dect
/
libpcap
Archived
13
0
Fork 0
Code Releases Activity
This repository has been archived on 2022-02-17. You can view files and clone it, but cannot push or open issues or pull requests.
libpcap/pcap-linux.c

5103 lines
139 KiB
C
Raw Permalink Normal View History

Initial revision
1999-10-07 23:46:40 +00:00
/*
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
* pcap-linux.c: Packet capture interface to the Linux kernel
*
* Copyright (c) 2000 Torsten Landschoff <torsten@debian.org>
* Sebastian Krahmer <krahmer@cs.uni-potsdam.de>
whitespace cleanup
2002-06-11 17:04:44 +00:00
*
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
* License: BSD
whitespace cleanup
2002-06-11 17:04:44 +00:00
*
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
whitespace cleanup
2002-06-11 17:04:44 +00:00
*
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
* 3. The names of the authors may not be used to endorse or promote
* products derived from this software without specific prior
* written permission.
whitespace cleanup
2002-06-11 17:04:44 +00:00
*
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
* THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
*
* Modifications: Added PACKET_MMAP support
* Paolo Abeni <paolo.abeni@email.it>
*
* based on previous works of:
* Simon Patarin <patarin@cs.unibo.it>
* Phil Wood <cpw@lanl.gov>
To put mac80211 devices in monitor mode, create a "monN" device for the underlying adapter, bring it up, and capture on that. This means libpcap nees to be linked with -lnl.
2009-05-22 12:50:15 +00:00
*
* Monitor-mode support for mac80211 includes code taken from the iw
* command; the copyright notice for that code is
*
* Copyright (c) 2007, 2008 Johannes Berg
* Copyright (c) 2007 Andy Lutomirski
* Copyright (c) 2007 Mike Kershaw
* Copyright (c) 2008 Gábor Stefanik
*
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. The name of the author may not be used to endorse or promote products
* derived from this software without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
* BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
* AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
*/
From Jesper Peterson <jesper@endace.com>: support for capturing from Endace DAG devices.
2003-07-23 05:29:19 +00:00
Give it an SCCS ID and an RCS ID.
2000-09-20 07:52:04 +00:00
#ifndef lint
Add _U_ to "rcsid[]" definitions, to eliminate "unused variable" warnings from newer versions of GCC.
2003-11-15 23:23:57 +00:00
static const char rcsid[] _U_ =
OK, let's try another approach - include <linux/if.h> rather than <net/if.h>, in the hope that 1) doing so won't cause some problem somewhere and 2) it'll have multiple-include protection (this whole "glibc is a separate project from the kernel, so we'll duplicate header files" thing has its downsides).
2008-12-14 22:00:57 +00:00
"@(#) $Header: /tcpdump/master/libpcap/pcap-linux.c,v 1.164 2008-12-14 22:00:57 guy Exp $ (LBL)";
Give it an SCCS ID and an RCS ID.
2000-09-20 07:52:04 +00:00
#endif
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
/*
If we're receiving packets from a PF_PACKET socket, check whether the interface index of the interface for the packet is the interface index of the loopback interface and, if it is, check if the packet is an outgoing packet; if so, ignore it, as we'll also be seeing that packet as a received packet. If we don't handle the arphrd type of an interface, and fall back on cooked mode, report the arphrd type, so we know what type we should consider supporting (if that type can't be supported well, e.g. if you don't get any link-layer header, as happens with PPP, we'd be silent).
2000-10-25 07:46:49 +00:00
* Known problems with 2.0[.x] kernels:
*
* - The loopback device gives every packet twice; on 2.2[.x] kernels,
* if we use PF_PACKET, we can filter out the transmitted version
* of the packet by using data in the "sockaddr_ll" returned by
* "recvfrom()", but, on 2.0[.x] kernels, we have to use
* PF_INET/SOCK_PACKET, which means "recvfrom()" supplies a
* "sockaddr_pkt" which doesn't give us enough information to let
* us do that.
*
* - We have to set the interface's IFF_PROMISC flag ourselves, if
* we're to run in promiscuous mode, which means we have to turn
* it off ourselves when we're done; the kernel doesn't keep track
* of how many sockets are listening promiscuously, which means
* it won't get turned off automatically when no sockets are
Clean up promiscuous mode, when using SOCK_PACKET, as best we can; remember which pcap_t's were opened (with SOCK_PACKET) in promiscuous mode on interfaces not already in promiscuous mode, turn promiscuous mode off when closing such a pcap_t, and arrange that, when the program exits, all pcap_t's of that sort not already closed have their interfaces taken out of promiscuous mode. (It's not sufficient to do this on exit - applications may close a pcap_t without exiting, e.g. Ethereal.) This won't always work right (if somebody else requests promiscuous mode after it's opened by libpcap, we'll turn promiscuous mode off when we close the pcap_t, and if the program doesn't exit cleanly, it won't clean up the interfaces), but neither of those problems are fixable - the only way to get things to work correctly is to use PF_PACKET sockets, which requires a 2.2 or later kernel. On a 2.0[.x] kernel, when doing a "recvfrom()" on a SOCK_PACKET socket to read a captured packet, don't pass a byte count value based on the snapshot length - "recvfrom()" won't return the actual packet length if you do that. (2.2 and later kernels will return the actual packet length if MSG_TRUNC is passed in.)
2000-12-16 10:43:26 +00:00
* listening promiscuously. We catch "pcap_close()" and, for
* interfaces we put into promiscuous mode, take them out of
* promiscuous mode - which isn't necessarily the right thing to
* do, if another socket also requested promiscuous mode between
* the time when we opened the socket and the time when we close
* the socket.
