pcap-int.h revision 172680
117683Spst/* 217683Spst * Copyright (c) 1994, 1995, 1996 317683Spst * The Regents of the University of California. All rights reserved. 417683Spst * 517683Spst * Redistribution and use in source and binary forms, with or without 617683Spst * modification, are permitted provided that the following conditions 717683Spst * are met: 817683Spst * 1. Redistributions of source code must retain the above copyright 917683Spst * notice, this list of conditions and the following disclaimer. 1017683Spst * 2. Redistributions in binary form must reproduce the above copyright 1117683Spst * notice, this list of conditions and the following disclaimer in the 1217683Spst * documentation and/or other materials provided with the distribution. 1317683Spst * 3. All advertising materials mentioning features or use of this software 1417683Spst * must display the following acknowledgement: 1517683Spst * This product includes software developed by the Computer Systems 1617683Spst * Engineering Group at Lawrence Berkeley Laboratory. 1717683Spst * 4. Neither the name of the University nor of the Laboratory may be used 1817683Spst * to endorse or promote products derived from this software without 1917683Spst * specific prior written permission. 2017683Spst * 2117683Spst * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 2217683Spst * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 2317683Spst * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 2417683Spst * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 2517683Spst * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 2617683Spst * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 2717683Spst * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 2817683Spst * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 2917683Spst * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 3017683Spst * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 3117683Spst * SUCH DAMAGE. 3217683Spst * 3356891Sfenner * $FreeBSD: head/contrib/libpcap/pcap-int.h 172680 2007-10-16 02:07:55Z mlaier $ 34172680Smlaier * @(#) $Header: /tcpdump/master/libpcap/pcap-int.h,v 1.68.2.11 2007/06/22 06:43:58 guy Exp $ (LBL) 3517683Spst */ 3617683Spst 3717683Spst#ifndef pcap_int_h 3817683Spst#define pcap_int_h 3917683Spst 4038151Sphk#ifdef __cplusplus 4138151Sphkextern "C" { 4238151Sphk#endif 4338151Sphk 4417683Spst#include <pcap.h> 4517683Spst 46127667Sbms#ifdef WIN32 47172680Smlaier#include <Packet32.h> 48127667Sbms#endif /* WIN32 */ 49127667Sbms 50146771Ssam#ifdef MSDOS 51146771Ssam#include <fcntl.h> 52146771Ssam#include <io.h> 53146771Ssam#endif 54146771Ssam 5517683Spst/* 56172680Smlaier * Swap byte ordering of unsigned long long timestamp on a big endian 57172680Smlaier * machine. 58172680Smlaier */ 59172680Smlaier#define SWAPLL(ull) ((ull & 0xff00000000000000LL) >> 56) | \ 60172680Smlaier ((ull & 0x00ff000000000000LL) >> 40) | \ 61172680Smlaier ((ull & 0x0000ff0000000000LL) >> 24) | \ 62172680Smlaier ((ull & 0x000000ff00000000LL) >> 8) | \ 63172680Smlaier ((ull & 0x00000000ff000000LL) << 8) | \ 64172680Smlaier ((ull & 0x0000000000ff0000LL) << 24) | \ 65172680Smlaier ((ull & 0x000000000000ff00LL) << 40) | \ 66172680Smlaier ((ull & 0x00000000000000ffLL) << 56) 67172680Smlaier 68172680Smlaier/* 6917683Spst * Savefile 7017683Spst */ 71127667Sbmstypedef enum { 72127667Sbms NOT_SWAPPED, 73127667Sbms SWAPPED, 74127667Sbms MAYBE_SWAPPED 75127667Sbms} swapped_type_t; 76127667Sbms 7717683Spststruct pcap_sf { 7817683Spst FILE *rfile; 7917683Spst int swapped; 8075110Sfenner int hdrsize; 81127667Sbms swapped_type_t lengths_swapped; 8217683Spst