1/* 2 * pcap-linux.c: Packet capture interface to the Linux kernel 3 * 4 * Copyright (c) 2000 Torsten Landschoff <torsten@debian.org> 5 * Sebastian Krahmer <krahmer@cs.uni-potsdam.de> 6 * 7 * License: BSD 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in 17 * the documentation and/or other materials provided with the 18 * distribution. 19 * 3. The names of the authors may not be used to endorse or promote 20 * products derived from this software without specific prior 21 * written permission. 22 * 23 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR 24 * IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED 25 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 26 */ 27 28#ifndef lint 29static const char rcsid[] _U_ = 30 "@(#) $Header: /tcpdump/master/libpcap/pcap-linux.c,v 1.110.2.12 2006/09/18 17:34:31 guy Exp $ (LBL)"; 31#endif 32 33/* 34 * Known problems with 2.0[.x] kernels: 35 * 36 * - The loopback device gives every packet twice; on 2.2[.x] kernels, 37 * if we use PF_PACKET, we can filter out the transmitted version 38 * of the packet by using data in the "sockaddr_ll" returned by 39 * "recvfrom()", but, on 2.0[.x] kernels, we have to use 40 * PF_INET/SOCK_PACKET, which means "recvfrom()" supplies a 41 * "sockaddr_pkt" which doesn't give us enough information to let 42 * us do that. 43 * 44 * - We have to set the interface's IFF_PROMISC flag ourselves, if 45 * we're to run in promiscuous mode, which means we have to turn 46 * it off ourselves when we're done; the kernel doesn't keep track 47 * of how many sockets are listening promiscuously, which means 48 * it won't get turned off automatically when no sockets are 49 * listening promiscuously. We catch "pcap_close()" and, for 50 * interfaces we put into promiscuous mode, take them out of 51 * promiscuous mode - which isn't necessarily the right thing to 52 * do, if another socket also requested promiscuous mode between 53 * the time when we opened the socket and the time when we close 54 * the socket. 55 * 56 * - MSG_TRUNC isn't supported, so you can't specify that "recvfrom()" 57 * return the amount of data that you could have read, rather than 58 * the amount that was returned, so we can't just allocate a buffer 59 * whose size is the snapshot length and pass the snapshot length 60 * as the byte count, and also pass MSG_TRUNC, so that the return 61 * value tells us how long the packet was on the wire. 62 * 63 * This means that, if we want to get the actual size of the packet, 64 * so we can return it in the "len" field of the packet header, 65 * we have to read the entire packet, not just the part that fits 66 * within the snapshot length, and thus waste CPU time copying data 67 * from the kernel that our caller won't see. 68 * 69 * We have to get the actual size, and supply it in "len", because 70 * otherwise, the IP dissector in tcpdump, for example, will complain 71 * about "truncated-ip", as the packet will appear to have been 72 * shorter, on the wire, than the IP header said it should have been. 73 */ 74 75 76#ifdef HAVE_CONFIG_H 77#include "config.h" 78#endif 79 80#include "pcap-int.h" 81#include "sll.h" 82 83#ifdef HAVE_DAG_API 84#include "pcap-dag.h" 85#endif /* HAVE_DAG_API */ 86 87#ifdef HAVE_SEPTEL_API 88#include "pcap-septel.h" 89#endif /* HAVE_SEPTEL_API */ 90 91#include <errno.h> 92#include <stdlib.h> 93#include <unistd.h> 94#include <fcntl.h> 95#include <string.h> 96#include <sys/socket.h> 97#include <sys/ioctl.h> 98#include <sys/utsname.h> 99#include <net/if.h> 100#include <netinet/in.h> 101#include <linux/if_ether.h> 102#include <net/if_arp.h> 103 104/* 105 * If PF_PACKET is defined, we can use {SOCK_RAW,SOCK_DGRAM}/PF_PACKET 106 * sockets rather than SOCK_PACKET sockets. 107 * 108 * To use them, we include <linux/if_packet.h> rather than 109 * <netpacket/packet.h>; we do so because 110 * 111 * some Linux distributions (e.g., Slackware 4.0) have 2.2 or 112 * later kernels and libc5, and don't provide a <netpacket/packet.h> 113 * file; 114 * 115 * not all versions of glibc2 have a <netpacket/packet.h> file 116 * that defines stuff needed for some of the 2.4-or-later-kernel 117 * features, so if the system has a 2.4 or later kernel, we 118 * still can't use those features. 119 * 120 * We're already including a number of other <linux/XXX.h> headers, and 121 * this code is Linux-specific (no other OS has PF_PACKET sockets as 122 * a raw packet capture mechanism), so it's not as if you gain any 123 * useful portability by using <netpacket/packet.h> 124 * 125 * XXX - should we just include <linux/if_packet.h> even if PF_PACKET 126 * isn't defined? It only defines one data structure in 2.0.x, so 127 * it shouldn't cause any problems. 128 */ 129#ifdef PF_PACKET 130# include <linux/if_packet.h> 131 132 /* 133 * On at least some Linux distributions (for example, Red Hat 5.2), 134 * there's no <netpacket/packet.h> file, but PF_PACKET is defined if 135 * you include <sys/socket.h>, but <linux/if_packet.h> doesn't define 136 * any of the PF_PACKET stuff such as "struct sockaddr_ll" or any of 137 * the PACKET_xxx stuff. 138 * 139 * So we check whether PACKET_HOST is defined, and assume that we have 140 * PF_PACKET sockets only if it is defined. 141 */ 142# ifdef PACKET_HOST 143# define HAVE_PF_PACKET_SOCKETS 144# endif /* PACKET_HOST */ 145#endif /* PF_PACKET */ 146 147#ifdef SO_ATTACH_FILTER 148#include <linux/types.h> 149#include <linux/filter.h> 150#endif 151 152#ifndef __GLIBC__ 153typedef int socklen_t; 154#endif 155 156#ifndef MSG_TRUNC 157/* 158 * This is being compiled on a system that lacks MSG_TRUNC; define it 159 * with the value it has in the 2.2 and later kernels, so that, on 160 * those kernels, when we pass it in the flags argument to "recvfrom()" 161 * we're passing the right value and thus get the MSG_TRUNC behavior 162 * we want. (We don't get that behavior on 2.0[.x] kernels, because 163 * they didn't support MSG_TRUNC.) 164 */ 165#define MSG_TRUNC 0x20 166#endif 167 168#ifndef SOL_PACKET 169/* 170 * This is being compiled on a system that lacks SOL_PACKET; define it 171 * with the value it has in the 2.2 and later kernels, so that we can 172 * set promiscuous mode in the good modern way rather than the old 173 * 2.0-kernel crappy way. 174 */ 175#define SOL_PACKET 263 176#endif 177 178#define MAX_LINKHEADER_SIZE 256 179 180/* 181 * When capturing on all interfaces we use this as the buffer size. 182 * Should be bigger then all MTUs that occur in real life. 183 * 64kB should be enough for now. 184 */ 185#define BIGGER_THAN_ALL_MTUS (64*1024) 186 187/* 188 * Prototypes for internal functions 189 */ 190static void map_arphrd_to_dlt(pcap_t *, int, int); 191static int live_open_old(pcap_t *, const char *, int, int, char *); 192static int live_open_new(pcap_t *, const char *, int, int, char *); 193static int pcap_read_linux(pcap_t *, int, pcap_handler, u_char *); 194static int pcap_read_packet(pcap_t *, pcap_handler, u_char *); 195static int pcap_inject_linux(pcap_t *, const void *, size_t); 196static int pcap_stats_linux(pcap_t *, struct pcap_stat *); 197static int pcap_setfilter_linux(pcap_t *, struct bpf_program *); 198static int pcap_setdirection_linux(pcap_t *, pcap_direction_t); 199static void pcap_close_linux(pcap_t *); 200 201/* 202 * Wrap some ioctl calls 203 */ 204#ifdef HAVE_PF_PACKET_SOCKETS 205static int iface_get_id(int fd, const char *device, char *ebuf); 206#endif 207static int iface_get_mtu(int fd, const char *device, char *ebuf); 208static int iface_get_arptype(int fd, const char *device, char *ebuf); 209#ifdef HAVE_PF_PACKET_SOCKETS 210static int iface_bind(int fd, int ifindex, char *ebuf); 211#endif 212static int iface_bind_old(int fd, const char *device, char *ebuf); 213 214#ifdef SO_ATTACH_FILTER 215static int fix_program(pcap_t *handle, struct sock_fprog *fcode); 216static int fix_offset(struct bpf_insn *p); 217static int set_kernel_filter(pcap_t *handle, struct sock_fprog *fcode); 218static int reset_kernel_filter(pcap_t *handle); 219 220static struct sock_filter total_insn 221 = BPF_STMT(BPF_RET | BPF_K, 0); 222static struct sock_fprog total_fcode 223 = { 1, &total_insn }; 224#endif 225 226/* 227 * Get a handle for a live capture from the given device. You can 228 * pass NULL as device to get all packages (without link level 229 * information of course). If you pass 1 as promisc the interface 230 * will be set to promiscous mode (XXX: I think this usage should 231 * be deprecated and functions be added to select that later allow 232 * modification of that values -- Torsten). 