pcap-bpf.c revision 172680
1/* 2 * Copyright (c) 1993, 1994, 1995, 1996, 1998 3 * The Regents of the University of California. All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that: (1) source code distributions 7 * retain the above copyright notice and this paragraph in its entirety, (2) 8 * distributions including binary code include the above copyright notice and 9 * this paragraph in its entirety in the documentation or other materials 10 * provided with the distribution, and (3) all advertising materials mentioning 11 * features or use of this software display the following acknowledgement: 12 * ``This product includes software developed by the University of California, 13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of 14 * the University nor the names of its contributors may be used to endorse 15 * or promote products derived from this software without specific prior 16 * written permission. 17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED 18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF 19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 20 * 21 * $FreeBSD: head/contrib/libpcap/pcap-bpf.c 172680 2007-10-16 02:07:55Z mlaier $ 22 */ 23#ifndef lint 24static const char rcsid[] _U_ = 25 "@(#) $Header: /tcpdump/master/libpcap/pcap-bpf.c,v 1.86.2.12 2007/06/15 17:57:27 guy Exp $ (LBL)"; 26#endif 27 28#ifdef HAVE_CONFIG_H 29#include "config.h" 30#endif 31 32#include <sys/param.h> /* optionally get BSD define */ 33#include <sys/time.h> 34#include <sys/timeb.h> 35#include <sys/socket.h> 36#include <sys/file.h> 37#include <sys/ioctl.h> 38#include <sys/utsname.h> 39 40#include <net/if.h> 41 42#ifdef _AIX 43 44/* 45 * Make "pcap.h" not include "pcap-bpf.h"; we are going to include the 46 * native OS version, as we need "struct bpf_config" from it. 47 */ 48#define PCAP_DONT_INCLUDE_PCAP_BPF_H 49 50#include <sys/types.h> 51 52/* 53 * Prevent bpf.h from redefining the DLT_ values to their 54 * IFT_ values, as we're going to return the standard libpcap 55 * values, not IBM's non-standard IFT_ values. 56 */ 57#undef _AIX 58#include <net/bpf.h> 59#define _AIX 60 61#include <net/if_types.h> /* for IFT_ values */ 62#include <sys/sysconfig.h> 63#include <sys/device.h> 64#include <sys/cfgodm.h> 65#include <cf.h> 66 67#ifdef __64BIT__ 68#define domakedev makedev64 69#define getmajor major64 70#define bpf_hdr bpf_hdr32 71#else /* __64BIT__ */ 72#define domakedev makedev 73#define getmajor major 74#endif /* __64BIT__ */ 75 76#define BPF_NAME "bpf" 77#define BPF_MINORS 4 78#define DRIVER_PATH "/usr/lib/drivers" 79#define BPF_NODE "/dev/bpf" 80static int bpfloadedflag = 0; 81static int odmlockid = 0; 82 83#else /* _AIX */ 84 85#include <net/bpf.h> 86 87#endif /* _AIX */ 88 89#include <ctype.h> 90#include <errno.h> 91#include <netdb.h> 92#include <stdio.h> 93#include <stdlib.h> 94#include <string.h> 95#include <unistd.h> 96 97#include "pcap-int.h" 98 99#ifdef HAVE_DAG_API 100#include "pcap-dag.h" 101#endif /* HAVE_DAG_API */ 102 103#ifdef HAVE_OS_PROTO_H 104#include "os-proto.h" 105#endif 106 107#include "gencode.h" /* for "no_optimize" */ 108 109static int pcap_setfilter_bpf(pcap_t *p, struct bpf_program *fp); 110static int pcap_setdirection_bpf(pcap_t *, pcap_direction_t); 111static int pcap_set_datalink_bpf(pcap_t *p, int dlt); 112 113static int 114pcap_stats_bpf(pcap_t *p, struct pcap_stat *ps) 115{ 116 struct bpf_stat s; 117 118 /* 119 * "ps_recv" counts packets handed to the filter, not packets 120 * that passed the filter. This includes packets later dropped 121 * because we ran out of buffer space. 122 * 123 * "ps_drop" counts packets dropped inside the BPF device 124 * because we ran out of buffer space. It doesn't count 125 * packets dropped by the interface driver. It counts 126 * only packets that passed the filter. 127 * 128 * Both statistics include packets not yet read from the kernel 129 * by libpcap, and thus not yet seen by the application. 