1/* 2 * pcap-linux.c: Packet capture interface to the Linux kernel 3 * 4 * Copyright (c) 2000 Torsten Landschoff <torsten@debian.org> 5 * Sebastian Krahmer <krahmer@cs.uni-potsdam.de> 6 * 7 * License: BSD 8 * --- 13 unchanged lines hidden (view full) --- 22 * 23 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR 24 * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED 25 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 26 */ 27 28#ifndef lint 29static const char rcsid[] _U_ = |
30 "@(#) $Header: /tcpdump/master/libpcap/pcap-linux.c,v 1.110.2.14 2006/10/12 17:26:58 guy Exp $ (LBL)"; |
31#endif 32 33/* 34 * Known problems with 2.0[.x] kernels: 35 * 36 * - The loopback device gives every packet twice; on 2.2[.x] kernels, 37 * if we use PF_PACKET, we can filter out the transmitted version 38 * of the packet by using data in the "sockaddr_ll" returned by --- 350 unchanged lines hidden (view full) --- 389 * This is a 2.2[.x] or later kernel (we know that 390 * either because we're not using a SOCK_PACKET 391 * socket - PF_PACKET is supported only in 2.2 392 * and later kernels - or because we checked the 393 * kernel version). 394 * 395 * We can safely pass "recvfrom()" a byte count 396 * based on the snapshot length. |
397 * 398 * If we're in cooked mode, make the snapshot length 399 * large enough to hold a "cooked mode" header plus 400 * 1 byte of packet data (so we don't pass a byte 401 * count of 0 to "recvfrom()"). |
402 */ |
403 if (handle->md.cooked) { 404 if (handle->snapshot < SLL_HDR_LEN + 1) 405 handle->snapshot = SLL_HDR_LEN + 1; 406 } |
407 handle->bufsize = handle->snapshot; 408 } 409 410 /* Allocate the buffer */ 411 412 handle->buffer = malloc(handle->bufsize + handle->offset); 413 if (!handle->buffer) { 414 snprintf(ebuf, PCAP_ERRBUF_SIZE, --- 107 unchanged lines hidden (view full) --- 522 "recvfrom: %s", pcap_strerror(errno)); 523 return -1; 524 } 525 } 526 527#ifdef HAVE_PF_PACKET_SOCKETS 528 if (!handle->md.sock_packet) { 529 /* |
530 * Unfortunately, there is a window between socket() and 531 * bind() where the kernel may queue packets from any 532 * interface. If we're bound to a particular interface, 533 * discard packets not from that interface. 534 * 535 * (If socket filters are supported, we could do the 536 * same thing we do when changing the filter; however, 537 * that won't handle packet sockets without socket 538 * filter support, and it's a bit more complicated. 539 * It would save some instructions per packet, however.) 540 */ 541 if (handle->md.ifindex != -1 && 542 from.sll_ifindex != handle->md.ifindex) 543 return 0; 544 545 /* |
546 * Do checks based on packet direction. 547 * We can only do this if we're using PF_PACKET; the 548 * address returned for SOCK_PACKET is a "sockaddr_pkt" 549 * which lacks the relevant packet type information. 550 */ 551 if (from.sll_pkttype == PACKET_OUTGOING) { 552 /* 553 * Outgoing packet. --- 123 unchanged lines hidden (view full) --- 677 return 0; 678 } 679 } 680 681 /* Fill in our own header data */ 682 683 if (ioctl(handle->fd, SIOCGSTAMP, &pcap_header.ts) == -1) { 684 snprintf(handle->errbuf, sizeof(handle->errbuf), |
685 "SIOCGSTAMP: %s", pcap_strerror(errno)); |
