pcap-pf.c revision 127664
160812Sps/* 2238730Sdelphij * Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996 3238730Sdelphij * The Regents of the University of California. All rights reserved. 4238730Sdelphij * 5238730Sdelphij * Redistribution and use in source and binary forms, with or without 6238730Sdelphij * modification, are permitted provided that: (1) source code distributions 7238730Sdelphij * retain the above copyright notice and this paragraph in its entirety, (2) 8238730Sdelphij * distributions including binary code include the above copyright notice and 9238730Sdelphij * this paragraph in its entirety in the documentation or other materials 1060786Sps * provided with the distribution, and (3) all advertising materials mentioning 1160786Sps * features or use of this software display the following acknowledgement: 1260786Sps * ``This product includes software developed by the University of California, 1360786Sps * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of 1460786Sps * the University nor the names of its contributors may be used to endorse 1560786Sps * or promote products derived from this software without specific prior 1660786Sps * written permission. 1789022Sps * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED 1889022Sps * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF 1989022Sps * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 2060786Sps * 2160786Sps * packet filter subroutines for tcpdump 2260786Sps * Extraction/creation by Jeffrey Mogul, DECWRL 2360786Sps */ 24161478Sdelphij 2560786Sps#ifndef lint 2660786Spsstatic const char rcsid[] _U_ = 2760786Sps "@(#) $Header: /tcpdump/master/libpcap/pcap-pf.c,v 1.79.2.5 2003/11/22 00:32:55 guy Exp $ (LBL)"; 2860786Sps#endif 2960786Sps 3060786Sps#ifdef HAVE_CONFIG_H 3160786Sps#include "config.h" 3260786Sps#endif 3360786Sps 3460786Sps#include <sys/types.h> 3560786Sps#include <sys/time.h> 3660786Sps#include <sys/timeb.h> 3760786Sps#include <sys/socket.h> 3860786Sps#include <sys/file.h> 39170259Sdelphij#include <sys/ioctl.h> 40237613Sdelphij#include <net/pfilt.h> 4160786Sps 4260786Spsstruct mbuf; 4360786Spsstruct rtentry; 4460786Sps#include <net/if.h> 4560786Sps 4660786Sps#include <netinet/in.h> 4760786Sps#include <netinet/in_systm.h> 4860786Sps#include <netinet/ip.h> 4960786Sps#include <netinet/if_ether.h> 5060786Sps#include <netinet/ip_var.h> 5160786Sps#include <netinet/udp.h> 5260786Sps#include <netinet/udp_var.h> 5360786Sps#include <netinet/tcp.h> 5460786Sps#include <netinet/tcpip.h> 5560786Sps 5663131Sps#include <ctype.h> 57170259Sdelphij#include <errno.h> 58170259Sdelphij#include <netdb.h> 5960786Sps#include <stdio.h> 6060786Sps#include <stdlib.h> 6160786Sps#include <string.h> 6260786Sps#include <unistd.h> 6360786Sps 6460786Sps/* 65128348Stjr * Make "pcap.h" not include "pcap-bpf.h"; we are going to include the 66170259Sdelphij * native OS version, as we need various BPF ioctls from it. 67221715Sdelphij */ 68221715Sdelphij#define PCAP_DONT_INCLUDE_PCAP_BPF_H 6960786Sps#include <net/bpf.h> 7060786Sps 7160786Sps#include "pcap-int.h" 