case PACKET_HOST: 601 hdrp->sll_pkttype = htons(LINUX_SLL_HOST); 602 break; 603 604 case PACKET_BROADCAST: 605 hdrp->sll_pkttype = htons(LINUX_SLL_BROADCAST); 606 break; 607 608 case PACKET_MULTICAST: 609 hdrp->sll_pkttype = htons(LINUX_SLL_MULTICAST); 610 break; 611 612 case PACKET_OTHERHOST: 613 hdrp->sll_pkttype = htons(LINUX_SLL_OTHERHOST); 614 break; 615 616 case PACKET_OUTGOING: 617 hdrp->sll_pkttype = htons(LINUX_SLL_OUTGOING); 618 break; 619 620 default: 621 hdrp->sll_pkttype = -1; 622 break; 623 } 624 625 hdrp->sll_hatype = htons(from.sll_hatype); 626 hdrp->sll_halen = htons(from.sll_halen); 627 memcpy(hdrp->sll_addr, from.sll_addr, 628 (from.sll_halen > SLL_ADDRLEN) ? 629 SLL_ADDRLEN : 630 from.sll_halen); 631 hdrp->sll_protocol = from.sll_protocol; 632 } 633#endif 634 635 /* 636 * XXX: According to the kernel source we should get the real 637 * packet len if calling recvfrom with MSG_TRUNC set. It does 638 * not seem to work here :(, but it is supported by this code 639 * anyway. 640 * To be honest the code RELIES on that feature so this is really 641 * broken with 2.2.x kernels. 642 * I spend a day to figure out what's going on and I found out 643 * that the following is happening: 644 * 645 * The packet comes from a random interface and the packet_rcv 646 * hook is called with a clone of the packet. That code inserts 647 * the packet into the receive queue of the packet socket. 648 * If a filter is attached to that socket that filter is run 649 * first - and there lies the problem. The default filter always 650 * cuts the packet at the snaplen: 651 * 652 * # tcpdump -d 653 * (000) ret #68 654 * 655 * So the packet filter cuts down the packet. The recvfrom call 656 * says "hey, it's only 68 bytes, it fits into the buffer" with 657 * the result that we don't get the real packet length. This 658 * is valid at least until kernel 2.2.17pre6. 659 * 660 * We currently handle this by making a copy of the filter 661 * program, fixing all "ret" instructions with non-zero 662 * operands to have an operand of 65535 so that the filter 663 * doesn't truncate the packet, and supplying that modified 664 * filter to the kernel. 665 */ 666 667 caplen = packet_len; 668 if (caplen > handle->snapshot) 669 caplen = handle->snapshot; 670 671 /* Run the packet filter if not using kernel filter */ 672 if (!handle->md.use_bpf && handle->fcode.bf_insns) { 673 if (bpf_filter(handle->fcode.bf_insns, bp, 674 packet_len, caplen) == 0) 675 { 676 /* rejected by filter */ 677 return 0; 678 } 679 } 680 681 /* Fill in our own header data */ 682 683 if (ioctl(handle->fd, SIOCGSTAMP, &pcap_header.ts) == -1) { 684 snprintf(handle->errbuf, sizeof(handle->errbuf),
|
660 "ioctl: %s", pcap_strerror(errno));
| 685 "SIOCGSTAMP: %s", pcap_strerror(errno));
|
661 return -1; 662 } 663 pcap_header.caplen = caplen; 664 pcap_header.len = packet_len; 665 666 /* 667 * Count the packet. 668 * 669 * Arguably, we should count them before we check the filter, 670 * as on many other platforms "ps_recv" counts packets 671 * handed to the filter rather than packets that passed 672 * the filter, but if filtering is done in the kernel, we 673 * can't get a count of packets that passed the filter, 674 * and that would mean the meaning of "ps_recv" wouldn't 675 * be the same on all Linux systems. 676 * 677 * XXX - it's not the same on all systems in any case; 678 * ideally, we should have a "get the statistics" call 679 * that supplies more counts and indicates which of them 680 * it supplies, so that we supply a count of packets 681 * handed to the filter only on platforms where that 682 * information is available. 683 * 684 * We count them here even if we can get the packet count 685 * from the kernel, as we can only determine at run time 686 * whether we'll be able to get it from the kernel (if 687 * HAVE_TPACKET_STATS isn't defined, we can't get it from 688 * the kernel, but if it is defined, the library might 689 * have been built with a 2.4 or later kernel, but we 690 * might be running on a 2.2[.x] kernel without Alexey 691 * Kuznetzov's turbopacket patches, and thus the kernel 692 * might not be able to supply those statistics). We 693 * could, I guess, try, when opening the socket, to get 694 * the statistics, and if we can not increment the count 695 * here, but it's not clear that always incrementing 696 * the count is more expensive than always testing a flag 697 * in memory.
| 686 return -1; 687 } 688 pcap_header.caplen = caplen; 689 pcap_header.len = packet_len; 690 691 /* 692 * Count the packet. 693 * 694 * Arguably, we should count them before we check the filter, 695 * as on many other platforms "ps_recv" counts packets 696 * handed to the filter rather than packets that passed 697 * the filter, but if filtering is done in the kernel, we 698 * can't get a count of packets that passed the filter, 699 * and that would mean the meaning of "ps_recv" wouldn't 700 * be the same on all Linux systems. 701 * 702 * XXX - it's not the same on all systems in any case; 703 * ideally, we should have a "get the statistics" call 704 * that supplies more counts and indicates which of them 705 * it supplies, so that we supply a count of packets 706 * handed to the filter only on platforms where that 707 * information is available. 708 * 709 * We count them here even if we can get the packet count 710 * from the kernel, as we can only determine at run time 711 * whether we'll be able to get it from the kernel (if 712 * HAVE_TPACKET_STATS isn't defined, we can't get it from 713 * the kernel, but if it is defined, the library might 714 * have been built with a 2.4 or later kernel, but we 715 * might be running on a 2.2[.x] kernel without Alexey 716 * Kuznetzov's turbopacket patches, and thus the kernel 717 * might not be able to supply those statistics). We 718 * could, I guess, try, when opening the socket, to get 719 * the statistics, and if we can not increment the count 720 * here, but it's not clear that always incrementing 721 * the count is more expensive than always testing a flag 722 * in memory.
|
| 723 * 724 * We keep the count in "md.packets_read", and use that for 725 * "ps_recv" if we can't get the statistics from the kernel. 726 * We do that because, if we *can* get the statistics from 727 * the kernel, we use "md.stat.ps_recv" and "md.stat.ps_drop" 728 * as running counts, as reading the statistics from the 729 * kernel resets the kernel statistics, and if we directly 730 * increment "md.stat.ps_recv" here, that means it will 731 * count packets *twice* on systems where we can get kernel 732 * statistics - once here, and once in pcap_stats_linux().
|
698 */
| 733 */
|
699 handle->md.stat.ps_recv++;
| 734 handle->md.packets_read++;
|
700 701 /* Call the user supplied callback function */ 702 callback(userdata, &pcap_header, bp); 703 704 return 1; 705} 706 707static int 708pcap_inject_linux(pcap_t *handle, const void *buf, size_t size) 709{ 710 int ret; 711 712#ifdef HAVE_PF_PACKET_SOCKETS 713 if (!handle->md.sock_packet) { 714 /* PF_PACKET socket */ 715 if (handle->md.ifindex == -1) { 716 /* 717 * We don't support sending on the "any" device. 718 */ 719 strlcpy(handle->errbuf, 720 "Sending packets isn't supported on the \"any\" device", 721 PCAP_ERRBUF_SIZE); 722 return (-1); 723 } 724 725 if (handle->md.cooked) { 726 /* 727 * We don't support sending on the "any" device. 728 * 729 * XXX - how do you send on a bound cooked-mode 730 * socket? 731 * Is a "sendto()" required there? 732 */ 733 strlcpy(handle->errbuf, 734 "Sending packets isn't supported in cooked mode", 735 PCAP_ERRBUF_SIZE); 736 return (-1); 737 } 738 } 739#endif 740 741 ret = send(handle->fd, buf, size, 0); 742 if (ret == -1) { 743 snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "send: %s", 744 pcap_strerror(errno)); 745 return (-1); 746 } 747 return (ret); 748} 749 750/* 751 * Get the statistics for the given packet capture handle. 752 * Reports the number of dropped packets iff the kernel supports 753 * the PACKET_STATISTICS "getsockopt()" argument (2.4 and later 754 * kernels, and 2.2[.x] kernels with Alexey Kuznetzov's turbopacket 755 * patches); otherwise, that information isn't available, and we lie 756 * and report 0 as the count of dropped packets. 757 */ 758static int 759pcap_stats_linux(pcap_t *handle, struct pcap_stat *stats) 760{ 761#ifdef HAVE_TPACKET_STATS 762 struct tpacket_stats kstats; 763 socklen_t len = sizeof (struct tpacket_stats); 764#endif 765 766#ifdef HAVE_TPACKET_STATS 767 /* 768 * Try to get the packet counts from the kernel. 769 */ 770 if (getsockopt(handle->fd, SOL_PACKET, PACKET_STATISTICS, 771 &kstats, &len) > -1) { 772 /*
| 735 736 /* Call the user supplied callback function */ 737 callback(userdata, &pcap_header, bp); 738 739 return 1; 740} 741 742static int 743pcap_inject_linux(pcap_t *handle, const void *buf, size_t size) 744{ 745 int ret; 746 747#ifdef HAVE_PF_PACKET_SOCKETS 748 if (!handle->md.sock_packet) { 749 /* PF_PACKET socket */ 750 if (handle->md.ifindex == -1) { 751 /* 752 * We don't support sending on the "any" device. 753 */ 754 strlcpy(handle->errbuf, 755 "Sending packets isn't supported on the \"any\" device", 756 PCAP_ERRBUF_SIZE); 757 return (-1); 758 } 759 760 if (handle->md.cooked) { 761 /* 762 * We don't support sending on the "any" device. 763 * 764 * XXX - how do you send on a bound cooked-mode 765 * socket? 766 * Is a "sendto()" required there? 767 */ 768 strlcpy(handle->errbuf, 769 "Sending packets isn't supported in cooked mode", 770 PCAP_ERRBUF_SIZE); 771 return (-1); 772 } 773 } 774#endif 775 776 ret = send(handle->fd, buf, size, 0); 777 if (ret == -1) { 778 snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "send: %s", 779 pcap_strerror(errno)); 780 return (-1); 781 } 782 return (ret); 783} 784 785/* 786 * Get the statistics for the given packet capture handle. 787 * Reports the number of dropped packets iff the kernel supports 788 * the PACKET_STATISTICS "getsockopt()" argument (2.4 and later 789 * kernels, and 2.2[.x] kernels with Alexey Kuznetzov's turbopacket 790 * patches); otherwise, that information isn't available, and we lie 791 * and report 0 as the count of dropped packets. 792 */ 793static int 794pcap_stats_linux(pcap_t *handle, struct pcap_stat *stats) 795{ 796#ifdef HAVE_TPACKET_STATS 797 struct tpacket_stats kstats; 798 socklen_t len = sizeof (struct tpacket_stats); 799#endif 800 801#ifdef HAVE_TPACKET_STATS 802 /* 803 * Try to get the packet counts from the kernel. 804 */ 805 if (getsockopt(handle->fd, SOL_PACKET, PACKET_STATISTICS, 806 &kstats, &len) > -1) { 807 /*
|
| 808 * On systems where the PACKET_STATISTICS "getsockopt()" 809 * argument is supported on PF_PACKET sockets: 810 * 811 * "ps_recv" counts only packets that *passed* the 812 * filter, not packets that didn't pass the filter. 813 * This includes packets later dropped because we 814 * ran out of buffer space. 815 * 816 * "ps_drop" counts packets dropped because we ran 817 * out of buffer space. It doesn't count packets 818 * dropped by the interface driver. It counts only 819 * packets that passed the filter. 820 * 821 * Both statistics include packets not yet read from 822 * the kernel by libpcap, and thus not yet seen by 823 * the application. 824 *
|
773 * In "linux/net/packet/af_packet.c", at least in the 774 * 2.4.9 kernel, "tp_packets" is incremented for every 775 * packet that passes the packet filter *and* is 776 * successfully queued on the socket; "tp_drops" is 777 * incremented for every packet dropped because there's 778 * not enough free space in the socket buffer. 779 * 780 * When the statistics are returned for a PACKET_STATISTICS 781 * "getsockopt()" call, "tp_drops" is added to "tp_packets", 782 * so that "tp_packets" counts all packets handed to 783 * the PF_PACKET socket, including packets dropped because 784 * there wasn't room on the socket buffer - but not 785 * including packets that didn't pass the filter. 786 * 787 * In the BSD BPF, the count of received packets is 788 * incremented for every packet handed to BPF, regardless 789 * of whether it passed the filter. 790 * 791 * We can't make "pcap_stats()" work the same on both 792 * platforms, but the best approximation is to return 793 * "tp_packets" as the count of packets and "tp_drops" 794 * as the count of drops. 795 * 796 * Keep a running total because each call to 797 * getsockopt(handle->fd, SOL_PACKET, PACKET_STATISTICS, .... 798 * resets the counters to zero. 799 */ 800 handle->md.stat.ps_recv += kstats.tp_packets; 801 handle->md.stat.ps_drop += kstats.tp_drops;
| 825 * In "linux/net/packet/af_packet.c", at least in the 826 * 2.4.9 kernel, "tp_packets" is incremented for every 827 * packet that passes the packet filter *and* is 828 * successfully queued on the socket; "tp_drops" is 829 * incremented for every packet dropped because there's 830 * not enough free space in the socket buffer. 831 * 832 * When the statistics are returned for a PACKET_STATISTICS 833 * "getsockopt()" call, "tp_drops" is added to "tp_packets", 834 * so that "tp_packets" counts all packets handed to 835 * the PF_PACKET socket, including packets dropped because 836 * there wasn't room on the socket buffer - but not 837 * including packets that didn't pass the filter. 838 * 839 * In the BSD BPF, the count of received packets is 840 * incremented for every packet handed to BPF, regardless 841 * of whether it passed the filter. 842 * 843 * We can't make "pcap_stats()" work the same on both 844 * platforms, but the best approximation is to return 845 * "tp_packets" as the count of packets and "tp_drops" 846 * as the count of drops. 847 * 848 * Keep a running total because each call to 849 * getsockopt(handle->fd, SOL_PACKET, PACKET_STATISTICS, .... 850 * resets the counters to zero. 851 */ 852 handle->md.stat.ps_recv += kstats.tp_packets; 853 handle->md.stat.ps_drop += kstats.tp_drops;
|
| 854 *stats = handle->md.stat; 855 return 0;
|
802 } 803 else 804 { 805 /* 806 * If the error was EOPNOTSUPP, fall through, so that 807 * if you build the library on a system with 808 * "struct tpacket_stats" and run it on a system 809 * that doesn't, it works as it does if the library 810 * is built on a system without "struct tpacket_stats". 811 */ 812 if (errno != EOPNOTSUPP) { 813 snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, 814 "pcap_stats: %s", pcap_strerror(errno)); 815 return -1; 816 } 817 } 818#endif 819 /* 820 * On systems where the PACKET_STATISTICS "getsockopt()" argument
| 856 } 857 else 858 { 859 /* 860 * If the error was EOPNOTSUPP, fall through, so that 861 * if you build the library on a system with 862 * "struct tpacket_stats" and run it on a system 863 * that doesn't, it works as it does if the library 864 * is built on a system without "struct tpacket_stats". 865 */ 866 if (errno != EOPNOTSUPP) { 867 snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, 868 "pcap_stats: %s", pcap_strerror(errno)); 869 return -1; 870 } 871 } 872#endif 873 /* 874 * On systems where the PACKET_STATISTICS "getsockopt()" argument
|
821 * is supported on PF_PACKET sockets: 822 * 823 * "ps_recv" counts only packets that *passed* the filter, 824 * not packets that didn't pass the filter. This includes 825 * packets later dropped because we ran out of buffer space. 826 * 827 * "ps_drop" counts packets dropped because we ran out of 828 * buffer space. It doesn't count packets dropped by the 829 * interface driver. It counts only packets that passed 830 * the filter. 831 * 832 * Both statistics include packets not yet read from the 833 * kernel by libpcap, and thus not yet seen by the application. 834 * 835 * On systems where the PACKET_STATISTICS "getsockopt()" argument
| |
836 * is not supported on PF_PACKET sockets: 837 * 838 * "ps_recv" counts only packets that *passed* the filter, 839 * not packets that didn't pass the filter. It does not 840 * count packets dropped because we ran out of buffer 841 * space. 842 * 843 * "ps_drop" is not supported. 844 * 845 * "ps_recv" doesn't include packets not yet read from 846 * the kernel by libpcap.