233 * 234 * See also pcap(3). 235 */ 236pcap_t * 237pcap_open_live(const char *device, int snaplen, int promisc, int to_ms, 238 char *ebuf) 239{ 240 pcap_t *handle; 241 int mtu; 242 int err; 243 int live_open_ok = 0; 244 struct utsname utsname; 245 246#ifdef HAVE_DAG_API 247 if (strstr(device, "dag")) { 248 return dag_open_live(device, snaplen, promisc, to_ms, ebuf); 249 } 250#endif /* HAVE_DAG_API */ 251 252#ifdef HAVE_SEPTEL_API 253 if (strstr(device, "septel")) { 254 return septel_open_live(device, snaplen, promisc, to_ms, ebuf); 255 } 256#endif /* HAVE_SEPTEL_API */ 257 258 /* Allocate a handle for this session. */ 259 260 handle = malloc(sizeof(*handle)); 261 if (handle == NULL) { 262 snprintf(ebuf, PCAP_ERRBUF_SIZE, "malloc: %s", 263 pcap_strerror(errno)); 264 return NULL; 265 } 266 267 /* Initialize some components of the pcap structure. */ 268 269 memset(handle, 0, sizeof(*handle)); 270 handle->snapshot = snaplen; 271 handle->md.timeout = to_ms; 272 273 /* 274 * NULL and "any" are special devices which give us the hint to 275 * monitor all devices. 276 */ 277 if (!device || strcmp(device, "any") == 0) { 278 device = NULL; 279 handle->md.device = strdup("any"); 280 if (promisc) { 281 promisc = 0; 282 /* Just a warning. */ 283 snprintf(ebuf, PCAP_ERRBUF_SIZE, 284 "Promiscuous mode not supported on the \"any\" device"); 285 } 286 287 } else 288 handle->md.device = strdup(device); 289 290 if (handle->md.device == NULL) { 291 snprintf(ebuf, PCAP_ERRBUF_SIZE, "strdup: %s", 292 pcap_strerror(errno) ); 293 free(handle); 294 return NULL; 295 } 296 297 /* 298 * Current Linux kernels use the protocol family PF_PACKET to 299 * allow direct access to all packets on the network while 300 * older kernels had a special socket type SOCK_PACKET to 301 * implement this feature. 302 * While this old implementation is kind of obsolete we need 303 * to be compatible with older kernels for a while so we are 304 * trying both methods with the newer method preferred. 305 */ 306 307 if ((err = live_open_new(handle, device, promisc, to_ms, ebuf)) == 1) 308 live_open_ok = 1; 309 else if (err == 0) { 310 /* Non-fatal error; try old way */ 311 if (live_open_old(handle, device, promisc, to_ms, ebuf)) 312 live_open_ok = 1; 313 } 314 if (!live_open_ok) { 315 /* 316 * Both methods to open the packet socket failed. Tidy 317 * up and report our failure (ebuf is expected to be 318 * set by the functions above). 319 */ 320 321 if (handle->md.device != NULL) 322 free(handle->md.device); 323 free(handle); 324 return NULL; 325 } 326 327 /* 328 * Compute the buffer size. 329 * 330 * If we're using SOCK_PACKET, this might be a 2.0[.x] kernel, 331 * and might require special handling - check. 332 */ 333 if (handle->md.sock_packet && (uname(&utsname) < 0 || 334 strncmp(utsname.release, "2.0", 3) == 0)) { 335 /* 336 * We're using a SOCK_PACKET structure, and either 337 * we couldn't find out what kernel release this is, 338 * or it's a 2.0[.x] kernel. 339 * 340 * In the 2.0[.x] kernel, a "recvfrom()" on 341 * a SOCK_PACKET socket, with MSG_TRUNC set, will 342 * return the number of bytes read, so if we pass 343 * a length based on the snapshot length, it'll 344 * return the number of bytes from the packet 345 * copied to userland, not the actual length 346 * of the packet. 347 * 348 * This means that, for example, the IP dissector 349 * in tcpdump will get handed a packet length less 350 * than the length in the IP header, and will 351 * complain about "truncated-ip". 352 * 353 * So we don't bother trying to copy from the 354 * kernel only the bytes in which we're interested, 355 * but instead copy them all, just as the older 356 * versions of libpcap for Linux did. 357 * 358 * The buffer therefore needs to be big enough to 359 * hold the largest packet we can get from this 360 * device. Unfortunately, we can't get the MRU 361 * of the network; we can only get the MTU. The 362 * MTU may be too small, in which case a packet larger 363 * than the buffer size will be truncated *and* we 364 * won't get the actual packet size. 365 * 366 * However, if the snapshot length is larger than 367 * the buffer size based on the MTU, we use the 368 * snapshot length as the buffer size, instead; 369 * this means that with a sufficiently large snapshot 370 * length we won't artificially truncate packets 371 * to the MTU-based size. 372 * 373 * This mess just one of many problems with packet 374 * capture on 2.0[.x] kernels; you really want a 375 * 2.2[.x] or later kernel if you want packet capture 376 * to work well. 377 */ 378 mtu = iface_get_mtu(handle->fd, device, ebuf); 379 if (mtu == -1) { 380 pcap_close_linux(handle); 381 free(handle); 382 return NULL; 383 } 384 handle->bufsize = MAX_LINKHEADER_SIZE + mtu; 385 if (handle->bufsize < handle->snapshot) 386 handle->bufsize = handle->snapshot; 387 } else { 388 /* 389 * This is a 2.2[.x] or later kernel (we know that 390 * either because we're not using a SOCK_PACKET 391 * socket - PF_PACKET is supported only in 2.2 392 * and later kernels - or because we checked the 393 * kernel version). 394 * 395 * We can safely pass "recvfrom()" a byte count 396 * based on the snapshot length. 397 * 398 * If we're in cooked mode, make the snapshot length 399 * large enough to hold a "cooked mode" header plus 400 * 1 byte of packet data (so we don't pass a byte 401 * count of 0 to "recvfrom()"). 402 */ 403 if (handle->md.cooked) { 404 if (handle->snapshot < SLL_HDR_LEN + 1) 405 handle->snapshot = SLL_HDR_LEN + 1; 406 } 407 handle->bufsize = handle->snapshot; 408 } 409 410 /* Allocate the buffer */ 411 412 handle->buffer = malloc(handle->bufsize + handle->offset); 413 if (!handle->buffer) { 414 snprintf(ebuf, PCAP_ERRBUF_SIZE, 415 "malloc: %s", pcap_strerror(errno)); 416 pcap_close_linux(handle); 417 free(handle); 418 return NULL; 419 } 420 421 /* 422 * "handle->fd" is a socket, so "select()" and "poll()" 423 * should work on it. 424 */ 425 handle->selectable_fd = handle->fd; 426 427 handle->read_op = pcap_read_linux; 428 handle->inject_op = pcap_inject_linux; 429 handle->setfilter_op = pcap_setfilter_linux; 430 handle->setdirection_op = pcap_setdirection_linux; 431 handle->set_datalink_op = NULL; /* can't change data link type */ 432 handle->getnonblock_op = pcap_getnonblock_fd; 433 handle->setnonblock_op = pcap_setnonblock_fd; 434 handle->stats_op = pcap_stats_linux; 435 handle->close_op = pcap_close_linux; 436 437 return handle; 438} 439 440/* 441 * Read at most max_packets from the capture stream and call the callback 442 * for each of them. Returns the number of packets handled or -1 if an 443 * error occured. 444 */ 445static int 446pcap_read_linux(pcap_t *handle, int max_packets, pcap_handler callback, u_char *user) 447{ 448 /* 449 * Currently, on Linux only one packet is delivered per read, 450 * so we don't loop. 451 */ 452 return pcap_read_packet(handle, callback, user); 453} 454 455/* 456 * Read a packet from the socket calling the handler provided by 457 * the user. Returns the number of packets received or -1 if an 458 * error occured. 459 */ 460static int 461pcap_read_packet(pcap_t *handle, pcap_handler callback, u_char *userdata) 462{ 463 u_char *bp; 464 int offset; 465#ifdef HAVE_PF_PACKET_SOCKETS 466 struct sockaddr_ll from; 467 struct sll_header *hdrp; 468#else 469 struct sockaddr from; 470#endif 471 socklen_t fromlen; 472 int packet_len, caplen; 473 struct pcap_pkthdr pcap_header; 474 475#ifdef HAVE_PF_PACKET_SOCKETS 476 /* 477 * If this is a cooked device, leave extra room for a 478 * fake packet header. 479 */ 480 if (handle->md.cooked) 481 offset = SLL_HDR_LEN; 482 else 483 offset = 0; 484#else 485 /* 486 * This system doesn't have PF_PACKET sockets, so it doesn't 487 * support cooked devices. 488 */ 489 offset = 0; 490#endif 491 492 /* Receive a single packet from the kernel */ 493 494 bp = handle->buffer + handle->offset; 495 do { 496 /* 497 * Has "pcap_breakloop()" been called? 