72161478Sdelphij 7360786Sps#ifdef HAVE_OS_PROTO_H 7460786Sps#include "os-proto.h" 7560786Sps#endif 7660786Sps 77221715Sdelphijstatic int pcap_setfilter_pf(pcap_t *, struct bpf_program *); 78221715Sdelphij 79221715Sdelphij/* 80221715Sdelphij * BUFSPACE is the size in bytes of the packet read buffer. Most tcpdump 81221715Sdelphij * applications aren't going to need more than 200 bytes of packet header 82221715Sdelphij * and the read shouldn't return more packets than packetfilter's internal 83221715Sdelphij * queue limit (bounded at 256). 8460786Sps */ 8560786Sps#define BUFSPACE (200 * 256) 8660786Sps 87170259Sdelphijstatic int 8860786Spspcap_read_pf(pcap_t *pc, int cnt, pcap_handler callback, u_char *user) 8960786Sps{ 9060786Sps register u_char *p, *bp; 9160786Sps struct bpf_insn *fcode; 9260786Sps register int cc, n, buflen, inc; 9360786Sps register struct enstamp *sp; 94191930Sdelphij#ifdef LBL_ALIGN 9560786Sps struct enstamp stamp; 96191930Sdelphij#endif 97170967Sdelphij#ifdef PCAP_FDDIPAD 9860786Sps register int pad; 9960786Sps#endif 10060786Sps 10160786Sps fcode = pc->md.use_bpf ? NULL : pc->fcode.bf_insns; 10260786Sps again: 10360786Sps cc = pc->cc; 10460786Sps if (cc == 0) { 10560786Sps cc = read(pc->fd, (char *)pc->buffer + pc->offset, pc->bufsize); 10660786Sps if (cc < 0) { 107237613Sdelphij if (errno == EWOULDBLOCK) 108237613Sdelphij return (0); 10960786Sps if (errno == EINVAL && 11060786Sps lseek(pc->fd, 0L, SEEK_CUR) + pc->bufsize < 0) { 11160786Sps /* 112170259Sdelphij * Due to a kernel bug, after 2^31 bytes, 11360786Sps * the kernel file offset overflows and 11460786Sps * read fails with EINVAL. The lseek() 11560786Sps * to 0 will fix things. 11660786Sps */ 11760786Sps (void)lseek(pc->fd, 0L, SEEK_SET); 11860786Sps goto again; 11960786Sps } 12060786Sps snprintf(pc->errbuf, sizeof(pc->errbuf), "pf read: %s", 12160786Sps pcap_strerror(errno)); 12260786Sps return (-1); 12360786Sps } 12460786Sps bp = pc->buffer + pc->offset; 12560786Sps } else 12660786Sps bp = pc->bp; 12760786Sps /* 12860786Sps * Loop through each packet. 12960786Sps */ 130191930Sdelphij n = 0; 131191930Sdelphij#ifdef PCAP_FDDIPAD 132191930Sdelphij if (pc->linktype == DLT_FDDI) 133191930Sdelphij pad = pcap_fddipad; 134191930Sdelphij else 13560786Sps pad = 0; 13660786Sps#endif 13760786Sps while (cc > 0) { 13860786Sps /* 13960786Sps * Has "pcap_breakloop()" been called? 140170259Sdelphij * If so, return immediately - if we haven't read any 14160786Sps * packets, clear the flag and return -2 to indicate 14260786Sps * that we were told to break out of the loop, otherwise 14360786Sps * leave the flag set, so that the *next* call will break 14460786Sps * out of the loop without having read any packets, and 14560786Sps * return the number of packets we've processed so far. 14660786Sps */ 14760786Sps if (pc->break_loop) { 14860786Sps if (n == 0) { 14960786Sps pc->break_loop = 0; 15060786Sps return (-2); 15160786Sps } else { 15260786Sps pc->cc = cc; 15360786Sps pc->bp = bp; 154191930Sdelphij return (n); 155191930Sdelphij } 156191930Sdelphij } 