1335640Shselasky/* 2335640Shselasky * Copyright (c) 1994, 1995, 1996 3335640Shselasky * The Regents of the University of California. All rights reserved. 4335640Shselasky * 5335640Shselasky * Redistribution and use in source and binary forms, with or without 6335640Shselasky * modification, are permitted provided that the following conditions 7335640Shselasky * are met: 8335640Shselasky * 1. Redistributions of source code must retain the above copyright 9335640Shselasky * notice, this list of conditions and the following disclaimer. 10335640Shselasky * 2. Redistributions in binary form must reproduce the above copyright 11335640Shselasky * notice, this list of conditions and the following disclaimer in the 12335640Shselasky * documentation and/or other materials provided with the distribution. 13335640Shselasky * 3. All advertising materials mentioning features or use of this software 14335640Shselasky * must display the following acknowledgement: 15335640Shselasky * This product includes software developed by the Computer Systems 16335640Shselasky * Engineering Group at Lawrence Berkeley Laboratory. 17335640Shselasky * 4. Neither the name of the University nor of the Laboratory may be used 18335640Shselasky * to endorse or promote products derived from this software without 19335640Shselasky * specific prior written permission. 20335640Shselasky * 21335640Shselasky * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 22335640Shselasky * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23335640Shselasky * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24335640Shselasky * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 25335640Shselasky * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26335640Shselasky * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27335640Shselasky * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28335640Shselasky * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29335640Shselasky * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30335640Shselasky * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31335640Shselasky * SUCH DAMAGE. 32335640Shselasky */ 33335640Shselasky 34335640Shselasky#ifndef pcap_int_h 35335640Shselasky#define pcap_int_h 36335640Shselasky 37335640Shselasky#include <signal.h> 38335640Shselasky 39335640Shselasky#include <pcap/pcap.h> 40335640Shselasky 41335640Shselasky#include "varattrs.h" 42335640Shselasky#include "fmtutils.h" 43335640Shselasky 44335640Shselasky/* 45335640Shselasky * Version string. 46335640Shselasky * Uses PACKAGE_VERSION from config.h. 47335640Shselasky */ 48335640Shselasky#define PCAP_VERSION_STRING "libpcap version " PACKAGE_VERSION 49335640Shselasky 50335640Shselasky#ifdef __cplusplus 51335640Shselaskyextern "C" { 52335640Shselasky#endif 53335640Shselasky 54335640Shselasky#ifdef MSDOS 55335640Shselasky #include <fcntl.h> 56335640Shselasky #include <io.h> 57335640Shselasky#endif 58335640Shselasky 59335640Shselasky/* 60335640Shselasky * Swap byte ordering of unsigned long long timestamp on a big endian 61335640Shselasky * machine. 62335640Shselasky */ 63335640Shselasky#define SWAPLL(ull) ((ull & 0xff00000000000000ULL) >> 56) | \ 64335640Shselasky ((ull & 0x00ff000000000000ULL) >> 40) | \ 65335640Shselasky ((ull & 0x0000ff0000000000ULL) >> 24) | \ 66335640Shselasky ((ull & 0x000000ff00000000ULL) >> 8) | \ 67335640Shselasky ((ull & 0x00000000ff000000ULL) << 8) | \ 68335640Shselasky ((ull & 0x0000000000ff0000ULL) << 24) | \ 69335640Shselasky ((ull & 0x000000000000ff00ULL) << 40) | \ 70335640Shselasky ((ull & 0x00000000000000ffULL) << 56) 71335640Shselasky 72335640Shselasky/* 73335640Shselasky * Maximum snapshot length. 