130 */ 131 if (ioctl(p->fd, BIOCGSTATS, (caddr_t)&s) < 0) { 132 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "BIOCGSTATS: %s", 133 pcap_strerror(errno)); 134 return (-1); 135 } 136 137 ps->ps_recv = s.bs_recv; 138 ps->ps_drop = s.bs_drop; 139 return (0); 140} 141 142static int 143pcap_read_bpf(pcap_t *p, int cnt, pcap_handler callback, u_char *user) 144{ 145 int cc; 146 int n = 0; 147 register u_char *bp, *ep; 148 u_char *datap; 149 struct bpf_insn *fcode; 150#ifdef PCAP_FDDIPAD 151 register int pad; 152#endif 153 154 fcode = p->md.use_bpf ? NULL : p->fcode.bf_insns; 155 again: 156 /* 157 * Has "pcap_breakloop()" been called? 158 */ 159 if (p->break_loop) { 160 /* 161 * Yes - clear the flag that indicates that it 162 * has, and return -2 to indicate that we were 163 * told to break out of the loop. 164 */ 165 p->break_loop = 0; 166 return (-2); 167 } 168 cc = p->cc; 169 if (p->cc == 0) { 170 cc = read(p->fd, (char *)p->buffer, p->bufsize); 171 if (cc < 0) { 172 /* Don't choke when we get ptraced */ 173 switch (errno) { 174 175 case EINTR: 176 goto again; 177 178#ifdef _AIX 179 case EFAULT: 180 /* 181 * Sigh. More AIX wonderfulness. 182 * 183 * For some unknown reason the uiomove() 184 * operation in the bpf kernel extension 185 * used to copy the buffer into user 186 * space sometimes returns EFAULT. I have 187 * no idea why this is the case given that 188 * a kernel debugger shows the user buffer 189 * is correct. This problem appears to 190 * be mostly mitigated by the memset of 191 * the buffer before it is first used. 192 * Very strange.... Shaun Clowes 193 * 194 * In any case this means that we shouldn't 195 * treat EFAULT as a fatal error; as we 196 * don't have an API for returning 197 * a "some packets were dropped since 198 * the last packet you saw" indication, 199 * we just ignore EFAULT and keep reading. 200 */ 201 goto again; 202#endif 203 204 case EWOULDBLOCK: 205 return (0); 206#if defined(sun) && !defined(BSD) 207 /* 208 * Due to a SunOS bug, after 2^31 bytes, the kernel 209 * file offset overflows and read fails with EINVAL. 210 * The lseek() to 0 will fix things. 211 */ 212 case EINVAL: 213 if (lseek(p->fd, 0L, SEEK_CUR) + 214 p->bufsize < 0) { 215 (void)lseek(p->fd, 0L, SEEK_SET); 216 goto again; 217 } 218 /* fall through */ 219#endif 220 } 221 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "read: %s", 222 pcap_strerror(errno)); 223 return (-1); 224 } 225 bp = p->buffer; 226 } else 227 bp = p->bp; 228 229 /* 230 * Loop through each packet. 231 */ 232#define bhp ((struct bpf_hdr *)bp) 233 ep = bp + cc; 234#ifdef PCAP_FDDIPAD 235 pad = p->fddipad; 236#endif 237 while (bp < ep) { 238 register int caplen, hdrlen; 239 240 /* 241 * Has "pcap_breakloop()" been called? 242 * If so, return immediately - if we haven't read any 243 * packets, clear the flag and return -2 to indicate 244 * that we were told to break out of the loop, otherwise 245 * leave the flag set, so that the *next* call will break 246 * out of the loop without having read any packets, and 247 * return the number of packets we've processed so far. 248 */ 249 if (p->break_loop) { 250 if (n == 0) { 251 p->break_loop = 0; 252 return (-2); 253 } else { 254 p->bp = bp; 255 p->cc = ep - bp; 256 return (n); 257 } 258 } 259 260 caplen = bhp->bh_caplen; 261 hdrlen = bhp->bh_hdrlen; 262 datap = bp + hdrlen; 263 /* 264 * Short-circuit evaluation: if using BPF filter 265 * in kernel, no need to do it now. 266 * 267#ifdef PCAP_FDDIPAD 268 * Note: the filter code was generated assuming 269 * that p->fddipad was the amount of padding 270 * before the header, as that's what's required 271 * in the kernel, so we run the filter before 272 * skipping that padding. 273#endif 274 */ 275 if (fcode == NULL || 276 bpf_filter(fcode, datap, bhp->bh_datalen, caplen)) { 277 struct pcap_pkthdr pkthdr; 278 279 pkthdr.ts.tv_sec = bhp->bh_tstamp.tv_sec; 280#ifdef _AIX 281 /* 282 * AIX's BPF returns seconds/nanoseconds time 283 * stamps, not seconds/microseconds time stamps. 284 */ 285 pkthdr.ts.tv_usec = bhp->bh_tstamp.tv_usec/1000; 286#else 287 pkthdr.ts.tv_usec = bhp->bh_tstamp.tv_usec; 288#endif 289#ifdef PCAP_FDDIPAD 290 if (caplen > pad) 291 pkthdr.caplen = caplen - pad; 292 else 293 pkthdr.caplen = 0; 294 if (bhp->bh_datalen > pad) 295 pkthdr.len = bhp->bh_datalen - pad; 296 else 297 pkthdr.len = 0; 298 datap += pad; 299#else 300 pkthdr.caplen = caplen; 301 pkthdr.len = bhp->bh_datalen; 302#endif 303 (*callback)(user, &pkthdr, datap); 304 bp += BPF_WORDALIGN(caplen + hdrlen); 305 if (++n >= cnt && cnt > 0) { 306 p->bp = bp; 307 p->cc = ep - bp; 308 return (n); 309 } 310 } else { 311 /* 312 * Skip this packet. 