| 875 * is not supported on PF_PACKET sockets: 876 * 877 * "ps_recv" counts only packets that *passed* the filter, 878 * not packets that didn't pass the filter. It does not 879 * count packets dropped because we ran out of buffer 880 * space. 881 * 882 * "ps_drop" is not supported. 883 * 884 * "ps_recv" doesn't include packets not yet read from 885 * the kernel by libpcap.
|
| 886 * 887 * We maintain the count of packets processed by libpcap in 888 * "md.packets_read", for reasons described in the comment 889 * at the end of pcap_read_packet(). We have no idea how many 890 * packets were dropped.
|
847 */
| 891 */
|
848 *stats = handle->md.stat;
| 892 stats->ps_recv = handle->md.packets_read; 893 stats->ps_drop = 0;
|
849 return 0; 850} 851 852/* 853 * Description string for the "any" device. 854 */ 855static const char any_descr[] = "Pseudo-device that captures on all interfaces"; 856 857int 858pcap_platform_finddevs(pcap_if_t **alldevsp, char *errbuf) 859{ 860 if (pcap_add_if(alldevsp, "any", 0, any_descr, errbuf) < 0) 861 return (-1); 862 863#ifdef HAVE_DAG_API 864 if (dag_platform_finddevs(alldevsp, errbuf) < 0) 865 return (-1); 866#endif /* HAVE_DAG_API */ 867 868#ifdef HAVE_SEPTEL_API 869 if (septel_platform_finddevs(alldevsp, errbuf) < 0) 870 return (-1); 871#endif /* HAVE_SEPTEL_API */ 872 873 return (0); 874} 875 876/* 877 * Attach the given BPF code to the packet capture device. 878 */ 879static int 880pcap_setfilter_linux(pcap_t *handle, struct bpf_program *filter) 881{ 882#ifdef SO_ATTACH_FILTER 883 struct sock_fprog fcode; 884 int can_filter_in_kernel; 885 int err = 0; 886#endif 887 888 if (!handle) 889 return -1; 890 if (!filter) { 891 strncpy(handle->errbuf, "setfilter: No filter specified", 892 sizeof(handle->errbuf)); 893 return -1; 894 } 895 896 /* Make our private copy of the filter */ 897 898 if (install_bpf_program(handle, filter) < 0) 899 /* install_bpf_program() filled in errbuf */ 900 return -1; 901 902 /* 903 * Run user level packet filter by default. Will be overriden if 904 * installing a kernel filter succeeds. 905 */ 906 handle->md.use_bpf = 0; 907 908 /* Install kernel level filter if possible */ 909 910#ifdef SO_ATTACH_FILTER 911#ifdef USHRT_MAX 912 if (handle->fcode.bf_len > USHRT_MAX) { 913 /* 914 * fcode.len is an unsigned short for current kernel. 915 * I have yet to see BPF-Code with that much 916 * instructions but still it is possible. So for the 917 * sake of correctness I added this check. 918 */ 919 fprintf(stderr, "Warning: Filter too complex for kernel\n");
| 894 return 0; 895} 896 897/* 898 * Description string for the "any" device. 899 */ 900static const char any_descr[] = "Pseudo-device that captures on all interfaces"; 901 902int 903pcap_platform_finddevs(pcap_if_t **alldevsp, char *errbuf) 904{ 905 if (pcap_add_if(alldevsp, "any", 0, any_descr, errbuf) < 0) 906 return (-1); 907 908#ifdef HAVE_DAG_API 909 if (dag_platform_finddevs(alldevsp, errbuf) < 0) 910 return (-1); 911#endif /* HAVE_DAG_API */ 912 913#ifdef HAVE_SEPTEL_API 914 if (septel_platform_finddevs(alldevsp, errbuf) < 0) 915 return (-1); 916#endif /* HAVE_SEPTEL_API */ 917 918 return (0); 919} 920 921/* 922 * Attach the given BPF code to the packet capture device. 923 */ 924static int 925pcap_setfilter_linux(pcap_t *handle, struct bpf_program *filter) 926{ 927#ifdef SO_ATTACH_FILTER 928 struct sock_fprog fcode; 929 int can_filter_in_kernel; 930 int err = 0; 931#endif 932 933 if (!handle) 934 return -1; 935 if (!filter) { 936 strncpy(handle->errbuf, "setfilter: No filter specified", 937 sizeof(handle->errbuf)); 938 return -1; 939 } 940 941 /* Make our private copy of the filter */ 942 943 if (install_bpf_program(handle, filter) < 0) 944 /* install_bpf_program() filled in errbuf */ 945 return -1; 946 947 /* 948 * Run user level packet filter by default. Will be overriden if 949 * installing a kernel filter succeeds. 950 */ 951 handle->md.use_bpf = 0; 952 953 /* Install kernel level filter if possible */ 954 955#ifdef SO_ATTACH_FILTER 956#ifdef USHRT_MAX 957 if (handle->fcode.bf_len > USHRT_MAX) { 958 /* 959 * fcode.len is an unsigned short for current kernel. 960 * I have yet to see BPF-Code with that much 961 * instructions but still it is possible. So for the 962 * sake of correctness I added this check. 963 */ 964 fprintf(stderr, "Warning: Filter too complex for kernel\n");
|
| 965 fcode.len = 0;
|
920 fcode.filter = NULL; 921 can_filter_in_kernel = 0; 922 } else 923#endif /* USHRT_MAX */ 924 { 925 /* 926 * Oh joy, the Linux kernel uses struct sock_fprog instead 927 * of struct bpf_program and of course the length field is 928 * of different size. Pointed out by Sebastian 929 * 930 * Oh, and we also need to fix it up so that all "ret" 931 * instructions with non-zero operands have 65535 as the 932 * operand, and so that, if we're in cooked mode, all 933 * memory-reference instructions use special magic offsets 934 * in references to the link-layer header and assume that 935 * the link-layer payload begins at 0; "fix_program()" 936 * will do that. 937 */ 938 switch (fix_program(handle, &fcode)) { 939 940 case -1: 941 default: 942 /* 943 * Fatal error; just quit. 944 * (The "default" case shouldn't happen; we 945 * return -1 for that reason.) 946 */ 947 return -1; 948 949 case 0: 950 /* 951 * The program performed checks that we can't make 952 * work in the kernel. 953 */ 954 can_filter_in_kernel = 0; 955 break; 956 957 case 1: 958 /* 959 * We have a filter that'll work in the kernel. 960 */ 961 can_filter_in_kernel = 1; 962 break; 963 } 964 } 965 966 if (can_filter_in_kernel) { 967 if ((err = set_kernel_filter(handle, &fcode)) == 0) 968 { 969 /* Installation succeded - using kernel filter. */ 970 handle->md.use_bpf = 1; 971 } 972 else if (err == -1) /* Non-fatal error */ 973 { 974 /* 975 * Print a warning if we weren't able to install 976 * the filter for a reason other than "this kernel 977 * isn't configured to support socket filters. 978 */ 979 if (errno != ENOPROTOOPT && errno != EOPNOTSUPP) { 980 fprintf(stderr, 981 "Warning: Kernel filter failed: %s\n", 982 pcap_strerror(errno)); 983 } 984 } 985 } 986 987 /* 988 * If we're not using the kernel filter, get rid of any kernel 989 * filter that might've been there before, e.g. because the 990 * previous filter could work in the kernel, or because some other 991 * code attached a filter to the socket by some means other than 992 * calling "pcap_setfilter()". Otherwise, the kernel filter may 993 * filter out packets that would pass the new userland filter. 994 */ 995 if (!handle->md.use_bpf) 996 reset_kernel_filter(handle); 997 998 /* 999 * Free up the copy of the filter that was made by "fix_program()". 1000 */ 1001 if (fcode.filter != NULL) 1002 free(fcode.filter); 1003 1004 if (err == -2) 1005 /* Fatal error */ 1006 return -1; 1007#endif /* SO_ATTACH_FILTER */ 1008 1009 return 0; 1010} 1011 1012/* 1013 * Set direction flag: Which packets do we accept on a forwarding 1014 * single device? IN, OUT or both? 1015 */ 1016static int 1017pcap_setdirection_linux(pcap_t *handle, pcap_direction_t d) 1018{ 1019#ifdef HAVE_PF_PACKET_SOCKETS 1020 if (!handle->md.sock_packet) { 1021 handle->direction = d; 1022 return 0; 1023 } 1024#endif 1025 /* 1026 * We're not using PF_PACKET sockets, so we can't determine 1027 * the direction of the packet. 1028 */ 1029 snprintf(handle->errbuf, sizeof(handle->errbuf), 1030 "Setting direction is not supported on SOCK_PACKET sockets"); 1031 return -1; 1032} 1033 1034/* 1035 * Linux uses the ARP hardware type to identify the type of an 1036 * interface. pcap uses the DLT_xxx constants for this. This 1037 * function takes a pointer to a "pcap_t", and an ARPHRD_xxx 1038 * constant, as arguments, and sets "handle->linktype" to the 1039 * appropriate DLT_XXX constant and sets "handle->offset" to 1040 * the appropriate value (to make "handle->offset" plus link-layer 1041 * header length be a multiple of 4, so that the link-layer payload 1042 * will be aligned on a 4-byte boundary when capturing packets). 1043 * (If the offset isn't set here, it'll be 0; add code as appropriate 1044 * for cases where it shouldn't be 0.) 1045 * 1046 * If "cooked_ok" is non-zero, we can use DLT_LINUX_SLL and capture 1047 * in cooked mode; otherwise, we can't use cooked mode, so we have 1048 * to pick some type that works in raw mode, or fail. 1049 * 1050 * Sets the link type to -1 if unable to map the type. 1051 */ 1052static void map_arphrd_to_dlt(pcap_t *handle, int arptype, int cooked_ok) 1053{ 1054 switch (arptype) { 1055 1056 case ARPHRD_ETHER: 1057 /* 1058 * This is (presumably) a real Ethernet capture; give it a 1059 * link-layer-type list with DLT_EN10MB and DLT_DOCSIS, so 1060 * that an application can let you choose it, in case you're 1061 * capturing DOCSIS traffic that a Cisco Cable Modem 1062 * Termination System is putting out onto an Ethernet (it 1063 * doesn't put an Ethernet header onto the wire, it puts raw 1064 * DOCSIS frames out on the wire inside the low-level 1065 * Ethernet framing). 1066 * 1067 * XXX - are there any sorts of "fake Ethernet" that have 1068 * ARPHRD_ETHER but that *shouldn't offer DLT_DOCSIS as 1069 * a Cisco CMTS won't put traffic onto it or get traffic 1070 * bridged onto it? ISDN is handled in "live_open_new()", 1071 * as we fall back on cooked mode there; are there any 1072 * others? 1073 */ 1074 handle->dlt_list = (u_int *) malloc(sizeof(u_int) * 2); 1075 /* 1076 * If that fails, just leave the list empty. 1077 */ 1078 if (handle->dlt_list != NULL) { 1079 handle->dlt_list[0] = DLT_EN10MB; 1080 handle->dlt_list[1] = DLT_DOCSIS; 1081 handle->dlt_count = 2; 1082 } 1083 /* FALLTHROUGH */ 1084 1085 case ARPHRD_METRICOM: 1086 case ARPHRD_LOOPBACK: 1087 handle->linktype = DLT_EN10MB; 1088 handle->offset = 2; 1089 break; 1090 1091 case ARPHRD_EETHER: 1092 handle->linktype = DLT_EN3MB; 1093 break; 1094 1095 case ARPHRD_AX25: 1096 handle->linktype = DLT_AX25; 1097 break; 1098 1099 case ARPHRD_PRONET: 1100 handle->linktype = DLT_PRONET; 1101 break; 1102 1103 case ARPHRD_CHAOS: 1104 handle->linktype = DLT_CHAOS; 1105 break; 1106 1107#ifndef ARPHRD_IEEE802_TR 1108#define ARPHRD_IEEE802_TR 800 /* From Linux 2.4 */ 1109#endif 1110 case ARPHRD_IEEE802_TR: 1111 case ARPHRD_IEEE802: 1112 handle->linktype = DLT_IEEE802; 1113 handle->offset = 2; 1114 break; 1115 1116 case ARPHRD_ARCNET: 1117 handle->linktype = DLT_ARCNET_LINUX; 1118 break; 1119 1120#ifndef ARPHRD_FDDI /* From Linux 2.2.13 */ 1121#define ARPHRD_FDDI 774 1122#endif 1123 case ARPHRD_FDDI: 1124 handle->linktype = DLT_FDDI; 1125 handle->offset = 3; 1126 break; 1127 1128#ifndef ARPHRD_ATM /* FIXME: How to #include this? */ 1129#define ARPHRD_ATM 19 1130#endif 1131 case ARPHRD_ATM: 1132 /* 1133 * The Classical IP implementation in ATM for Linux 1134 * supports both what RFC 1483 calls "LLC Encapsulation", 1135 * in which each packet has an LLC header, possibly 1136 * with a SNAP header as well, prepended to it, and 1137 * what RFC 1483 calls "VC Based Multiplexing", in which 1138 * different virtual circuits carry different network 1139 * layer protocols, and no header is prepended to packets. 