498 */ 499 if (handle->break_loop) { 500 /* 501 * Yes - clear the flag that indicates that it 502 * has, and return -2 as an indication that we 503 * were told to break out of the loop. 504 */ 505 handle->break_loop = 0; 506 return -2; 507 } 508 fromlen = sizeof(from); 509 packet_len = recvfrom( 510 handle->fd, bp + offset, 511 handle->bufsize - offset, MSG_TRUNC, 512 (struct sockaddr *) &from, &fromlen); 513 } while (packet_len == -1 && errno == EINTR); 514 515 /* Check if an error occured */ 516 517 if (packet_len == -1) { 518 if (errno == EAGAIN) 519 return 0; /* no packet there */ 520 else { 521 snprintf(handle->errbuf, sizeof(handle->errbuf), 522 "recvfrom: %s", pcap_strerror(errno)); 523 return -1; 524 } 525 } 526 527#ifdef HAVE_PF_PACKET_SOCKETS 528 if (!handle->md.sock_packet) { 529 /* 530 * Unfortunately, there is a window between socket() and 531 * bind() where the kernel may queue packets from any 532 * interface. If we're bound to a particular interface, 533 * discard packets not from that interface. 534 * 535 * (If socket filters are supported, we could do the 536 * same thing we do when changing the filter; however, 537 * that won't handle packet sockets without socket 538 * filter support, and it's a bit more complicated. 539 * It would save some instructions per packet, however.) 540 */ 541 if (handle->md.ifindex != -1 && 542 from.sll_ifindex != handle->md.ifindex) 543 return 0; 544 545 /* 546 * Do checks based on packet direction. 547 * We can only do this if we're using PF_PACKET; the 548 * address returned for SOCK_PACKET is a "sockaddr_pkt" 549 * which lacks the relevant packet type information. 550 */ 551 if (from.sll_pkttype == PACKET_OUTGOING) { 552 /* 553 * Outgoing packet. 554 * If this is from the loopback device, reject it; 555 * we'll see the packet as an incoming packet as well, 556 * and we don't want to see it twice. 557 */ 558 if (from.sll_ifindex == handle->md.lo_ifindex) 559 return 0; 560 561 /* 562 * If the user only wants incoming packets, reject it. 563 */ 564 if (handle->direction == PCAP_D_IN) 565 return 0; 566 } else { 567 /* 568 * Incoming packet. 569 * If the user only wants outgoing packets, reject it. 570 */ 571 if (handle->direction == PCAP_D_OUT) 572 return 0; 573 } 574 } 575#endif 576 577#ifdef HAVE_PF_PACKET_SOCKETS 578 /* 579 * If this is a cooked device, fill in the fake packet header. 580 */ 581 if (handle->md.cooked) { 582 /* 583 * Add the length of the fake header to the length 584 * of packet data we read. 585 */ 586 packet_len += SLL_HDR_LEN; 587 588 hdrp = (struct sll_header *)bp; 589 590 /* 591 * Map the PACKET_ value to a LINUX_SLL_ value; we 592 * want the same numerical value to be used in 593 * the link-layer header even if the numerical values 594 * for the PACKET_ #defines change, so that programs 595 * that look at the packet type field will always be 596 * able to handle DLT_LINUX_SLL captures. 597 */ 598 switch (from.sll_pkttype) { 599 600 case PACKET_HOST: 601 hdrp->sll_pkttype = htons(LINUX_SLL_HOST); 602 break; 603 604 case PACKET_BROADCAST: 605 hdrp->sll_pkttype = htons(LINUX_SLL_BROADCAST); 606 break; 607 608 case PACKET_MULTICAST: 609 hdrp->sll_pkttype = htons(LINUX_SLL_MULTICAST); 610 break; 611 612 case PACKET_OTHERHOST: 613 hdrp->sll_pkttype = htons(LINUX_SLL_OTHERHOST); 614 break; 615 616 case PACKET_OUTGOING: 617 hdrp->sll_pkttype = htons(LINUX_SLL_OUTGOING); 618 break; 619 620 default: 621 hdrp->sll_pkttype = -1; 622 break; 623 } 624 625 hdrp->sll_hatype = htons(from.sll_hatype); 626 hdrp->sll_halen = htons(from.sll_halen); 627 memcpy(hdrp->sll_addr, from.sll_addr, 628 (from.sll_halen > SLL_ADDRLEN) ? 629 SLL_ADDRLEN : 630 from.sll_halen); 631 hdrp->sll_protocol = from.sll_protocol; 632 } 633#endif 634 635 /* 636 * XXX: According to the kernel source we should get the real 637 * packet len if calling recvfrom with MSG_TRUNC set. It does 638 * not seem to work here :(, but it is supported by this code 639 * anyway. 640 * To be honest the code RELIES on that feature so this is really 641 * broken with 2.2.x kernels. 642 * I spend a day to figure out what's going on and I found out 643 * that the following is happening: 644 * 645 * The packet comes from a random interface and the packet_rcv 646 * hook is called with a clone of the packet. That code inserts 647 * the packet into the receive queue of the packet socket. 648 * If a filter is attached to that socket that filter is run 649 * first - and there lies the problem. The default filter always 650 * cuts the packet at the snaplen: 651 * 652 * # tcpdump -d 653 * (000) ret #68 654 * 655 * So the packet filter cuts down the packet. The recvfrom call 656 * says "hey, it's only 68 bytes, it fits into the buffer" with 657 * the result that we don't get the real packet length. This 658 * is valid at least until kernel 2.2.17pre6. 659 * 660 * We currently handle this by making a copy of the filter 661 * program, fixing all "ret" instructions with non-zero 662 * operands to have an operand of 65535 so that the filter 663 * doesn't truncate the packet, and supplying that modified 664 * filter to the kernel. 665 */ 666 667 caplen = packet_len; 668 if (caplen > handle->snapshot) 669 caplen = handle->snapshot; 670 671 /* Run the packet filter if not using kernel filter */ 672 if (!handle->md.use_bpf && handle->fcode.bf_insns) { 673 if (bpf_filter(handle->fcode.bf_insns, bp, 674 packet_len, caplen) == 0) 675 { 676 /* rejected by filter */ 677 return 0; 678 } 679 } 680 681 /* Fill in our own header data */ 682 683 if (ioctl(handle->fd, SIOCGSTAMP, &pcap_header.ts) == -1) { 684 snprintf(handle->errbuf, sizeof(handle->errbuf), 685 "SIOCGSTAMP: %s", pcap_strerror(errno)); 686 return -1; 687 } 688 pcap_header.caplen = caplen; 689 pcap_header.len = packet_len; 690 691 /* 692 * Count the packet. 693 * 694 * Arguably, we should count them before we check the filter, 695 * as on many other platforms "ps_recv" counts packets 696 * handed to the filter rather than packets that passed 697 * the filter, but if filtering is done in the kernel, we 698 * can't get a count of packets that passed the filter, 699 * and that would mean the meaning of "ps_recv" wouldn't 700 * be the same on all Linux systems. 701 * 702 * XXX - it's not the same on all systems in any case; 703 * ideally, we should have a "get the statistics" call 704 * that supplies more counts and indicates which of them 705 * it supplies, so that we supply a count of packets 706 * handed to the filter only on platforms where that 707 * information is available. 708 * 709 * We count them here even if we can get the packet count 710 * from the kernel, as we can only determine at run time 711 * whether we'll be able to get it from the kernel (if 712 * HAVE_TPACKET_STATS isn't defined, we can't get it from 713 * the kernel, but if it is defined, the library might 714 * have been built with a 2.4 or later kernel, but we 715 * might be running on a 2.2[.x] kernel without Alexey 716 * Kuznetzov's turbopacket patches, and thus the kernel 717 * might not be able to supply those statistics). We 718 * could, I guess, try, when opening the socket, to get 719 * the statistics, and if we can not increment the count 720 * here, but it's not clear that always incrementing 721 * the count is more expensive than always testing a flag 722 * in memory. 723 * 724 * We keep the count in "md.packets_read", and use that for 725 * "ps_recv" if we can't get the statistics from the kernel. 726 * We do that because, if we *can* get the statistics from 727 * the kernel, we use "md.stat.ps_recv" and "md.stat.ps_drop" 728 * as running counts, as reading the statistics from the 729 * kernel resets the kernel statistics, and if we directly 730 * increment "md.stat.ps_recv" here, that means it will 731 * count packets *twice* on systems where we can get kernel 732 * statistics - once here, and once in pcap_stats_linux(). 733 */ 734 handle->md.packets_read++; 735 736 /* Call the user supplied callback function */ 737 callback(userdata, &pcap_header, bp); 738 739 return 1; 740} 741 742static int 743pcap_inject_linux(pcap_t *handle, const void *buf, size_t size) 744{ 745 int ret; 746 747#ifdef HAVE_PF_PACKET_SOCKETS 748 if (!handle->md.sock_packet) { 749 /* PF_PACKET socket */ 750 if (handle->md.ifindex == -1) { 751 /* 752 * We don't support sending on the "any" device. 753 */ 754 strlcpy(handle->errbuf, 755 "Sending packets isn't supported on the \"any\" device", 756 PCAP_ERRBUF_SIZE); 757 return (-1); 758 } 759 760 if (handle->md.cooked) { 761 /* 762 * We don't support sending on the "any" device. 