313 */ 314 bp += BPF_WORDALIGN(caplen + hdrlen); 315 } 316 } 317#undef bhp 318 p->cc = 0; 319 return (n); 320} 321 322static int 323pcap_inject_bpf(pcap_t *p, const void *buf, size_t size) 324{ 325 int ret; 326 327 ret = write(p->fd, buf, size); 328#ifdef __APPLE__ 329 if (ret == -1 && errno == EAFNOSUPPORT) { 330 /* 331 * In Mac OS X, there's a bug wherein setting the 332 * BIOCSHDRCMPLT flag causes writes to fail; see, 333 * for example: 334 * 335 * http://cerberus.sourcefire.com/~jeff/archives/patches/macosx/BIOCSHDRCMPLT-10.3.3.patch 336 * 337 * So, if, on OS X, we get EAFNOSUPPORT from the write, we 338 * assume it's due to that bug, and turn off that flag 339 * and try again. If we succeed, it either means that 340 * somebody applied the fix from that URL, or other patches 341 * for that bug from 342 * 343 * http://cerberus.sourcefire.com/~jeff/archives/patches/macosx/ 344 * 345 * and are running a Darwin kernel with those fixes, or 346 * that Apple fixed the problem in some OS X release. 347 */ 348 u_int spoof_eth_src = 0; 349 350 if (ioctl(p->fd, BIOCSHDRCMPLT, &spoof_eth_src) == -1) { 351 (void)snprintf(p->errbuf, PCAP_ERRBUF_SIZE, 352 "send: can't turn off BIOCSHDRCMPLT: %s", 353 pcap_strerror(errno)); 354 return (-1); 355 } 356 357 /* 358 * Now try the write again. 359 */ 360 ret = write(p->fd, buf, size); 361 } 362#endif /* __APPLE__ */ 363 if (ret == -1) { 364 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "send: %s", 365 pcap_strerror(errno)); 366 return (-1); 367 } 368 return (ret); 369} 370 371#ifdef _AIX 372static int 373bpf_odminit(char *errbuf) 374{ 375 char *errstr; 376 377 if (odm_initialize() == -1) { 378 if (odm_err_msg(odmerrno, &errstr) == -1) 379 errstr = "Unknown error"; 380 snprintf(errbuf, PCAP_ERRBUF_SIZE, 381 "bpf_load: odm_initialize failed: %s", 382 errstr); 383 return (-1); 384 } 385 386 if ((odmlockid = odm_lock("/etc/objrepos/config_lock", ODM_WAIT)) == -1) { 387 if (odm_err_msg(odmerrno, &errstr) == -1) 388 errstr = "Unknown error"; 389 snprintf(errbuf, PCAP_ERRBUF_SIZE, 390 "bpf_load: odm_lock of /etc/objrepos/config_lock failed: %s", 391 errstr); 392 return (-1); 393 } 394 395 return (0); 396} 397 398static int 399bpf_odmcleanup(char *errbuf) 400{ 401 char *errstr; 402 403 if (odm_unlock(odmlockid) == -1) { 404 if (odm_err_msg(odmerrno, &errstr) == -1) 405 errstr = "Unknown error"; 406 snprintf(errbuf, PCAP_ERRBUF_SIZE, 407 "bpf_load: odm_unlock failed: %s", 408 errstr); 409 return (-1); 410 } 411 412 if (odm_terminate() == -1) { 413 if (odm_err_msg(odmerrno, &errstr) == -1) 414 errstr = "Unknown error"; 415 snprintf(errbuf, PCAP_ERRBUF_SIZE, 416 "bpf_load: odm_terminate failed: %s", 417 errstr); 418 return (-1); 419 } 420 421 return (0); 422} 423 424static int 425bpf_load(char *errbuf) 426{ 427 long major; 428 int *minors; 429 int numminors, i, rc; 430 char buf[1024]; 431 struct stat sbuf; 432 struct bpf_config cfg_bpf; 433 struct cfg_load cfg_ld; 434 struct cfg_kmod cfg_km; 435 436 /* 437 * This is very very close to what happens in the real implementation 438 * but I've fixed some (unlikely) bug situations. 439 */ 440 if (bpfloadedflag) 441 return (0); 442 443 if (bpf_odminit(errbuf) != 0) 444 return (-1); 445 446 major = genmajor(BPF_NAME); 447 if (major == -1) { 448 snprintf(errbuf, PCAP_ERRBUF_SIZE, 449 "bpf_load: genmajor failed: %s", pcap_strerror(errno)); 450 return (-1); 451 } 452 453 minors = getminor(major, &numminors, BPF_NAME); 454 if (!minors) { 455 minors = genminor("bpf", major, 0, BPF_MINORS, 1, 1); 456 if (!minors) { 457 snprintf(errbuf, PCAP_ERRBUF_SIZE, 458 "bpf_load: genminor failed: %s", 459 pcap_strerror(errno)); 460 return (-1); 461 } 462 } 463 464 if (bpf_odmcleanup(errbuf)) 465 return (-1); 466 467 rc = stat(BPF_NODE "0", &sbuf); 468 if (rc == -1 && errno != ENOENT) { 469 