Define MSG_TRUNC as 0x20 if it's not defined, so that if this is compiled on a system that doesn't have it, it'll use it on systems that do have it. On systems with MSG_TRUNC support (i.e., 2.2 and later kernels), there's no need to read in the entire packet in order to find out how large it is, so just allocate a buffer big enough for a snapshot length's worth of data, and just read that much data. There's no need for a "readlen" member of the "pcap_md" structure, as the byte count to "recvfrom()" is just the "bufsize" member of the "pcap_t" structure.
2001-08-24 07:46:52 +00:00
*
* - MSG_TRUNC isn't supported, so you can't specify that "recvfrom()"
* return the amount of data that you could have read, rather than
* the amount that was returned, so we can't just allocate a buffer
* whose size is the snapshot length and pass the snapshot length
* as the byte count, and also pass MSG_TRUNC, so that the return
* value tells us how long the packet was on the wire.
*
* This means that, if we want to get the actual size of the packet,
* so we can return it in the "len" field of the packet header,
* we have to read the entire packet, not just the part that fits
* within the snapshot length, and thus waste CPU time copying data
* from the kernel that our caller won't see.
*
* We have to get the actual size, and supply it in "len", because
* otherwise, the IP dissector in tcpdump, for example, will complain
* about "truncated-ip", as the packet will appear to have been
* shorter, on the wire, than the IP header said it should have been.
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
*/
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
To put mac80211 devices in monitor mode, create a "monN" device for the underlying adapter, bring it up, and capture on that. This means libpcap nees to be linked with -lnl.
2009-05-22 12:50:15 +00:00
#define _GNU_SOURCE
add config.h, remove gnuc.h. remove __dead
2000-07-11 00:37:04 +00:00
#ifdef HAVE_CONFIG_H
#include "config.h"
#endif
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
#include <errno.h>
To put mac80211 devices in monitor mode, create a "monN" device for the underlying adapter, bring it up, and capture on that. This means libpcap nees to be linked with -lnl.
2009-05-22 12:50:15 +00:00
#include <stdio.h>
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
#include <stdlib.h>
Include <ctype.h>, as we use macros from it. Also, use isascii() to avoid surprises from characters with the 8th bit set, rather than playing signed vs. unsigned character games.
2010-01-10 02:50:52 +00:00
#include <ctype.h>
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
#include <unistd.h>
#include <fcntl.h>
#include <string.h>
To put mac80211 devices in monitor mode, create a "monN" device for the underlying adapter, bring it up, and capture on that. This means libpcap nees to be linked with -lnl.
2009-05-22 12:50:15 +00:00
#include <limits.h>
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
#include <sys/socket.h>
#include <sys/ioctl.h>
#include <sys/utsname.h>
#include <sys/mman.h>
OK, let's try another approach - include <linux/if.h> rather than <net/if.h>, in the hope that 1) doing so won't cause some problem somewhere and 2) it'll have multiple-include protection (this whole "glibc is a separate project from the kernel, so we'll duplicate header files" thing has its downsides).
2008-12-14 22:00:57 +00:00
#include <linux/if.h>
#include <netinet/in.h>
#include <linux/if_ether.h>
#include <net/if_arp.h>
#include <poll.h>
Scan /sys/class/net if we have it. It's a bit easier to scan than /proc/net/dev, as it's a directory.
2010-01-10 18:56:25 +00:00
#include <dirent.h>
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
Add support for setting the time stamp type for a capture. Based on a patch from Scott Mcmillan <scott.a.mcmillan@intel.com>. (Second part of the commit.)
2010-08-23 00:36:27 +00:00
#ifdef HAVE_LINUX_NET_TSTAMP_H
#include <linux/net_tstamp.h>
#include <linux/sockios.h>
#endif
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
/*
* Got Wireless Extensions?
*/
#ifdef HAVE_LINUX_WIRELESS_H
#include <linux/wireless.h>
When checking whether a device will let you turn monitor mode on, assume mac80211 devices will, regardless of whether they support the Wireless Extensions - wmaster devices will let you turn monitor mode on but don't appear to support the Wireless Extensions. Support turning on monitor mode with libnl even if we don't have support for the Wireless Extensions, just in case the Wireless Extensions go away at some point in the future if every 802.11 device has a mac80211 driver.
2009-06-01 19:56:05 +00:00
#endif /* HAVE_LINUX_WIRELESS_H */
To put mac80211 devices in monitor mode, create a "monN" device for the underlying adapter, bring it up, and capture on that. This means libpcap nees to be linked with -lnl.
2009-05-22 12:50:15 +00:00
/*
* Got libnl?
*/
#ifdef HAVE_LIBNL
#include <linux/nl80211.h>
#include <netlink/genl/genl.h>
#include <netlink/genl/family.h>
#include <netlink/genl/ctrl.h>
#include <netlink/msg.h>
#include <netlink/attr.h>
#endif /* HAVE_LIBNL */
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
#include "pcap-int.h"
Put the public libpcap headers into a pcap subdirectory in both the source directory and the target include directory, and have include files at the top-level directory to include those headers, for backwards compatibility. Update the FILES and INSTALL.txt files to reflect current reality.
2006-10-04 18:09:21 +00:00
#include "pcap/sll.h"
From Patrick McHardy: VLAN packets sent over devices supporting VLAN tagging/stripping in hardware don't have a VLAN header when they are received on packet sockets. The VLAN TCI is available through the PACKET_AUXDATA cmsg, reconstruct the entire header when necessary.
2008-08-06 07:45:00 +00:00
#include "pcap/vlan.h"
Initial revision
1999-10-07 23:46:40 +00:00
From Jesper Peterson <jesper@endace.com>: support for capturing from Endace DAG devices.