157191930Sdelphij if (cc < sizeof(*sp)) { 158191930Sdelphij snprintf(pc->errbuf, sizeof(pc->errbuf), 15960786Sps "pf short read (%d)", cc); 16060786Sps return (-1); 16160786Sps } 16260786Sps#ifdef LBL_ALIGN 16360786Sps if ((long)bp & 3) { 16460786Sps sp = &stamp; 16560786Sps memcpy((char *)sp, (char *)bp, sizeof(*sp)); 16660786Sps } else 16760786Sps#endif 16860786Sps sp = (struct enstamp *)bp; 16960786Sps if (sp->ens_stamplen != sizeof(*sp)) { 17060786Sps snprintf(pc->errbuf, sizeof(pc->errbuf), 17160786Sps "pf short stamplen (%d)", 17260786Sps sp->ens_stamplen); 17360786Sps return (-1); 17460786Sps } 17560786Sps 17660786Sps p = bp + sp->ens_stamplen; 17760786Sps buflen = sp->ens_count; 17860786Sps if (buflen > pc->snapshot) 17960786Sps buflen = pc->snapshot; 18060786Sps 181170259Sdelphij /* Calculate inc before possible pad update */ 18260786Sps inc = ENALIGN(buflen + sp->ens_stamplen); 18360786Sps cc -= inc; 18460786Sps bp += inc; 18560786Sps#ifdef PCAP_FDDIPAD 18660786Sps p += pad; 18760786Sps buflen -= pad; 18860786Sps#endif 18960786Sps pc->md.TotPkts++; 19060786Sps pc->md.TotDrops += sp->ens_dropped; 19160786Sps pc->md.TotMissed = sp->ens_ifoverflows; 19260786Sps if (pc->md.OrigMissed < 0) 19360786Sps pc->md.OrigMissed = pc->md.TotMissed; 19460786Sps 19560786Sps /* 19660786Sps * Short-circuit evaluation: if using BPF filter 19760786Sps * in kernel, no need to do it now. 19860786Sps */ 19960786Sps if (fcode == NULL || 20060786Sps bpf_filter(fcode, p, sp->ens_count, buflen)) { 20160786Sps struct pcap_pkthdr h; 20260786Sps pc->md.TotAccepted++; 20360786Sps h.ts = sp->ens_tstamp; 20460786Sps#ifdef PCAP_FDDIPAD 20560786Sps h.len = sp->ens_count - pad; 20660786Sps#else 20760786Sps h.len = sp->ens_count; 20860786Sps#endif 20960786Sps h.caplen = buflen; 21060786Sps (*callback)(user, &h, p); 21160786Sps if (++n >= cnt && cnt > 0) { 21260786Sps pc->cc = cc; 21360786Sps pc->bp = bp; 21460786Sps return (n); 215128348Stjr } 21660786Sps } 217191930Sdelphij } 218191930Sdelphij pc->cc = 0; 219191930Sdelphij return (n); 220191930Sdelphij} 221191930Sdelphij 222191930Sdelphijstatic int 22360786Spspcap_stats_pf(pcap_t *p, struct pcap_stat *ps) 22460786Sps{ 22560786Sps 22660786Sps /* 22760786Sps * If packet filtering is being done in the kernel: 22860786Sps * 22960786Sps * "ps_recv" counts only packets that passed the filter. 23060786Sps * This does not include packets dropped because we 23160786Sps * ran out of buffer space. (XXX - perhaps it should, 23260786Sps * by adding "ps_drop" to "ps_recv", for compatibility 23360786Sps * with some other platforms. On the other hand, on 23460786Sps * some platforms "ps_recv" counts only packets that 23560786Sps * passed the filter, and on others it counts packets 23660786Sps * that didn't pass the filter....) 237221715Sdelphij * 238221715Sdelphij * "ps_drop" counts packets that passed the kernel filter 23960786Sps * (if any) but were dropped because the input queue was 24060786Sps * full. 241128348Stjr * 24260786Sps * "ps_ifdrop" counts packets dropped by the network 24360786Sps * inteface (regardless of whether they would have passed 244128348Stjr * the input filter, of course). 