snprintf(errbuf, PCAP_ERRBUF_SIZE, 470 "bpf_load: can't stat %s: %s", 471 BPF_NODE "0", pcap_strerror(errno)); 472 return (-1); 473 } 474 475 if (rc == -1 || getmajor(sbuf.st_rdev) != major) { 476 for (i = 0; i < BPF_MINORS; i++) { 477 sprintf(buf, "%s%d", BPF_NODE, i); 478 unlink(buf); 479 if (mknod(buf, S_IRUSR | S_IFCHR, domakedev(major, i)) == -1) { 480 snprintf(errbuf, PCAP_ERRBUF_SIZE, 481 "bpf_load: can't mknod %s: %s", 482 buf, pcap_strerror(errno)); 483 return (-1); 484 } 485 } 486 } 487 488 /* Check if the driver is loaded */ 489 memset(&cfg_ld, 0x0, sizeof(cfg_ld)); 490 cfg_ld.path = buf; 491 sprintf(cfg_ld.path, "%s/%s", DRIVER_PATH, BPF_NAME); 492 if ((sysconfig(SYS_QUERYLOAD, (void *)&cfg_ld, sizeof(cfg_ld)) == -1) || 493 (cfg_ld.kmid == 0)) { 494 /* Driver isn't loaded, load it now */ 495 if (sysconfig(SYS_SINGLELOAD, (void *)&cfg_ld, sizeof(cfg_ld)) == -1) { 496 snprintf(errbuf, PCAP_ERRBUF_SIZE, 497 "bpf_load: could not load driver: %s", 498 strerror(errno)); 499 return (-1); 500 } 501 } 502 503 /* Configure the driver */ 504 cfg_km.cmd = CFG_INIT; 505 cfg_km.kmid = cfg_ld.kmid; 506 cfg_km.mdilen = sizeof(cfg_bpf); 507 cfg_km.mdiptr = (void *)&cfg_bpf; 508 for (i = 0; i < BPF_MINORS; i++) { 509 cfg_bpf.devno = domakedev(major, i); 510 if (sysconfig(SYS_CFGKMOD, (void *)&cfg_km, sizeof(cfg_km)) == -1) { 511 snprintf(errbuf, PCAP_ERRBUF_SIZE, 512 "bpf_load: could not configure driver: %s", 513 strerror(errno)); 514 return (-1); 515 } 516 } 517 518 bpfloadedflag = 1; 519 520 return (0); 521} 522#endif 523 524static inline int 525bpf_open(pcap_t *p, char *errbuf) 526{ 527 int fd; 528#ifdef HAVE_CLONING_BPF 529 static const char device[] = "/dev/bpf"; 530#else 531 int n = 0; 532 char device[sizeof "/dev/bpf0000000000"]; 533#endif 534 535#ifdef _AIX 536 /* 537 * Load the bpf driver, if it isn't already loaded, 538 * and create the BPF device entries, if they don't 539 * already exist. 540 */ 541 if (bpf_load(errbuf) == -1) 542 return (-1); 543#endif 544 545#ifdef HAVE_CLONING_BPF 546 if ((fd = open(device, O_RDWR)) == -1 && 547 (errno != EACCES || (fd = open(device, O_RDONLY)) == -1)) 548 snprintf(errbuf, PCAP_ERRBUF_SIZE, 549 "(cannot open device) %s: %s", device, pcap_strerror(errno)); 550#else 551 /* 552 * Go through all the minors and find one that isn't in use. 553 */ 554 do { 555 (void)snprintf(device, sizeof(device), "/dev/bpf%d", n++); 556 /* 557 * Initially try a read/write open (to allow the inject 558 * method to work). If that fails due to permission 559 * issues, fall back to read-only. This allows a 560 * non-root user to be granted specific access to pcap 561 * capabilities via file permissions. 562 * 563 * XXX - we should have an API that has a flag that 564 * controls whether to open read-only or read-write, 565 * so that denial of permission to send (or inability 566 * to send, if sending packets isn't supported on 567 * the device in question) can be indicated at open 568 * time. 569 */ 570 fd = open(device, O_RDWR); 571 if (fd == -1 && errno == EACCES) 572 fd = open(device, O_RDONLY); 573 } while (fd < 0 && errno == EBUSY); 574 575 /* 576 * XXX better message for all minors used 577 */ 578 if (fd < 0) 579 snprintf(errbuf, PCAP_ERRBUF_SIZE, "(no devices found) %s: %s", 580 device, pcap_strerror(errno)); 581#endif 582 583 return (fd); 584} 585 586/* 587 * We include the OS's <net/bpf.h>, not our "pcap-bpf.h", so we probably 588 * don't get DLT_DOCSIS defined. 589 */ 590#ifndef DLT_DOCSIS 591#define DLT_DOCSIS 143 592#endif 593 594pcap_t * 595pcap_open_live(const char *device, int snaplen, int promisc, int to_ms, 596 char *ebuf) 597{ 598 int fd; 599 struct ifreq ifr; 600 struct bpf_version bv; 601#ifdef BIOCGDLTLIST 602 struct bpf_dltlist bdl; 603#endif 604#if defined(BIOCGHDRCMPLT) && defined(BIOCSHDRCMPLT) 605 u_int spoof_eth_src = 1; 606#endif 607 u_int v; 608 pcap_t *p; 609 struct bpf_insn total_insn; 610 struct bpf_program total_prog; 611 struct utsname osinfo; 612 613#ifdef HAVE_DAG_API 614 if (strstr(device, "dag")) { 615 return dag_open_live(device, snaplen, promisc, to_ms, ebuf); 616 } 617#endif /* HAVE_DAG_API */ 618 619#ifdef BIOCGDLTLIST 620 