74335640Shselasky * 75335640Shselasky * Somewhat arbitrary, but chosen to be: 76335640Shselasky * 77335640Shselasky * 1) big enough for maximum-size Linux loopback packets (65549) 78335640Shselasky * and some USB packets captured with USBPcap: 79335640Shselasky * 80335640Shselasky * http://desowin.org/usbpcap/ 81335640Shselasky * 82335640Shselasky * (> 131072, < 262144) 83335640Shselasky * 84335640Shselasky * and 85335640Shselasky * 86335640Shselasky * 2) small enough not to cause attempts to allocate huge amounts of 87335640Shselasky * memory; some applications might use the snapshot length in a 88335640Shselasky * savefile header to control the size of the buffer they allocate, 89356341Scy * so a size of, say, 2^31-1 might not work well. (libpcap uses it 90356341Scy * as a hint, but doesn't start out allocating a buffer bigger than 91356341Scy * 2 KiB, and grows the buffer as necessary, but not beyond the 92356341Scy * per-linktype maximum snapshot length. Other code might naively 93356341Scy * use it; we want to avoid writing a too-large snapshot length, 94356341Scy * in order not to cause that code problems.) 95335640Shselasky * 96335640Shselasky * We don't enforce this in pcap_set_snaplen(), but we use it internally. 97335640Shselasky */ 98335640Shselasky#define MAXIMUM_SNAPLEN 262144 99335640Shselasky 100335640Shselaskystruct pcap_opt { 101335640Shselasky char *device; 102335640Shselasky int timeout; /* timeout for buffering */ 103335640Shselasky u_int buffer_size; 104335640Shselasky int promisc; 105335640Shselasky int rfmon; /* monitor mode */ 106335640Shselasky int immediate; /* immediate mode - deliver packets as soon as they arrive */ 107335640Shselasky int nonblock; /* non-blocking mode - don't wait for packets to be delivered, return "no packets available" */ 108335640Shselasky int tstamp_type; 109335640Shselasky int tstamp_precision; 110335640Shselasky 111335640Shselasky /* 112335640Shselasky * Platform-dependent options. 113335640Shselasky */ 114335640Shselasky#ifdef __linux__ 115335640Shselasky int protocol; /* protocol to use when creating PF_PACKET socket */ 116335640Shselasky#endif 117335640Shselasky#ifdef _WIN32 118335640Shselasky int nocapture_local;/* disable NPF loopback */ 119335640Shselasky#endif 120335640Shselasky}; 121335640Shselasky 122335640Shselaskytypedef int (*activate_op_t)(pcap_t *); 123335640Shselaskytypedef int (*can_set_rfmon_op_t)(pcap_t *); 124335640Shselaskytypedef int (*read_op_t)(pcap_t *, int cnt, pcap_handler, u_char *); 125335640Shselaskytypedef int (*next_packet_op_t)(pcap_t *, struct pcap_pkthdr *, u_char **); 126335640Shselaskytypedef int (*inject_op_t)(pcap_t *, const void *, size_t); 127335640Shselaskytypedef void (*save_current_filter_op_t)(pcap_t *, const char *); 128335640Shselaskytypedef int (*setfilter_op_t)(pcap_t *, struct bpf_program *); 129335640Shselaskytypedef int (*setdirection_op_t)(pcap_t *, pcap_direction_t); 130335640Shselaskytypedef int (*set_datalink_op_t)(pcap_t *, int); 131335640Shselaskytypedef int (*getnonblock_op_t)(pcap_t *); 132335640Shselaskytypedef int (*setnonblock_op_t)(pcap_t *, int); 133335640Shselaskytypedef int (*stats_op_t)(pcap_t *, struct pcap_stat *); 134335640Shselasky#ifdef _WIN32 135335640Shselaskytypedef struct pcap_stat *(*stats_ex_op_t)(pcap_t *, int *); 136335640Shselaskytypedef int (*setbuff_op_t)(pcap_t *, int); 137335640Shselaskytypedef int (*setmode_op_t)(pcap_t *, int); 138335640Shselaskytypedef int (*setmintocopy_op_t)(pcap_t *, int); 139335640Shselaskytypedef HANDLE (*getevent_op_t)(pcap_t *); 140335640Shselaskytypedef int (*oid_get_request_op_t)(pcap_t *, bpf_u_int32, void *, size_t *); 141335640Shselaskytypedef int (*oid_set_request_op_t)(pcap_t *, bpf_u_int32, const void *, size_t *); 142335640Shselaskytypedef