763 * 764 * XXX - how do you send on a bound cooked-mode 765 * socket? 766 * Is a "sendto()" required there? 767 */ 768 strlcpy(handle->errbuf, 769 "Sending packets isn't supported in cooked mode", 770 PCAP_ERRBUF_SIZE); 771 return (-1); 772 } 773 } 774#endif 775 776 ret = send(handle->fd, buf, size, 0); 777 if (ret == -1) { 778 snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "send: %s", 779 pcap_strerror(errno)); 780 return (-1); 781 } 782 return (ret); 783} 784 785/* 786 * Get the statistics for the given packet capture handle. 787 * Reports the number of dropped packets iff the kernel supports 788 * the PACKET_STATISTICS "getsockopt()" argument (2.4 and later 789 * kernels, and 2.2[.x] kernels with Alexey Kuznetzov's turbopacket 790 * patches); otherwise, that information isn't available, and we lie 791 * and report 0 as the count of dropped packets. 792 */ 793static int 794pcap_stats_linux(pcap_t *handle, struct pcap_stat *stats) 795{ 796#ifdef HAVE_TPACKET_STATS 797 struct tpacket_stats kstats; 798 socklen_t len = sizeof (struct tpacket_stats); 799#endif 800 801#ifdef HAVE_TPACKET_STATS 802 /* 803 * Try to get the packet counts from the kernel. 804 */ 805 if (getsockopt(handle->fd, SOL_PACKET, PACKET_STATISTICS, 806 &kstats, &len) > -1) { 807 /* 808 * On systems where the PACKET_STATISTICS "getsockopt()" 809 * argument is supported on PF_PACKET sockets: 810 * 811 * "ps_recv" counts only packets that *passed* the 812 * filter, not packets that didn't pass the filter. 813 * This includes packets later dropped because we 814 * ran out of buffer space. 815 * 816 * "ps_drop" counts packets dropped because we ran 817 * out of buffer space. It doesn't count packets 818 * dropped by the interface driver. It counts only 819 * packets that passed the filter. 820 * 821 * Both statistics include packets not yet read from 822 * the kernel by libpcap, and thus not yet seen by 823 * the application. 824 * 825 * In "linux/net/packet/af_packet.c", at least in the 826 * 2.4.9 kernel, "tp_packets" is incremented for every 827 * packet that passes the packet filter *and* is 828 * successfully queued on the socket; "tp_drops" is 829 * incremented for every packet dropped because there's 830 * not enough free space in the socket buffer. 831 * 832 * When the statistics are returned for a PACKET_STATISTICS 833 * "getsockopt()" call, "tp_drops" is added to "tp_packets", 834 * so that "tp_packets" counts all packets handed to 835 * the PF_PACKET socket, including packets dropped because 836 * there wasn't room on the socket buffer - but not 837 * including packets that didn't pass the filter. 838 * 839 * In the BSD BPF, the count of received packets is 840 * incremented for every packet handed to BPF, regardless 841 * of whether it passed the filter. 842 * 843 * We can't make "pcap_stats()" work the same on both 844 * platforms, but the best approximation is to return 845 * "tp_packets" as the count of packets and "tp_drops" 846 * as the count of drops. 847 * 848 * Keep a running total because each call to 849 * getsockopt(handle->fd, SOL_PACKET, PACKET_STATISTICS, .... 850 * resets the counters to zero. 851 */ 852 handle->md.stat.ps_recv += kstats.tp_packets; 853 handle->md.stat.ps_drop += kstats.tp_drops; 854 *stats = handle->md.stat; 855 return 0; 856 } 857 else 858 { 859 /* 860 * If the error was EOPNOTSUPP, fall through, so that 861 * if you build the library on a system with 862 * "struct tpacket_stats" and run it on a system 863 * that doesn't, it works as it does if the library 864 * is built on a system without "struct tpacket_stats". 865 */ 866 if (errno != EOPNOTSUPP) { 867 snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, 868 "pcap_stats: %s", pcap_strerror(errno)); 869 return -1; 870 } 871 } 872#endif 873 /* 874 * On systems where the PACKET_STATISTICS "getsockopt()" argument 875 * is not supported on PF_PACKET sockets: 876 * 877 * "ps_recv" counts only packets that *passed* the filter, 878 * not packets that didn't pass the filter. It does not 879 * count packets dropped because we ran out of buffer 880 * space. 881 * 882 * "ps_drop" is not supported. 883 * 884 * "ps_recv" doesn't include packets not yet read from 885 * the kernel by libpcap. 886 * 887 * We maintain the count of packets processed by libpcap in 888 * "md.packets_read", for reasons described in the comment 889 * at the end of pcap_read_packet(). We have no idea how many 890 * packets were dropped. 891 */ 892 stats->ps_recv = handle->md.packets_read; 893 stats->ps_drop = 0; 894 return 0; 895} 896 897/* 898 * Description string for the "any" device. 899 */ 900static const char any_descr[] = "Pseudo-device that captures on all interfaces"; 901 902int 903pcap_platform_finddevs(pcap_if_t **alldevsp, char *errbuf) 904{ 905 if (pcap_add_if(alldevsp, "any", 0, any_descr, errbuf) < 0) 906 return (-1); 907 908#ifdef HAVE_DAG_API 909 if (dag_platform_finddevs(alldevsp, errbuf) < 0) 910 return (-1); 911#endif /* HAVE_DAG_API */ 912 913#ifdef HAVE_SEPTEL_API 914 if (septel_platform_finddevs(alldevsp, errbuf) < 0) 915 return (-1); 916#endif /* HAVE_SEPTEL_API */ 917 918 return (0); 919} 920 921/* 922 * Attach the given BPF code to the packet capture device. 923 */ 924static int 925pcap_setfilter_linux(pcap_t *handle, struct bpf_program *filter) 926{ 927#ifdef SO_ATTACH_FILTER 928 struct sock_fprog fcode; 929 int can_filter_in_kernel; 930 int err = 0; 931#endif 932 933 if (!handle) 934 return -1; 935 if (!filter) { 936 strncpy(handle->errbuf, "setfilter: No filter specified", 937 sizeof(handle->errbuf)); 938 return -1; 939 } 940 941 /* Make our private copy of the filter */ 942 943 if (install_bpf_program(handle, filter) < 0) 944 /* install_bpf_program() filled in errbuf */ 945 return -1; 946 947 /* 948 * Run user level packet filter by default. Will be overriden if 949 * installing a kernel filter succeeds. 950 */ 951 handle->md.use_bpf = 0; 952 953 /* Install kernel level filter if possible */ 954 955#ifdef SO_ATTACH_FILTER 956#ifdef USHRT_MAX 957 if (handle->fcode.bf_len > USHRT_MAX) { 958 /* 959 * fcode.len is an unsigned short for current kernel. 960 * I have yet to see BPF-Code with that much 961 * instructions but still it is possible. So for the 962 * sake of correctness I added this check. 963 */ 964 fprintf(stderr, "Warning: Filter too complex for kernel\n"); 965 fcode.filter = NULL; 966 can_filter_in_kernel = 0; 967 } else 968#endif /* USHRT_MAX */ 969 { 970 /* 971 * Oh joy, the Linux kernel uses struct sock_fprog instead 972 * of struct bpf_program and of course the length field is 973 * of different size. Pointed out by Sebastian 974 * 975 * Oh, and we also need to fix it up so that all "ret" 976 * instructions with non-zero operands have 65535 as the 977 * operand, and so that, if we're in cooked mode, all 978 * memory-reference instructions use special magic offsets 979 * in references to the link-layer header and assume that 980 * the link-layer payload begins at 0; "fix_program()" 981 * will do that. 982 */ 983 switch (fix_program(handle, &fcode)) { 984 985 case -1: 986 default: 987 /* 988 * Fatal error; just quit. 989 * (The "default" case shouldn't happen; we 990 * return -1 for that reason.) 991 */ 992 return -1; 993 994 case 0: 995 /* 996 * The program performed checks that we can't make 997 * work in the kernel. 998 */ 999 can_filter_in_kernel = 0; 1000 break; 1001 1002 case 1: 1003 /* 1004 * We have a filter that'll work in the kernel. 1005 */ 1006 can_filter_in_kernel = 1; 1007 break; 1008 } 1009 } 1010 1011 if (can_filter_in_kernel) { 1012 if ((err = set_kernel_filter(handle, &fcode)) == 0) 1013 { 1014 /* Installation succeded - using kernel filter. */ 1015 handle->md.use_bpf = 1; 1016 } 1017 else if (err == -1) /* Non-fatal error */ 1018 { 1019 /* 1020 * Print a warning if we weren't able to install 1021 * the filter for a reason other than "this kernel 1022 * isn't configured to support socket filters. 1023 */ 1024 if (errno != ENOPROTOOPT && errno != EOPNOTSUPP) { 1025 fprintf(stderr, 1026 "Warning: Kernel filter failed: %s\n", 1027 pcap_strerror(errno)); 1028 } 1029 } 1030 } 1031 1032 /* 1033 * If we're not using the kernel filter, get rid of any kernel 1034 * filter that might've been there before, e.g. because the 1035 * previous filter could work in the kernel, or because some other 1036 * code attached a filter to the socket by some means other than 1037 * calling "pcap_setfilter()". Otherwise, the kernel filter may 1038 * filter out packets that would pass the new userland filter. 