memset(&bdl, 0, sizeof(bdl)); 621#endif 622 623 p = (pcap_t *)malloc(sizeof(*p)); 624 if (p == NULL) { 625 snprintf(ebuf, PCAP_ERRBUF_SIZE, "malloc: %s", 626 pcap_strerror(errno)); 627 return (NULL); 628 } 629 memset(p, 0, sizeof(*p)); 630 fd = bpf_open(p, ebuf); 631 if (fd < 0) 632 goto bad; 633 634 p->fd = fd; 635 p->snapshot = snaplen; 636 637 if (ioctl(fd, BIOCVERSION, (caddr_t)&bv) < 0) { 638 snprintf(ebuf, PCAP_ERRBUF_SIZE, "BIOCVERSION: %s", 639 pcap_strerror(errno)); 640 goto bad; 641 } 642 if (bv.bv_major != BPF_MAJOR_VERSION || 643 bv.bv_minor < BPF_MINOR_VERSION) { 644 snprintf(ebuf, PCAP_ERRBUF_SIZE, 645 "kernel bpf filter out of date"); 646 goto bad; 647 } 648 649 /* 650 * Try finding a good size for the buffer; 32768 may be too 651 * big, so keep cutting it in half until we find a size 652 * that works, or run out of sizes to try. If the default 653 * is larger, don't make it smaller. 654 * 655 * XXX - there should be a user-accessible hook to set the 656 * initial buffer size. 657 */ 658 if ((ioctl(fd, BIOCGBLEN, (caddr_t)&v) < 0) || v < 32768) 659 v = 32768; 660 for ( ; v != 0; v >>= 1) { 661 /* Ignore the return value - this is because the call fails 662 * on BPF systems that don't have kernel malloc. And if 663 * the call fails, it's no big deal, we just continue to 664 * use the standard buffer size. 665 */ 666 (void) ioctl(fd, BIOCSBLEN, (caddr_t)&v); 667 668 (void)strncpy(ifr.ifr_name, device, sizeof(ifr.ifr_name)); 669 if (ioctl(fd, BIOCSETIF, (caddr_t)&ifr) >= 0) 670 break; /* that size worked; we're done */ 671 672 if (errno != ENOBUFS) { 673 snprintf(ebuf, PCAP_ERRBUF_SIZE, "BIOCSETIF: %s: %s", 674 device, pcap_strerror(errno)); 675 goto bad; 676 } 677 } 678 679 if (v == 0) { 680 snprintf(ebuf, PCAP_ERRBUF_SIZE, 681 "BIOCSBLEN: %s: No buffer size worked", device); 682 goto bad; 683 } 684 685 /* Get the data link layer type. */ 686 if (ioctl(fd, BIOCGDLT, (caddr_t)&v) < 0) { 687 snprintf(ebuf, PCAP_ERRBUF_SIZE, "BIOCGDLT: %s", 688 pcap_strerror(errno)); 689 goto bad; 690 } 691#ifdef _AIX 692 /* 693 * AIX's BPF returns IFF_ types, not DLT_ types, in BIOCGDLT. 694 */ 695 switch (v) { 696 697 case IFT_ETHER: 698 case IFT_ISO88023: 699 v = DLT_EN10MB; 700 break; 701 702 case IFT_FDDI: 703 v = DLT_FDDI; 704 break; 705 706 case IFT_ISO88025: 707 v = DLT_IEEE802; 708 break; 709 710 case IFT_LOOP: 711 v = DLT_NULL; 712 break; 713 714 default: 715 /* 716 * We don't know what to map this to yet. 717 */ 718 snprintf(ebuf, PCAP_ERRBUF_SIZE, "unknown interface type %u", 719 v); 720 goto bad; 721 } 722#endif 723#if _BSDI_VERSION - 0 >= 199510 724 /* The SLIP and PPP link layer header changed in BSD/OS 2.1 */ 725 switch (v) { 726 727 case DLT_SLIP: 728 v = DLT_SLIP_BSDOS; 729 break; 730 731 case DLT_PPP: 732 v = DLT_PPP_BSDOS; 733 break; 734 735 case 11: /*DLT_FR*/ 736 v = DLT_FRELAY; 737 break; 738 739 case 12: /*DLT_C_HDLC*/ 740 v = DLT_CHDLC; 741 break; 742 } 743#endif 744#ifdef PCAP_FDDIPAD 745 if (v == DLT_FDDI) 746 p->fddipad = PCAP_FDDIPAD; 747 else 748 p->fddipad = 0; 749#endif 750 p->linktype = v; 751 752#ifdef BIOCGDLTLIST 753 /* 754 * We know the default link type -- now determine all the DLTs 755 * this interface supports. If this fails with EINVAL, it's 756 * not fatal; we just don't get to use the feature later. 757 */ 758 if (ioctl(fd, BIOCGDLTLIST, (caddr_t)&bdl) == 0) { 759 u_int i; 760 int is_ethernet; 761 762 bdl.bfl_list = (u_int *) malloc(sizeof(u_int) * (bdl.bfl_len + 1)); 763 if (bdl.bfl_list == NULL) { 764 (void)snprintf(ebuf, PCAP_ERRBUF_SIZE, "malloc: %s", 765 pcap_strerror(errno)); 766 goto bad; 767 } 768 769 if (ioctl(fd, BIOCGDLTLIST, (caddr_t)&bdl) < 0) { 770 (void)snprintf(ebuf, PCAP_ERRBUF_SIZE, 771 "BIOCGDLTLIST: %s", pcap_strerror(errno)); 772 free(bdl.bfl_list); 773 goto bad; 774 } 775 776 /* 777 * OK, for real Ethernet devices, add DLT_DOCSIS to the 778 * list, so that an application can let you choose it, 779 * in case you're capturing DOCSIS traffic that a Cisco 780 * Cable Modem Termination System is putting out onto 781 * an Ethernet (it doesn't put an Ethernet header onto 782 * the wire, it puts raw DOCSIS frames out on the wire 783 * inside the low-level Ethernet framing). 