686 return -1; 687 } 688 pcap_header.caplen = caplen; 689 pcap_header.len = packet_len; 690 691 /* 692 * Count the packet. 693 * --- 21 unchanged lines hidden (view full) --- 715 * might be running on a 2.2[.x] kernel without Alexey 716 * Kuznetzov's turbopacket patches, and thus the kernel 717 * might not be able to supply those statistics). We 718 * could, I guess, try, when opening the socket, to get 719 * the statistics, and if we can not increment the count 720 * here, but it's not clear that always incrementing 721 * the count is more expensive than always testing a flag 722 * in memory. |
723 * 724 * We keep the count in "md.packets_read", and use that for 725 * "ps_recv" if we can't get the statistics from the kernel. 726 * We do that because, if we *can* get the statistics from 727 * the kernel, we use "md.stat.ps_recv" and "md.stat.ps_drop" 728 * as running counts, as reading the statistics from the 729 * kernel resets the kernel statistics, and if we directly 730 * increment "md.stat.ps_recv" here, that means it will 731 * count packets *twice* on systems where we can get kernel 732 * statistics - once here, and once in pcap_stats_linux(). |
733 */ |
734 handle->md.packets_read++; |
735 736 /* Call the user supplied callback function */ 737 callback(userdata, &pcap_header, bp); 738 739 return 1; 740} 741 742static int --- 57 unchanged lines hidden (view full) --- 800 801#ifdef HAVE_TPACKET_STATS 802 /* 803 * Try to get the packet counts from the kernel. 804 */ 805 if (getsockopt(handle->fd, SOL_PACKET, PACKET_STATISTICS, 806 &kstats, &len) > -1) { 807 /* |
808 * On systems where the PACKET_STATISTICS "getsockopt()" 809 * argument is supported on PF_PACKET sockets: 810 * 811 * "ps_recv" counts only packets that *passed* the 812 * filter, not packets that didn't pass the filter. 813 * This includes packets later dropped because we 814 * ran out of buffer space. 815 * 816 * "ps_drop" counts packets dropped because we ran 817 * out of buffer space. It doesn't count packets 818 * dropped by the interface driver. It counts only 819 * packets that passed the filter. 820 * 821 * Both statistics include packets not yet read from 822 * the kernel by libpcap, and thus not yet seen by 823 * the application. 824 * |
825 * In "linux/net/packet/af_packet.c", at least in the 826 * 2.4.9 kernel, "tp_packets" is incremented for every 827 * packet that passes the packet filter *and* is 828 * successfully queued on the socket; "tp_drops" is 829 * incremented for every packet dropped because there's 830 * not enough free space in the socket buffer. 831 * 832 * When the statistics are returned for a PACKET_STATISTICS --- 13 unchanged lines hidden (view full) --- 846 * as the count of drops. 847 * 848 * Keep a running total because each call to 849 * getsockopt(handle->fd, SOL_PACKET, PACKET_STATISTICS, .... 850 * resets the counters to zero. 851 */ 852 handle->md.stat.ps_recv += kstats.tp_packets; 853 handle->md.stat.ps_drop += kstats.tp_drops; |
854 *stats = handle->md.stat; 855 return 0; |
856 } 857 else 858 { 859 /* 860 * If the error was EOPNOTSUPP, fall through, so that 861 * if you build the library on a system with 862 * "struct tpacket_stats" and run it on a system 863 * that doesn't, it works as it does if the library 864 * is built on a system without "struct tpacket_stats". 865 */ 866 if (errno != EOPNOTSUPP) { 867 snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, 868 "pcap_stats: %s", pcap_strerror(errno)); 869 return -1; 870 } 871 } 872#endif 873 /* 874 * On systems where the PACKET_STATISTICS "getsockopt()" argument |