2003-07-23 05:29:19 +00:00
#ifdef HAVE_DAG_API
#include "pcap-dag.h"
#endif /* HAVE_DAG_API */
From Gilbert Hoyek <gil_hoyek@hotmail.com>: support for capturing SS7 traffic on Intel Septel cards, and for filtering on SS7 MTP3 fields. Clean up indentation.
2005-06-20 21:27:07 +00:00
#ifdef HAVE_SEPTEL_API
#include "pcap-septel.h"
#endif /* HAVE_SEPTEL_API */
Move the Linux Bluetooth and USB declarations to a header file. Clean up some comments. Protect all references to the USB stuff from the common Linux code with PCAP_SUPPORT_USB, just as references to the Bluetooth code are protected with PCAP_SUPPORT_BT.
2006-10-13 17:46:45 +00:00
Add Myricom SNF API support as a new pcap device. This patch adds support for our NICs when run in a specialized capture mode. It is diffed against the current master. The Myricom Sniffer10G software uses Myri-10G programmable Network Interface Cards (NICs), a firmware extension, a specialized driver and a user-level library (libsnf) to enable sustained capture of 10-Gigabit Ethernet traffic. Small-packet coalescing and an efficient zero-copy path to host memory allow Sniffer10G to capture streams at line rate for all Ethernet packet sizes. Optionally, libpcap can be used concurrently by multiple processes on a single NIC port to partition the incoming traffic across processes. While the Linux kernel enables this through multiple receive queues, the difference is that the myri_snf driver cooperates with libsnf to set up multiple queues that are each independently accessible through user-space. More information here: http://www.myri.com/scs/SNF/doc Signed-off-by: Guy Harris <guy@alum.mit.edu>
2010-01-26 19:58:37 +00:00
#ifdef HAVE_SNF_API
#include "pcap-snf.h"
#endif /* HAVE_SNF_API */
Move the Linux Bluetooth and USB declarations to a header file. Clean up some comments. Protect all references to the USB stuff from the common Linux code with PCAP_SUPPORT_USB, just as references to the Bluetooth code are protected with PCAP_SUPPORT_BT.
2006-10-13 17:46:45 +00:00
#ifdef PCAP_SUPPORT_USB
#include "pcap-usb-linux.h"
#endif
#ifdef PCAP_SUPPORT_BT
#include "pcap-bt-linux.h"
#endif
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
Add support for CANbus capture. Signed-off-by: Guy Harris <guy@alum.mit.edu>
2009-12-29 09:04:20 +00:00
#ifdef PCAP_SUPPORT_CAN
#include "pcap-can-linux.h"
#endif
Import pcap-dect-linux Signed-off-by: Patrick McHardy <kaber@trash.net>
2010-10-15 00:21:10 +00:00
#ifdef PCAP_SUPPORT_DECT
#include "pcap-dect-linux.h"
#endif
From Scott Barron <sb125499@ohiou.edu>: use the SOL_PACKET/PACKET_STATISTICS "getsockopt()" call, on Linux kernels that support it, to get packet statistics, so that we can report the number of dropped packets, and always use <linux/if_packet.h> to get definitions for PF_PACKET sockets, so that we don't depend on glibc's header files having been updated to support all the latest shiniest kernel features (many systems with 2.4[.x] kernels don't have a <netpacket/packet.h> that defines "struct tpacket_stats", for example, so we wouldn't have been able to support that kernel feature on those systems).
2001-07-29 18:25:46 +00:00
/*
* If PF_PACKET is defined, we can use {SOCK_RAW,SOCK_DGRAM}/PF_PACKET
* sockets rather than SOCK_PACKET sockets.
*
* To use them, we include <linux/if_packet.h> rather than
* <netpacket/packet.h>; we do so because
*
* some Linux distributions (e.g., Slackware 4.0) have 2.2 or
* later kernels and libc5, and don't provide a <netpacket/packet.h>
* file;
*
* not all versions of glibc2 have a <netpacket/packet.h> file
* that defines stuff needed for some of the 2.4-or-later-kernel
* features, so if the system has a 2.4 or later kernel, we
* still can't use those features.
*
* We're already including a number of other <linux/XXX.h> headers, and
* this code is Linux-specific (no other OS has PF_PACKET sockets as
* a raw packet capture mechanism), so it's not as if you gain any
* useful portability by using <netpacket/packet.h>
*
* XXX - should we just include <linux/if_packet.h> even if PF_PACKET
* isn't defined? It only defines one data structure in 2.0.x, so
* it shouldn't cause any problems.
*/
whitespace cleanup
2002-06-11 17:04:44 +00:00
#ifdef PF_PACKET
From Scott Barron <sb125499@ohiou.edu>: use the SOL_PACKET/PACKET_STATISTICS "getsockopt()" call, on Linux kernels that support it, to get packet statistics, so that we can report the number of dropped packets, and always use <linux/if_packet.h> to get definitions for PF_PACKET sockets, so that we don't depend on glibc's header files having been updated to support all the latest shiniest kernel features (many systems with 2.4[.x] kernels don't have a <netpacket/packet.h> that defines "struct tpacket_stats", for example, so we wouldn't have been able to support that kernel feature on those systems).
2001-07-29 18:25:46 +00:00
# include <linux/if_packet.h>
Some platforms that lack <netpacket/packet.h> define PF_PACKET but don't support PF_PACKET sockets, and, in particular, don't define in <linux/if_packet.h> any of the stuff needed by the code to handle PF_PACKET sockets. Define HAVE_PF_PACKET_SOCKETS if either 1) we have <netpacket/packet.h> or 2) PF_PACKET is defined *and* PACKET_HOST is defined by <linux/if_packet.h> and use HAVE_PF_PACKET_SOCKETS, not PF_PACKET, be what we use in #ifdefs to conditionally compile in support for PF_PACKET sockets. Not all platforms define ARPHRD_SIT, either; #define it if it's not already defined.