int version_major; 8317683Spst int version_minor; 8417683Spst u_char *base; 8517683Spst}; 8617683Spst 8717683Spststruct pcap_md { 8817683Spst struct pcap_stat stat; 8917683Spst /*XXX*/ 9075110Sfenner int use_bpf; /* using kernel filter */ 9117683Spst u_long TotPkts; /* can't oflow for 79 hrs on ether */ 9217683Spst u_long TotAccepted; /* count accepted by filter */ 9317683Spst u_long TotDrops; /* count of dropped packets */ 9417683Spst long TotMissed; /* missed by i/f during this run */ 9517683Spst long OrigMissed; /* missed by i/f before this run */ 96146771Ssam char *device; /* device name */ 9726175Sfenner#ifdef linux 9875110Sfenner int sock_packet; /* using Linux 2.0 compatible interface */ 9975110Sfenner int timeout; /* timeout specified to pcap_open_live */ 10075110Sfenner int clear_promisc; /* must clear promiscuous mode when we close */ 10175110Sfenner int cooked; /* using SOCK_DGRAM rather than SOCK_RAW */ 102146771Ssam int ifindex; /* interface index of device we're bound to */ 10375110Sfenner int lo_ifindex; /* interface index of the loopback device */ 10475110Sfenner struct pcap *next; /* list of open promiscuous sock_packet pcaps */ 105172680Smlaier u_int packets_read; /* count of packets read with recvfrom() */ 10626175Sfenner#endif 107127667Sbms 108127667Sbms#ifdef HAVE_DAG_API 109162015Ssam#ifdef HAVE_DAG_STREAMS_API 110162015Ssam u_char *dag_mem_bottom; /* DAG card current memory bottom pointer */ 111162015Ssam u_char *dag_mem_top; /* DAG card current memory top pointer */ 112162015Ssam#else 113127667Sbms void *dag_mem_base; /* DAG card memory base address */ 114162015Ssam u_int dag_mem_bottom; /* DAG card current memory bottom offset */ 115162015Ssam u_int dag_mem_top; /* DAG card current memory top offset */ 116162015Ssam#endif /* HAVE_DAG_STREAMS_API */ 117127667Sbms int dag_fcs_bits; /* Number of checksum bits from link layer */ 118146771Ssam int dag_offset_flags; /* Flags to pass to dag_offset(). */ 119162015Ssam int dag_stream; /* DAG stream number */ 120162015Ssam int dag_timeout; /* timeout specified to pcap_open_live. 121162015Ssam * Same as in linux above, introduce 122162015Ssam * generally? */ 123162015Ssam#endif /* HAVE_DAG_API */ 12417683Spst}; 12517683Spst 126147897Ssam/* 127147897Ssam * Ultrix, DEC OSF/1^H^H^H^H^H^H^H^H^HDigital UNIX^H^H^H^H^H^H^H^H^H^H^H^H 128172680Smlaier * Tru64 UNIX, and some versions of NetBSD pad FDDI packets to make everything 129172680Smlaier * line up on a nice boundary. 130147897Ssam */ 131172680Smlaier#ifdef __NetBSD__ 132172680Smlaier#include <sys/param.h> /* needed to declare __NetBSD_Version__ */ 133172680Smlaier#endif 134172680Smlaier 135147897Ssam#if defined(ultrix) || defined(__osf__) || (defined(__NetBSD__) && __NetBSD_Version__ > 106000000) 136147897Ssam#define PCAP_FDDIPAD 3 137147897Ssam#endif 138147897Ssam 13917683Spststruct pcap { 140127667Sbms#ifdef WIN32 141127667Sbms ADAPTER *adapter; 142127667Sbms LPPACKET Packet; 143127667Sbms int timeout; 144127667Sbms int nonblock; 145127667Sbms#else 14617683Spst int fd; 147127667Sbms int selectable_fd; 148146771Ssam int send_fd; 149127667Sbms#endif /* WIN32 */ 15017683Spst int snapshot; 15117683Spst int linktype; 15217683Spst int tzoff; /* timezone offset */ 15317683Spst int offset; /* offset for proper alignment */ 15417683Spst 155127667Sbms int break_loop; /* flag set to force break from packet-reading loop */ 156127667Sbms 157146771Ssam#ifdef PCAP_FDDIPAD 158146771Ssam int fddipad; 159146771Ssam#endif 160146771Ssam 161146771Ssam#ifdef MSDOS 162146771Ssam int inter_packet_wait; /* offline: wait between packets */ 163146771Ssam void (*wait_proc)(void); /* call proc while waiting */ 164146771Ssam#endif 165146771Ssam 16617683Spst struct pcap_sf sf; 16717683Spst struct pcap_md md; 16817683Spst 16917683Spst /* 17017683Spst * Read buffer. 