1140 * 1141 * They both have an ARPHRD_ type of ARPHRD_ATM, so 1142 * you can't use the ARPHRD_ type to find out whether 1143 * captured packets will have an LLC header, and, 1144 * while there's a socket ioctl to *set* the encapsulation 1145 * type, there's no ioctl to *get* the encapsulation type. 1146 * 1147 * This means that 1148 * 1149 * programs that dissect Linux Classical IP frames 1150 * would have to check for an LLC header and, 1151 * depending on whether they see one or not, dissect 1152 * the frame as LLC-encapsulated or as raw IP (I 1153 * don't know whether there's any traffic other than 1154 * IP that would show up on the socket, or whether 1155 * there's any support for IPv6 in the Linux 1156 * Classical IP code); 1157 * 1158 * filter expressions would have to compile into 1159 * code that checks for an LLC header and does 1160 * the right thing. 1161 * 1162 * Both of those are a nuisance - and, at least on systems 1163 * that support PF_PACKET sockets, we don't have to put 1164 * up with those nuisances; instead, we can just capture 1165 * in cooked mode. That's what we'll do, if we can. 1166 * Otherwise, we'll just fail. 1167 */ 1168 if (cooked_ok) 1169 handle->linktype = DLT_LINUX_SLL; 1170 else 1171 handle->linktype = -1; 1172 break; 1173 1174#ifndef ARPHRD_IEEE80211 /* From Linux 2.4.6 */ 1175#define ARPHRD_IEEE80211 801 1176#endif 1177 case ARPHRD_IEEE80211: 1178 handle->linktype = DLT_IEEE802_11; 1179 break; 1180 1181#ifndef ARPHRD_IEEE80211_PRISM /* From Linux 2.4.18 */ 1182#define ARPHRD_IEEE80211_PRISM 802 1183#endif 1184 case ARPHRD_IEEE80211_PRISM: 1185 handle->linktype = DLT_PRISM_HEADER; 1186 break; 1187 1188#ifndef ARPHRD_IEEE80211_RADIOTAP /* new */ 1189#define ARPHRD_IEEE80211_RADIOTAP 803 1190#endif 1191 case ARPHRD_IEEE80211_RADIOTAP: 1192 handle->linktype = DLT_IEEE802_11_RADIO; 1193 break; 1194 1195 case ARPHRD_PPP: 1196 /* 1197 * Some PPP code in the kernel supplies no link-layer 1198 * header whatsoever to PF_PACKET sockets; other PPP 1199 * code supplies PPP link-layer headers ("syncppp.c"); 1200 * some PPP code might supply random link-layer 1201 * headers (PPP over ISDN - there's code in Ethereal, 1202 * for example, to cope with PPP-over-ISDN captures 1203 * with which the Ethereal developers have had to cope, 1204 * heuristically trying to determine which of the 1205 * oddball link-layer headers particular packets have). 1206 * 1207 * As such, we just punt, and run all PPP interfaces 1208 * in cooked mode, if we can; otherwise, we just treat 1209 * it as DLT_RAW, for now - if somebody needs to capture, 1210 * on a 2.0[.x] kernel, on PPP devices that supply a 1211 * link-layer header, they'll have to add code here to 1212 * map to the appropriate DLT_ type (possibly adding a 1213 * new DLT_ type, if necessary). 1214 */ 1215 if (cooked_ok) 1216 handle->linktype = DLT_LINUX_SLL; 1217 else { 1218 /* 1219 * XXX - handle ISDN types here? We can't fall 1220 * back on cooked sockets, so we'd have to 1221 * figure out from the device name what type of 1222 * link-layer encapsulation it's using, and map 1223 * that to an appropriate DLT_ value, meaning 1224 * we'd map "isdnN" devices to DLT_RAW (they 1225 * supply raw IP packets with no link-layer 1226 * header) and "isdY" devices to a new DLT_I4L_IP 1227 * type that has only an Ethernet packet type as 1228 * a link-layer header. 1229 * 1230 * But sometimes we seem to get random crap 1231 * in the link-layer header when capturing on 1232 * ISDN devices.... 1233 */ 1234 handle->linktype = DLT_RAW; 1235 } 1236 break; 1237 1238#ifndef ARPHRD_CISCO 1239#define ARPHRD_CISCO 513 /* previously ARPHRD_HDLC */ 1240#endif 1241 case ARPHRD_CISCO: 1242 handle->linktype = DLT_C_HDLC; 1243 break; 1244 1245 /* Not sure if this is correct for all tunnels, but it 1246 * works for CIPE */ 1247 case ARPHRD_TUNNEL: 1248#ifndef ARPHRD_SIT 1249#define ARPHRD_SIT 776 /* From Linux 2.2.13 */ 1250#endif 1251 case ARPHRD_SIT: 1252 case ARPHRD_CSLIP: 1253 case ARPHRD_SLIP6: 1254 case ARPHRD_CSLIP6: 1255 case ARPHRD_ADAPT: 1256 case ARPHRD_SLIP: 1257#ifndef ARPHRD_RAWHDLC 1258#define ARPHRD_RAWHDLC 518 1259#endif 1260 case ARPHRD_RAWHDLC: 1261#ifndef ARPHRD_DLCI 1262#define ARPHRD_DLCI 15 1263#endif 1264 case ARPHRD_DLCI: 1265 /* 1266 * XXX - should some of those be mapped to DLT_LINUX_SLL 1267 * instead? Should we just map all of them to DLT_LINUX_SLL? 1268 */ 1269 handle->linktype = DLT_RAW; 1270 break; 1271 1272#ifndef ARPHRD_FRAD 1273#define ARPHRD_FRAD 770 1274#endif 1275 case ARPHRD_FRAD: 1276 handle->linktype = DLT_FRELAY; 1277 break; 1278 1279 case ARPHRD_LOCALTLK: 1280 handle->linktype = DLT_LTALK; 1281 break; 1282 1283#ifndef ARPHRD_FCPP 1284#define ARPHRD_FCPP 784 1285#endif 1286 case ARPHRD_FCPP: 1287#ifndef ARPHRD_FCAL 1288#define ARPHRD_FCAL 785 1289#endif 1290 case ARPHRD_FCAL: 1291#ifndef ARPHRD_FCPL 1292#define ARPHRD_FCPL 786 1293#endif 1294 case ARPHRD_FCPL: 1295#ifndef ARPHRD_FCFABRIC 1296#define ARPHRD_FCFABRIC 787 1297#endif 1298 case ARPHRD_FCFABRIC: 1299 /* 1300 * We assume that those all mean RFC 2625 IP-over- 1301 * Fibre Channel, with the RFC 2625 header at 1302 * the beginning of the packet. 1303 */ 1304 handle->linktype = DLT_IP_OVER_FC; 1305 break; 1306 1307#ifndef ARPHRD_IRDA 1308#define ARPHRD_IRDA 783 1309#endif 1310 case ARPHRD_IRDA: 1311 /* Don't expect IP packet out of this interfaces... */ 1312 handle->linktype = DLT_LINUX_IRDA; 1313 /* We need to save packet direction for IrDA decoding, 1314 * so let's use "Linux-cooked" mode. Jean II */ 1315 //handle->md.cooked = 1; 1316 break; 1317
| 966 fcode.filter = NULL; 967 can_filter_in_kernel = 0; 968 } else 969#endif /* USHRT_MAX */ 970 { 971 /* 972 * Oh joy, the Linux kernel uses struct sock_fprog instead 973 * of struct bpf_program and of course the length field is 974 * of different size. Pointed out by Sebastian 975 * 976 * Oh, and we also need to fix it up so that all "ret" 977 * instructions with non-zero operands have 65535 as the 978 * operand, and so that, if we're in cooked mode, all 979 * memory-reference instructions use special magic offsets 980 * in references to the link-layer header and assume that 981 * the link-layer payload begins at 0; "fix_program()" 982 * will do that. 983 */ 984 switch (fix_program(handle, &fcode)) { 985 986 case -1: 987 default: 988 /* 989 * Fatal error; just quit. 990 * (The "default" case shouldn't happen; we 991 * return -1 for that reason.) 992 */ 993 return -1; 994 995 case 0: 996 /* 997 * The program performed checks that we can't make 998 * work in the kernel. 999 */ 1000 can_filter_in_kernel = 0; 1001 break; 1002 1003 case 1: 1004 /* 1005 * We have a filter that'll work in the kernel. 1006 */ 1007 can_filter_in_kernel = 1; 1008 break; 1009 } 1010 } 1011 1012 if (can_filter_in_kernel) { 1013 if ((err = set_kernel_filter(handle, &fcode)) == 0) 1014 { 1015 /* Installation succeded - using kernel filter. */ 1016 handle->md.use_bpf = 1; 1017 } 1018 else if (err == -1) /* Non-fatal error */ 1019 { 1020 /* 1021 * Print a warning if we weren't able to install 1022 * the filter for a reason other than "this kernel 1023 * isn't configured to support socket filters. 1024 */ 1025 if (errno != ENOPROTOOPT && errno != EOPNOTSUPP) { 1026 fprintf(stderr, 1027 "Warning: Kernel filter failed: %s\n", 1028 pcap_strerror(errno)); 1029 } 1030 } 1031 } 1032 1033 /* 1034 * If we're not using the kernel filter, get rid of any kernel 1035 * filter that might've been there before, e.g. because the 1036 * previous filter could work in the kernel, or because some other 1037 * code attached a filter to the socket by some means other than 1038 * calling "pcap_setfilter()". Otherwise, the kernel filter may 1039 * filter out packets that would pass the new userland filter. 1040 */ 1041 if (!handle->md.use_bpf) 1042 reset_kernel_filter(handle); 1043 1044 /* 1045 * Free up the copy of the filter that was made by "fix_program()". 1046 */ 1047 if (fcode.filter != NULL) 1048 free(fcode.filter); 1049 1050 if (err == -2) 1051 /* Fatal error */ 1052 return -1; 1053#endif /* SO_ATTACH_FILTER */ 1054 1055 return 0; 1056} 1057 1058/* 1059 * Set direction flag: Which packets do we accept on a forwarding 1060 * single device? IN, OUT or both? 1061 */ 1062static int 1063pcap_setdirection_linux(pcap_t *handle, pcap_direction_t d) 1064{ 1065#ifdef HAVE_PF_PACKET_SOCKETS 1066 if (!handle->md.sock_packet) { 1067 handle->direction = d; 1068 return 0; 1069 } 1070#endif 1071 /* 1072 * We're not using PF_PACKET sockets, so we can't determine 1073 * the direction of the packet. 1074 */ 1075 snprintf(handle->errbuf, sizeof(handle->errbuf), 1076 "Setting direction is not supported on SOCK_PACKET sockets"); 1077 return -1; 1078} 1079 1080/* 1081 * Linux uses the ARP hardware type to identify the type of an 1082 * interface. pcap uses the DLT_xxx constants for this. This 1083 * function takes a pointer to a "pcap_t", and an ARPHRD_xxx 1084 * constant, as arguments, and sets "handle->linktype" to the 1085 * appropriate DLT_XXX constant and sets "handle->offset" to 1086 * the appropriate value (to make "handle->offset" plus link-layer 1087 * header length be a multiple of 4, so that the link-layer payload 1088 * will be aligned on a 4-byte boundary when capturing packets). 1089 * (If the offset isn't set here, it'll be 0; add code as appropriate 1090 * for cases where it shouldn't be 0.) 1091 * 1092 * If "cooked_ok" is non-zero, we can use DLT_LINUX_SLL and capture 1093 * in cooked mode; otherwise, we can't use cooked mode, so we have 1094 * to pick some type that works in raw mode, or fail. 1095 * 1096 * Sets the link type to -1 if unable to map the type. 1097 */ 1098static void map_arphrd_to_dlt(pcap_t *handle, int arptype, int cooked_ok) 1099{ 1100 switch (arptype) { 1101 1102 case ARPHRD_ETHER: 1103 /* 1104 * This is (presumably) a real Ethernet capture; give it a 1105 * link-layer-type list with DLT_EN10MB and DLT_DOCSIS, so 1106 * that an application can let you choose it, in case you're 1107 * capturing DOCSIS traffic that a Cisco Cable Modem 1108 * Termination System is putting out onto an Ethernet (it 1109 * doesn't put an Ethernet header onto the wire, it puts raw 1110 * DOCSIS frames out on the wire inside the low-level 1111 * Ethernet framing). 