784 * 785 * A "real Ethernet device" is defined here as a device 786 * that has a link-layer type of DLT_EN10MB and that has 787 * no alternate link-layer types; that's done to exclude 788 * 802.11 interfaces (which might or might not be the 789 * right thing to do, but I suspect it is - Ethernet <-> 790 * 802.11 bridges would probably badly mishandle frames 791 * that don't have Ethernet headers). 792 */ 793 if (p->linktype == DLT_EN10MB) { 794 is_ethernet = 1; 795 for (i = 0; i < bdl.bfl_len; i++) { 796 if (bdl.bfl_list[i] != DLT_EN10MB) { 797 is_ethernet = 0; 798 break; 799 } 800 } 801 if (is_ethernet) { 802 /* 803 * We reserved one more slot at the end of 804 * the list. 805 */ 806 bdl.bfl_list[bdl.bfl_len] = DLT_DOCSIS; 807 bdl.bfl_len++; 808 } 809 } 810 p->dlt_count = bdl.bfl_len; 811 p->dlt_list = bdl.bfl_list; 812 } else { 813 if (errno != EINVAL) { 814 (void)snprintf(ebuf, PCAP_ERRBUF_SIZE, 815 "BIOCGDLTLIST: %s", pcap_strerror(errno)); 816 goto bad; 817 } 818 } 819#endif 820 821 /* 822 * If this is an Ethernet device, and we don't have a DLT_ list, 823 * give it a list with DLT_EN10MB and DLT_DOCSIS. (That'd give 824 * 802.11 interfaces DLT_DOCSIS, which isn't the right thing to 825 * do, but there's not much we can do about that without finding 826 * some other way of determining whether it's an Ethernet or 802.11 827 * device.) 828 */ 829 if (p->linktype == DLT_EN10MB && p->dlt_count == 0) { 830 p->dlt_list = (u_int *) malloc(sizeof(u_int) * 2); 831 /* 832 * If that fails, just leave the list empty. 833 */ 834 if (p->dlt_list != NULL) { 835 p->dlt_list[0] = DLT_EN10MB; 836 p->dlt_list[1] = DLT_DOCSIS; 837 p->dlt_count = 2; 838 } 839 } 840 841#if defined(BIOCGHDRCMPLT) && defined(BIOCSHDRCMPLT) 842 /* 843 * Do a BIOCSHDRCMPLT, if defined, to turn that flag on, so 844 * the link-layer source address isn't forcibly overwritten. 845 * (Should we ignore errors? Should we do this only if 846 * we're open for writing?) 847 * 848 * XXX - I seem to remember some packet-sending bug in some 849 * BSDs - check CVS log for "bpf.c"? 850 */ 851 if (ioctl(fd, BIOCSHDRCMPLT, &spoof_eth_src) == -1) { 852 (void)snprintf(ebuf, PCAP_ERRBUF_SIZE, 853 "BIOCSHDRCMPLT: %s", pcap_strerror(errno)); 854 goto bad; 855 } 856#endif 857 /* set timeout */ 858 if (to_ms != 0) { 859 /* 860 * XXX - is this seconds/nanoseconds in AIX? 861 * (Treating it as such doesn't fix the timeout 862 * problem described below.) 863 */ 864 struct timeval to; 865 to.tv_sec = to_ms / 1000; 866 to.tv_usec = (to_ms * 1000) % 1000000; 867 if (ioctl(p->fd, BIOCSRTIMEOUT, (caddr_t)&to) < 0) { 868 snprintf(ebuf, PCAP_ERRBUF_SIZE, "BIOCSRTIMEOUT: %s", 869 pcap_strerror(errno)); 870 goto bad; 871 } 872 } 873 874#ifdef _AIX 875#ifdef BIOCIMMEDIATE 876 /* 877 * Darren Reed notes that 878 * 879 * On AIX (4.2 at least), if BIOCIMMEDIATE is not set, the 880 * timeout appears to be ignored and it waits until the buffer 881 * is filled before returning. The result of not having it 882 * set is almost worse than useless if your BPF filter 883 * is reducing things to only a few packets (i.e. one every 884 * second or so). 885 * 886 * so we turn BIOCIMMEDIATE mode on if this is AIX. 887 * 888 * We don't turn it on for other platforms, as that means we 889 * get woken up for every packet, which may not be what we want; 890 * in the Winter 1993 USENIX paper on BPF, they say: 891 * 892 * Since a process might want to look at every packet on a 893 * network and the time between packets can be only a few 894 * microseconds, it is not possible to do a read system call 895 * per packet and BPF must collect the data from several 896 * packets and return it as a unit when the monitoring 897 * application does a read. 898 * 899 * which I infer is the reason for the timeout - it means we 900 * wait that amount of time, in the hopes that more packets 901 * will arrive and we'll get them all with one read. 902 * 903 * Setting BIOCIMMEDIATE mode on FreeBSD (and probably other 904 * BSDs) causes the timeout to be ignored. 