2001-01-18 03:58:22 +00:00
/*
From Scott Barron <sb125499@ohiou.edu>: use the SOL_PACKET/PACKET_STATISTICS "getsockopt()" call, on Linux kernels that support it, to get packet statistics, so that we can report the number of dropped packets, and always use <linux/if_packet.h> to get definitions for PF_PACKET sockets, so that we don't depend on glibc's header files having been updated to support all the latest shiniest kernel features (many systems with 2.4[.x] kernels don't have a <netpacket/packet.h> that defines "struct tpacket_stats", for example, so we wouldn't have been able to support that kernel feature on those systems).
2001-07-29 18:25:46 +00:00
* On at least some Linux distributions (for example, Red Hat 5.2),
* there's no <netpacket/packet.h> file, but PF_PACKET is defined if
* you include <sys/socket.h>, but <linux/if_packet.h> doesn't define
Some platforms that lack <netpacket/packet.h> define PF_PACKET but don't support PF_PACKET sockets, and, in particular, don't define in <linux/if_packet.h> any of the stuff needed by the code to handle PF_PACKET sockets. Define HAVE_PF_PACKET_SOCKETS if either 1) we have <netpacket/packet.h> or 2) PF_PACKET is defined *and* PACKET_HOST is defined by <linux/if_packet.h> and use HAVE_PF_PACKET_SOCKETS, not PF_PACKET, be what we use in #ifdefs to conditionally compile in support for PF_PACKET sockets. Not all platforms define ARPHRD_SIT, either; #define it if it's not already defined.
2001-01-18 03:58:22 +00:00
* any of the PF_PACKET stuff such as "struct sockaddr_ll" or any of
* the PACKET_xxx stuff.
*
* So we check whether PACKET_HOST is defined, and assume that we have
* PF_PACKET sockets only if it is defined.
*/
# ifdef PACKET_HOST
# define HAVE_PF_PACKET_SOCKETS
From Patrick McHardy: VLAN packets sent over devices supporting VLAN tagging/stripping in hardware don't have a VLAN header when they are received on packet sockets. The VLAN TCI is available through the PACKET_AUXDATA cmsg, reconstruct the entire header when necessary.
2008-08-06 07:45:00 +00:00
# ifdef PACKET_AUXDATA
# define HAVE_PACKET_AUXDATA
# endif /* PACKET_AUXDATA */
Some platforms that lack <netpacket/packet.h> define PF_PACKET but don't support PF_PACKET sockets, and, in particular, don't define in <linux/if_packet.h> any of the stuff needed by the code to handle PF_PACKET sockets. Define HAVE_PF_PACKET_SOCKETS if either 1) we have <netpacket/packet.h> or 2) PF_PACKET is defined *and* PACKET_HOST is defined by <linux/if_packet.h> and use HAVE_PF_PACKET_SOCKETS, not PF_PACKET, be what we use in #ifdefs to conditionally compile in support for PF_PACKET sockets. Not all platforms define ARPHRD_SIT, either; #define it if it's not already defined.
2001-01-18 03:58:22 +00:00
# endif /* PACKET_HOST */
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
/* check for memory mapped access avaibility. We assume every needed
* struct is defined if the macro TPACKET_HDRLEN is defined, because it
* uses many ring related structs and macros */
# ifdef TPACKET_HDRLEN
# define HAVE_PACKET_RING
From Patrick McHardy: The tpacket_hdr is not clean for 64 bit kernel/32 bit userspace and is not extendable because the struct sockaddr_ll following it is expected at a fixed offset. Linux 2.6.27-rc supports a new tpacket frame header that removes these two limitations. Convert the mmap ring support to support both formats and probe for availability of the new version.
2008-08-06 07:49:19 +00:00
# ifdef TPACKET2_HDRLEN
# define HAVE_TPACKET2
# else
# define TPACKET_V1 0
# endif /* TPACKET2_HDRLEN */
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
# endif /* TPACKET_HDRLEN */
From Scott Barron <sb125499@ohiou.edu>: use the SOL_PACKET/PACKET_STATISTICS "getsockopt()" call, on Linux kernels that support it, to get packet statistics, so that we can report the number of dropped packets, and always use <linux/if_packet.h> to get definitions for PF_PACKET sockets, so that we don't depend on glibc's header files having been updated to support all the latest shiniest kernel features (many systems with 2.4[.x] kernels don't have a <netpacket/packet.h> that defines "struct tpacket_stats", for example, so we wouldn't have been able to support that kernel feature on those systems).
2001-07-29 18:25:46 +00:00
#endif /* PF_PACKET */
At least some libc5 systems don't have <netinet/if_ether.h> but do have <net/if_arp.h>, and the stuff we want is in <net/if_arp.h>, so include that rather than <netinet/if_ether.h>. At least some libc5 systems don't have <netpacket/packet.h>, but have a <sys/socket.h> that includes <linux/socket.h>, and the latter defines SO_ATTACH_FILTER if the kernel is a 2.2 or later kernel, so there exist systems that have SO_ATTACH_FILTER defined but don't have <netpacket/packet.h>. Work around that by: checking whether we have PF_PACKET sockets by checking whether PF_PACKET is defined, not whether we have <netpacket/packet.h> (but we still check whether we have <netpacket/packet.h> before including it); if PF_PACKET is defined but we don't have <netpacket/packet.h>, include <linux/if_packet.h> to get the relevant definitions.