1039 */ 1040 if (!handle->md.use_bpf) 1041 reset_kernel_filter(handle); 1042 1043 /* 1044 * Free up the copy of the filter that was made by "fix_program()". 1045 */ 1046 if (fcode.filter != NULL) 1047 free(fcode.filter); 1048 1049 if (err == -2) 1050 /* Fatal error */ 1051 return -1; 1052#endif /* SO_ATTACH_FILTER */ 1053 1054 return 0; 1055} 1056 1057/* 1058 * Set direction flag: Which packets do we accept on a forwarding 1059 * single device? IN, OUT or both? 1060 */ 1061static int 1062pcap_setdirection_linux(pcap_t *handle, pcap_direction_t d) 1063{ 1064#ifdef HAVE_PF_PACKET_SOCKETS 1065 if (!handle->md.sock_packet) { 1066 handle->direction = d; 1067 return 0; 1068 } 1069#endif 1070 /* 1071 * We're not using PF_PACKET sockets, so we can't determine 1072 * the direction of the packet. 1073 */ 1074 snprintf(handle->errbuf, sizeof(handle->errbuf), 1075 "Setting direction is not supported on SOCK_PACKET sockets"); 1076 return -1; 1077} 1078 1079/* 1080 * Linux uses the ARP hardware type to identify the type of an 1081 * interface. pcap uses the DLT_xxx constants for this. This 1082 * function takes a pointer to a "pcap_t", and an ARPHRD_xxx 1083 * constant, as arguments, and sets "handle->linktype" to the 1084 * appropriate DLT_XXX constant and sets "handle->offset" to 1085 * the appropriate value (to make "handle->offset" plus link-layer 1086 * header length be a multiple of 4, so that the link-layer payload 1087 * will be aligned on a 4-byte boundary when capturing packets). 1088 * (If the offset isn't set here, it'll be 0; add code as appropriate 1089 * for cases where it shouldn't be 0.) 1090 * 1091 * If "cooked_ok" is non-zero, we can use DLT_LINUX_SLL and capture 1092 * in cooked mode; otherwise, we can't use cooked mode, so we have 1093 * to pick some type that works in raw mode, or fail. 1094 * 1095 * Sets the link type to -1 if unable to map the type. 1096 */ 1097static void map_arphrd_to_dlt(pcap_t *handle, int arptype, int cooked_ok) 1098{ 1099 switch (arptype) { 1100 1101 case ARPHRD_ETHER: 1102 /* 1103 * This is (presumably) a real Ethernet capture; give it a 1104 * link-layer-type list with DLT_EN10MB and DLT_DOCSIS, so 1105 * that an application can let you choose it, in case you're 1106 * capturing DOCSIS traffic that a Cisco Cable Modem 1107 * Termination System is putting out onto an Ethernet (it 1108 * doesn't put an Ethernet header onto the wire, it puts raw 1109 * DOCSIS frames out on the wire inside the low-level 1110 * Ethernet framing). 1111 * 1112 * XXX - are there any sorts of "fake Ethernet" that have 1113 * ARPHRD_ETHER but that *shouldn't offer DLT_DOCSIS as 1114 * a Cisco CMTS won't put traffic onto it or get traffic 1115 * bridged onto it? ISDN is handled in "live_open_new()", 1116 * as we fall back on cooked mode there; are there any 1117 * others? 1118 */ 1119 handle->dlt_list = (u_int *) malloc(sizeof(u_int) * 2); 1120 /* 1121 * If that fails, just leave the list empty. 1122 */ 1123 if (handle->dlt_list != NULL) { 1124 handle->dlt_list[0] = DLT_EN10MB; 1125 handle->dlt_list[1] = DLT_DOCSIS; 1126 handle->dlt_count = 2; 1127 } 1128 /* FALLTHROUGH */ 1129 1130 case ARPHRD_METRICOM: 1131 case ARPHRD_LOOPBACK: 1132 handle->linktype = DLT_EN10MB; 1133 handle->offset = 2; 1134 break; 1135 1136 case ARPHRD_EETHER: 1137 handle->linktype = DLT_EN3MB; 1138 break; 1139 1140 case ARPHRD_AX25: 1141 handle->linktype = DLT_AX25; 1142 break; 1143 1144 case ARPHRD_PRONET: 1145 handle->linktype = DLT_PRONET; 1146 break; 1147 1148 case ARPHRD_CHAOS: 1149 handle->linktype = DLT_CHAOS; 1150 break; 1151 1152#ifndef ARPHRD_IEEE802_TR 1153#define ARPHRD_IEEE802_TR 800 /* From Linux 2.4 */ 1154#endif 1155 case ARPHRD_IEEE802_TR: 1156 case ARPHRD_IEEE802: 1157 handle->linktype = DLT_IEEE802; 1158 handle->offset = 2; 1159 break; 1160 1161 case ARPHRD_ARCNET: 1162 handle->linktype = DLT_ARCNET_LINUX; 1163 break; 1164 1165#ifndef ARPHRD_FDDI /* From Linux 2.2.13 */ 1166#define ARPHRD_FDDI 774 1167#endif 1168 case ARPHRD_FDDI: 1169 handle->linktype = DLT_FDDI; 1170 handle->offset = 3; 1171 break; 1172 1173#ifndef ARPHRD_ATM /* FIXME: How to #include this? */ 1174#define ARPHRD_ATM 19 1175#endif 1176 case ARPHRD_ATM: 1177 /* 1178 * The Classical IP implementation in ATM for Linux 1179 * supports both what RFC 1483 calls "LLC Encapsulation", 1180 * in which each packet has an LLC header, possibly 1181 * with a SNAP header as well, prepended to it, and 1182 * what RFC 1483 calls "VC Based Multiplexing", in which 1183 * different virtual circuits carry different network 1184 * layer protocols, and no header is prepended to packets. 1185 * 1186 * They both have an ARPHRD_ type of ARPHRD_ATM, so 1187 * you can't use the ARPHRD_ type to find out whether 1188 * captured packets will have an LLC header, and, 1189 * while there's a socket ioctl to *set* the encapsulation 1190 * type, there's no ioctl to *get* the encapsulation type. 1191 * 1192 * This means that 1193 * 1194 * programs that dissect Linux Classical IP frames 1195 * would have to check for an LLC header and, 1196 * depending on whether they see one or not, dissect 1197 * the frame as LLC-encapsulated or as raw IP (I 1198 * don't know whether there's any traffic other than 1199 * IP that would show up on the socket, or whether 1200 * there's any support for IPv6 in the Linux 1201 * Classical IP code); 1202 * 1203 * filter expressions would have to compile into 1204 * code that checks for an LLC header and does 1205 * the right thing. 1206 * 1207 * Both of those are a nuisance - and, at least on systems 1208 * that support PF_PACKET sockets, we don't have to put 1209 * up with those nuisances; instead, we can just capture 1210 * in cooked mode. That's what we'll do, if we can. 1211 * Otherwise, we'll just fail. 1212 */ 1213 if (cooked_ok) 1214 handle->linktype = DLT_LINUX_SLL; 1215 else 1216 handle->linktype = -1; 1217 break; 1218 1219#ifndef ARPHRD_IEEE80211 /* From Linux 2.4.6 */ 1220#define ARPHRD_IEEE80211 801 1221#endif 1222 case ARPHRD_IEEE80211: 1223 handle->linktype = DLT_IEEE802_11; 1224 break; 1225 1226#ifndef ARPHRD_IEEE80211_PRISM /* From Linux 2.4.18 */ 1227#define ARPHRD_IEEE80211_PRISM 802 1228#endif 1229 case ARPHRD_IEEE80211_PRISM: 1230 handle->linktype = DLT_PRISM_HEADER; 1231 break; 1232 1233#ifndef ARPHRD_IEEE80211_RADIOTAP /* new */ 1234#define ARPHRD_IEEE80211_RADIOTAP 803 1235#endif 1236 case ARPHRD_IEEE80211_RADIOTAP: 1237 handle->linktype = DLT_IEEE802_11_RADIO; 1238 break; 1239 1240 case ARPHRD_PPP: 1241 /* 1242 * Some PPP code in the kernel supplies no link-layer 1243 * header whatsoever to PF_PACKET sockets; other PPP 1244 * code supplies PPP link-layer headers ("syncppp.c"); 1245 * some PPP code might supply random link-layer 1246 * headers (PPP over ISDN - there's code in Ethereal, 1247 * for example, to cope with PPP-over-ISDN captures 1248 * with which the Ethereal developers have had to cope, 1249 * heuristically trying to determine which of the 1250 * oddball link-layer headers particular packets have). 1251 * 1252 * As such, we just punt, and run all PPP interfaces 1253 * in cooked mode, if we can; otherwise, we just treat 1254 * it as DLT_RAW, for now - if somebody needs to capture, 1255 * on a 2.0[.x] kernel, on PPP devices that supply a 1256 * link-layer header, they'll have to add code here to 1257 * map to the appropriate DLT_ type (possibly adding a 1258 * new DLT_ type, if necessary). 1259 */ 1260 if (cooked_ok) 1261 handle->linktype = DLT_LINUX_SLL; 1262 else { 1263 /* 1264 * XXX - handle ISDN types here? We can't fall 1265 * back on cooked sockets, so we'd have to 1266 * figure out from the device name what type of 1267 * link-layer encapsulation it's using, and map 1268 * that to an appropriate DLT_ value, meaning 1269 * we'd map "isdnN" devices to DLT_RAW (they 1270 * supply raw IP packets with no link-layer 1271 * header) and "isdY" devices to a new DLT_I4L_IP 1272 * type that has only an Ethernet packet type as 1273 * a link-layer header. 1274 * 1275 * But sometimes we seem to get random crap 1276 * in the link-layer header when capturing on 1277 * ISDN devices.... 