u_int (*sendqueue_transmit_op_t)(pcap_t *, pcap_send_queue *, int); 143335640Shselaskytypedef int (*setuserbuffer_op_t)(pcap_t *, int); 144335640Shselaskytypedef int (*live_dump_op_t)(pcap_t *, char *, int, int); 145335640Shselaskytypedef int (*live_dump_ended_op_t)(pcap_t *, int); 146335640Shselaskytypedef PAirpcapHandle (*get_airpcap_handle_op_t)(pcap_t *); 147335640Shselasky#endif 148335640Shselaskytypedef void (*cleanup_op_t)(pcap_t *); 149335640Shselasky 150335640Shselasky/* 151335640Shselasky * We put all the stuff used in the read code path at the beginning, 152335640Shselasky * to try to keep it together in the same cache line or lines. 153335640Shselasky */ 154335640Shselaskystruct pcap { 155335640Shselasky /* 156335640Shselasky * Method to call to read packets on a live capture. 157335640Shselasky */ 158335640Shselasky read_op_t read_op; 159335640Shselasky 160335640Shselasky /* 161335640Shselasky * Method to call to read the next packet from a savefile. 162335640Shselasky */ 163335640Shselasky next_packet_op_t next_packet_op; 164335640Shselasky 165335640Shselasky#ifdef _WIN32 166335640Shselasky HANDLE handle; 167335640Shselasky#else 168335640Shselasky int fd; 169335640Shselasky#endif /* _WIN32 */ 170335640Shselasky 171335640Shselasky /* 172335640Shselasky * Read buffer. 173335640Shselasky */ 174335640Shselasky u_int bufsize; 175335640Shselasky void *buffer; 176335640Shselasky u_char *bp; 177335640Shselasky int cc; 178335640Shselasky 179335640Shselasky sig_atomic_t break_loop; /* flag set to force break from packet-reading loop */ 180335640Shselasky 181335640Shselasky void *priv; /* private data for methods */ 182335640Shselasky 183335640Shselasky#ifdef ENABLE_REMOTE 184335640Shselasky struct pcap_samp rmt_samp; /* parameters related to the sampling process. */ 185335640Shselasky#endif 186335640Shselasky 187335640Shselasky int swapped; 188335640Shselasky FILE *rfile; /* null if live capture, non-null if savefile */ 189335640Shselasky u_int fddipad; 190335640Shselasky struct pcap *next; /* list of open pcaps that need stuff cleared on close */ 191335640Shselasky 192335640Shselasky /* 193335640Shselasky * File version number; meaningful only for a savefile, but we 194335640Shselasky * keep it here so that apps that (mistakenly) ask for the 195335640Shselasky * version numbers will get the same zero values that they 196335640Shselasky * always did. 197335640Shselasky */ 198335640Shselasky int version_major; 199335640Shselasky int version_minor; 200335640Shselasky 201335640Shselasky int snapshot; 202335640Shselasky int linktype; /* Network linktype */ 203335640Shselasky int linktype_ext; /* Extended information stored in the linktype field of a file */ 204335640Shselasky int tzoff; /* timezone offset */ 205335640Shselasky int offset; /* offset for proper alignment */ 206335640Shselasky int activated; /* true if the capture is really started */ 207335640Shselasky int oldstyle; /* if we're opening with pcap_open_live() */ 208335640Shselasky 209335640Shselasky struct pcap_opt opt; 210335640Shselasky 211335640Shselasky /* 212335640Shselasky * Place holder for pcap_next(). 213335640Shselasky */ 214335640Shselasky u_char *pkt; 215335640Shselasky 216335640Shselasky#ifdef _WIN32 217335640Shselasky struct pcap_stat stat; /* used for pcap_stats_ex() */ 218335640Shselasky#endif 219335640Shselasky 220335640Shselasky /* We're accepting only packets in this direction/these directions. */ 221335640Shselasky pcap_direction_t direction; 222335640Shselasky 223335640Shselasky /* 224335640Shselasky * Flags to affect BPF code generation. 