17117683Spst */ 17217683Spst int bufsize; 17317683Spst u_char *buffer; 17417683Spst u_char *bp; 17517683Spst int cc; 17617683Spst 17717683Spst /* 17817683Spst * Place holder for pcap_next(). 17917683Spst */ 18017683Spst u_char *pkt; 18117683Spst 182147897Ssam /* We're accepting only packets in this direction/these directions. */ 183162015Ssam pcap_direction_t direction; 184147897Ssam 18517683Spst /* 186127667Sbms * Methods. 187127667Sbms */ 188127667Sbms int (*read_op)(pcap_t *, int cnt, pcap_handler, u_char *); 189146771Ssam int (*inject_op)(pcap_t *, const void *, size_t); 190127667Sbms int (*setfilter_op)(pcap_t *, struct bpf_program *); 191162015Ssam int (*setdirection_op)(pcap_t *, pcap_direction_t); 192127667Sbms int (*set_datalink_op)(pcap_t *, int); 193127667Sbms int (*getnonblock_op)(pcap_t *, char *); 194127667Sbms int (*setnonblock_op)(pcap_t *, int, char *); 195127667Sbms int (*stats_op)(pcap_t *, struct pcap_stat *); 196127667Sbms void (*close_op)(pcap_t *); 197127667Sbms 198127667Sbms /* 19917683Spst * Placeholder for filter code if bpf not in kernel. 20017683Spst */ 20117683Spst struct bpf_program fcode; 20217683Spst 203127667Sbms char errbuf[PCAP_ERRBUF_SIZE + 1]; 204109841Sfenner int dlt_count; 205146771Ssam u_int *dlt_list; 206127667Sbms 207127667Sbms struct pcap_pkthdr pcap_header; /* This is needed for the pcap_next_ex() to work */ 20817683Spst}; 20917683Spst 21056891Sfenner/* 211172680Smlaier * This is a timeval as stored in a savefile. 21256891Sfenner * It has to use the same types everywhere, independent of the actual 213172680Smlaier * `struct timeval'; `struct timeval' has 32-bit tv_sec values on some 214172680Smlaier * platforms and 64-bit tv_sec values on other platforms, and writing 215172680Smlaier * out native `struct timeval' values would mean files could only be 216172680Smlaier * read on systems with the same tv_sec size as the system on which 217172680Smlaier * the file was written. 21856891Sfenner */ 21956891Sfenner 22056891Sfennerstruct pcap_timeval { 22156891Sfenner bpf_int32 tv_sec; /* seconds */ 22256891Sfenner bpf_int32 tv_usec; /* microseconds */ 22356891Sfenner}; 22456891Sfenner 22556891Sfenner/* 226172680Smlaier * This is a `pcap_pkthdr' as actually stored in a savefile. 22775110Sfenner * 22875110Sfenner * Do not change the format of this structure, in any way (this includes 22975110Sfenner * changes that only affect the length of fields in this structure), 23075110Sfenner * and do not make the time stamp anything other than seconds and 23175110Sfenner * microseconds (e.g., seconds and nanoseconds). Instead: 23275110Sfenner * 23375110Sfenner * introduce a new structure for the new format; 23475110Sfenner * 23575110Sfenner * send mail to "tcpdump-workers@tcpdump.org", requesting a new 23675110Sfenner * magic number for your new capture file format, and, when 23775110Sfenner * you get the new magic number, put it in "savefile.c"; 23875110Sfenner * 23975110Sfenner * use that magic number for save files with the changed record 24075110Sfenner * header; 24175110Sfenner * 24275110Sfenner * make the code in "savefile.c" capable of reading files with 24375110Sfenner * the old record header as well as files with the new record header 24475110Sfenner * (using the magic number to determine the header format). 24575110Sfenner * 24675110Sfenner * Then supply the changes to "patches@tcpdump.org", so that future 24775110Sfenner * versions of libpcap and programs that use it (such as tcpdump) will 24875110Sfenner * be able to read your new capture file format. 