1278 */ 1279 handle->linktype = DLT_RAW; 1280 } 1281 break; 1282 1283#ifndef ARPHRD_CISCO 1284#define ARPHRD_CISCO 513 /* previously ARPHRD_HDLC */ 1285#endif 1286 case ARPHRD_CISCO: 1287 handle->linktype = DLT_C_HDLC; 1288 break; 1289 1290 /* Not sure if this is correct for all tunnels, but it 1291 * works for CIPE */ 1292 case ARPHRD_TUNNEL: 1293#ifndef ARPHRD_SIT 1294#define ARPHRD_SIT 776 /* From Linux 2.2.13 */ 1295#endif 1296 case ARPHRD_SIT: 1297 case ARPHRD_CSLIP: 1298 case ARPHRD_SLIP6: 1299 case ARPHRD_CSLIP6: 1300 case ARPHRD_ADAPT: 1301 case ARPHRD_SLIP: 1302#ifndef ARPHRD_RAWHDLC 1303#define ARPHRD_RAWHDLC 518 1304#endif 1305 case ARPHRD_RAWHDLC: 1306#ifndef ARPHRD_DLCI 1307#define ARPHRD_DLCI 15 1308#endif 1309 case ARPHRD_DLCI: 1310 /* 1311 * XXX - should some of those be mapped to DLT_LINUX_SLL 1312 * instead? Should we just map all of them to DLT_LINUX_SLL? 1313 */ 1314 handle->linktype = DLT_RAW; 1315 break; 1316 1317#ifndef ARPHRD_FRAD 1318#define ARPHRD_FRAD 770 1319#endif 1320 case ARPHRD_FRAD: 1321 handle->linktype = DLT_FRELAY; 1322 break; 1323 1324 case ARPHRD_LOCALTLK: 1325 handle->linktype = DLT_LTALK; 1326 break; 1327 1328#ifndef ARPHRD_FCPP 1329#define ARPHRD_FCPP 784 1330#endif 1331 case ARPHRD_FCPP: 1332#ifndef ARPHRD_FCAL 1333#define ARPHRD_FCAL 785 1334#endif 1335 case ARPHRD_FCAL: 1336#ifndef ARPHRD_FCPL 1337#define ARPHRD_FCPL 786 1338#endif 1339 case ARPHRD_FCPL: 1340#ifndef ARPHRD_FCFABRIC 1341#define ARPHRD_FCFABRIC 787 1342#endif 1343 case ARPHRD_FCFABRIC: 1344 /* 1345 * We assume that those all mean RFC 2625 IP-over- 1346 * Fibre Channel, with the RFC 2625 header at 1347 * the beginning of the packet. 1348 */ 1349 handle->linktype = DLT_IP_OVER_FC; 1350 break; 1351 1352#ifndef ARPHRD_IRDA 1353#define ARPHRD_IRDA 783 1354#endif 1355 case ARPHRD_IRDA: 1356 /* Don't expect IP packet out of this interfaces... */ 1357 handle->linktype = DLT_LINUX_IRDA; 1358 /* We need to save packet direction for IrDA decoding, 1359 * so let's use "Linux-cooked" mode. Jean II */ 1360 //handle->md.cooked = 1; 1361 break; 1362 1363 /* ARPHRD_LAPD is unofficial and randomly allocated, if reallocation 1364 * is needed, please report it to <daniele@orlandi.com> */ 1365#ifndef ARPHRD_LAPD 1366#define ARPHRD_LAPD 8445 1367#endif 1368 case ARPHRD_LAPD: 1369 /* Don't expect IP packet out of this interfaces... */ 1370 handle->linktype = DLT_LINUX_LAPD; 1371 break; 1372 1373 default: 1374 handle->linktype = -1; 1375 break; 1376 } 1377} 1378 1379/* ===== Functions to interface to the newer kernels ================== */ 1380 1381/* 1382 * Try to open a packet socket using the new kernel interface. 1383 * Returns 0 on failure. 1384 * FIXME: 0 uses to mean success (Sebastian) 1385 */ 1386static int 1387live_open_new(pcap_t *handle, const char *device, int promisc, 1388 int to_ms, char *ebuf) 1389{ 1390#ifdef HAVE_PF_PACKET_SOCKETS 1391 int sock_fd = -1, arptype; 1392 int err; 1393 int fatal_err = 0; 1394 struct packet_mreq mr; 1395 1396 /* One shot loop used for error handling - bail out with break */ 1397 1398 do { 1399 /* 1400 * Open a socket with protocol family packet. If a device is 1401 * given we try to open it in raw mode otherwise we use 1402 * the cooked interface. 1403 */ 1404 sock_fd = device ? 1405 socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL)) 1406 : socket(PF_PACKET, SOCK_DGRAM, htons(ETH_P_ALL)); 1407 1408 if (sock_fd == -1) { 1409 snprintf(ebuf, PCAP_ERRBUF_SIZE, "socket: %s", 1410 pcap_strerror(errno) ); 1411 break; 1412 } 1413 1414 /* It seems the kernel supports the new interface. */ 1415 handle->md.sock_packet = 0; 1416 1417 /* 1418 * Get the interface index of the loopback device. 1419 * If the attempt fails, don't fail, just set the 1420 * "md.lo_ifindex" to -1. 1421 * 1422 * XXX - can there be more than one device that loops 1423 * packets back, i.e. devices other than "lo"? If so, 1424 * we'd need to find them all, and have an array of 1425 * indices for them, and check all of them in 1426 * "pcap_read_packet()". 1427 */ 1428 handle->md.lo_ifindex = iface_get_id(sock_fd, "lo", ebuf); 1429 1430 /* 1431 * Default value for offset to align link-layer payload 1432 * on a 4-byte boundary. 1433 */ 1434 handle->offset = 0; 1435 1436 /* 1437 * What kind of frames do we have to deal with? Fall back 1438 * to cooked mode if we have an unknown interface type. 1439 */ 1440 1441 if (device) { 1442 /* Assume for now we don't need cooked mode. */ 1443 handle->md.cooked = 0; 1444 1445 arptype = iface_get_arptype(sock_fd, device, ebuf); 1446 if (arptype == -1) { 1447 fatal_err = 1; 1448 break; 1449 } 1450 map_arphrd_to_dlt(handle, arptype, 1); 1451 if (handle->linktype == -1 || 1452 handle->linktype == DLT_LINUX_SLL || 1453 handle->linktype == DLT_LINUX_IRDA || 1454 handle->linktype == DLT_LINUX_LAPD || 1455 (handle->linktype == DLT_EN10MB && 1456 (strncmp("isdn", device, 4) == 0 || 1457 strncmp("isdY", device, 4) == 0))) { 1458 /* 1459 * Unknown interface type (-1), or a 1460 * device we explicitly chose to run 1461 * in cooked mode (e.g., PPP devices), 1462 * or an ISDN device (whose link-layer 1463 * type we can only determine by using 1464 * APIs that may be different on different 1465 * kernels) - reopen in cooked mode. 1466 */ 1467 if (close(sock_fd) == -1) { 1468 snprintf(ebuf, PCAP_ERRBUF_SIZE, 1469 "close: %s", pcap_strerror(errno)); 1470 break; 1471 } 1472 sock_fd = socket(PF_PACKET, SOCK_DGRAM, 1473 htons(ETH_P_ALL)); 1474 if (sock_fd == -1) { 1475 snprintf(ebuf, PCAP_ERRBUF_SIZE, 1476 "socket: %s", pcap_strerror(errno)); 1477 break; 1478 } 1479 handle->md.cooked = 1; 1480 1481 /* 1482 * Get rid of any link-layer type list 1483 * we allocated - this only supports cooked 1484 * capture. 1485 */ 1486 if (handle->dlt_list != NULL) { 1487 free(handle->dlt_list); 1488 handle->dlt_list = NULL; 1489 handle->dlt_count = 0; 1490 } 1491 1492 if (handle->linktype == -1) { 1493 /* 1494 * Warn that we're falling back on 1495 * cooked mode; we may want to 1496 * update "map_arphrd_to_dlt()" 1497 * to handle the new type. 1498 */ 1499 snprintf(ebuf, PCAP_ERRBUF_SIZE, 1500 "arptype %d not " 1501 "supported by libpcap - " 1502 "falling back to cooked " 1503 "socket", 1504 arptype); 1505 } 1506 /* IrDA capture is not a real "cooked" capture, 1507 * it's IrLAP frames, not IP packets. */ 1508 if (handle->linktype != DLT_LINUX_IRDA && 1509 handle->linktype != DLT_LINUX_LAPD) 1510 handle->linktype = DLT_LINUX_SLL; 1511 } 1512 1513 handle->md.ifindex = iface_get_id(sock_fd, device, ebuf); 1514 if (handle->md.ifindex == -1) 1515 break; 1516 1517 if ((err = iface_bind(sock_fd, handle->md.ifindex, 1518 ebuf)) < 0) { 1519 if (err == -2) 1520 fatal_err = 1; 1521 break; 1522 } 1523 } else { 1524 /* 1525 * This is cooked mode. 1526 */ 1527 handle->md.cooked = 1; 1528 handle->linktype = DLT_LINUX_SLL; 1529 1530 /* 1531 * We're not bound to a device. 1532 * XXX - true? Or true only if we're using 1533 * the "any" device? 1534 * For now, we're using this as an indication 1535 * that we can't transmit; stop doing that only 1536 * if we figure out how to transmit in cooked 1537 * mode. 1538 */ 1539 handle->md.ifindex = -1; 1540 } 1541 1542 /* 1543 * Select promiscuous mode on if "promisc" is set. 1544 * 1545 * Do not turn allmulti mode on if we don't select 1546 * promiscuous mode - on some devices (e.g., Orinoco 1547 * wireless interfaces), allmulti mode isn't supported 1548 * and the driver implements it by turning promiscuous 1549 * mode on, and that screws up the operation of the 1550 * card as a normal networking interface, and on no 1551 * other platform I know of does starting a non- 1552 * promiscuous capture affect which multicast packets 1553 * are received by the interface. 1554 */ 1555 1556 /* 1557 * Hmm, how can we set promiscuous mode on all interfaces? 1558 * I am not sure if that is possible at all. 1559 */ 1560 1561 if (device && promisc) { 1562 memset(&mr, 0, sizeof(mr)); 1563 mr.mr_ifindex = handle->md.ifindex; 1564 mr.mr_type = PACKET_MR_PROMISC; 1565 if (setsockopt(sock_fd, SOL_PACKET, 1566 PACKET_ADD_MEMBERSHIP, &mr, sizeof(mr)) == -1) 1567 { 1568 snprintf(ebuf, PCAP_ERRBUF_SIZE, 1569 "setsockopt: %s", pcap_strerror(errno)); 1570 break; 1571 } 1572 } 1573 1574 /* Save the socket FD in the pcap structure */ 1575 1576 handle->fd = sock_fd; 1577 1578 return 1; 1579 1580 } while(0); 1581 1582 if (sock_fd != -1) 1583 close(sock_fd); 1584 1585 if (fatal_err) { 1586 /* 1587 * Get rid of any link-layer type list we allocated. 