905 * 906 * On the other hand, some platforms (e.g., Linux) don't support 907 * timeouts, they just hand stuff to you as soon as it arrives; 908 * if that doesn't cause a problem on those platforms, it may 909 * be OK to have BIOCIMMEDIATE mode on BSD as well. 910 * 911 * (Note, though, that applications may depend on the read 912 * completing, even if no packets have arrived, when the timeout 913 * expires, e.g. GUI applications that have to check for input 914 * while waiting for packets to arrive; a non-zero timeout 915 * prevents "select()" from working right on FreeBSD and 916 * possibly other BSDs, as the timer doesn't start until a 917 * "read()" is done, so the timer isn't in effect if the 918 * application is blocked on a "select()", and the "select()" 919 * doesn't get woken up for a BPF device until the buffer 920 * fills up.) 921 */ 922 v = 1; 923 if (ioctl(p->fd, BIOCIMMEDIATE, &v) < 0) { 924 snprintf(ebuf, PCAP_ERRBUF_SIZE, "BIOCIMMEDIATE: %s", 925 pcap_strerror(errno)); 926 goto bad; 927 } 928#endif /* BIOCIMMEDIATE */ 929#endif /* _AIX */ 930 931 if (promisc) { 932 /* set promiscuous mode, okay if it fails */ 933 if (ioctl(p->fd, BIOCPROMISC, NULL) < 0) { 934 snprintf(ebuf, PCAP_ERRBUF_SIZE, "BIOCPROMISC: %s", 935 pcap_strerror(errno)); 936 } 937 } 938 939 if (ioctl(fd, BIOCGBLEN, (caddr_t)&v) < 0) { 940 snprintf(ebuf, PCAP_ERRBUF_SIZE, "BIOCGBLEN: %s", 941 pcap_strerror(errno)); 942 goto bad; 943 } 944 p->bufsize = v; 945 p->buffer = (u_char *)malloc(p->bufsize); 946 if (p->buffer == NULL) { 947 snprintf(ebuf, PCAP_ERRBUF_SIZE, "malloc: %s", 948 pcap_strerror(errno)); 949 goto bad; 950 } 951#ifdef _AIX 952 /* For some strange reason this seems to prevent the EFAULT 953 * problems we have experienced from AIX BPF. */ 954 memset(p->buffer, 0x0, p->bufsize); 955#endif 956 957 /* 958 * If there's no filter program installed, there's 959 * no indication to the kernel of what the snapshot 960 * length should be, so no snapshotting is done. 961 * 962 * Therefore, when we open the device, we install 963 * an "accept everything" filter with the specified 964 * snapshot length. 965 */ 966 total_insn.code = (u_short)(BPF_RET | BPF_K); 967 total_insn.jt = 0; 968 total_insn.jf = 0; 969 total_insn.k = snaplen; 970 971 total_prog.bf_len = 1; 972 total_prog.bf_insns = &total_insn; 973 if (ioctl(p->fd, BIOCSETF, (caddr_t)&total_prog) < 0) { 974 snprintf(ebuf, PCAP_ERRBUF_SIZE, "BIOCSETF: %s", 975 pcap_strerror(errno)); 976 goto bad; 977 } 978 979 /* 980 * On most BPF platforms, either you can do a "select()" or 981 * "poll()" on a BPF file descriptor and it works correctly, 982 * or you can do it and it will return "readable" if the 983 * hold buffer is full but not if the timeout expires *and* 984 * a non-blocking read will, if the hold buffer is empty 985 * but the store buffer isn't empty, rotate the buffers 986 * and return what packets are available. 987 * 988 * In the latter case, the fact that a non-blocking read 989 * will give you the available packets means you can work 990 * around the failure of "select()" and "poll()" to wake up 991 * and return "readable" when the timeout expires by using 992 * the timeout as the "select()" or "poll()" timeout, putting 993 * the BPF descriptor into non-blocking mode, and read from 994 * it regardless of whether "select()" reports it as readable 995 * or not. 996 * 997 * However, in FreeBSD 4.3 and 4.4, "select()" and "poll()" 998 * won't wake up and return "readable" if the timer expires 999 * and non-blocking reads return EWOULDBLOCK if the hold 1000 * buffer is empty, even if the store buffer is non-empty. 1001 * 1002 * This means the workaround in question won't work. 1003 * 1004 * Therefore, on FreeBSD 4.3 and 4.4, we set "p->selectable_fd" 1005 * to -1, which means "sorry, you can't use 'select()' or 'poll()' 1006 * here". On all other BPF platforms, we set it to the FD for 1007 * the BPF device; in NetBSD, OpenBSD, and Darwin, a non-blocking 1008 * read will, if the hold buffer is empty and the store buffer 1009 * isn't empty, rotate the buffers and return what packets are 1010 * there (and in sufficiently recent versions of OpenBSD 1011 * "select()" and "poll()" should work correctly). 