2001-01-17 07:42:37 +00:00
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
#ifdef SO_ATTACH_FILTER
#include <linux/types.h>
#include <linux/filter.h>
#endif
Initial revision
1999-10-07 23:46:40 +00:00
From Kris Katterjohn: explicitly check for socklen_t, don't just assume glibc is the only Linux libc that defines socklen_t.
2008-03-14 09:09:13 +00:00
#ifndef HAVE_SOCKLEN_T
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
typedef int socklen_t;
(MSG_TRUNC): define if it's not defined. From Love <lha@stacken.kth.se>
2000-07-11 01:06:27 +00:00
#endif
#ifndef MSG_TRUNC
Define MSG_TRUNC as 0x20 if it's not defined, so that if this is compiled on a system that doesn't have it, it'll use it on systems that do have it. On systems with MSG_TRUNC support (i.e., 2.2 and later kernels), there's no need to read in the entire packet in order to find out how large it is, so just allocate a buffer big enough for a snapshot length's worth of data, and just read that much data. There's no need for a "readlen" member of the "pcap_md" structure, as the byte count to "recvfrom()" is just the "bufsize" member of the "pcap_t" structure.
2001-08-24 07:46:52 +00:00
/*
* This is being compiled on a system that lacks MSG_TRUNC; define it
* with the value it has in the 2.2 and later kernels, so that, on
* those kernels, when we pass it in the flags argument to "recvfrom()"
* we're passing the right value and thus get the MSG_TRUNC behavior
* we want. (We don't get that behavior on 2.0[.x] kernels, because
* they didn't support MSG_TRUNC.)
*/
#define MSG_TRUNC 0x20
Initial revision
1999-10-07 23:46:40 +00:00
#endif
Isn't Linux fun? You might have a distribution whose kernel is a shiny new 2.2-or-later kernel, with PF_PACKET sockets including SOL_PACKET, but with an older version of the C library whose headers don't define SOL_PACKET. On those systems, define SOL_PACKET to have the value it has in the 2.2.0 kernel; this means we can get rid of the "#ifdef SOL_PACKET"/#endif stuff wrapped around the code to turn promiscuous mode on or off (we don't want that #ifdeffed out, as if it's absent we won't pay attention to the "promiscuous mode" flag argument to "pcap_open_live()").
2002-07-06 21:22:35 +00:00
#ifndef SOL_PACKET
/*
* This is being compiled on a system that lacks SOL_PACKET; define it
* with the value it has in the 2.2 and later kernels, so that we can
* set promiscuous mode in the good modern way rather than the old
* 2.0-kernel crappy way.
*/
#define SOL_PACKET 263
#endif
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
#define MAX_LINKHEADER_SIZE 256
Initial revision
1999-10-07 23:46:40 +00:00
whitespace cleanup
2002-06-11 17:04:44 +00:00
/*
* When capturing on all interfaces we use this as the buffer size.
Added support for an "any" device based on a patch from Sebastian Krahmer.
2000-09-20 15:10:28 +00:00
* Should be bigger then all MTUs that occur in real life.
* 64kB should be enough for now.
*/
#define BIGGER_THAN_ALL_MTUS (64*1024)
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
/*
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
* Prototypes for internal functions and methods.
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
*/
Have "map_arphrd_to_dlt()" take a flag indicating whether it's OK to return DLT_LINUX_SLL or not, and, if that flag is false, for those interface types where we'd used DLT_LINUX_SLL, pick a DLT_ type that works as well as possible in raw mode, or fail. Pass 1 as that flag if we're using a PF_PACKET socket; pass 0 as that flag if we're using a PF_INET/SOCK_PACKET socket. For PF_INET/SOCK_PACKET sockets, try to get the link-layer type and map it to a DLT_ value *before* turning promiscuous mode on, so that we don't try to put the interface into promiscuous mode unless we know we can handle its link-layer type (and thus that we can use the interface).
2002-02-10 00:05:14 +00:00
static void map_arphrd_to_dlt(pcap_t *, int, int);
map_packet_type_to_sll_type() isn't used - and won't compile - if you don't have PF_PACKET support; #ifdef it out. Move the code to compute the buffer size into live_open_new() and live_open_old(), as it's dependent on the mechanism being used; there's little code shared between the two variants.
2008-01-24 20:20:08 +00:00
#ifdef HAVE_PF_PACKET_SOCKETS
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
static short int map_packet_type_to_sll_type(short int);
map_packet_type_to_sll_type() isn't used - and won't compile - if you don't have PF_PACKET support; #ifdef it out. Move the code to compute the buffer size into live_open_new() and live_open_old(), as it's dependent on the mechanism being used; there's little code shared between the two variants.
2008-01-24 20:20:08 +00:00
#endif
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
static int pcap_activate_linux(pcap_t *);
static int activate_old(pcap_t *);
static int activate_new(pcap_t *);
If the specified time stamp type isn't supported, treat that as a warning.
2010-08-23 02:09:50 +00:00
static int activate_mmap(pcap_t *, int *);
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
static int pcap_can_set_rfmon_linux(pcap_t *);
Add a "read" function pointer to the pcap_t structure, which handles reading packets from a pcap_t, and make "pcap_read()" call it. That removes the last place where we have to check for a pcap_t that refers to a DAG card rather than a live capture, so get rid of the "is_dag" flag.
2003-07-25 05:32:02 +00:00
static int pcap_read_linux(pcap_t *, int, pcap_handler, u_char *);
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
static int pcap_read_packet(pcap_t *, pcap_handler, u_char *);
Add support for sending packets; includes contributions from Mark Pizzolato <List-tcpdump-workers@subscriptions.pizzolato.net>.