1588 */ 1589 if (handle->dlt_list != NULL) 1590 free(handle->dlt_list); 1591 return -2; 1592 } else 1593 return 0; 1594#else 1595 strncpy(ebuf, 1596 "New packet capturing interface not supported by build " 1597 "environment", PCAP_ERRBUF_SIZE); 1598 return 0; 1599#endif 1600} 1601 1602#ifdef HAVE_PF_PACKET_SOCKETS 1603/* 1604 * Return the index of the given device name. Fill ebuf and return 1605 * -1 on failure. 1606 */ 1607static int 1608iface_get_id(int fd, const char *device, char *ebuf) 1609{ 1610 struct ifreq ifr; 1611 1612 memset(&ifr, 0, sizeof(ifr)); 1613 strncpy(ifr.ifr_name, device, sizeof(ifr.ifr_name)); 1614 1615 if (ioctl(fd, SIOCGIFINDEX, &ifr) == -1) { 1616 snprintf(ebuf, PCAP_ERRBUF_SIZE, 1617 "SIOCGIFINDEX: %s", pcap_strerror(errno)); 1618 return -1; 1619 } 1620 1621 return ifr.ifr_ifindex; 1622} 1623 1624/* 1625 * Bind the socket associated with FD to the given device. 1626 */ 1627static int 1628iface_bind(int fd, int ifindex, char *ebuf) 1629{ 1630 struct sockaddr_ll sll; 1631 int err; 1632 socklen_t errlen = sizeof(err); 1633 1634 memset(&sll, 0, sizeof(sll)); 1635 sll.sll_family = AF_PACKET; 1636 sll.sll_ifindex = ifindex; 1637 sll.sll_protocol = htons(ETH_P_ALL); 1638 1639 if (bind(fd, (struct sockaddr *) &sll, sizeof(sll)) == -1) { 1640 snprintf(ebuf, PCAP_ERRBUF_SIZE, 1641 "bind: %s", pcap_strerror(errno)); 1642 return -1; 1643 } 1644 1645 /* Any pending errors, e.g., network is down? */ 1646 1647 if (getsockopt(fd, SOL_SOCKET, SO_ERROR, &err, &errlen) == -1) { 1648 snprintf(ebuf, PCAP_ERRBUF_SIZE, 1649 "getsockopt: %s", pcap_strerror(errno)); 1650 return -2; 1651 } 1652 1653 if (err > 0) { 1654 snprintf(ebuf, PCAP_ERRBUF_SIZE, 1655 "bind: %s", pcap_strerror(err)); 1656 return -2; 1657 } 1658 1659 return 0; 1660} 1661 1662#endif 1663 1664 1665/* ===== Functions to interface to the older kernels ================== */ 1666 1667/* 1668 * With older kernels promiscuous mode is kind of interesting because we 1669 * have to reset the interface before exiting. The problem can't really 1670 * be solved without some daemon taking care of managing usage counts. 1671 * If we put the interface into promiscuous mode, we set a flag indicating 1672 * that we must take it out of that mode when the interface is closed, 1673 * and, when closing the interface, if that flag is set we take it out 1674 * of promiscuous mode. 1675 */ 1676 1677/* 1678 * List of pcaps for which we turned promiscuous mode on by hand. 1679 * If there are any such pcaps, we arrange to call "pcap_close_all()" 1680 * when we exit, and have it close all of them to turn promiscuous mode 1681 * off. 1682 */ 1683static struct pcap *pcaps_to_close; 1684 1685/* 1686 * TRUE if we've already called "atexit()" to cause "pcap_close_all()" to 1687 * be called on exit. 1688 */ 1689static int did_atexit; 1690 1691static void pcap_close_all(void) 1692{ 1693 struct pcap *handle; 1694 1695 while ((handle = pcaps_to_close) != NULL) 1696 pcap_close(handle); 1697} 1698 1699static void pcap_close_linux( pcap_t *handle ) 1700{ 1701 struct pcap *p, *prevp; 1702 struct ifreq ifr; 1703 1704 if (handle->md.clear_promisc) { 1705 /* 1706 * We put the interface into promiscuous mode; take 1707 * it out of promiscuous mode. 1708 * 1709 * XXX - if somebody else wants it in promiscuous mode, 1710 * this code cannot know that, so it'll take it out 1711 * of promiscuous mode. That's not fixable in 2.0[.x] 1712 * kernels. 1713 */ 1714 memset(&ifr, 0, sizeof(ifr)); 1715 strncpy(ifr.ifr_name, handle->md.device, sizeof(ifr.ifr_name)); 1716 if (ioctl(handle->fd, SIOCGIFFLAGS, &ifr) == -1) { 1717 fprintf(stderr, 1718 "Can't restore interface flags (SIOCGIFFLAGS failed: %s).\n" 1719 "Please adjust manually.\n" 1720 "Hint: This can't happen with Linux >= 2.2.0.\n", 1721 strerror(errno)); 1722 } else { 1723 if (ifr.ifr_flags & IFF_PROMISC) { 1724 /* 1725 * Promiscuous mode is currently on; turn it 1726 * off. 1727 */ 1728 ifr.ifr_flags &= ~IFF_PROMISC; 1729 if (ioctl(handle->fd, SIOCSIFFLAGS, &ifr) == -1) { 1730 fprintf(stderr, 1731 "Can't restore interface flags (SIOCSIFFLAGS failed: %s).\n" 1732 "Please adjust manually.\n" 1733 "Hint: This can't happen with Linux >= 2.2.0.\n", 1734 strerror(errno)); 1735 } 1736 } 1737 } 1738 1739 /* 1740 * Take this pcap out of the list of pcaps for which we 1741 * have to take the interface out of promiscuous mode. 1742 */ 1743 for (p = pcaps_to_close, prevp = NULL; p != NULL; 1744 prevp = p, p = p->md.next) { 1745 if (p == handle) { 1746 /* 1747 * Found it. Remove it from the list. 1748 */ 1749 if (prevp == NULL) { 1750 /* 1751 * It was at the head of the list. 1752 */ 1753 pcaps_to_close = p->md.next; 1754 } else { 1755 /* 1756 * It was in the middle of the list. 1757 */ 1758 prevp->md.next = p->md.next; 1759 } 1760 break; 1761 } 1762 } 1763 } 1764 1765 if (handle->md.device != NULL) 1766 free(handle->md.device); 1767 handle->md.device = NULL; 1768 pcap_close_common(handle); 1769} 1770 1771/* 1772 * Try to open a packet socket using the old kernel interface. 1773 * Returns 0 on failure. 1774 * FIXME: 0 uses to mean success (Sebastian) 1775 */ 1776static int 1777live_open_old(pcap_t *handle, const char *device, int promisc, 1778 int to_ms, char *ebuf) 1779{ 1780 int arptype; 1781 struct ifreq ifr; 1782 1783 do { 1784 /* Open the socket */ 1785 1786 handle->fd = socket(PF_INET, SOCK_PACKET, htons(ETH_P_ALL)); 1787 if (handle->fd == -1) { 1788 snprintf(ebuf, PCAP_ERRBUF_SIZE, 1789 "socket: %s", pcap_strerror(errno)); 1790 break; 1791 } 1792 1793 /* It worked - we are using the old interface */ 1794 handle->md.sock_packet = 1; 1795 1796 /* ...which means we get the link-layer header. */ 1797 handle->md.cooked = 0; 1798 1799 /* Bind to the given device */ 1800 1801 if (!device) { 1802 strncpy(ebuf, "pcap_open_live: The \"any\" device isn't supported on 2.0[.x]-kernel systems", 1803 PCAP_ERRBUF_SIZE); 1804 break; 1805 } 1806 if (iface_bind_old(handle->fd, device, ebuf) == -1) 1807 break; 1808 1809 /* 1810 * Try to get the link-layer type. 1811 */ 1812 arptype = iface_get_arptype(handle->fd, device, ebuf); 1813 if (arptype == -1) 1814 break; 1815 1816 /* 1817 * Try to find the DLT_ type corresponding to that 1818 * link-layer type. 1819 */ 1820 map_arphrd_to_dlt(handle, arptype, 0); 1821 if (handle->linktype == -1) { 1822 snprintf(ebuf, PCAP_ERRBUF_SIZE, 1823 "unknown arptype %d", arptype); 1824 break; 1825 } 1826 1827 /* Go to promisc mode if requested */ 1828 1829 if (promisc) { 1830 memset(&ifr, 0, sizeof(ifr)); 1831 strncpy(ifr.ifr_name, device, sizeof(ifr.ifr_name)); 1832 if (ioctl(handle->fd, SIOCGIFFLAGS, &ifr) == -1) { 1833 snprintf(ebuf, PCAP_ERRBUF_SIZE, 1834 "SIOCGIFFLAGS: %s", pcap_strerror(errno)); 1835 break; 1836 } 1837 if ((ifr.ifr_flags & IFF_PROMISC) == 0) { 1838 /* 1839 * Promiscuous mode isn't currently on, 1840 * so turn it on, and remember that 1841 * we should turn it off when the 1842 * pcap_t is closed. 1843 */ 1844 1845 /* 1846 * If we haven't already done so, arrange 1847 * to have "pcap_close_all()" called when 1848 * we exit. 1849 */ 1850 if (!did_atexit) { 1851 if (atexit(pcap_close_all) == -1) { 1852 /* 1853 * "atexit()" failed; don't 1854 * put the interface in 1855 * promiscuous mode, just 1856 * give up. 1857 */ 1858 strncpy(ebuf, "atexit failed", 1859 PCAP_ERRBUF_SIZE); 1860 break; 1861 } 1862 did_atexit = 1; 1863 } 1864 1865 ifr.ifr_flags |= IFF_PROMISC; 1866 if (ioctl(handle->fd, SIOCSIFFLAGS, &ifr) == -1) { 1867 snprintf(ebuf, PCAP_ERRBUF_SIZE, 1868 "SIOCSIFFLAGS: %s", 1869 pcap_strerror(errno)); 1870 break; 1871 } 1872 handle->md.clear_promisc = 1; 1873 1874 /* 1875 * Add this to the list of pcaps 1876 * to close when we exit. 1877 */ 1878 handle->md.next = pcaps_to_close; 1879 pcaps_to_close = handle; 1880 } 1881 } 1882 1883 /* 1884 * Default value for offset to align link-layer payload 1885 * on a 4-byte boundary. 1886 */ 1887 handle->offset = 0; 1888 1889 return 1; 1890 1891 } while (0); 1892 1893 pcap_close_linux(handle); 1894 return 0; 1895} 1896 1897/* 1898 * Bind the socket associated with FD to the given device using the 1899 * interface of the old kernels. 