1112 * 1113 * XXX - are there any sorts of "fake Ethernet" that have 1114 * ARPHRD_ETHER but that *shouldn't offer DLT_DOCSIS as 1115 * a Cisco CMTS won't put traffic onto it or get traffic 1116 * bridged onto it? ISDN is handled in "live_open_new()", 1117 * as we fall back on cooked mode there; are there any 1118 * others? 1119 */ 1120 handle->dlt_list = (u_int *) malloc(sizeof(u_int) * 2); 1121 /* 1122 * If that fails, just leave the list empty. 1123 */ 1124 if (handle->dlt_list != NULL) { 1125 handle->dlt_list[0] = DLT_EN10MB; 1126 handle->dlt_list[1] = DLT_DOCSIS; 1127 handle->dlt_count = 2; 1128 } 1129 /* FALLTHROUGH */ 1130 1131 case ARPHRD_METRICOM: 1132 case ARPHRD_LOOPBACK: 1133 handle->linktype = DLT_EN10MB; 1134 handle->offset = 2; 1135 break; 1136 1137 case ARPHRD_EETHER: 1138 handle->linktype = DLT_EN3MB; 1139 break; 1140 1141 case ARPHRD_AX25: 1142 handle->linktype = DLT_AX25; 1143 break; 1144 1145 case ARPHRD_PRONET: 1146 handle->linktype = DLT_PRONET; 1147 break; 1148 1149 case ARPHRD_CHAOS: 1150 handle->linktype = DLT_CHAOS; 1151 break; 1152 1153#ifndef ARPHRD_IEEE802_TR 1154#define ARPHRD_IEEE802_TR 800 /* From Linux 2.4 */ 1155#endif 1156 case ARPHRD_IEEE802_TR: 1157 case ARPHRD_IEEE802: 1158 handle->linktype = DLT_IEEE802; 1159 handle->offset = 2; 1160 break; 1161 1162 case ARPHRD_ARCNET: 1163 handle->linktype = DLT_ARCNET_LINUX; 1164 break; 1165 1166#ifndef ARPHRD_FDDI /* From Linux 2.2.13 */ 1167#define ARPHRD_FDDI 774 1168#endif 1169 case ARPHRD_FDDI: 1170 handle->linktype = DLT_FDDI; 1171 handle->offset = 3; 1172 break; 1173 1174#ifndef ARPHRD_ATM /* FIXME: How to #include this? */ 1175#define ARPHRD_ATM 19 1176#endif 1177 case ARPHRD_ATM: 1178 /* 1179 * The Classical IP implementation in ATM for Linux 1180 * supports both what RFC 1483 calls "LLC Encapsulation", 1181 * in which each packet has an LLC header, possibly 1182 * with a SNAP header as well, prepended to it, and 1183 * what RFC 1483 calls "VC Based Multiplexing", in which 1184 * different virtual circuits carry different network 1185 * layer protocols, and no header is prepended to packets. 1186 * 1187 * They both have an ARPHRD_ type of ARPHRD_ATM, so 1188 * you can't use the ARPHRD_ type to find out whether 1189 * captured packets will have an LLC header, and, 1190 * while there's a socket ioctl to *set* the encapsulation 1191 * type, there's no ioctl to *get* the encapsulation type. 1192 * 1193 * This means that 1194 * 1195 * programs that dissect Linux Classical IP frames 1196 * would have to check for an LLC header and, 1197 * depending on whether they see one or not, dissect 1198 * the frame as LLC-encapsulated or as raw IP (I 1199 * don't know whether there's any traffic other than 1200 * IP that would show up on the socket, or whether 1201 * there's any support for IPv6 in the Linux 1202 * Classical IP code); 1203 * 1204 * filter expressions would have to compile into 1205 * code that checks for an LLC header and does 1206 * the right thing. 1207 * 1208 * Both of those are a nuisance - and, at least on systems 1209 * that support PF_PACKET sockets, we don't have to put 1210 * up with those nuisances; instead, we can just capture 1211 * in cooked mode. That's what we'll do, if we can. 1212 * Otherwise, we'll just fail. 1213 */ 1214 if (cooked_ok) 1215 handle->linktype = DLT_LINUX_SLL; 1216 else 1217 handle->linktype = -1; 1218 break; 1219 1220#ifndef ARPHRD_IEEE80211 /* From Linux 2.4.6 */ 1221#define ARPHRD_IEEE80211 801 1222#endif 1223 case ARPHRD_IEEE80211: 1224 handle->linktype = DLT_IEEE802_11; 1225 break; 1226 1227#ifndef ARPHRD_IEEE80211_PRISM /* From Linux 2.4.18 */ 1228#define ARPHRD_IEEE80211_PRISM 802 1229#endif 1230 case ARPHRD_IEEE80211_PRISM: 1231 handle->linktype = DLT_PRISM_HEADER; 1232 break; 1233 1234#ifndef ARPHRD_IEEE80211_RADIOTAP /* new */ 1235#define ARPHRD_IEEE80211_RADIOTAP 803 1236#endif 1237 case ARPHRD_IEEE80211_RADIOTAP: 1238 handle->linktype = DLT_IEEE802_11_RADIO; 1239 break; 1240 1241 case ARPHRD_PPP: 1242 /* 1243 * Some PPP code in the kernel supplies no link-layer 1244 * header whatsoever to PF_PACKET sockets; other PPP 1245 * code supplies PPP link-layer headers ("syncppp.c"); 1246 * some PPP code might supply random link-layer 1247 * headers (PPP over ISDN - there's code in Ethereal, 1248 * for example, to cope with PPP-over-ISDN captures 1249 * with which the Ethereal developers have had to cope, 1250 * heuristically trying to determine which of the 1251 * oddball link-layer headers particular packets have). 1252 * 1253 * As such, we just punt, and run all PPP interfaces 1254 * in cooked mode, if we can; otherwise, we just treat 1255 * it as DLT_RAW, for now - if somebody needs to capture, 1256 * on a 2.0[.x] kernel, on PPP devices that supply a 1257 * link-layer header, they'll have to add code here to 1258 * map to the appropriate DLT_ type (possibly adding a 1259 * new DLT_ type, if necessary). 1260 */ 1261 if (cooked_ok) 1262 handle->linktype = DLT_LINUX_SLL; 1263 else { 1264 /* 1265 * XXX - handle ISDN types here? We can't fall 1266 * back on cooked sockets, so we'd have to 1267 * figure out from the device name what type of 1268 * link-layer encapsulation it's using, and map 1269 * that to an appropriate DLT_ value, meaning 1270 * we'd map "isdnN" devices to DLT_RAW (they 1271 * supply raw IP packets with no link-layer 1272 * header) and "isdY" devices to a new DLT_I4L_IP 1273 * type that has only an Ethernet packet type as 1274 * a link-layer header. 1275 * 1276 * But sometimes we seem to get random crap 1277 * in the link-layer header when capturing on 1278 * ISDN devices.... 1279 */ 1280 handle->linktype = DLT_RAW; 1281 } 1282 break; 1283 1284#ifndef ARPHRD_CISCO 1285#define ARPHRD_CISCO 513 /* previously ARPHRD_HDLC */ 1286#endif 1287 case ARPHRD_CISCO: 1288 handle->linktype = DLT_C_HDLC; 1289 break; 1290 1291 /* Not sure if this is correct for all tunnels, but it 1292 * works for CIPE */ 1293 case ARPHRD_TUNNEL: 1294#ifndef ARPHRD_SIT 1295#define ARPHRD_SIT 776 /* From Linux 2.2.13 */ 1296#endif 1297 case ARPHRD_SIT: 1298 case ARPHRD_CSLIP: 1299 case ARPHRD_SLIP6: 1300 case ARPHRD_CSLIP6: 1301 case ARPHRD_ADAPT: 1302 case ARPHRD_SLIP: 1303#ifndef ARPHRD_RAWHDLC 1304#define ARPHRD_RAWHDLC 518 1305#endif 1306 case ARPHRD_RAWHDLC: 1307#ifndef ARPHRD_DLCI 1308#define ARPHRD_DLCI 15 1309#endif 1310 case ARPHRD_DLCI: 1311 /* 1312 * XXX - should some of those be mapped to DLT_LINUX_SLL 1313 * instead? Should we just map all of them to DLT_LINUX_SLL? 1314 */ 1315 handle->linktype = DLT_RAW; 1316 break; 1317 1318#ifndef ARPHRD_FRAD 1319#define ARPHRD_FRAD 770 1320#endif 1321 case ARPHRD_FRAD: 1322 handle->linktype = DLT_FRELAY; 1323 break; 1324 1325 case ARPHRD_LOCALTLK: 1326 handle->linktype = DLT_LTALK; 1327 break; 1328 1329#ifndef ARPHRD_FCPP 1330#define ARPHRD_FCPP 784 1331#endif 1332 case ARPHRD_FCPP: 1333#ifndef ARPHRD_FCAL 1334#define ARPHRD_FCAL 785 1335#endif 1336 case ARPHRD_FCAL: 1337#ifndef ARPHRD_FCPL 1338#define ARPHRD_FCPL 786 1339#endif 1340 case ARPHRD_FCPL: 1341#ifndef ARPHRD_FCFABRIC 1342#define ARPHRD_FCFABRIC 787 1343#endif 1344 case ARPHRD_FCFABRIC: 1345 /* 1346 * We assume that those all mean RFC 2625 IP-over- 1347 * Fibre Channel, with the RFC 2625 header at 1348 * the beginning of the packet. 1349 */ 1350 handle->linktype = DLT_IP_OVER_FC; 1351 break; 1352 1353#ifndef ARPHRD_IRDA 1354#define ARPHRD_IRDA 783 1355#endif 1356 case ARPHRD_IRDA: 1357 /* Don't expect IP packet out of this interfaces... */ 1358 handle->linktype = DLT_LINUX_IRDA; 1359 /* We need to save packet direction for IrDA decoding, 1360 * so let's use "Linux-cooked" mode. Jean II */ 1361 //handle->md.cooked = 1; 1362 break; 1363
|
| 1364 /* ARPHRD_LAPD is unofficial and randomly allocated, if reallocation 1365 * is needed, please report it to <daniele@orlandi.com> */ 1366#ifndef ARPHRD_LAPD 1367#define ARPHRD_LAPD 8445 1368#endif 1369 case ARPHRD_LAPD: 1370 /* Don't expect IP packet out of this interfaces... */ 1371 handle->linktype = DLT_LINUX_LAPD; 1372 break; 1373
|
1318 default: 1319 handle->linktype = -1; 1320 break; 1321 } 1322} 1323 1324/* ===== Functions to interface to the newer kernels ================== */ 1325 1326/* 1327 * Try to open a packet socket using the new kernel interface. 1328 * Returns 0 on failure. 1329 * FIXME: 0 uses to mean success (Sebastian) 1330 */ 1331static int 1332live_open_new(pcap_t *handle, const char *device, int promisc, 1333 int to_ms, char *ebuf) 1334{ 1335#ifdef HAVE_PF_PACKET_SOCKETS 1336 int sock_fd = -1, arptype; 1337 int err; 1338 int fatal_err = 0; 1339 struct packet_mreq mr; 1340 1341 /* One shot loop used for error handling - bail out with break */ 1342 1343 do { 1344 /* 1345 * Open a socket with protocol family packet. If a device is 1346 * given we try to open it in raw mode otherwise we use 1347 * the cooked interface. 1348 */ 1349 sock_fd = device ? 1350 socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL)) 1351 : socket(PF_PACKET, SOCK_DGRAM, htons(ETH_P_ALL)); 1352 1353 if (sock_fd == -1) { 1354 snprintf(ebuf, PCAP_ERRBUF_SIZE, "socket: %s", 1355 pcap_strerror(errno) ); 1356 break; 1357 } 1358 1359 /* It seems the kernel supports the new interface. */ 1360 handle->md.sock_packet = 0; 1361 1362 /* 1363 * Get the interface index of the loopback device. 1364 * If the attempt fails, don't fail, just set the 1365 * "md.lo_ifindex" to -1. 1366 * 1367 * XXX - can there be more than one device that loops 1368 * packets back, i.e. devices other than "lo"? If so, 1369 * we'd need to find them all, and have an array of 1370 * indices for them, and check all of them in 1371 * "pcap_read_packet()". 1372 */ 1373 handle->md.lo_ifindex = iface_get_id(sock_fd, "lo", ebuf); 1374 1375 /* 1376 * Default value for offset to align link-layer payload 1377 * on a 4-byte boundary. 1378 */ 1379 handle->offset = 0; 1380 1381 /* 1382 * What kind of frames do we have to deal with? Fall back 1383 * to cooked mode if we have an unknown interface type. 1384 */ 1385 1386 if (device) { 1387 /* Assume for now we don't need cooked mode. */ 1388 handle->md.cooked = 0; 1389 1390 arptype = iface_get_arptype(sock_fd, device, ebuf); 1391 if (arptype == -1) { 1392 fatal_err = 1; 1393 break; 1394 } 1395 map_arphrd_to_dlt(handle, arptype, 1); 1396 if (handle->linktype == -1 || 1397 handle->linktype == DLT_LINUX_SLL || 1398 handle->linktype == DLT_LINUX_IRDA ||