2004-03-23 19:18:04 +00:00
static int pcap_inject_linux(pcap_t *, const void *, size_t);
Add a "stats" function pointer to the pcap_t structure, which handles getting statistics for a pcap_t. Have "pcap_stats()" call it, rather than being a per-platform function; have stats routines for non-live pcap_t's that return an error.
2003-07-25 04:04:56 +00:00
static int pcap_stats_linux(pcap_t *, struct pcap_stat *);
Add a "setfilter" function pointer to the pcap_t structure, which handles setting a filter for a pcap_t. Have "pcap_setfilter()" call it, rather than being a per-platform function. The per-platform functions don't need to check for an offline capture any more, as they're not called for an offline capture (and the ones that just call "install_bpf_program()" don't need to exist at all).
2003-07-25 04:42:02 +00:00
static int pcap_setfilter_linux(pcap_t *, struct bpf_program *);
OK, we'll be putting out 0.9.2 soon, so add the API changes back in again.
2005-07-07 01:57:00 +00:00
static int pcap_setdirection_linux(pcap_t *, pcap_direction_t);
Turn close_op into cleanup_op; the routine that handles it can also be used to clean up after a failed pcap_activate() call. Convert the existing close_op routines to cleanup_op routines, and use them to clean up; rename pcap_close_common() to pcap_cleanup_live_common(), and use it directly if there's no platform-dependent cleanup needed. That means we don't have to write the same cleanup code twice (and possibly forget stuff in the version done on a failed pcap_activate() call). Have the cleanup routines do whatever is necessary to indicate that cleanup has been done, and not do any particular cleaning up if it's already been done (i.e., don't free something if the pointer to it is null and null out the pointer once it's been freed, don't close an FD if it's -1 and set it to -1 once it's been closed, etc.). For device types/platforms where we don't support monitor mode, check for it and return PCAP_ERROR_RFMON_NOTSUP - but do so after we've checked whether we can open the device, so we return "no such device" or "permission denied" rather than "that device doesn't support monitor mode" if we can't open the device in the first place. Fix a comment.
2008-04-14 20:40:58 +00:00
static void pcap_cleanup_linux(pcap_t *);
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
Not releasing a packet in Linux memory-mapped mode until we try to read the next packet breaks select(). Back those changes out; we'll have to fix the behavior of pcap_next* by making a copy of the packet.
2009-07-03 21:37:06 +00:00
union thdr {
struct tpacket_hdr *h1;
struct tpacket2_hdr *h2;
void *raw;
};
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
#ifdef HAVE_PACKET_RING
From Patrick McHardy: The tpacket_hdr is not clean for 64 bit kernel/32 bit userspace and is not extendable because the struct sockaddr_ll following it is expected at a fixed offset. Linux 2.6.27-rc supports a new tpacket frame header that removes these two limitations. Convert the mmap ring support to support both formats and probe for availability of the new version.
2008-08-06 07:49:19 +00:00
#define RING_GET_FRAME(h) (((union thdr **)h->buffer)[h->offset])
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
static void destroy_ring(pcap_t *handle);
If the specified time stamp type isn't supported, treat that as a warning.
2010-08-23 02:09:50 +00:00
static int create_ring(pcap_t *handle, int *status);
From Patrick McHardy: The tpacket_hdr is not clean for 64 bit kernel/32 bit userspace and is not extendable because the struct sockaddr_ll following it is expected at a fixed offset. Linux 2.6.27-rc supports a new tpacket frame header that removes these two limitations. Convert the mmap ring support to support both formats and probe for availability of the new version.
2008-08-06 07:49:19 +00:00
static int prepare_tpacket_socket(pcap_t *handle);
Turn close_op into cleanup_op; the routine that handles it can also be used to clean up after a failed pcap_activate() call. Convert the existing close_op routines to cleanup_op routines, and use them to clean up; rename pcap_close_common() to pcap_cleanup_live_common(), and use it directly if there's no platform-dependent cleanup needed. That means we don't have to write the same cleanup code twice (and possibly forget stuff in the version done on a failed pcap_activate() call). Have the cleanup routines do whatever is necessary to indicate that cleanup has been done, and not do any particular cleaning up if it's already been done (i.e., don't free something if the pointer to it is null and null out the pointer once it's been freed, don't close an FD if it's -1 and set it to -1 once it's been closed, etc.). For device types/platforms where we don't support monitor mode, check for it and return PCAP_ERROR_RFMON_NOTSUP - but do so after we've checked whether we can open the device, so we return "no such device" or "permission denied" rather than "that device doesn't support monitor mode" if we can't open the device in the first place. Fix a comment.
2008-04-14 20:40:58 +00:00
static void pcap_cleanup_linux_mmap(pcap_t *);
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
static int pcap_read_linux_mmap(pcap_t *, int, pcap_handler , u_char *);
static int pcap_setfilter_linux_mmap(pcap_t *, struct bpf_program *);
static int pcap_setnonblock_mmap(pcap_t *p, int nonblock, char *errbuf);
static int pcap_getnonblock_mmap(pcap_t *p, char *errbuf);
When doing Linux mmapped capture: Allocate a buffer into which to copy a packet, and have the callback for pcap_next() and pcap_next_ex() copy to that buffer and return a pointer to that buffer; we can't return the packet data pointer passed to the callback, as, once the callback returns, that buffer can be overwritten, even before you read the next packet. Don't tweak filter programs passed into the kernel to return 65535 on success - we don't have to, as we're not reading packets with recvfrom(), and we don't want to, as, if we return the actual snapshot length, the kernel will copy less data to the ring buffer. Truncate the packet snapshot length to the specified length, as we might not have a filter to do that.