225335640Shselasky */ 226335640Shselasky int bpf_codegen_flags; 227335640Shselasky 228335640Shselasky#if !defined(_WIN32) && !defined(MSDOS) 229335640Shselasky int selectable_fd; /* FD on which select()/poll()/epoll_wait()/kevent()/etc. can be done */ 230335640Shselasky 231335640Shselasky /* 232335640Shselasky * In case there either is no selectable FD, or there is but 233335640Shselasky * it doesn't necessarily work (e.g., if it doesn't get notified 234335640Shselasky * if the packet capture timeout expires before the buffer 235335640Shselasky * fills up), this points to a timeout that should be used 236335640Shselasky * in select()/poll()/epoll_wait()/kevent() call. The pcap_t should 237335640Shselasky * be put into non-blocking mode, and, if the timeout expires on 238335640Shselasky * the call, an attempt should be made to read packets from all 239335640Shselasky * pcap_t's with a required timeout, and the code must be 240335640Shselasky * prepared not to see any packets from the attempt. 241335640Shselasky */ 242335640Shselasky struct timeval *required_select_timeout; 243335640Shselasky#endif 244335640Shselasky 245335640Shselasky /* 246335640Shselasky * Placeholder for filter code if bpf not in kernel. 247335640Shselasky */ 248335640Shselasky struct bpf_program fcode; 249335640Shselasky 250335640Shselasky char errbuf[PCAP_ERRBUF_SIZE + 1]; 251335640Shselasky int dlt_count; 252335640Shselasky u_int *dlt_list; 253335640Shselasky int tstamp_type_count; 254335640Shselasky u_int *tstamp_type_list; 255335640Shselasky int tstamp_precision_count; 256335640Shselasky u_int *tstamp_precision_list; 257335640Shselasky 258335640Shselasky struct pcap_pkthdr pcap_header; /* This is needed for the pcap_next_ex() to work */ 259335640Shselasky 260335640Shselasky /* 261335640Shselasky * More methods. 262335640Shselasky */ 263335640Shselasky activate_op_t activate_op; 264335640Shselasky can_set_rfmon_op_t can_set_rfmon_op; 265335640Shselasky inject_op_t inject_op; 266335640Shselasky save_current_filter_op_t save_current_filter_op; 267335640Shselasky setfilter_op_t setfilter_op; 268335640Shselasky setdirection_op_t setdirection_op; 269335640Shselasky set_datalink_op_t set_datalink_op; 270335640Shselasky getnonblock_op_t getnonblock_op; 271335640Shselasky setnonblock_op_t setnonblock_op; 272335640Shselasky stats_op_t stats_op; 273335640Shselasky 274335640Shselasky /* 275335640Shselasky * Routine to use as callback for pcap_next()/pcap_next_ex(). 276335640Shselasky */ 277335640Shselasky pcap_handler oneshot_callback; 278335640Shselasky 279335640Shselasky#ifdef _WIN32 280335640Shselasky /* 281335640Shselasky * These are, at least currently, specific to the Win32 NPF 282335640Shselasky * driver. 283335640Shselasky */ 284335640Shselasky stats_ex_op_t stats_ex_op; 285335640Shselasky setbuff_op_t setbuff_op; 286335640Shselasky setmode_op_t setmode_op; 287335640Shselasky setmintocopy_op_t setmintocopy_op; 288335640Shselasky getevent_op_t getevent_op; 289335640Shselasky oid_get_request_op_t oid_get_request_op; 290335640Shselasky oid_set_request_op_t oid_set_request_op; 291335640Shselasky sendqueue_transmit_op_t sendqueue_transmit_op; 292335640Shselasky setuserbuffer_op_t setuserbuffer_op; 293335640Shselasky live_dump_op_t live_dump_op; 294335640Shselasky live_dump_ended_op_t live_dump_ended_op; 295335640Shselasky get_airpcap_handle_op_t get_airpcap_handle_op; 296335640Shselasky#endif 297335640Shselasky cleanup_op_t cleanup_op; 298335640Shselasky}; 299335640Shselasky 300335640Shselasky/* 301335640Shselasky * BPF code generation flags. 302335640Shselasky */ 303335640Shselasky#define BPF_SPECIAL_VLAN_HANDLING 0x00000001 /* special VLAN handling for Linux */ 304335640Shselasky 305335640Shselasky/* 306335640Shselasky * This is a timeval as stored in a savefile. 