24560786Sps * 24660786Sps * If packet filtering is not being done in the kernel: 24760786Sps * 24860786Sps * "ps_recv" counts only packets that passed the filter. 24960786Sps * 25060786Sps * "ps_drop" counts packets that were dropped because the 251128348Stjr * input queue was full, regardless of whether they passed 25289022Sps * the userland filter. 25389022Sps * 254128348Stjr * "ps_ifdrop" counts packets dropped by the network 25560786Sps * inteface (regardless of whether they would have passed 25660786Sps * the input filter, of course). 25760786Sps * 25860786Sps * These statistics don't include packets not yet read from 25960786Sps * the kernel by libpcap, but they may include packets not 26060786Sps * yet read from libpcap by the application. 26160786Sps */ 26260786Sps ps->ps_recv = p->md.TotAccepted; 26360786Sps ps->ps_drop = p->md.TotDrops; 26460786Sps ps->ps_ifdrop = p->md.TotMissed - p->md.OrigMissed; 26560786Sps return (0); 26660786Sps} 26760786Sps 26860786Spsstatic void 26960786Spspcap_close_pf(pcap_t *p) 27060786Sps{ 27160786Sps if (p->buffer != NULL) 27260786Sps free(p->buffer); 27360786Sps if (p->fd >= 0) 27460786Sps close(p->fd); 27560786Sps} 27660786Sps 27760786Spspcap_t * 27860786Spspcap_open_live(const char *device, int snaplen, int promisc, int to_ms, 27960786Sps char *ebuf) 28060786Sps{ 28160786Sps pcap_t *p; 28260786Sps short enmode; 28360786Sps int backlog = -1; /* request the most */ 28460786Sps struct enfilter Filter; 28560786Sps struct endevp devparams; 28660786Sps 28760786Sps p = (pcap_t *)malloc(sizeof(*p)); 28860786Sps if (p == NULL) { 28960786Sps snprintf(ebuf, PCAP_ERRBUF_SIZE, 29060786Sps "pcap_open_live: %s", pcap_strerror(errno)); 291221715Sdelphij return (0); 29260786Sps } 29360786Sps memset(p, 0, sizeof(*p)); 294221715Sdelphij 29560786Sps /* 29660786Sps * XXX - we assume here that "pfopen()" does not, in fact, modify 297221715Sdelphij * its argument, even though it takes a "char *" rather than a 298221715Sdelphij * "const char *" as its first argument. That appears to be 299221715Sdelphij * the case, at least on Digital UNIX 4.0. 300221715Sdelphij */ 301221715Sdelphij p->fd = pfopen(device, O_RDONLY); 302221715Sdelphij if (p->fd < 0) { 303221715Sdelphij snprintf(ebuf, PCAP_ERRBUF_SIZE, "pf open: %s: %s\n\ 304221715Sdelphijyour system may not be properly configured; see the packetfilter(4) man page\n", 305222906Sdelphij device, pcap_strerror(errno)); 306221715Sdelphij goto bad; 307221715Sdelphij } 308221715Sdelphij p->md.OrigMissed = -1; 309221715Sdelphij enmode = ENTSTAMP|ENBATCH|ENNONEXCL; 310221715Sdelphij if (promisc) 311221715Sdelphij enmode |= ENPROMISC; 312221715Sdelphij if (ioctl(p->fd, EIOCMBIS, (caddr_t)&enmode) < 0) { 313221715Sdelphij snprintf(ebuf, PCAP_ERRBUF_SIZE, "EIOCMBIS: %s", 314221715Sdelphij pcap_strerror(errno)); 315221715Sdelphij goto bad; 316221715Sdelphij } 317221715Sdelphij#ifdef ENCOPYALL 318221715Sdelphij /* Try to set COPYALL mode so that we see packets to ourself */ 319221715Sdelphij enmode = ENCOPYALL; 320221715Sdelphij (void)ioctl(p->fd, EIOCMBIS, (caddr_t)&enmode);/* OK if this fails */ 321221715Sdelphij#endif 322221715Sdelphij /* set the backlog */ 323221715Sdelphij if (ioctl(p->fd, EIOCSETW, (caddr_t)&backlog) < 0) { 324221715Sdelphij snprintf(ebuf, PCAP_ERRBUF_SIZE, "EIOCSETW: %s", 325221715Sdelphij pcap_strerror(errno)); 326221715Sdelphij goto bad; 327221715Sdelphij } 328221715Sdelphij /* discover interface type */ 329221715Sdelphij if (ioctl(p->fd, EIOCDEVP, (caddr_t)&devparams) < 0) { 330221715Sdelphij snprintf(ebuf, PCAP_ERRBUF_SIZE, "EIOCDEVP: %s", 331221715Sdelphij pcap_strerror(errno)); 332221715Sdelphij goto bad; 333221715Sdelphij } 334221715Sdelphij /* HACK: to compile prior to Ultrix 4.2 */ 335221715Sdelphij#ifndef ENDT_FDDI 336221715Sdelphij#define ENDT_FDDI 4 337221715Sdelphij#endif 338221715Sdelphij switch (devparams.end_dev_type) { 339221715Sdelphij 340221715Sdelphij case ENDT_10MB: 341221715Sdelphij p->linktype = DLT_EN10MB; 342221715Sdelphij p->offset = 2; 343221715Sdelphij break; 344221715Sdelphij 345221715Sdelphij case ENDT_FDDI: 346221715Sdelphij p->linktype = DLT_FDDI; 347221715Sdelphij break; 348221715Sdelphij 349221715Sdelphij#ifdef ENDT_SLIP 350221715Sdelphij case ENDT_SLIP: 351221715Sdelphij p->linktype = DLT_SLIP; 352221715Sdelphij break; 353221715Sdelphij#endif 354221715Sdelphij 355221715Sdelphij#ifdef ENDT_PPP 356221715Sdelphij case ENDT_PPP: 357221715Sdelphij p->linktype = DLT_PPP; 358221715Sdelphij break; 35960786Sps#endif 360221715Sdelphij 361221715Sdelphij#ifdef ENDT_LOOPBACK 362221715Sdelphij case ENDT_LOOPBACK: 363221715Sdelphij /* 364221715Sdelphij * It appears to use Ethernet framing, at least on 365221715Sdelphij * Digital UNIX 4.0. 366221715Sdelphij */ 367221715Sdelphij p->linktype = DLT_EN10MB; 368221715Sdelphij p->offset = 2; 369221715Sdelphij break; 370221715Sdelphij#endif 371221715Sdelphij 372221715Sdelphij#ifdef ENDT_TRN 373221715Sdelphij case ENDT_TRN: 374221715Sdelphij p->linktype = DLT_IEEE802; 375221715Sdelphij break; 376221715Sdelphij#endif 377221715Sdelphij 378221715Sdelphij default: 379221715Sdelphij /* 380221715Sdelphij * XXX - what about ENDT_IEEE802? The pfilt.h header 381221715Sdelphij * file calls this "IEEE 802 networks (non-Ethernet)", 382221715Sdelphij * but that doesn't specify a specific link layer type; 383221715Sdelphij * it could be 802.4, or 802.5 (except that 802.5 is 384221715Sdelphij * ENDT_TRN), or 802.6, or 802.11, or.... That's why 385221715Sdelphij * DLT_IEEE802 was hijacked to mean Token Ring in various 386221715Sdelphij * BSDs, and why we went along with that hijacking. 387221715Sdelphij * 388221715Sdelphij * XXX - what about ENDT_HDLC and ENDT_NULL? 389221715Sdelphij * Presumably, as ENDT_OTHER is just "Miscellaneous 390221715Sdelphij * framing", there's not much we can do, as that 391221715Sdelphij * doesn't specify a particular type of header. 