2009-07-16 22:08:12 +00:00
static void pcap_oneshot_mmap(u_char *user, const struct pcap_pkthdr *h,
const u_char *bytes);
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
#endif
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
/*
* Wrap some ioctl calls
*/
Some platforms that lack <netpacket/packet.h> define PF_PACKET but don't support PF_PACKET sockets, and, in particular, don't define in <linux/if_packet.h> any of the stuff needed by the code to handle PF_PACKET sockets. Define HAVE_PF_PACKET_SOCKETS if either 1) we have <netpacket/packet.h> or 2) PF_PACKET is defined *and* PACKET_HOST is defined by <linux/if_packet.h> and use HAVE_PF_PACKET_SOCKETS, not PF_PACKET, be what we use in #ifdefs to conditionally compile in support for PF_PACKET sockets. Not all platforms define ARPHRD_SIT, either; #define it if it's not already defined.
2001-01-18 03:58:22 +00:00
#ifdef HAVE_PF_PACKET_SOCKETS
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
static int iface_get_id(int fd, const char *device, char *ebuf);
Don't declare "iface_get_id()" or "iface_bind()" if "HAVE_NETPACKET_PACKET_H" isn't defined, as we won't define them if it's not defined. If the packet buffer size, as computed from the MTU of the interface, is less than the user's requested snapshot length, set it to the user's requested snapshot length; otherwise, the "recvfrom()" call will fail, as the length specified in the call is the user's requested snapshot length, and the kernel checks whether the buffer is big enough for that much data and rejects the "recvfrom()" call if it's not.
2000-10-20 06:55:28 +00:00
#endif
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
static int iface_get_mtu(int fd, const char *device, char *ebuf);
static int iface_get_arptype(int fd, const char *device, char *ebuf);
Some platforms that lack <netpacket/packet.h> define PF_PACKET but don't support PF_PACKET sockets, and, in particular, don't define in <linux/if_packet.h> any of the stuff needed by the code to handle PF_PACKET sockets. Define HAVE_PF_PACKET_SOCKETS if either 1) we have <netpacket/packet.h> or 2) PF_PACKET is defined *and* PACKET_HOST is defined by <linux/if_packet.h> and use HAVE_PF_PACKET_SOCKETS, not PF_PACKET, be what we use in #ifdefs to conditionally compile in support for PF_PACKET sockets. Not all platforms define ARPHRD_SIT, either; #define it if it's not already defined.
2001-01-18 03:58:22 +00:00
#ifdef HAVE_PF_PACKET_SOCKETS
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
static int iface_bind(int fd, int ifindex, char *ebuf);
has_wext() isn't used if IW_MODE_MONITOR isn't defined, so don't define it if IW_MODE_MONITOR isn't defined.
2008-12-14 20:03:59 +00:00
#ifdef IW_MODE_MONITOR
Add an error for "you don't have permission to open that device", as that often means "sorry, this platform requires you to run as root or to somehow tweak the system to give you capture privileges", and applications might want to explain that in a way that does a better job of letting the user know what they have to do. Try to return or PCAP_ERROR_PERM_DENIED for open errors, rather than just returning PCAP_ERROR, so that the application can, if it chooses, try to explain the error better (as those two errors are the ones that don't mean "there's probably some obscure OS or libpcap problem", but mean, instead, "you made an error" or "you need to get permission to capture"). Check for monitor mode *after* checking whether the device exists in the first place; a non-existent device doesn't support monitor mode, but that's because it doesn't, well, exist, and the latter would be a more meaningful error. Have pcap_open_live() supply an error message for return values other than PCAP_ERROR, PCAP_ERROR_NO_SUCH_DEVICE, and PCAP_ERROR_PERM_DENIED - those all supply error strings (PCAP_ERROR because it's for various OS problems that might require debugging, and the other two because there might be multiple causes).
2008-04-09 19:58:02 +00:00
static int has_wext(int sock_fd, const char *device, char *ebuf);
has_wext() isn't used if IW_MODE_MONITOR isn't defined, so don't define it if IW_MODE_MONITOR isn't defined.
2008-12-14 20:03:59 +00:00
#endif /* IW_MODE_MONITOR */
To put mac80211 devices in monitor mode, create a "monN" device for the underlying adapter, bring it up, and capture on that. This means libpcap nees to be linked with -lnl.
2009-05-22 12:50:15 +00:00
static int enter_rfmon_mode(pcap_t *handle, int sock_fd,
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
const char *device);
has_wext() isn't used if IW_MODE_MONITOR isn't defined, so don't define it if IW_MODE_MONITOR isn't defined.
2008-12-14 20:03:59 +00:00
#endif /* HAVE_PF_PACKET_SOCKETS */
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
static int iface_bind_old(int fd, const char *device, char *ebuf);
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
Add support for a new link layer type DLT_LINUX_SLL, for use when doing live captures with a "cooked" (SOCK_DGRAM) rather than a "raw" (SOCK_RAW) PF_PACKET socket; it includes a bunch of the fields from the "struct sockaddr_ll" you get in a "recvfrom()", including the Ethernet protocol field. This requires us to rewrite the BPF program if we're stuffing it into the kernel; as long as we're doing *ex post facto* rewriting, we might as well also do the "ret <snaplen>" -> "ret 65535" fixup there as well, rather than in the code generator.