| 1374 default: 1375 handle->linktype = -1; 1376 break; 1377 } 1378} 1379 1380/* ===== Functions to interface to the newer kernels ================== */ 1381 1382/* 1383 * Try to open a packet socket using the new kernel interface. 1384 * Returns 0 on failure. 1385 * FIXME: 0 uses to mean success (Sebastian) 1386 */ 1387static int 1388live_open_new(pcap_t *handle, const char *device, int promisc, 1389 int to_ms, char *ebuf) 1390{ 1391#ifdef HAVE_PF_PACKET_SOCKETS 1392 int sock_fd = -1, arptype; 1393 int err; 1394 int fatal_err = 0; 1395 struct packet_mreq mr; 1396 1397 /* One shot loop used for error handling - bail out with break */ 1398 1399 do { 1400 /* 1401 * Open a socket with protocol family packet. If a device is 1402 * given we try to open it in raw mode otherwise we use 1403 * the cooked interface. 1404 */ 1405 sock_fd = device ? 1406 socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL)) 1407 : socket(PF_PACKET, SOCK_DGRAM, htons(ETH_P_ALL)); 1408 1409 if (sock_fd == -1) { 1410 snprintf(ebuf, PCAP_ERRBUF_SIZE, "socket: %s", 1411 pcap_strerror(errno) ); 1412 break; 1413 } 1414 1415 /* It seems the kernel supports the new interface. */ 1416 handle->md.sock_packet = 0; 1417 1418 /* 1419 * Get the interface index of the loopback device. 1420 * If the attempt fails, don't fail, just set the 1421 * "md.lo_ifindex" to -1. 1422 * 1423 * XXX - can there be more than one device that loops 1424 * packets back, i.e. devices other than "lo"? If so, 1425 * we'd need to find them all, and have an array of 1426 * indices for them, and check all of them in 1427 * "pcap_read_packet()". 1428 */ 1429 handle->md.lo_ifindex = iface_get_id(sock_fd, "lo", ebuf); 1430 1431 /* 1432 * Default value for offset to align link-layer payload 1433 * on a 4-byte boundary. 1434 */ 1435 handle->offset = 0; 1436 1437 /* 1438 * What kind of frames do we have to deal with? Fall back 1439 * to cooked mode if we have an unknown interface type. 1440 */ 1441 1442 if (device) { 1443 /* Assume for now we don't need cooked mode. */ 1444 handle->md.cooked = 0; 1445 1446 arptype = iface_get_arptype(sock_fd, device, ebuf); 1447 if (arptype == -1) { 1448 fatal_err = 1; 1449 break; 1450 } 1451 map_arphrd_to_dlt(handle, arptype, 1); 1452 if (handle->linktype == -1 || 1453 handle->linktype == DLT_LINUX_SLL || 1454 handle->linktype == DLT_LINUX_IRDA ||
|
| 1455 handle->linktype == DLT_LINUX_LAPD ||
|
1399 (handle->linktype == DLT_EN10MB && 1400 (strncmp("isdn", device, 4) == 0 || 1401 strncmp("isdY", device, 4) == 0))) { 1402 /* 1403 * Unknown interface type (-1), or a 1404 * device we explicitly chose to run 1405 * in cooked mode (e.g., PPP devices), 1406 * or an ISDN device (whose link-layer 1407 * type we can only determine by using 1408 * APIs that may be different on different 1409 * kernels) - reopen in cooked mode. 1410 */ 1411 if (close(sock_fd) == -1) { 1412 snprintf(ebuf, PCAP_ERRBUF_SIZE, 1413 "close: %s", pcap_strerror(errno)); 1414 break; 1415 } 1416 sock_fd = socket(PF_PACKET, SOCK_DGRAM, 1417 htons(ETH_P_ALL)); 1418 if (sock_fd == -1) { 1419 snprintf(ebuf, PCAP_ERRBUF_SIZE, 1420 "socket: %s", pcap_strerror(errno)); 1421 break; 1422 } 1423 handle->md.cooked = 1; 1424 1425 /* 1426 * Get rid of any link-layer type list 1427 * we allocated - this only supports cooked 1428 * capture. 1429 */ 1430 if (handle->dlt_list != NULL) { 1431 free(handle->dlt_list); 1432 handle->dlt_list = NULL; 1433 handle->dlt_count = 0; 1434 } 1435 1436 if (handle->linktype == -1) { 1437 /* 1438 * Warn that we're falling back on 1439 * cooked mode; we may want to 1440 * update "map_arphrd_to_dlt()" 1441 * to handle the new type. 1442 */ 1443 snprintf(ebuf, PCAP_ERRBUF_SIZE, 1444 "arptype %d not " 1445 "supported by libpcap - " 1446 "falling back to cooked " 1447 "socket", 1448 arptype); 1449 } 1450 /* IrDA capture is not a real "cooked" capture, 1451 * it's IrLAP frames, not IP packets. */
| 1456 (handle->linktype == DLT_EN10MB && 1457 (strncmp("isdn", device, 4) == 0 || 1458 strncmp("isdY", device, 4) == 0))) { 1459 /* 1460 * Unknown interface type (-1), or a 1461 * device we explicitly chose to run 1462 * in cooked mode (e.g., PPP devices), 1463 * or an ISDN device (whose link-layer 1464 * type we can only determine by using 1465 * APIs that may be different on different 1466 * kernels) - reopen in cooked mode. 1467 */ 1468 if (close(sock_fd) == -1) { 1469 snprintf(ebuf, PCAP_ERRBUF_SIZE, 1470 "close: %s", pcap_strerror(errno)); 1471 break; 1472 } 1473 sock_fd = socket(PF_PACKET, SOCK_DGRAM, 1474 htons(ETH_P_ALL)); 1475 if (sock_fd == -1) { 1476 snprintf(ebuf, PCAP_ERRBUF_SIZE, 1477 "socket: %s", pcap_strerror(errno)); 1478 break; 1479 } 1480 handle->md.cooked = 1; 1481 1482 /* 1483 * Get rid of any link-layer type list 1484 * we allocated - this only supports cooked 1485 * capture. 1486 */ 1487 if (handle->dlt_list != NULL) { 1488 free(handle->dlt_list); 1489 handle->dlt_list = NULL; 1490 handle->dlt_count = 0; 1491 } 1492 1493 if (handle->linktype == -1) { 1494 /* 1495 * Warn that we're falling back on 1496 * cooked mode; we may want to 1497 * update "map_arphrd_to_dlt()" 1498 * to handle the new type. 1499 */ 1500 snprintf(ebuf, PCAP_ERRBUF_SIZE, 1501 "arptype %d not " 1502 "supported by libpcap - " 1503 "falling back to cooked " 1504 "socket", 1505 arptype); 1506 } 1507 /* IrDA capture is not a real "cooked" capture, 1508 * it's IrLAP frames, not IP packets. */
|
1452 if (handle->linktype != DLT_LINUX_IRDA)
| 1509 if (handle->linktype != DLT_LINUX_IRDA && 1510 handle->linktype != DLT_LINUX_LAPD)
|
1453 handle->linktype = DLT_LINUX_SLL; 1454 } 1455 1456 handle->md.ifindex = iface_get_id(sock_fd, device, ebuf); 1457 if (handle->md.ifindex == -1) 1458 break; 1459 1460 if ((err = iface_bind(sock_fd, handle->md.ifindex, 1461 ebuf)) < 0) { 1462 if (err == -2) 1463 fatal_err = 1; 1464 break; 1465 } 1466 } else { 1467 /* 1468 * This is cooked mode. 1469 */ 1470 handle->md.cooked = 1; 1471 handle->linktype = DLT_LINUX_SLL; 1472 1473 /* 1474 * We're not bound to a device. 1475 * XXX - true? Or true only if we're using 1476 * the "any" device? 1477 * For now, we're using this as an indication 1478 * that we can't transmit; stop doing that only 1479 * if we figure out how to transmit in cooked 1480 * mode. 1481 */ 1482 handle->md.ifindex = -1; 1483 } 1484 1485 /* 1486 * Select promiscuous mode on if "promisc" is set. 1487 * 1488 * Do not turn allmulti mode on if we don't select 1489 * promiscuous mode - on some devices (e.g., Orinoco 1490 * wireless interfaces), allmulti mode isn't supported 1491 * and the driver implements it by turning promiscuous 1492 * mode on, and that screws up the operation of the 1493 * card as a normal networking interface, and on no 1494 * other platform I know of does starting a non- 1495 * promiscuous capture affect which multicast packets 1496 * are received by the interface. 1497 */ 1498 1499 /* 1500 * Hmm, how can we set promiscuous mode on all interfaces? 1501 * I am not sure if that is possible at all. 1502 */ 1503 1504 if (device && promisc) { 1505 memset(&mr, 0, sizeof(mr)); 1506 mr.mr_ifindex = handle->md.ifindex; 1507 mr.mr_type = PACKET_MR_PROMISC; 1508 if (setsockopt(sock_fd, SOL_PACKET, 1509 PACKET_ADD_MEMBERSHIP, &mr, sizeof(mr)) == -1) 1510 { 1511 snprintf(ebuf, PCAP_ERRBUF_SIZE, 1512 "setsockopt: %s", pcap_strerror(errno)); 1513 break; 1514 } 1515 } 1516 1517 /* Save the socket FD in the pcap structure */ 1518 1519 handle->fd = sock_fd; 1520 1521 return 1; 1522 1523 } while(0); 1524 1525 if (sock_fd != -1) 1526 close(sock_fd); 1527 1528 if (fatal_err) { 1529 /* 1530 * Get rid of any link-layer type list we allocated. 1531 */ 1532 if (handle->dlt_list != NULL) 1533 free(handle->dlt_list); 1534 return -2; 1535 } else 1536 return 0; 1537#else 1538 strncpy(ebuf, 1539 "New packet capturing interface not supported by build " 1540 "environment", PCAP_ERRBUF_SIZE); 1541 return 0; 1542#endif 1543} 1544 1545#ifdef HAVE_PF_PACKET_SOCKETS 1546/* 1547 * Return the index of the given device name. Fill ebuf and return 1548 * -1 on failure. 1549 */ 1550static int 1551iface_get_id(int fd, const char *device, char *ebuf) 1552{ 1553 struct ifreq ifr; 1554 1555 memset(&ifr, 0, sizeof(ifr)); 1556 strncpy(ifr.ifr_name, device, sizeof(ifr.ifr_name)); 1557 1558 if (ioctl(fd, SIOCGIFINDEX, &ifr) == -1) { 1559 snprintf(ebuf, PCAP_ERRBUF_SIZE,
| 1511 handle->linktype = DLT_LINUX_SLL; 1512 } 1513 1514 handle->md.ifindex = iface_get_id(sock_fd, device, ebuf); 1515 if (handle->md.ifindex == -1) 1516 break; 1517 1518 if ((err = iface_bind(sock_fd, handle->md.ifindex, 1519 ebuf)) < 0) { 1520 if (err == -2) 1521 fatal_err = 1; 1522 break; 1523 } 1524 } else { 1525 /* 1526 * This is cooked mode. 1527 */ 1528 handle->md.cooked = 1; 1529 handle->linktype = DLT_LINUX_SLL; 1530 1531 /* 1532 * We're not bound to a device. 1533 * XXX - true? Or true only if we're using 1534 * the "any" device? 1535 * For now, we're using this as an indication 1536 * that we can't transmit; stop doing that only 1537 * if we figure out how to transmit in cooked 1538 * mode. 1539 */ 1540 handle->md.ifindex = -1; 1541 } 1542 1543 /* 1544 * Select promiscuous mode on if "promisc" is set. 1545 * 1546 * Do not turn allmulti mode on if we don't select 1547 * promiscuous mode - on some devices (e.g., Orinoco 1548 * wireless interfaces), allmulti mode isn't supported 1549 * and the driver implements it by turning promiscuous 1550 * mode on, and that screws up the operation of the 1551 * card as a normal networking interface, and on no 1552 * other platform I know of does starting a non- 1553 * promiscuous capture affect which multicast packets 1554 * are received by the interface. 1555 */ 1556 1557 /* 1558 * Hmm, how can we set promiscuous mode on all interfaces? 1559 * I am not sure if that is possible at all. 1560 */ 1561 1562 if (device && promisc) { 1563 memset(&mr, 0, sizeof(mr)); 1564 mr.mr_ifindex = handle->md.ifindex; 1565 mr.mr_type = PACKET_MR_PROMISC; 1566 if (setsockopt(sock_fd, SOL_PACKET, 1567 PACKET_ADD_MEMBERSHIP, &mr, sizeof(mr)) == -1) 1568 { 1569 snprintf(ebuf, PCAP_ERRBUF_SIZE, 1570 "setsockopt: %s", pcap_strerror(errno)); 1571 break; 1572 } 1573 } 1574 1575 /* Save the socket FD in the pcap structure */ 1576 1577 handle->fd = sock_fd; 1578 1579 return 1; 1580 1581 } while(0); 1582 1583 if (sock_fd != -1) 1584 close(sock_fd); 1585 1586 if (fatal_err) { 1587 /* 1588 * Get rid of any link-layer type list we allocated. 1589 */ 1590 if (handle->dlt_list != NULL) 1591 free(handle->dlt_list); 1592 return -2; 1593 } else 1594 return 0; 1595#else 1596 strncpy(ebuf, 1597 "New packet capturing interface not supported by build " 1598 "environment", PCAP_ERRBUF_SIZE); 1599 return 0; 1600#endif 1601} 1602 1603#ifdef HAVE_PF_PACKET_SOCKETS 1604/* 1605 * Return the index of the given device name. Fill ebuf and return 1606 * -1 on failure. 1607 */ 1608static int 1609iface_get_id(int fd, const char *device, char *ebuf) 1610{ 1611 struct ifreq ifr; 1612 1613 memset(&ifr, 0, sizeof(ifr)); 1614 strncpy(ifr.ifr_name, device, sizeof(ifr.ifr_name)); 1615 1616 if (ioctl(fd, SIOCGIFINDEX, &ifr) == -1) { 1617 snprintf(ebuf, PCAP_ERRBUF_SIZE,