1012 * 1013 * XXX - what about AIX? 1014 */ 1015 p->selectable_fd = p->fd; /* assume select() works until we know otherwise */ 1016 if (uname(&osinfo) == 0) { 1017 /* 1018 * We can check what OS this is. 1019 */ 1020 if (strcmp(osinfo.sysname, "FreeBSD") == 0) { 1021 if (strncmp(osinfo.release, "4.3-", 4) == 0 || 1022 strncmp(osinfo.release, "4.4-", 4) == 0) 1023 p->selectable_fd = -1; 1024 } 1025 } 1026 1027 p->read_op = pcap_read_bpf; 1028 p->inject_op = pcap_inject_bpf; 1029 p->setfilter_op = pcap_setfilter_bpf; 1030 p->setdirection_op = pcap_setdirection_bpf; 1031 p->set_datalink_op = pcap_set_datalink_bpf; 1032 p->getnonblock_op = pcap_getnonblock_fd; 1033 p->setnonblock_op = pcap_setnonblock_fd; 1034 p->stats_op = pcap_stats_bpf; 1035 p->close_op = pcap_close_common; 1036 1037 return (p); 1038 bad: 1039 (void)close(fd); 1040 if (p->dlt_list != NULL) 1041 free(p->dlt_list); 1042 free(p); 1043 return (NULL); 1044} 1045 1046int 1047pcap_platform_finddevs(pcap_if_t **alldevsp, char *errbuf) 1048{ 1049#ifdef HAVE_DAG_API 1050 if (dag_platform_finddevs(alldevsp, errbuf) < 0) 1051 return (-1); 1052#endif /* HAVE_DAG_API */ 1053 1054 return (0); 1055} 1056 1057static int 1058pcap_setfilter_bpf(pcap_t *p, struct bpf_program *fp) 1059{ 1060 /* 1061 * It looks that BPF code generated by gen_protochain() is not 1062 * compatible with some of kernel BPF code (for example BSD/OS 3.1). 1063 * Take a safer side for now. 1064 */ 1065 if (no_optimize) { 1066 /* 1067 * XXX - what if we already have a filter in the kernel? 1068 */ 1069 if (install_bpf_program(p, fp) < 0) 1070 return (-1); 1071 p->md.use_bpf = 0; /* filtering in userland */ 1072 return (0); 1073 } 1074 1075 /* 1076 * Free any user-mode filter we might happen to have installed. 1077 */ 1078 pcap_freecode(&p->fcode); 1079 1080 /* 1081 * Try to install the kernel filter. 1082 */ 1083 if (ioctl(p->fd, BIOCSETF, (caddr_t)fp) < 0) { 1084 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "BIOCSETF: %s", 1085 pcap_strerror(errno)); 1086 return (-1); 1087 } 1088 p->md.use_bpf = 1; /* filtering in the kernel */ 1089 1090 /* 1091 * Discard any previously-received packets, as they might have 1092 * passed whatever filter was formerly in effect, but might 1093 * not pass this filter (BIOCSETF discards packets buffered 1094 * in the kernel, so you can lose packets in any case). 1095 */ 1096 p->cc = 0; 1097 return (0); 1098} 1099 1100/* 1101 * Set direction flag: Which packets do we accept on a forwarding 1102 * single device? IN, OUT or both? 1103 */ 1104static int 1105pcap_setdirection_bpf(pcap_t *p, pcap_direction_t d) 1106{ 1107#if defined(BIOCSDIRECTION) 1108 u_int direction; 1109 1110 direction = (d == PCAP_D_IN) ? BPF_D_IN : 1111 ((d == PCAP_D_OUT) ? BPF_D_OUT : BPF_D_INOUT); 1112 if (ioctl(p->fd, BIOCSDIRECTION, &direction) == -1) { 1113 (void) snprintf(p->errbuf, sizeof(p->errbuf), 1114 "Cannot set direction to %s: %s", 1115 (d == PCAP_D_IN) ? "PCAP_D_IN" : 1116 ((d == PCAP_D_OUT) ? "PCAP_D_OUT" : "PCAP_D_INOUT"), 1117 strerror(errno)); 1118 return (-1); 1119 } 1120 return (0); 1121#elif defined(BIOCSSEESENT) 1122 u_int seesent; 1123 1124 /* 1125 * We don't support PCAP_D_OUT. 1126 */ 1127 if (d == PCAP_D_OUT) { 1128 snprintf(p->errbuf, sizeof(p->errbuf), 1129 "Setting direction to PCAP_D_OUT is not supported on BPF"); 1130 return -1; 1131 } 1132 1133 seesent = (d == PCAP_D_INOUT); 1134 if (ioctl(p->fd, BIOCSSEESENT, &seesent) == -1) { 1135 (void) snprintf(p->errbuf, sizeof(p->errbuf), 1136 "Cannot set direction to %s: %s", 1137 (d == PCAP_D_INOUT) ? "PCAP_D_INOUT" : "PCAP_D_IN", 1138 strerror(errno)); 1139 return (-1); 1140 } 1141 return (0); 1142#else 1143 (void) snprintf(p->errbuf, sizeof(p->errbuf), 1144 "This system doesn't support BIOCSSEESENT, so the direction can't be set"); 1145 return (-1); 1146#endif 1147} 1148 1149static int 1150pcap_set_datalink_bpf(pcap_t *p, int dlt) 1151{ 1152#ifdef BIOCSDLT 1153 if (ioctl(p->fd, BIOCSDLT, &dlt) == -1) { 1154 (void) snprintf(p->errbuf, sizeof(p->errbuf), 1155 "Cannot set DLT %d: %s", dlt, strerror(errno)); 1156 return (-1); 1157 } 1158#endif 1159 return (0); 1160} 1161