307335640Shselasky * It has to use the same types everywhere, independent of the actual 308335640Shselasky * `struct timeval'; `struct timeval' has 32-bit tv_sec values on some 309335640Shselasky * platforms and 64-bit tv_sec values on other platforms, and writing 310335640Shselasky * out native `struct timeval' values would mean files could only be 311335640Shselasky * read on systems with the same tv_sec size as the system on which 312335640Shselasky * the file was written. 313335640Shselasky */ 314335640Shselasky 315335640Shselaskystruct pcap_timeval { 316335640Shselasky bpf_int32 tv_sec; /* seconds */ 317335640Shselasky bpf_int32 tv_usec; /* microseconds */ 318335640Shselasky}; 319335640Shselasky 320335640Shselasky/* 321335640Shselasky * This is a `pcap_pkthdr' as actually stored in a savefile. 322335640Shselasky * 323335640Shselasky * Do not change the format of this structure, in any way (this includes 324335640Shselasky * changes that only affect the length of fields in this structure), 325335640Shselasky * and do not make the time stamp anything other than seconds and 326335640Shselasky * microseconds (e.g., seconds and nanoseconds). Instead: 327335640Shselasky * 328335640Shselasky * introduce a new structure for the new format; 329335640Shselasky * 330335640Shselasky * send mail to "tcpdump-workers@lists.tcpdump.org", requesting 331335640Shselasky * a new magic number for your new capture file format, and, when 332335640Shselasky * you get the new magic number, put it in "savefile.c"; 333335640Shselasky * 334335640Shselasky * use that magic number for save files with the changed record 335335640Shselasky * header; 336335640Shselasky * 337335640Shselasky * make the code in "savefile.c" capable of reading files with 338335640Shselasky * the old record header as well as files with the new record header 339335640Shselasky * (using the magic number to determine the header format). 340335640Shselasky * 341335640Shselasky * Then supply the changes by forking the branch at 342335640Shselasky * 343335640Shselasky * https://github.com/the-tcpdump-group/libpcap/issues 344335640Shselasky * 345335640Shselasky * and issuing a pull request, so that future versions of libpcap and 346335640Shselasky * programs that use it (such as tcpdump) will be able to read your new 347335640Shselasky * capture file format. 348335640Shselasky */ 349335640Shselasky 350335640Shselaskystruct pcap_sf_pkthdr { 351335640Shselasky struct pcap_timeval ts; /* time stamp */ 352335640Shselasky bpf_u_int32 caplen; /* length of portion present */ 353335640Shselasky bpf_u_int32 len; /* length this packet (off wire) */ 354335640Shselasky}; 355335640Shselasky 356335640Shselasky/* 357335640Shselasky * How a `pcap_pkthdr' is actually stored in savefiles written 358335640Shselasky * by some patched versions of libpcap (e.g. the ones in Red 359335640Shselasky * Hat Linux 6.1 and 6.2). 360335640Shselasky * 361335640Shselasky * Do not change the format of this structure, in any way (this includes 362335640Shselasky * changes that only affect the length of fields in this structure). 363335640Shselasky * Instead, introduce a new structure, as per the above. 364335640Shselasky */ 365335640Shselasky 366335640Shselaskystruct pcap_sf_patched_pkthdr { 367335640Shselasky struct pcap_timeval ts; /* time stamp */ 368335640Shselasky bpf_u_int32 caplen; /* length of portion present */ 369335640Shselasky bpf_u_int32 len; /* length this packet (off wire) */ 370335640Shselasky int index; 371335640Shselasky unsigned short protocol; 372335640Shselasky unsigned char pkt_type; 373335640Shselasky}; 374335640Shselasky 375335640Shselasky/* 376335640Shselasky * User data structure for the one-shot callback used for pcap_next() 377335640Shselasky * and pcap_next_ex(). 