|
1560 "ioctl: %s", pcap_strerror(errno));
| 1618 "SIOCGIFINDEX: %s", pcap_strerror(errno));
|
1561 return -1; 1562 } 1563 1564 return ifr.ifr_ifindex; 1565} 1566 1567/* 1568 * Bind the socket associated with FD to the given device. 1569 */ 1570static int 1571iface_bind(int fd, int ifindex, char *ebuf) 1572{ 1573 struct sockaddr_ll sll; 1574 int err; 1575 socklen_t errlen = sizeof(err); 1576 1577 memset(&sll, 0, sizeof(sll)); 1578 sll.sll_family = AF_PACKET; 1579 sll.sll_ifindex = ifindex; 1580 sll.sll_protocol = htons(ETH_P_ALL); 1581 1582 if (bind(fd, (struct sockaddr *) &sll, sizeof(sll)) == -1) { 1583 snprintf(ebuf, PCAP_ERRBUF_SIZE, 1584 "bind: %s", pcap_strerror(errno)); 1585 return -1; 1586 } 1587 1588 /* Any pending errors, e.g., network is down? */ 1589 1590 if (getsockopt(fd, SOL_SOCKET, SO_ERROR, &err, &errlen) == -1) { 1591 snprintf(ebuf, PCAP_ERRBUF_SIZE, 1592 "getsockopt: %s", pcap_strerror(errno)); 1593 return -2; 1594 } 1595 1596 if (err > 0) { 1597 snprintf(ebuf, PCAP_ERRBUF_SIZE, 1598 "bind: %s", pcap_strerror(err)); 1599 return -2; 1600 } 1601 1602 return 0; 1603} 1604 1605#endif 1606 1607 1608/* ===== Functions to interface to the older kernels ================== */ 1609 1610/* 1611 * With older kernels promiscuous mode is kind of interesting because we 1612 * have to reset the interface before exiting. The problem can't really 1613 * be solved without some daemon taking care of managing usage counts. 1614 * If we put the interface into promiscuous mode, we set a flag indicating 1615 * that we must take it out of that mode when the interface is closed, 1616 * and, when closing the interface, if that flag is set we take it out 1617 * of promiscuous mode. 1618 */ 1619 1620/* 1621 * List of pcaps for which we turned promiscuous mode on by hand. 1622 * If there are any such pcaps, we arrange to call "pcap_close_all()" 1623 * when we exit, and have it close all of them to turn promiscuous mode 1624 * off. 1625 */ 1626static struct pcap *pcaps_to_close; 1627 1628/* 1629 * TRUE if we've already called "atexit()" to cause "pcap_close_all()" to 1630 * be called on exit. 1631 */ 1632static int did_atexit; 1633 1634static void pcap_close_all(void) 1635{ 1636 struct pcap *handle; 1637 1638 while ((handle = pcaps_to_close) != NULL) 1639 pcap_close(handle); 1640} 1641 1642static void pcap_close_linux( pcap_t *handle ) 1643{ 1644 struct pcap *p, *prevp; 1645 struct ifreq ifr; 1646 1647 if (handle->md.clear_promisc) { 1648 /* 1649 * We put the interface into promiscuous mode; take 1650 * it out of promiscuous mode. 1651 * 1652 * XXX - if somebody else wants it in promiscuous mode, 1653 * this code cannot know that, so it'll take it out 1654 * of promiscuous mode. That's not fixable in 2.0[.x] 1655 * kernels. 1656 */ 1657 memset(&ifr, 0, sizeof(ifr)); 1658 strncpy(ifr.ifr_name, handle->md.device, sizeof(ifr.ifr_name)); 1659 if (ioctl(handle->fd, SIOCGIFFLAGS, &ifr) == -1) { 1660 fprintf(stderr, 1661 "Can't restore interface flags (SIOCGIFFLAGS failed: %s).\n" 1662 "Please adjust manually.\n" 1663 "Hint: This can't happen with Linux >= 2.2.0.\n", 1664 strerror(errno)); 1665 } else { 1666 if (ifr.ifr_flags & IFF_PROMISC) { 1667 /* 1668 * Promiscuous mode is currently on; turn it 1669 * off. 1670 */ 1671 ifr.ifr_flags &= ~IFF_PROMISC; 1672 if (ioctl(handle->fd, SIOCSIFFLAGS, &ifr) == -1) { 1673 fprintf(stderr, 1674 "Can't restore interface flags (SIOCSIFFLAGS failed: %s).\n" 1675 "Please adjust manually.\n" 1676 "Hint: This can't happen with Linux >= 2.2.0.\n", 1677 strerror(errno)); 1678 } 1679 } 1680 } 1681 1682 /* 1683 * Take this pcap out of the list of pcaps for which we 1684 * have to take the interface out of promiscuous mode. 1685 */ 1686 for (p = pcaps_to_close, prevp = NULL; p != NULL; 1687 prevp = p, p = p->md.next) { 1688 if (p == handle) { 1689 /* 1690 * Found it. Remove it from the list. 1691 */ 1692 if (prevp == NULL) { 1693 /* 1694 * It was at the head of the list. 1695 */ 1696 pcaps_to_close = p->md.next; 1697 } else { 1698 /* 1699 * It was in the middle of the list. 1700 */ 1701 prevp->md.next = p->md.next; 1702 } 1703 break; 1704 } 1705 } 1706 } 1707 1708 if (handle->md.device != NULL) 1709 free(handle->md.device); 1710 handle->md.device = NULL; 1711 pcap_close_common(handle); 1712} 1713 1714/* 1715 * Try to open a packet socket using the old kernel interface. 1716 * Returns 0 on failure. 1717 * FIXME: 0 uses to mean success (Sebastian) 1718 */ 1719static int 1720live_open_old(pcap_t *handle, const char *device, int promisc, 1721 int to_ms, char *ebuf) 1722{ 1723 int arptype; 1724 struct ifreq ifr; 1725 1726 do { 1727 /* Open the socket */ 1728 1729 handle->fd = socket(PF_INET, SOCK_PACKET, htons(ETH_P_ALL)); 1730 if (handle->fd == -1) { 1731 snprintf(ebuf, PCAP_ERRBUF_SIZE, 1732 "socket: %s", pcap_strerror(errno)); 1733 break; 1734 } 1735 1736 /* It worked - we are using the old interface */ 1737 handle->md.sock_packet = 1; 1738 1739 /* ...which means we get the link-layer header. */ 1740 handle->md.cooked = 0; 1741 1742 /* Bind to the given device */ 1743 1744 if (!device) { 1745 strncpy(ebuf, "pcap_open_live: The \"any\" device isn't supported on 2.0[.x]-kernel systems", 1746 PCAP_ERRBUF_SIZE); 1747 break; 1748 } 1749 if (iface_bind_old(handle->fd, device, ebuf) == -1) 1750 break; 1751 1752 /* 1753 * Try to get the link-layer type. 1754 */ 1755 arptype = iface_get_arptype(handle->fd, device, ebuf); 1756 if (arptype == -1) 1757 break; 1758 1759 /* 1760 * Try to find the DLT_ type corresponding to that 1761 * link-layer type. 1762 */ 1763 map_arphrd_to_dlt(handle, arptype, 0); 1764 if (handle->linktype == -1) { 1765 snprintf(ebuf, PCAP_ERRBUF_SIZE, 1766 "unknown arptype %d", arptype); 1767 break; 1768 } 1769 1770 /* Go to promisc mode if requested */ 1771 1772 if (promisc) { 1773 memset(&ifr, 0, sizeof(ifr)); 1774 strncpy(ifr.ifr_name, device, sizeof(ifr.ifr_name)); 1775 if (ioctl(handle->fd, SIOCGIFFLAGS, &ifr) == -1) { 1776 snprintf(ebuf, PCAP_ERRBUF_SIZE,
| 1619 return -1; 1620 } 1621 1622 return ifr.ifr_ifindex; 1623} 1624 1625/* 1626 * Bind the socket associated with FD to the given device. 1627 */ 1628static int 1629iface_bind(int fd, int ifindex, char *ebuf) 1630{ 1631 struct sockaddr_ll sll; 1632 int err; 1633 socklen_t errlen = sizeof(err); 1634 1635 memset(&sll, 0, sizeof(sll)); 1636 sll.sll_family = AF_PACKET; 1637 sll.sll_ifindex = ifindex; 1638 sll.sll_protocol = htons(ETH_P_ALL); 1639 1640 if (bind(fd, (struct sockaddr *) &sll, sizeof(sll)) == -1) { 1641 snprintf(ebuf, PCAP_ERRBUF_SIZE, 1642 "bind: %s", pcap_strerror(errno)); 1643 return -1; 1644 } 1645 1646 /* Any pending errors, e.g., network is down? */ 1647 1648 if (getsockopt(fd, SOL_SOCKET, SO_ERROR, &err, &errlen) == -1) { 1649 snprintf(ebuf, PCAP_ERRBUF_SIZE, 1650 "getsockopt: %s", pcap_strerror(errno)); 1651 return -2; 1652 } 1653 1654 if (err > 0) { 1655 snprintf(ebuf, PCAP_ERRBUF_SIZE, 1656 "bind: %s", pcap_strerror(err)); 1657 return -2; 1658 } 1659 1660 return 0; 1661} 1662 1663#endif 1664 1665 1666/* ===== Functions to interface to the older kernels ================== */ 1667 1668/* 1669 * With older kernels promiscuous mode is kind of interesting because we 1670 * have to reset the interface before exiting. The problem can't really 1671 * be solved without some daemon taking care of managing usage counts. 1672 * If we put the interface into promiscuous mode, we set a flag indicating 1673 * that we must take it out of that mode when the interface is closed, 1674 * and, when closing the interface, if that flag is set we take it out 1675 * of promiscuous mode. 1676 */ 1677 1678/* 1679 * List of pcaps for which we turned promiscuous mode on by hand. 1680 * If there are any such pcaps, we arrange to call "pcap_close_all()" 1681 * when we exit, and have it close all of them to turn promiscuous mode 1682 * off. 1683 */ 1684static struct pcap *pcaps_to_close; 1685 1686/* 1687 * TRUE if we've already called "atexit()" to cause "pcap_close_all()" to 1688 * be called on exit. 1689 */ 1690static int did_atexit; 1691 1692static void pcap_close_all(void) 1693{ 1694 struct pcap *handle; 1695 1696 while ((handle = pcaps_to_close) != NULL) 1697 pcap_close(handle); 1698} 1699 1700static void pcap_close_linux( pcap_t *handle ) 1701{ 1702 struct pcap *p, *prevp; 1703 struct ifreq ifr; 1704 1705 if (handle->md.clear_promisc) { 1706 /* 1707 * We put the interface into promiscuous mode; take 1708 * it out of promiscuous mode. 1709 * 1710 * XXX - if somebody else wants it in promiscuous mode, 1711 * this code cannot know that, so it'll take it out 1712 * of promiscuous mode. That's not fixable in 2.0[.x] 1713 * kernels. 1714 */ 1715 memset(&ifr, 0, sizeof(ifr)); 1716 strncpy(ifr.ifr_name, handle->md.device, sizeof(ifr.ifr_name)); 1717 if (ioctl(handle->fd, SIOCGIFFLAGS, &ifr) == -1) { 1718 fprintf(stderr, 1719 "Can't restore interface flags (SIOCGIFFLAGS failed: %s).\n" 1720 "Please adjust manually.\n" 1721 "Hint: This can't happen with Linux >= 2.2.0.\n", 1722 strerror(errno)); 1723 } else { 1724 if (ifr.ifr_flags & IFF_PROMISC) { 1725 /* 1726 * Promiscuous mode is currently on; turn it 1727 * off. 1728 */ 1729 ifr.ifr_flags &= ~IFF_PROMISC; 1730 if (ioctl(handle->fd, SIOCSIFFLAGS, &ifr) == -1) { 1731 fprintf(stderr, 1732 "Can't restore interface flags (SIOCSIFFLAGS failed: %s).\n" 1733 "Please adjust manually.\n" 1734 "Hint: This can't happen with Linux >= 2.2.0.\n", 1735 strerror(errno)); 1736 } 1737 } 1738 } 1739 1740 /* 1741 * Take this pcap out of the list of pcaps for which we 1742 * have to take the interface out of promiscuous mode. 1743 */ 1744 for (p = pcaps_to_close, prevp = NULL; p != NULL; 1745 prevp = p, p = p->md.next) { 1746 if (p == handle) { 1747 /* 1748 * Found it. Remove it from the list. 1749 */ 1750 if (prevp == NULL) { 1751 /* 1752 * It was at the head of the list. 1753 */ 1754 pcaps_to_close = p->md.next; 1755 } else { 1756 /* 1757 * It was in the middle of the list. 1758 */ 1759 prevp->md.next = p->md.next; 1760 } 1761 break; 1762 } 1763 } 1764 } 1765 1766 if (handle->md.device != NULL) 1767 free(handle->md.device); 1768 handle->md.device = NULL; 1769 pcap_close_common(handle); 1770} 1771 1772/* 1773 * Try to open a packet socket using the old kernel interface. 1774 * Returns 0 on failure. 1775 * FIXME: 0 uses to mean success (Sebastian) 1776 */ 1777static int 1778live_open_old(pcap_t *handle, const char *device, int promisc, 1779 int to_ms, char *ebuf) 1780{ 1781 int arptype; 1782 struct ifreq ifr; 1783 1784 do { 1785 /* Open the socket */ 1786 1787 handle->fd = socket(PF_INET, SOCK_PACKET, htons(ETH_P_ALL)); 1788 if (handle->fd == -1) { 1789 snprintf(ebuf, PCAP_ERRBUF_SIZE, 1790 "socket: %s", pcap_strerror(errno)); 1791 break; 1792 } 1793 1794 /* It worked - we are using the old interface */ 1795 handle->md.sock_packet = 1; 1796 1797 /* ...which means we get the link-layer header. */ 1798 handle->md.cooked = 0; 1799 1800 /* Bind to the given device */ 1801 1802 if (!device) { 1803 strncpy(ebuf, "pcap_open_live: The \"any\" device isn't supported on 2.0[.x]-kernel systems", 1804 PCAP_ERRBUF_SIZE); 1805 break; 1806 } 1807 if (iface_bind_old(handle->fd, device, ebuf) == -1) 1808 break; 1809 1810 /* 1811 * Try to get the link-layer type. 1812 */ 1813 arptype = iface_get_arptype(handle->fd, device, ebuf); 1814 if (arptype == -1) 1815 break; 1816 1817 /* 1818 * Try to find the DLT_ type corresponding to that 1819 * link-layer type. 1820 */ 1821 map_arphrd_to_dlt(handle, arptype, 0); 1822 if (handle->linktype == -1) { 1823 snprintf(ebuf, PCAP_ERRBUF_SIZE, 1824 "unknown arptype %d", arptype); 1825 break; 1826 } 1827 1828 /* Go to promisc mode if requested */ 1829 1830 if (promisc) { 1831 memset(&ifr, 0, sizeof(ifr)); 1832 strncpy(ifr.ifr_name, device, sizeof(ifr.ifr_name)); 1833 if (ioctl(handle->fd, SIOCGIFFLAGS, &ifr) == -1) { 1834 snprintf(ebuf, PCAP_ERRBUF_SIZE,