875 * is not supported on PF_PACKET sockets: 876 * 877 * "ps_recv" counts only packets that *passed* the filter, 878 * not packets that didn't pass the filter. It does not 879 * count packets dropped because we ran out of buffer 880 * space. 881 * 882 * "ps_drop" is not supported. 883 * 884 * "ps_recv" doesn't include packets not yet read from 885 * the kernel by libpcap. |
886 * 887 * We maintain the count of packets processed by libpcap in 888 * "md.packets_read", for reasons described in the comment 889 * at the end of pcap_read_packet(). We have no idea how many 890 * packets were dropped. |
891 */ |
892 stats->ps_recv = handle->md.packets_read; 893 stats->ps_drop = 0; |
894 return 0; 895} 896 897/* 898 * Description string for the "any" device. 899 */ 900static const char any_descr[] = "Pseudo-device that captures on all interfaces"; 901 --- 55 unchanged lines hidden (view full) --- 957 if (handle->fcode.bf_len > USHRT_MAX) { 958 /* 959 * fcode.len is an unsigned short for current kernel. 960 * I have yet to see BPF-Code with that much 961 * instructions but still it is possible. So for the 962 * sake of correctness I added this check. 963 */ 964 fprintf(stderr, "Warning: Filter too complex for kernel\n"); |
965 fcode.len = 0; |
966 fcode.filter = NULL; 967 can_filter_in_kernel = 0; 968 } else 969#endif /* USHRT_MAX */ 970 { 971 /* 972 * Oh joy, the Linux kernel uses struct sock_fprog instead 973 * of struct bpf_program and of course the length field is --- 382 unchanged lines hidden (view full) --- 1356 case ARPHRD_IRDA: 1357 /* Don't expect IP packet out of this interfaces... */ 1358 handle->linktype = DLT_LINUX_IRDA; 1359 /* We need to save packet direction for IrDA decoding, 1360 * so let's use "Linux-cooked" mode. Jean II */ 1361 //handle->md.cooked = 1; 1362 break; 1363 |
1364 /* ARPHRD_LAPD is unofficial and randomly allocated, if reallocation 1365 * is needed, please report it to <daniele@orlandi.com> */ 1366#ifndef ARPHRD_LAPD 1367#define ARPHRD_LAPD 8445 1368#endif 1369 case ARPHRD_LAPD: 1370 /* Don't expect IP packet out of this interfaces... */ 1371 handle->linktype = DLT_LINUX_LAPD; 1372 break; 1373 |
1374 default: 1375 handle->linktype = -1; 1376 break; 1377 } 1378} 1379 1380/* ===== Functions to interface to the newer kernels ================== */ 1381 --- 65 unchanged lines hidden (view full) --- 1447 if (arptype == -1) { 1448 fatal_err = 1; 1449 break; 1450 } 1451 map_arphrd_to_dlt(handle, arptype, 1); 1452 if (handle->linktype == -1 || 1453 handle->linktype == DLT_LINUX_SLL || 1454 handle->linktype == DLT_LINUX_IRDA || |
1455 handle->linktype == DLT_LINUX_LAPD || |
1456 (handle->linktype == DLT_EN10MB && 1457 (strncmp("isdn", device, 4) == 0 || 1458 strncmp("isdY", device, 4) == 0))) { 1459 /* 1460 * Unknown interface type (-1), or a 1461 * device we explicitly chose to run 1462 * in cooked mode (e.g., PPP devices), 1463 * or an ISDN device (whose link-layer --- 37 unchanged lines hidden (view full) --- 1501 "arptype %d not " 1502 "supported by libpcap - " 1503 "falling back to cooked " 1504 "socket", 1505 arptype); 1506 } 1507 /* IrDA capture is not a real "cooked" capture, 1508 * it's IrLAP frames, not IP packets. */ |