392221715Sdelphij */ 393221715Sdelphij snprintf(ebuf, PCAP_ERRBUF_SIZE, "unknown data-link type %u", 394221715Sdelphij devparams.end_dev_type); 395221715Sdelphij goto bad; 396221715Sdelphij } 397221715Sdelphij /* set truncation */ 398221715Sdelphij#ifdef PCAP_FDDIPAD 399221715Sdelphij if (p->linktype == DLT_FDDI) 400221715Sdelphij /* packetfilter includes the padding in the snapshot */ 401221715Sdelphij snaplen += pcap_fddipad; 402221715Sdelphij#endif 403221715Sdelphij if (ioctl(p->fd, EIOCTRUNCATE, (caddr_t)&snaplen) < 0) { 404221715Sdelphij snprintf(ebuf, PCAP_ERRBUF_SIZE, "EIOCTRUNCATE: %s", 405221715Sdelphij pcap_strerror(errno)); 406221715Sdelphij goto bad; 407221715Sdelphij } 408221715Sdelphij p->snapshot = snaplen; 40960786Sps /* accept all packets */ 41060786Sps memset(&Filter, 0, sizeof(Filter)); 411221715Sdelphij Filter.enf_Priority = 37; /* anything > 2 */ 412221715Sdelphij Filter.enf_FilterLen = 0; /* means "always true" */ 413221715Sdelphij if (ioctl(p->fd, EIOCSETF, (caddr_t)&Filter) < 0) { 414221715Sdelphij snprintf(ebuf, PCAP_ERRBUF_SIZE, "EIOCSETF: %s", 415221715Sdelphij pcap_strerror(errno)); 416221715Sdelphij goto bad; 417221715Sdelphij } 418221715Sdelphij 419221715Sdelphij if (to_ms != 0) { 420221715Sdelphij struct timeval timeout; 421221715Sdelphij timeout.tv_sec = to_ms / 1000; 422221715Sdelphij timeout.tv_usec = (to_ms * 1000) % 1000000; 423221715Sdelphij if (ioctl(p->fd, EIOCSRTIMEOUT, (caddr_t)&timeout) < 0) { 424221715Sdelphij snprintf(ebuf, PCAP_ERRBUF_SIZE, "EIOCSRTIMEOUT: %s", 425221715Sdelphij pcap_strerror(errno)); 426221715Sdelphij goto bad; 427221715Sdelphij } 428221715Sdelphij } 429221715Sdelphij 430221715Sdelphij p->bufsize = BUFSPACE; 431221715Sdelphij p->buffer = (u_char*)malloc(p->bufsize + p->offset); 432221715Sdelphij if (p->buffer == NULL) { 433221715Sdelphij strlcpy(ebuf, pcap_strerror(errno), PCAP_ERRBUF_SIZE); 434221715Sdelphij goto bad; 435221715Sdelphij } 436221715Sdelphij 437221715Sdelphij /* 438221715Sdelphij * "select()" and "poll()" work on packetfilter devices. 439221715Sdelphij */ 440221715Sdelphij p->selectable_fd = p->fd; 441221715Sdelphij 442221715Sdelphij p->read_op = pcap_read_pf; 443221715Sdelphij p->setfilter_op = pcap_setfilter_pf; 444221715Sdelphij p->set_datalink_op = NULL; /* can't change data link type */ 445221715Sdelphij p->getnonblock_op = pcap_getnonblock_fd; 446221715Sdelphij p->setnonblock_op = pcap_setnonblock_fd; 447221715Sdelphij p->stats_op = pcap_stats_pf; 448221715Sdelphij p->close_op = pcap_close_pf; 449221715Sdelphij 450221715Sdelphij return (p); 451221715Sdelphij bad: 452221715Sdelphij if (p->fd >= 0) 453221715Sdelphij close(p->fd); 454221715Sdelphij free(p); 455221715Sdelphij return (NULL); 456221715Sdelphij} 457221715Sdelphij 458221715Sdelphijint 459221715Sdelphijpcap_platform_finddevs(pcap_if_t **alldevsp, char *errbuf) 460221715Sdelphij{ 461221715Sdelphij return (0); 462221715Sdelphij} 463221715Sdelphij 464221715Sdelphijstatic int 465221715Sdelphijpcap_setfilter_pf(pcap_t *p, struct bpf_program *fp) 466221715Sdelphij{ 467221715Sdelphij struct bpf_version bv; 468221715Sdelphij 469221715Sdelphij /* 470221715Sdelphij * See if BIOCVERSION works. If not, we assume the kernel doesn't 471221715Sdelphij * support BPF-style filters (it's not documented in the bpf(7) 472221715Sdelphij * or packetfiler(7) man pages, but the code used to fail if 473221715Sdelphij * BIOCSETF worked but BIOCVERSION didn't, and I've seen it do 474221715Sdelphij * kernel filtering in DU 4.0, so presumably BIOCVERSION works 475221715Sdelphij * there, at least). 