|
1777 "ioctl: %s", pcap_strerror(errno));
| 1835 "SIOCGIFFLAGS: %s", pcap_strerror(errno));
|
1778 break; 1779 } 1780 if ((ifr.ifr_flags & IFF_PROMISC) == 0) { 1781 /* 1782 * Promiscuous mode isn't currently on, 1783 * so turn it on, and remember that 1784 * we should turn it off when the 1785 * pcap_t is closed. 1786 */ 1787 1788 /* 1789 * If we haven't already done so, arrange 1790 * to have "pcap_close_all()" called when 1791 * we exit. 1792 */ 1793 if (!did_atexit) { 1794 if (atexit(pcap_close_all) == -1) { 1795 /* 1796 * "atexit()" failed; don't 1797 * put the interface in 1798 * promiscuous mode, just 1799 * give up. 1800 */ 1801 strncpy(ebuf, "atexit failed", 1802 PCAP_ERRBUF_SIZE); 1803 break; 1804 } 1805 did_atexit = 1; 1806 } 1807 1808 ifr.ifr_flags |= IFF_PROMISC; 1809 if (ioctl(handle->fd, SIOCSIFFLAGS, &ifr) == -1) { 1810 snprintf(ebuf, PCAP_ERRBUF_SIZE,
| 1836 break; 1837 } 1838 if ((ifr.ifr_flags & IFF_PROMISC) == 0) { 1839 /* 1840 * Promiscuous mode isn't currently on, 1841 * so turn it on, and remember that 1842 * we should turn it off when the 1843 * pcap_t is closed. 1844 */ 1845 1846 /* 1847 * If we haven't already done so, arrange 1848 * to have "pcap_close_all()" called when 1849 * we exit. 1850 */ 1851 if (!did_atexit) { 1852 if (atexit(pcap_close_all) == -1) { 1853 /* 1854 * "atexit()" failed; don't 1855 * put the interface in 1856 * promiscuous mode, just 1857 * give up. 1858 */ 1859 strncpy(ebuf, "atexit failed", 1860 PCAP_ERRBUF_SIZE); 1861 break; 1862 } 1863 did_atexit = 1; 1864 } 1865 1866 ifr.ifr_flags |= IFF_PROMISC; 1867 if (ioctl(handle->fd, SIOCSIFFLAGS, &ifr) == -1) { 1868 snprintf(ebuf, PCAP_ERRBUF_SIZE,
|
1811 "ioctl: %s",
| 1869 "SIOCSIFFLAGS: %s",
|
1812 pcap_strerror(errno)); 1813 break; 1814 } 1815 handle->md.clear_promisc = 1; 1816 1817 /* 1818 * Add this to the list of pcaps 1819 * to close when we exit. 1820 */ 1821 handle->md.next = pcaps_to_close; 1822 pcaps_to_close = handle; 1823 } 1824 } 1825 1826 /* 1827 * Default value for offset to align link-layer payload 1828 * on a 4-byte boundary. 1829 */ 1830 handle->offset = 0; 1831 1832 return 1; 1833 1834 } while (0); 1835 1836 pcap_close_linux(handle); 1837 return 0; 1838} 1839 1840/* 1841 * Bind the socket associated with FD to the given device using the 1842 * interface of the old kernels. 1843 */ 1844static int 1845iface_bind_old(int fd, const char *device, char *ebuf) 1846{ 1847 struct sockaddr saddr; 1848 int err; 1849 socklen_t errlen = sizeof(err); 1850 1851 memset(&saddr, 0, sizeof(saddr)); 1852 strncpy(saddr.sa_data, device, sizeof(saddr.sa_data)); 1853 if (bind(fd, &saddr, sizeof(saddr)) == -1) { 1854 snprintf(ebuf, PCAP_ERRBUF_SIZE, 1855 "bind: %s", pcap_strerror(errno)); 1856 return -1; 1857 } 1858 1859 /* Any pending errors, e.g., network is down? */ 1860 1861 if (getsockopt(fd, SOL_SOCKET, SO_ERROR, &err, &errlen) == -1) { 1862 snprintf(ebuf, PCAP_ERRBUF_SIZE, 1863 "getsockopt: %s", pcap_strerror(errno)); 1864 return -1; 1865 } 1866 1867 if (err > 0) { 1868 snprintf(ebuf, PCAP_ERRBUF_SIZE, 1869 "bind: %s", pcap_strerror(err)); 1870 return -1; 1871 } 1872 1873 return 0; 1874} 1875 1876 1877/* ===== System calls available on all supported kernels ============== */ 1878 1879/* 1880 * Query the kernel for the MTU of the given interface. 1881 */ 1882static int 1883iface_get_mtu(int fd, const char *device, char *ebuf) 1884{ 1885 struct ifreq ifr; 1886 1887 if (!device) 1888 return BIGGER_THAN_ALL_MTUS; 1889 1890 memset(&ifr, 0, sizeof(ifr)); 1891 strncpy(ifr.ifr_name, device, sizeof(ifr.ifr_name)); 1892 1893 if (ioctl(fd, SIOCGIFMTU, &ifr) == -1) { 1894 snprintf(ebuf, PCAP_ERRBUF_SIZE,
| 1870 pcap_strerror(errno)); 1871 break; 1872 } 1873 handle->md.clear_promisc = 1; 1874 1875 /* 1876 * Add this to the list of pcaps 1877 * to close when we exit. 1878 */ 1879 handle->md.next = pcaps_to_close; 1880 pcaps_to_close = handle; 1881 } 1882 } 1883 1884 /* 1885 * Default value for offset to align link-layer payload 1886 * on a 4-byte boundary. 1887 */ 1888 handle->offset = 0; 1889 1890 return 1; 1891 1892 } while (0); 1893 1894 pcap_close_linux(handle); 1895 return 0; 1896} 1897 1898/* 1899 * Bind the socket associated with FD to the given device using the 1900 * interface of the old kernels. 1901 */ 1902static int 1903iface_bind_old(int fd, const char *device, char *ebuf) 1904{ 1905 struct sockaddr saddr; 1906 int err; 1907 socklen_t errlen = sizeof(err); 1908 1909 memset(&saddr, 0, sizeof(saddr)); 1910 strncpy(saddr.sa_data, device, sizeof(saddr.sa_data)); 1911 if (bind(fd, &saddr, sizeof(saddr)) == -1) { 1912 snprintf(ebuf, PCAP_ERRBUF_SIZE, 1913 "bind: %s", pcap_strerror(errno)); 1914 return -1; 1915 } 1916 1917 /* Any pending errors, e.g., network is down? */ 1918 1919 if (getsockopt(fd, SOL_SOCKET, SO_ERROR, &err, &errlen) == -1) { 1920 snprintf(ebuf, PCAP_ERRBUF_SIZE, 1921 "getsockopt: %s", pcap_strerror(errno)); 1922 return -1; 1923 } 1924 1925 if (err > 0) { 1926 snprintf(ebuf, PCAP_ERRBUF_SIZE, 1927 "bind: %s", pcap_strerror(err)); 1928 return -1; 1929 } 1930 1931 return 0; 1932} 1933 1934 1935/* ===== System calls available on all supported kernels ============== */ 1936 1937/* 1938 * Query the kernel for the MTU of the given interface. 1939 */ 1940static int 1941iface_get_mtu(int fd, const char *device, char *ebuf) 1942{ 1943 struct ifreq ifr; 1944 1945 if (!device) 1946 return BIGGER_THAN_ALL_MTUS; 1947 1948 memset(&ifr, 0, sizeof(ifr)); 1949 strncpy(ifr.ifr_name, device, sizeof(ifr.ifr_name)); 1950 1951 if (ioctl(fd, SIOCGIFMTU, &ifr) == -1) { 1952 snprintf(ebuf, PCAP_ERRBUF_SIZE,
|
1895 "ioctl: %s", pcap_strerror(errno));
| 1953 "SIOCGIFMTU: %s", pcap_strerror(errno));
|
1896 return -1; 1897 } 1898 1899 return ifr.ifr_mtu; 1900} 1901 1902/* 1903 * Get the hardware type of the given interface as ARPHRD_xxx constant. 1904 */ 1905static int 1906iface_get_arptype(int fd, const char *device, char *ebuf) 1907{ 1908 struct ifreq ifr; 1909 1910 memset(&ifr, 0, sizeof(ifr)); 1911 strncpy(ifr.ifr_name, device, sizeof(ifr.ifr_name)); 1912 1913 if (ioctl(fd, SIOCGIFHWADDR, &ifr) == -1) { 1914 snprintf(ebuf, PCAP_ERRBUF_SIZE,
| 1954 return -1; 1955 } 1956 1957 return ifr.ifr_mtu; 1958} 1959 1960/* 1961 * Get the hardware type of the given interface as ARPHRD_xxx constant. 1962 */ 1963static int 1964iface_get_arptype(int fd, const char *device, char *ebuf) 1965{ 1966 struct ifreq ifr; 1967 1968 memset(&ifr, 0, sizeof(ifr)); 1969 strncpy(ifr.ifr_name, device, sizeof(ifr.ifr_name)); 1970 1971 if (ioctl(fd, SIOCGIFHWADDR, &ifr) == -1) { 1972 snprintf(ebuf, PCAP_ERRBUF_SIZE,
|
1915 "ioctl: %s", pcap_strerror(errno));
| 1973 "SIOCGIFHWADDR: %s", pcap_strerror(errno));
|
1916 return -1; 1917 } 1918 1919 return ifr.ifr_hwaddr.sa_family; 1920} 1921 1922#ifdef SO_ATTACH_FILTER 1923static int 1924fix_program(pcap_t *handle, struct sock_fprog *fcode) 1925{ 1926 size_t prog_size; 1927 register int i; 1928 register struct bpf_insn *p; 1929 struct bpf_insn *f; 1930 int len; 1931 1932 /* 1933 * Make a copy of the filter, and modify that copy if 1934 * necessary. 1935 */ 1936 prog_size = sizeof(*handle->fcode.bf_insns) * handle->fcode.bf_len; 1937 len = handle->fcode.bf_len; 1938 f = (struct bpf_insn *)malloc(prog_size); 1939 if (f == NULL) { 1940 snprintf(handle->errbuf, sizeof(handle->errbuf), 1941 "malloc: %s", pcap_strerror(errno)); 1942 return -1; 1943 } 1944 memcpy(f, handle->fcode.bf_insns, prog_size); 1945 fcode->len = len; 1946 fcode->filter = (struct sock_filter *) f; 1947 1948 for (i = 0; i < len; ++i) { 1949 p = &f[i]; 1950 /* 1951 * What type of instruction is this? 1952 */ 1953 switch (BPF_CLASS(p->code)) { 1954 1955 case BPF_RET: 1956 /* 1957 * It's a return instruction; is the snapshot 1958 * length a constant, rather than the contents 1959 * of the accumulator? 1960 */ 1961 if (BPF_MODE(p->code) == BPF_K) { 1962 /* 1963 * Yes - if the value to be returned, 1964 * i.e. the snapshot length, is anything 1965 * other than 0, make it 65535, so that 1966 * the packet is truncated by "recvfrom()", 1967 * not by the filter. 1968 * 1969 * XXX - there's nothing we can easily do 1970 * if it's getting the value from the 1971 * accumulator; we'd have to insert 1972 * code to force non-zero values to be 1973 * 65535. 1974 */ 1975 if (p->k != 0) 1976 p->k = 65535; 1977 } 1978 break; 1979 1980 case BPF_LD: 1981 case BPF_LDX: 1982 /* 1983 * It's a load instruction; is it loading 1984 * from the packet? 1985 */ 1986 switch (BPF_MODE(p->code)) { 1987 1988 case BPF_ABS: 1989 case BPF_IND: 1990 case BPF_MSH: 1991 /* 1992 * Yes; are we in cooked mode? 1993 */ 1994 if (handle->md.cooked) { 1995 /* 1996 * Yes, so we need to fix this 1997 * instruction. 1998 */ 1999 if (fix_offset(p) < 0) { 2000 /* 2001 * We failed to do so. 2002 * Return 0, so our caller 2003 * knows to punt to userland. 2004 */ 2005 return 0; 2006 } 2007 } 2008 break; 2009 } 2010 break; 2011 } 2012 } 2013 return 1; /* we succeeded */ 2014} 2015 2016static int 2017fix_offset(struct bpf_insn *p) 2018{ 2019 /* 2020 * What's the offset? 2021 */ 2022 if (p->k >= SLL_HDR_LEN) { 2023 /* 2024 * It's within the link-layer payload; that starts at an 2025 * offset of 0, as far as the kernel packet filter is 2026 * concerned, so subtract the length of the link-layer 2027 * header. 2028 */ 2029 p->k -= SLL_HDR_LEN; 2030 } else if (p->k == 14) { 2031 /* 2032 * It's the protocol field; map it to the special magic 2033 * kernel offset for that field. 