1509 if (handle->linktype != DLT_LINUX_IRDA && 1510 handle->linktype != DLT_LINUX_LAPD) |
1511 handle->linktype = DLT_LINUX_SLL; 1512 } 1513 1514 handle->md.ifindex = iface_get_id(sock_fd, device, ebuf); 1515 if (handle->md.ifindex == -1) 1516 break; 1517 1518 if ((err = iface_bind(sock_fd, handle->md.ifindex, --- 91 unchanged lines hidden (view full) --- 1610{ 1611 struct ifreq ifr; 1612 1613 memset(&ifr, 0, sizeof(ifr)); 1614 strncpy(ifr.ifr_name, device, sizeof(ifr.ifr_name)); 1615 1616 if (ioctl(fd, SIOCGIFINDEX, &ifr) == -1) { 1617 snprintf(ebuf, PCAP_ERRBUF_SIZE, |
1618 "SIOCGIFINDEX: %s", pcap_strerror(errno)); |
1619 return -1; 1620 } 1621 1622 return ifr.ifr_ifindex; 1623} 1624 1625/* 1626 * Bind the socket associated with FD to the given device. --- 200 unchanged lines hidden (view full) --- 1827 1828 /* Go to promisc mode if requested */ 1829 1830 if (promisc) { 1831 memset(&ifr, 0, sizeof(ifr)); 1832 strncpy(ifr.ifr_name, device, sizeof(ifr.ifr_name)); 1833 if (ioctl(handle->fd, SIOCGIFFLAGS, &ifr) == -1) { 1834 snprintf(ebuf, PCAP_ERRBUF_SIZE, |
1835 "SIOCGIFFLAGS: %s", pcap_strerror(errno)); |
1836 break; 1837 } 1838 if ((ifr.ifr_flags & IFF_PROMISC) == 0) { 1839 /* 1840 * Promiscuous mode isn't currently on, 1841 * so turn it on, and remember that 1842 * we should turn it off when the 1843 * pcap_t is closed. --- 17 unchanged lines hidden (view full) --- 1861 break; 1862 } 1863 did_atexit = 1; 1864 } 1865 1866 ifr.ifr_flags |= IFF_PROMISC; 1867 if (ioctl(handle->fd, SIOCSIFFLAGS, &ifr) == -1) { 1868 snprintf(ebuf, PCAP_ERRBUF_SIZE, |
1869 "SIOCSIFFLAGS: %s", |
1870 pcap_strerror(errno)); 1871 break; 1872 } 1873 handle->md.clear_promisc = 1; 1874 1875 /* 1876 * Add this to the list of pcaps 1877 * to close when we exit. --- 67 unchanged lines hidden (view full) --- 1945 if (!device) 1946 return BIGGER_THAN_ALL_MTUS; 1947 1948 memset(&ifr, 0, sizeof(ifr)); 1949 strncpy(ifr.ifr_name, device, sizeof(ifr.ifr_name)); 1950 1951 if (ioctl(fd, SIOCGIFMTU, &ifr) == -1) { 1952 snprintf(ebuf, PCAP_ERRBUF_SIZE, |
1953 "SIOCGIFMTU: %s", pcap_strerror(errno)); |
1954 return -1; 1955 } 1956 1957 return ifr.ifr_mtu; 1958} 1959 1960/* 1961 * Get the hardware type of the given interface as ARPHRD_xxx constant. 1962 */ 1963static int 1964iface_get_arptype(int fd, const char *device, char *ebuf) 1965{ 1966 struct ifreq ifr; 1967 1968 memset(&ifr, 0, sizeof(ifr)); 1969 strncpy(ifr.ifr_name, device, sizeof(ifr.ifr_name)); 1970 1971 if (ioctl(fd, SIOCGIFHWADDR, &ifr) == -1) { 1972 snprintf(ebuf, PCAP_ERRBUF_SIZE, |
1973 "SIOCGIFHWADDR: %s", pcap_strerror(errno)); |
1974 return -1; 1975 } 1976 1977 return ifr.ifr_hwaddr.sa_family; 1978} 1979 1980#ifdef SO_ATTACH_FILTER 1981static int --- 220 unchanged lines hidden (view full) --- 2202 errno = save_errno; 2203 } 2204 return ret; 2205} 2206 2207static int 2208reset_kernel_filter(pcap_t *handle) 2209{ |
2210 /* 2211 * setsockopt() barfs unless it get a dummy parameter. 2212 * valgrind whines unless the value is initialized, 2213 * as it has no idea that setsockopt() ignores its 2214 * parameter. 2215 */ 2216 int dummy = 0; |
2217 2218 return setsockopt(handle->fd, SOL_SOCKET, SO_DETACH_FILTER, 2219 &dummy, sizeof(dummy)); 2220} 2221#endif |