476221715Sdelphij */ 477221715Sdelphij if (ioctl(p->fd, BIOCVERSION, (caddr_t)&bv) >= 0) { 478221715Sdelphij /* 479221715Sdelphij * OK, we have the version of the BPF interpreter; 480221715Sdelphij * is it the same major version as us, and the same 481221715Sdelphij * or better minor version? 482221715Sdelphij */ 483221715Sdelphij if (bv.bv_major == BPF_MAJOR_VERSION && 484221715Sdelphij bv.bv_minor >= BPF_MINOR_VERSION) { 485221715Sdelphij /* 486221715Sdelphij * Yes. Try to install the filter. 487221715Sdelphij */ 488221715Sdelphij if (ioctl(p->fd, BIOCSETF, (caddr_t)fp) < 0) { 489221715Sdelphij snprintf(p->errbuf, sizeof(p->errbuf), 490221715Sdelphij "BIOCSETF: %s", pcap_strerror(errno)); 491221715Sdelphij return (-1); 492221715Sdelphij } 493221715Sdelphij 494221715Sdelphij /* 495221715Sdelphij * OK, that succeeded. We're doing filtering in 496221715Sdelphij * the kernel. (We assume we don't have a 497221715Sdelphij * userland filter installed - that'd require 498221715Sdelphij * a previous version check to have failed but 499221715Sdelphij * this one to succeed.) 500221715Sdelphij * 501221715Sdelphij * XXX - this message should be supplied to the 502221715Sdelphij * application as a warning of some sort, 503221715Sdelphij * except that if it's a GUI application, it's 504221715Sdelphij * not clear that it should be displayed in 505221715Sdelphij * a window to annoy the user. 506221715Sdelphij */ 507221715Sdelphij fprintf(stderr, "tcpdump: Using kernel BPF filter\n"); 508221715Sdelphij p->md.use_bpf = 1; 509221715Sdelphij return (0); 510221715Sdelphij } 511221715Sdelphij 512221715Sdelphij /* 513221715Sdelphij * We can't use the kernel's BPF interpreter; don't give 514221715Sdelphij * up, just log a message and be inefficient. 515221715Sdelphij * 516221715Sdelphij * XXX - this should really be supplied to the application 517221715Sdelphij * as a warning of some sort. 518221715Sdelphij */ 519221715Sdelphij fprintf(stderr, 520221715Sdelphij "tcpdump: Requires BPF language %d.%d or higher; kernel is %d.%d\n", 521221715Sdelphij BPF_MAJOR_VERSION, BPF_MINOR_VERSION, 522221715Sdelphij bv.bv_major, bv.bv_minor); 523221715Sdelphij } 524221715Sdelphij 525221715Sdelphij /* 526221715Sdelphij * We couldn't do filtering in the kernel; do it in userland. 527221715Sdelphij */ 528221715Sdelphij if (install_bpf_program(p, fp) < 0) 529221715Sdelphij return (-1); 530221715Sdelphij 531221715Sdelphij /* 532221715Sdelphij * XXX - this message should be supplied by the application as 533221715Sdelphij * a warning of some sort. 53460786Sps */ 53560786Sps fprintf(stderr, "tcpdump: Filtering in user process\n"); 53660786Sps p->md.use_bpf = 0; 53760786Sps return (0); 538221715Sdelphij} 53960786Sps