1900 */ 1901static int 1902iface_bind_old(int fd, const char *device, char *ebuf) 1903{ 1904 struct sockaddr saddr; 1905 int err; 1906 socklen_t errlen = sizeof(err); 1907 1908 memset(&saddr, 0, sizeof(saddr)); 1909 strncpy(saddr.sa_data, device, sizeof(saddr.sa_data)); 1910 if (bind(fd, &saddr, sizeof(saddr)) == -1) { 1911 snprintf(ebuf, PCAP_ERRBUF_SIZE, 1912 "bind: %s", pcap_strerror(errno)); 1913 return -1; 1914 } 1915 1916 /* Any pending errors, e.g., network is down? */ 1917 1918 if (getsockopt(fd, SOL_SOCKET, SO_ERROR, &err, &errlen) == -1) { 1919 snprintf(ebuf, PCAP_ERRBUF_SIZE, 1920 "getsockopt: %s", pcap_strerror(errno)); 1921 return -1; 1922 } 1923 1924 if (err > 0) { 1925 snprintf(ebuf, PCAP_ERRBUF_SIZE, 1926 "bind: %s", pcap_strerror(err)); 1927 return -1; 1928 } 1929 1930 return 0; 1931} 1932 1933 1934/* ===== System calls available on all supported kernels ============== */ 1935 1936/* 1937 * Query the kernel for the MTU of the given interface. 1938 */ 1939static int 1940iface_get_mtu(int fd, const char *device, char *ebuf) 1941{ 1942 struct ifreq ifr; 1943 1944 if (!device) 1945 return BIGGER_THAN_ALL_MTUS; 1946 1947 memset(&ifr, 0, sizeof(ifr)); 1948 strncpy(ifr.ifr_name, device, sizeof(ifr.ifr_name)); 1949 1950 if (ioctl(fd, SIOCGIFMTU, &ifr) == -1) { 1951 snprintf(ebuf, PCAP_ERRBUF_SIZE, 1952 "SIOCGIFMTU: %s", pcap_strerror(errno)); 1953 return -1; 1954 } 1955 1956 return ifr.ifr_mtu; 1957} 1958 1959/* 1960 * Get the hardware type of the given interface as ARPHRD_xxx constant. 1961 */ 1962static int 1963iface_get_arptype(int fd, const char *device, char *ebuf) 1964{ 1965 struct ifreq ifr; 1966 1967 memset(&ifr, 0, sizeof(ifr)); 1968 strncpy(ifr.ifr_name, device, sizeof(ifr.ifr_name)); 1969 1970 if (ioctl(fd, SIOCGIFHWADDR, &ifr) == -1) { 1971 snprintf(ebuf, PCAP_ERRBUF_SIZE, 1972 "SIOCGIFHWADDR: %s", pcap_strerror(errno)); 1973 return -1; 1974 } 1975 1976 return ifr.ifr_hwaddr.sa_family; 1977} 1978 1979#ifdef SO_ATTACH_FILTER 1980static int 1981fix_program(pcap_t *handle, struct sock_fprog *fcode) 1982{ 1983 size_t prog_size; 1984 register int i; 1985 register struct bpf_insn *p; 1986 struct bpf_insn *f; 1987 int len; 1988 1989 /* 1990 * Make a copy of the filter, and modify that copy if 1991 * necessary. 1992 */ 1993 prog_size = sizeof(*handle->fcode.bf_insns) * handle->fcode.bf_len; 1994 len = handle->fcode.bf_len; 1995 f = (struct bpf_insn *)malloc(prog_size); 1996 if (f == NULL) { 1997 snprintf(handle->errbuf, sizeof(handle->errbuf), 1998 "malloc: %s", pcap_strerror(errno)); 1999 return -1; 2000 } 2001 memcpy(f, handle->fcode.bf_insns, prog_size); 2002 fcode->len = len; 2003 fcode->filter = (struct sock_filter *) f; 2004 2005 for (i = 0; i < len; ++i) { 2006 p = &f[i]; 2007 /* 2008 * What type of instruction is this? 2009 */ 2010 switch (BPF_CLASS(p->code)) { 2011 2012 case BPF_RET: 2013 /* 2014 * It's a return instruction; is the snapshot 2015 * length a constant, rather than the contents 2016 * of the accumulator? 2017 */ 2018 if (BPF_MODE(p->code) == BPF_K) { 2019 /* 2020 * Yes - if the value to be returned, 2021 * i.e. the snapshot length, is anything 2022 * other than 0, make it 65535, so that 2023 * the packet is truncated by "recvfrom()", 2024 * not by the filter. 2025 * 2026 * XXX - there's nothing we can easily do 2027 * if it's getting the value from the 2028 * accumulator; we'd have to insert 2029 * code to force non-zero values to be 2030 * 65535. 2031 */ 2032 if (p->k != 0) 2033 p->k = 65535; 2034 } 2035 break; 2036 2037 case BPF_LD: 2038 case BPF_LDX: 2039 /* 2040 * It's a load instruction; is it loading 2041 * from the packet? 2042 */ 2043 switch (BPF_MODE(p->code)) { 2044 2045 case BPF_ABS: 2046 case BPF_IND: 2047 case BPF_MSH: 2048 /* 2049 * Yes; are we in cooked mode? 2050 */ 2051 if (handle->md.cooked) { 2052 /* 2053 * Yes, so we need to fix this 2054 * instruction. 2055 */ 2056 if (fix_offset(p) < 0) { 2057 /* 2058 * We failed to do so. 2059 * Return 0, so our caller 2060 * knows to punt to userland. 2061 */ 2062 return 0; 2063 } 2064 } 2065 break; 2066 } 2067 break; 2068 } 2069 } 2070 return 1; /* we succeeded */ 2071} 2072 2073static int 2074fix_offset(struct bpf_insn *p) 2075{ 2076 /* 2077 * What's the offset? 2078 */ 2079 if (p->k >= SLL_HDR_LEN) { 2080 /* 2081 * It's within the link-layer payload; that starts at an 2082 * offset of 0, as far as the kernel packet filter is 2083 * concerned, so subtract the length of the link-layer 2084 * header. 2085 */ 2086 p->k -= SLL_HDR_LEN; 2087 } else if (p->k == 14) { 2088 /* 2089 * It's the protocol field; map it to the special magic 2090 * kernel offset for that field. 2091 */ 2092 p->k = SKF_AD_OFF + SKF_AD_PROTOCOL; 2093 } else { 2094 /* 2095 * It's within the header, but it's not one of those 2096 * fields; we can't do that in the kernel, so punt 2097 * to userland. 2098 */ 2099 return -1; 2100 } 2101 return 0; 2102} 2103 2104static int 2105set_kernel_filter(pcap_t *handle, struct sock_fprog *fcode) 2106{ 2107 int total_filter_on = 0; 2108 int save_mode; 2109 int ret; 2110 int save_errno; 2111 2112 /* 2113 * The socket filter code doesn't discard all packets queued 2114 * up on the socket when the filter is changed; this means 2115 * that packets that don't match the new filter may show up 2116 * after the new filter is put onto the socket, if those 2117 * packets haven't yet been read. 2118 * 2119 * This means, for example, that if you do a tcpdump capture 2120 * with a filter, the first few packets in the capture might 2121 * be packets that wouldn't have passed the filter. 2122 * 2123 * We therefore discard all packets queued up on the socket 2124 * when setting a kernel filter. (This isn't an issue for 2125 * userland filters, as the userland filtering is done after 2126 * packets are queued up.) 2127 * 2128 * To flush those packets, we put the socket in read-only mode, 2129 * and read packets from the socket until there are no more to 2130 * read. 2131 * 2132 * In order to keep that from being an infinite loop - i.e., 2133 * to keep more packets from arriving while we're draining 2134 * the queue - we put the "total filter", which is a filter 2135 * that rejects all packets, onto the socket before draining 2136 * the queue. 2137 * 2138 * This code deliberately ignores any errors, so that you may 2139 * get bogus packets if an error occurs, rather than having 2140 * the filtering done in userland even if it could have been 2141 * done in the kernel. 2142 */ 2143 if (setsockopt(handle->fd, SOL_SOCKET, SO_ATTACH_FILTER, 2144 &total_fcode, sizeof(total_fcode)) == 0) { 2145 char drain[1]; 2146 2147 /* 2148 * Note that we've put the total filter onto the socket. 2149 */ 2150 total_filter_on = 1; 2151 2152 /* 2153 * Save the socket's current mode, and put it in 2154 * non-blocking mode; we drain it by reading packets 2155 * until we get an error (which is normally a 2156 * "nothing more to be read" error). 2157 */ 2158 save_mode = fcntl(handle->fd, F_GETFL, 0); 2159 if (save_mode != -1 && 2160 fcntl(handle->fd, F_SETFL, save_mode | O_NONBLOCK) >= 0) { 2161 while (recv(handle->fd, &drain, sizeof drain, 2162 MSG_TRUNC) >= 0) 2163 ; 2164 save_errno = errno; 2165 fcntl(handle->fd, F_SETFL, save_mode); 2166 if (save_errno != EAGAIN) { 2167 /* Fatal error */ 2168 reset_kernel_filter(handle); 2169 snprintf(handle->errbuf, sizeof(handle->errbuf), 2170 "recv: %s", pcap_strerror(save_errno)); 2171 return -2; 2172 } 2173 } 2174 } 2175 2176 /* 2177 * Now attach the new filter. 2178 */ 2179 ret = setsockopt(handle->fd, SOL_SOCKET, SO_ATTACH_FILTER, 2180 fcode, sizeof(*fcode)); 2181 if (ret == -1 && total_filter_on) { 2182 /* 2183 * Well, we couldn't set that filter on the socket, 2184 * but we could set the total filter on the socket. 2185 * 2186 * This could, for example, mean that the filter was 2187 * too big to put into the kernel, so we'll have to 2188 * filter in userland; in any case, we'll be doing 2189 * filtering in userland, so we need to remove the 2190 * total filter so we see packets. 2191 */ 2192 save_errno = errno; 2193 2194 /* 2195 * XXX - if this fails, we're really screwed; 2196 * we have the total filter on the socket, 2197 * and it won't come off. What do we do then? 2198 */ 2199 reset_kernel_filter(handle); 2200 2201 errno = save_errno; 2202 } 2203 return ret; 2204} 2205 2206static int 2207reset_kernel_filter(pcap_t *handle) 2208{ 2209 /* setsockopt() barfs unless it get a dummy parameter */ 2210 int dummy; 2211 2212 return setsockopt(handle->fd, SOL_SOCKET, SO_DETACH_FILTER, 2213 &dummy, sizeof(dummy)); 2214} 2215#endif 2216