2034 */ 2035 p->k = SKF_AD_OFF + SKF_AD_PROTOCOL; 2036 } else { 2037 /* 2038 * It's within the header, but it's not one of those 2039 * fields; we can't do that in the kernel, so punt 2040 * to userland. 2041 */ 2042 return -1; 2043 } 2044 return 0; 2045} 2046 2047static int 2048set_kernel_filter(pcap_t *handle, struct sock_fprog *fcode) 2049{ 2050 int total_filter_on = 0; 2051 int save_mode; 2052 int ret; 2053 int save_errno; 2054 2055 /* 2056 * The socket filter code doesn't discard all packets queued 2057 * up on the socket when the filter is changed; this means 2058 * that packets that don't match the new filter may show up 2059 * after the new filter is put onto the socket, if those 2060 * packets haven't yet been read. 2061 * 2062 * This means, for example, that if you do a tcpdump capture 2063 * with a filter, the first few packets in the capture might 2064 * be packets that wouldn't have passed the filter. 2065 * 2066 * We therefore discard all packets queued up on the socket 2067 * when setting a kernel filter. (This isn't an issue for 2068 * userland filters, as the userland filtering is done after 2069 * packets are queued up.) 2070 * 2071 * To flush those packets, we put the socket in read-only mode, 2072 * and read packets from the socket until there are no more to 2073 * read. 2074 * 2075 * In order to keep that from being an infinite loop - i.e., 2076 * to keep more packets from arriving while we're draining 2077 * the queue - we put the "total filter", which is a filter 2078 * that rejects all packets, onto the socket before draining 2079 * the queue. 2080 * 2081 * This code deliberately ignores any errors, so that you may 2082 * get bogus packets if an error occurs, rather than having 2083 * the filtering done in userland even if it could have been 2084 * done in the kernel. 2085 */ 2086 if (setsockopt(handle->fd, SOL_SOCKET, SO_ATTACH_FILTER, 2087 &total_fcode, sizeof(total_fcode)) == 0) { 2088 char drain[1]; 2089 2090 /* 2091 * Note that we've put the total filter onto the socket. 2092 */ 2093 total_filter_on = 1; 2094 2095 /* 2096 * Save the socket's current mode, and put it in 2097 * non-blocking mode; we drain it by reading packets 2098 * until we get an error (which is normally a 2099 * "nothing more to be read" error). 2100 */ 2101 save_mode = fcntl(handle->fd, F_GETFL, 0); 2102 if (save_mode != -1 && 2103 fcntl(handle->fd, F_SETFL, save_mode | O_NONBLOCK) >= 0) { 2104 while (recv(handle->fd, &drain, sizeof drain, 2105 MSG_TRUNC) >= 0) 2106 ; 2107 save_errno = errno; 2108 fcntl(handle->fd, F_SETFL, save_mode); 2109 if (save_errno != EAGAIN) { 2110 /* Fatal error */ 2111 reset_kernel_filter(handle); 2112 snprintf(handle->errbuf, sizeof(handle->errbuf), 2113 "recv: %s", pcap_strerror(save_errno)); 2114 return -2; 2115 } 2116 } 2117 } 2118 2119 /* 2120 * Now attach the new filter. 2121 */ 2122 ret = setsockopt(handle->fd, SOL_SOCKET, SO_ATTACH_FILTER, 2123 fcode, sizeof(*fcode)); 2124 if (ret == -1 && total_filter_on) { 2125 /* 2126 * Well, we couldn't set that filter on the socket, 2127 * but we could set the total filter on the socket. 2128 * 2129 * This could, for example, mean that the filter was 2130 * too big to put into the kernel, so we'll have to 2131 * filter in userland; in any case, we'll be doing 2132 * filtering in userland, so we need to remove the 2133 * total filter so we see packets. 2134 */ 2135 save_errno = errno; 2136 2137 /* 2138 * XXX - if this fails, we're really screwed; 2139 * we have the total filter on the socket, 2140 * and it won't come off. What do we do then? 2141 */ 2142 reset_kernel_filter(handle); 2143 2144 errno = save_errno; 2145 } 2146 return ret; 2147} 2148 2149static int 2150reset_kernel_filter(pcap_t *handle) 2151{
| 1974 return -1; 1975 } 1976 1977 return ifr.ifr_hwaddr.sa_family; 1978} 1979 1980#ifdef SO_ATTACH_FILTER 1981static int 1982fix_program(pcap_t *handle, struct sock_fprog *fcode) 1983{ 1984 size_t prog_size; 1985 register int i; 1986 register struct bpf_insn *p; 1987 struct bpf_insn *f; 1988 int len; 1989 1990 /* 1991 * Make a copy of the filter, and modify that copy if 1992 * necessary. 1993 */ 1994 prog_size = sizeof(*handle->fcode.bf_insns) * handle->fcode.bf_len; 1995 len = handle->fcode.bf_len; 1996 f = (struct bpf_insn *)malloc(prog_size); 1997 if (f == NULL) { 1998 snprintf(handle->errbuf, sizeof(handle->errbuf), 1999 "malloc: %s", pcap_strerror(errno)); 2000 return -1; 2001 } 2002 memcpy(f, handle->fcode.bf_insns, prog_size); 2003 fcode->len = len; 2004 fcode->filter = (struct sock_filter *) f; 2005 2006 for (i = 0; i < len; ++i) { 2007 p = &f[i]; 2008 /* 2009 * What type of instruction is this? 2010 */ 2011 switch (BPF_CLASS(p->code)) { 2012 2013 case BPF_RET: 2014 /* 2015 * It's a return instruction; is the snapshot 2016 * length a constant, rather than the contents 2017 * of the accumulator? 2018 */ 2019 if (BPF_MODE(p->code) == BPF_K) { 2020 /* 2021 * Yes - if the value to be returned, 2022 * i.e. the snapshot length, is anything 2023 * other than 0, make it 65535, so that 2024 * the packet is truncated by "recvfrom()", 2025 * not by the filter. 2026 * 2027 * XXX - there's nothing we can easily do 2028 * if it's getting the value from the 2029 * accumulator; we'd have to insert 2030 * code to force non-zero values to be 2031 * 65535. 2032 */ 2033 if (p->k != 0) 2034 p->k = 65535; 2035 } 2036 break; 2037 2038 case BPF_LD: 2039 case BPF_LDX: 2040 /* 2041 * It's a load instruction; is it loading 2042 * from the packet? 2043 */ 2044 switch (BPF_MODE(p->code)) { 2045 2046 case BPF_ABS: 2047 case BPF_IND: 2048 case BPF_MSH: 2049 /* 2050 * Yes; are we in cooked mode? 2051 */ 2052 if (handle->md.cooked) { 2053 /* 2054 * Yes, so we need to fix this 2055 * instruction. 2056 */ 2057 if (fix_offset(p) < 0) { 2058 /* 2059 * We failed to do so. 2060 * Return 0, so our caller 2061 * knows to punt to userland. 2062 */ 2063 return 0; 2064 } 2065 } 2066 break; 2067 } 2068 break; 2069 } 2070 } 2071 return 1; /* we succeeded */ 2072} 2073 2074static int 2075fix_offset(struct bpf_insn *p) 2076{ 2077 /* 2078 * What's the offset? 2079 */ 2080 if (p->k >= SLL_HDR_LEN) { 2081 /* 2082 * It's within the link-layer payload; that starts at an 2083 * offset of 0, as far as the kernel packet filter is 2084 * concerned, so subtract the length of the link-layer 2085 * header. 2086 */ 2087 p->k -= SLL_HDR_LEN; 2088 } else if (p->k == 14) { 2089 /* 2090 * It's the protocol field; map it to the special magic 2091 * kernel offset for that field. 2092 */ 2093 p->k = SKF_AD_OFF + SKF_AD_PROTOCOL; 2094 } else { 2095 /* 2096 * It's within the header, but it's not one of those 2097 * fields; we can't do that in the kernel, so punt 2098 * to userland. 2099 */ 2100 return -1; 2101 } 2102 return 0; 2103} 2104 2105static int 2106set_kernel_filter(pcap_t *handle, struct sock_fprog *fcode) 2107{ 2108 int total_filter_on = 0; 2109 int save_mode; 2110 int ret; 2111 int save_errno; 2112 2113 /* 2114 * The socket filter code doesn't discard all packets queued 2115 * up on the socket when the filter is changed; this means 2116 * that packets that don't match the new filter may show up 2117 * after the new filter is put onto the socket, if those 2118 * packets haven't yet been read. 2119 * 2120 * This means, for example, that if you do a tcpdump capture 2121 * with a filter, the first few packets in the capture might 2122 * be packets that wouldn't have passed the filter. 2123 * 2124 * We therefore discard all packets queued up on the socket 2125 * when setting a kernel filter. (This isn't an issue for 2126 * userland filters, as the userland filtering is done after 2127 * packets are queued up.) 2128 * 2129 * To flush those packets, we put the socket in read-only mode, 2130 * and read packets from the socket until there are no more to 2131 * read. 2132 * 2133 * In order to keep that from being an infinite loop - i.e., 2134 * to keep more packets from arriving while we're draining 2135 * the queue - we put the "total filter", which is a filter 2136 * that rejects all packets, onto the socket before draining 2137 * the queue. 2138 * 2139 * This code deliberately ignores any errors, so that you may 2140 * get bogus packets if an error occurs, rather than having 2141 * the filtering done in userland even if it could have been 2142 * done in the kernel. 2143 */ 2144 if (setsockopt(handle->fd, SOL_SOCKET, SO_ATTACH_FILTER, 2145 &total_fcode, sizeof(total_fcode)) == 0) { 2146 char drain[1]; 2147 2148 /* 2149 * Note that we've put the total filter onto the socket. 2150 */ 2151 total_filter_on = 1; 2152 2153 /* 2154 * Save the socket's current mode, and put it in 2155 * non-blocking mode; we drain it by reading packets 2156 * until we get an error (which is normally a 2157 * "nothing more to be read" error). 2158 */ 2159 save_mode = fcntl(handle->fd, F_GETFL, 0); 2160 if (save_mode != -1 && 2161 fcntl(handle->fd, F_SETFL, save_mode | O_NONBLOCK) >= 0) { 2162 while (recv(handle->fd, &drain, sizeof drain, 2163 MSG_TRUNC) >= 0) 2164 ; 2165 save_errno = errno; 2166 fcntl(handle->fd, F_SETFL, save_mode); 2167 if (save_errno != EAGAIN) { 2168 /* Fatal error */ 2169 reset_kernel_filter(handle); 2170 snprintf(handle->errbuf, sizeof(handle->errbuf), 2171 "recv: %s", pcap_strerror(save_errno)); 2172 return -2; 2173 } 2174 } 2175 } 2176 2177 /* 2178 * Now attach the new filter. 2179 */ 2180 ret = setsockopt(handle->fd, SOL_SOCKET, SO_ATTACH_FILTER, 2181 fcode, sizeof(*fcode)); 2182 if (ret == -1 && total_filter_on) { 2183 /* 2184 * Well, we couldn't set that filter on the socket, 2185 * but we could set the total filter on the socket. 2186 * 2187 * This could, for example, mean that the filter was 2188 * too big to put into the kernel, so we'll have to 2189 * filter in userland; in any case, we'll be doing 2190 * filtering in userland, so we need to remove the 2191 * total filter so we see packets. 2192 */ 2193 save_errno = errno; 2194 2195 /* 2196 * XXX - if this fails, we're really screwed; 2197 * we have the total filter on the socket, 2198 * and it won't come off. What do we do then? 2199 */ 2200 reset_kernel_filter(handle); 2201 2202 errno = save_errno; 2203 } 2204 return ret; 2205} 2206 2207static int 2208reset_kernel_filter(pcap_t *handle) 2209{
|
2152 /* setsockopt() barfs unless it get a dummy parameter */ 2153 int dummy;
| 2210 /* 2211 * setsockopt() barfs unless it get a dummy parameter. 2212 * valgrind whines unless the value is initialized, 2213 * as it has no idea that setsockopt() ignores its 2214 * parameter. 2215 */ 2216 int dummy = 0;
|
2154 2155 return setsockopt(handle->fd, SOL_SOCKET, SO_DETACH_FILTER, 2156 &dummy, sizeof(dummy)); 2157} 2158#endif
| 2217 2218 return setsockopt(handle->fd, SOL_SOCKET, SO_DETACH_FILTER, 2219 &dummy, sizeof(dummy)); 2220} 2221#endif
|