24956891Sfenner */ 25056891Sfenner 25156891Sfennerstruct pcap_sf_pkthdr { 25256891Sfenner struct pcap_timeval ts; /* time stamp */ 25356891Sfenner bpf_u_int32 caplen; /* length of portion present */ 25456891Sfenner bpf_u_int32 len; /* length this packet (off wire) */ 25556891Sfenner}; 25656891Sfenner 25775110Sfenner/* 258172680Smlaier * How a `pcap_pkthdr' is actually stored in savefiles written 25975110Sfenner * by some patched versions of libpcap (e.g. the ones in Red 26075110Sfenner * Hat Linux 6.1 and 6.2). 26175110Sfenner * 26275110Sfenner * Do not change the format of this structure, in any way (this includes 26375110Sfenner * changes that only affect the length of fields in this structure). 26475110Sfenner * Instead, introduce a new structure, as per the above. 26575110Sfenner */ 26675110Sfenner 26775110Sfennerstruct pcap_sf_patched_pkthdr { 26875110Sfenner struct pcap_timeval ts; /* time stamp */ 26975110Sfenner bpf_u_int32 caplen; /* length of portion present */ 27075110Sfenner bpf_u_int32 len; /* length this packet (off wire) */ 27175110Sfenner int index; 27275110Sfenner unsigned short protocol; 27375110Sfenner unsigned char pkt_type; 27475110Sfenner}; 27575110Sfenner 27617683Spstint yylex(void); 27717683Spst 27817683Spst#ifndef min 27917683Spst#define min(a, b) ((a) > (b) ? (b) : (a)) 28017683Spst#endif 28117683Spst 28217683Spst/* XXX should these be in pcap.h? */ 28317683Spstint pcap_offline_read(pcap_t *, int, pcap_handler, u_char *); 28417683Spstint pcap_read(pcap_t *, int cnt, pcap_handler, u_char *); 28517683Spst 286147897Ssam#ifndef HAVE_STRLCPY 287147897Ssam#define strlcpy(x, y, z) \ 288147897Ssam (strncpy((x), (y), (z)), \ 289147897Ssam ((z) <= 0 ? 0 : ((x)[(z) - 1] = '\0')), \ 290147897Ssam strlen((y))) 29117683Spst#endif 29217683Spst 293127667Sbms#include <stdarg.h> 294127667Sbms 295127667Sbms/* 296127667Sbms * Routines that most pcap implementations can use for non-blocking mode. 297127667Sbms */ 298146771Ssam#if !defined(WIN32) && !defined(MSDOS) 299127667Sbmsint pcap_getnonblock_fd(pcap_t *, char *); 300127667Sbmsint pcap_setnonblock_fd(pcap_t *p, int, char *); 301127667Sbms#endif 302127667Sbms 303146771Ssamvoid pcap_close_common(pcap_t *); 304146771Ssam 305127667Sbms/* 306127667Sbms * Internal interfaces for "pcap_findalldevs()". 307127667Sbms * 308127667Sbms * "pcap_platform_finddevs()" is a platform-dependent routine to 309127667Sbms * add devices not found by the "standard" mechanisms (SIOCGIFCONF, 310127667Sbms * "getifaddrs()", etc.. 311127667Sbms * 312127667Sbms * "pcap_add_if()" adds an interface to the list of interfaces. 313127667Sbms */ 314127667Sbmsint pcap_platform_finddevs(pcap_if_t **, char *); 315146771Ssamint add_addr_to_iflist(pcap_if_t **, const char *, u_int, struct sockaddr *, 316127667Sbms size_t, struct sockaddr *, size_t, struct sockaddr *, size_t, 317127667Sbms struct sockaddr *, size_t, char *); 318146771Ssamint pcap_add_if(pcap_if_t **, const char *, u_int, const char *, char *); 319127667Sbmsstruct sockaddr *dup_sockaddr(struct sockaddr *, size_t); 320127667Sbmsint add_or_find_if(pcap_if_t **, pcap_if_t **, const char *, u_int, 321127667Sbms const char *, char *); 322127667Sbms 323127667Sbms#ifdef WIN32 324127667Sbmschar *pcap_win32strerror(void); 325127667Sbms#endif 326127667Sbms 32775110Sfennerint install_bpf_program(pcap_t *, struct bpf_program *); 32875110Sfenner 329127667Sbmsint pcap_strcasecmp(const char *, const char *); 330127667Sbms 33138151Sphk#ifdef __cplusplus 33238151Sphk} 33317683Spst#endif 33438151Sphk 33538151Sphk#endif 336