378335640Shselasky */ 379335640Shselaskystruct oneshot_userdata { 380335640Shselasky struct pcap_pkthdr *hdr; 381335640Shselasky const u_char **pkt; 382335640Shselasky pcap_t *pd; 383335640Shselasky}; 384335640Shselasky 385335640Shselasky#ifndef min 386335640Shselasky#define min(a, b) ((a) > (b) ? (b) : (a)) 387335640Shselasky#endif 388335640Shselasky 389335640Shselaskyint pcap_offline_read(pcap_t *, int, pcap_handler, u_char *); 390335640Shselasky 391335640Shselasky#include <stdarg.h> 392335640Shselasky 393335640Shselasky#include "portability.h" 394335640Shselasky 395335640Shselasky/* 396335640Shselasky * Does the packet count argument to a module's read routine say 397335640Shselasky * "supply packets until you run out of packets"? 398335640Shselasky */ 399335640Shselasky#define PACKET_COUNT_IS_UNLIMITED(count) ((count) <= 0) 400335640Shselasky 401335640Shselasky/* 402335640Shselasky * Routines that most pcap implementations can use for non-blocking mode. 403335640Shselasky */ 404335640Shselasky#if !defined(_WIN32) && !defined(MSDOS) 405335640Shselaskyint pcap_getnonblock_fd(pcap_t *); 406335640Shselaskyint pcap_setnonblock_fd(pcap_t *p, int); 407335640Shselasky#endif 408335640Shselasky 409335640Shselasky/* 410335640Shselasky * Internal interfaces for "pcap_create()". 411335640Shselasky * 412335640Shselasky * "pcap_create_interface()" is the routine to do a pcap_create on 413335640Shselasky * a regular network interface. There are multiple implementations 414335640Shselasky * of this, one for each platform type (Linux, BPF, DLPI, etc.), 415335640Shselasky * with the one used chosen by the configure script. 416335640Shselasky * 417335640Shselasky * "pcap_create_common()" allocates and fills in a pcap_t, for use 418335640Shselasky * by pcap_create routines. 419335640Shselasky */ 420335640Shselaskypcap_t *pcap_create_interface(const char *, char *); 421335640Shselaskypcap_t *pcap_create_common(char *, size_t); 422335640Shselaskyint pcap_do_addexit(pcap_t *); 423335640Shselaskyvoid pcap_add_to_pcaps_to_close(pcap_t *); 424335640Shselaskyvoid pcap_remove_from_pcaps_to_close(pcap_t *); 425335640Shselaskyvoid pcap_cleanup_live_common(pcap_t *); 426335640Shselaskyint pcap_check_activated(pcap_t *); 427335640Shselasky 428335640Shselasky/* 429335640Shselasky * Internal interfaces for "pcap_findalldevs()". 430335640Shselasky * 431335640Shselasky * A pcap_if_list_t * is a reference to a list of devices. 432335640Shselasky * 433335640Shselasky * A get_if_flags_func is a platform-dependent function called to get 434335640Shselasky * additional interface flags. 435335640Shselasky * 436335640Shselasky * "pcap_platform_finddevs()" is the platform-dependent routine to 437335640Shselasky * find local network interfaces. 438335640Shselasky * 439335640Shselasky * "pcap_findalldevs_interfaces()" is a helper to find those interfaces 440335640Shselasky * using the "standard" mechanisms (SIOCGIFCONF, "getifaddrs()", etc.). 441335640Shselasky * 442335640Shselasky * "add_dev()" adds an entry to a pcap_if_list_t. 443335640Shselasky * 444335640Shselasky * "find_dev()" tries to find a device, by name, in a pcap_if_list_t. 445335640Shselasky * 446335640Shselasky * "find_or_add_dev()" checks whether a device is already in a pcap_if_list_t 447335640Shselasky * and, if not, adds an entry for it. 448335640Shselasky */ 449335640Shselaskystruct pcap_if_list; 450335640Shselaskytypedef struct pcap_if_list pcap_if_list_t; 451335640Shselaskytypedef int (*get_if_flags_func)(const char *, bpf_u_int32 *, char *); 452335640Shselaskyint pcap_platform_finddevs(pcap_if_list_t *, char *); 453335640Shselasky#if !defined(_WIN32) && !defined(MSDOS) 454335640Shselaskyint pcap_findalldevs_interfaces(pcap_if_list_t *, char *, 455335640Shselasky int (*)(const char *), get_if_flags_func); 456335640Shselasky#endif 457335640Shselaskypcap_if_t *find_or_add_dev(pcap_if_list_t *, const char *, bpf_u_int32, 458335640Shselasky get_if_flags_func, const char *, char *); 459335640Shselaskypcap_if_t *find_dev(pcap_if_list_t *, const char *); 460335640Shselaskypcap_if_t *add_dev(pcap_if_list_t *, const char *, bpf_u_int32, const char *, 461335640Shselasky char *); 462335640Shselaskyint add_addr_to_dev(pcap_if_t *, struct sockaddr *, size_t, 463335640Shselasky struct sockaddr *, size_t, struct sockaddr *, size_t, 464335640Shselasky struct sockaddr *dstaddr, size_t, char *errbuf); 465335640Shselasky#ifndef _WIN32 466335640Shselaskypcap_if_t *find_or_add_if(pcap_if_list_t *, const char *, bpf_u_int32, 467335640Shselasky get_if_flags_func, char *); 468335640Shselaskyint add_addr_to_if(pcap_if_list_t *, const char *, bpf_u_int32, 469335640Shselasky get_if_flags_func, 470335640Shselasky struct sockaddr *, size_t, struct sockaddr *, size_t, 471335640Shselasky struct sockaddr *, size_t, struct sockaddr *, size_t, char *); 472335640Shselasky#endif 473335640Shselasky 474335640Shselasky/* 475335640Shselasky * Internal interfaces for "pcap_open_offline()". 476335640Shselasky * 477335640Shselasky * "pcap_open_offline_common()" allocates and fills in a pcap_t, for use 478335640Shselasky * by pcap_open_offline routines. 479335640Shselasky * 480356341Scy * "pcap_adjust_snapshot()" adjusts the snapshot to be non-zero and 481356341Scy * fit within an int. 482356341Scy * 483335640Shselasky * "sf_cleanup()" closes the file handle associated with a pcap_t, if 484335640Shselasky * appropriate, and frees all data common to all modules for handling 485335640Shselasky * savefile types. 486335640Shselasky */ 487335640Shselaskypcap_t *pcap_open_offline_common(char *ebuf, size_t size); 488356341Scybpf_u_int32 pcap_adjust_snapshot(bpf_u_int32 linktype, bpf_u_int32 snaplen); 489335640Shselaskyvoid sf_cleanup(pcap_t *p); 490335640Shselasky 491335640Shselasky/* 492356341Scy * Internal interfaces for doing user-mode filtering of packets and 493356341Scy * validating filter programs. 494356341Scy */ 495356341Scy/* 496356341Scy * Auxiliary data, for use when interpreting a filter intended for the 497356341Scy * Linux kernel when the kernel rejects the filter (requiring us to 498356341Scy * run it in userland). It contains VLAN tag information. 499356341Scy */ 500356341Scystruct bpf_aux_data { 501356341Scy u_short vlan_tag_present; 502356341Scy u_short vlan_tag; 503356341Scy}; 504356341Scy 505356341Scy/* 506356341Scy * Filtering routine that takes the auxiliary data as an additional 507356341Scy * argument. 508356341Scy */ 509356341Scyu_int bpf_filter_with_aux_data(const struct bpf_insn *, 510356341Scy const u_char *, u_int, u_int, const struct bpf_aux_data *); 511356341Scy 512356341Scy/* 513335640Shselasky * Internal interfaces for both "pcap_create()" and routines that 514335640Shselasky * open savefiles. 515335640Shselasky * 516335640Shselasky * "pcap_oneshot()" is the standard one-shot callback for "pcap_next()" 517335640Shselasky * and "pcap_next_ex()". 518335640Shselasky */ 519335640Shselaskyvoid pcap_oneshot(u_char *, const struct pcap_pkthdr *, const u_char *); 520335640Shselasky 521335640Shselaskyint install_bpf_program(pcap_t *, struct bpf_program *); 522335640Shselasky 523335640Shselaskyint pcap_strcasecmp(const char *, const char *); 524335640Shselasky 525335640Shselasky#ifdef YYDEBUG 526335640Shselaskyextern int pcap_debug; 527335640Shselasky#endif 528335640Shselasky 529335640Shselasky#ifdef __cplusplus 530335640Shselasky} 531335640Shselasky#endif 532335640Shselasky 533335640Shselasky#endif 534