2000-12-21 10:29:21 +00:00
#ifdef SO_ATTACH_FILTER
When doing Linux mmapped capture: Allocate a buffer into which to copy a packet, and have the callback for pcap_next() and pcap_next_ex() copy to that buffer and return a pointer to that buffer; we can't return the packet data pointer passed to the callback, as, once the callback returns, that buffer can be overwritten, even before you read the next packet. Don't tweak filter programs passed into the kernel to return 65535 on success - we don't have to, as we're not reading packets with recvfrom(), and we don't want to, as, if we return the actual snapshot length, the kernel will copy less data to the ring buffer. Truncate the packet snapshot length to the specified length, as we might not have a filter to do that.
2009-07-16 22:08:12 +00:00
static int fix_program(pcap_t *handle, struct sock_fprog *fcode,
int is_mapped);
Add support for a new link layer type DLT_LINUX_SLL, for use when doing live captures with a "cooked" (SOCK_DGRAM) rather than a "raw" (SOCK_RAW) PF_PACKET socket; it includes a bunch of the fields from the "struct sockaddr_ll" you get in a "recvfrom()", including the Ethernet protocol field. This requires us to rewrite the BPF program if we're stuffing it into the kernel; as long as we're doing *ex post facto* rewriting, we might as well also do the "ret <snaplen>" -> "ret 65535" fixup there as well, rather than in the code generator.
2000-12-21 10:29:21 +00:00
static int fix_offset(struct bpf_insn *p);
Patch, based on a patch from Pavel Kankovsky <kan@dcit.cz>, to flush all packets queued up on the socket when we set a kernel filter on the socket, so that if there are any queue-up packets that wouldn't have passed the new filter, we don't see them. (Some other packet capture mechanisms do this automatically; this prevents tcpdump, for example, from showing or saving, when run with a filter, some packets that wouldn't have passed the filter.) XXX - do we have to do this on any other platforms? Choose whether to compile in the code to modify filter programs for use in the kernel, and to flush queued-up packet and set a kernel filter, on whether SO_ATTACH_FILTER is defined (i.e., on whether we have kernel filter support in our build environment), rather than on whether HAVE_PF_PACKET_SOCKETS is defined (i.e., on whether we have PF_PACKET support in our build environment), as we choose whether to *use* that code based on whether SO_ATTACH_FILTER is defined.
2001-08-25 05:08:26 +00:00
static int set_kernel_filter(pcap_t *handle, struct sock_fprog *fcode);
Changes from Pavel Kankovsky to reset the kernel filter in "pcap_setfilter()" if we're not using a kernel filter, in case a previous call to "pcap_setfilter()" had succeeded in adding a kernel filter, as if we're doing userland filtering we need to get rid of all kernel filters that might discard packets that'd pass the userland filter.
2001-08-30 03:08:43 +00:00
static int reset_kernel_filter(pcap_t *handle);
Patch, based on a patch from Pavel Kankovsky <kan@dcit.cz>, to flush all packets queued up on the socket when we set a kernel filter on the socket, so that if there are any queue-up packets that wouldn't have passed the new filter, we don't see them. (Some other packet capture mechanisms do this automatically; this prevents tcpdump, for example, from showing or saving, when run with a filter, some packets that wouldn't have passed the filter.) XXX - do we have to do this on any other platforms? Choose whether to compile in the code to modify filter programs for use in the kernel, and to flush queued-up packet and set a kernel filter, on whether SO_ATTACH_FILTER is defined (i.e., on whether we have kernel filter support in our build environment), rather than on whether HAVE_PF_PACKET_SOCKETS is defined (i.e., on whether we have PF_PACKET support in our build environment), as we choose whether to *use* that code based on whether SO_ATTACH_FILTER is defined.
2001-08-25 05:08:26 +00:00
static struct sock_filter total_insn
= BPF_STMT(BPF_RET | BPF_K, 0);
static struct sock_fprog total_fcode
= { 1, &total_insn };
Add support for a new link layer type DLT_LINUX_SLL, for use when doing live captures with a "cooked" (SOCK_DGRAM) rather than a "raw" (SOCK_RAW) PF_PACKET socket; it includes a bunch of the fields from the "struct sockaddr_ll" you get in a "recvfrom()", including the Ethernet protocol field. This requires us to rewrite the BPF program if we're stuffing it into the kernel; as long as we're doing *ex post facto* rewriting, we might as well also do the "ret <snaplen>" -> "ret 65535" fixup there as well, rather than in the code generator.
2000-12-21 10:29:21 +00:00
#endif
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
pcap_t *
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
pcap_create(const char *device, char *ebuf)
Initial revision
1999-10-07 23:46:40 +00:00
{
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
pcap_t *handle;
Move the code to allocate the packet buffer into "pcap_open_live()", so that we don't have almost-duplicate code in "live_open_old()" and "live_open_new()". This fixes a bug wherein "live_open_new()" wasn't making the buffer size the maximum of "enough to hold packets of the MTU obtained from the socket" and "the snapshot length" (for some reason, "recvfrom()" was copying more data than the MTU obtained from the socket).
2001-08-23 16:36:41 +00:00
Fix the handling of the "any" device, including making it reject attempts to open it in monitor mode.
2008-11-19 08:20:39 +00:00
/*
* A null device name is equivalent to the "any" device.
*/
if (device == NULL)
device = "any";
From Jesper Peterson <jesper@endace.com>: support for capturing from Endace DAG devices.
2003-07-23 05:29:19 +00:00
#ifdef HAVE_DAG_API
if (strstr(device, "dag")) {
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
return dag_create(device, ebuf);
From Jesper Peterson <jesper@endace.com>: support for capturing from Endace DAG devices.
2003-07-23 05:29:19 +00:00
}
#endif /* HAVE_DAG_API */
From Gilbert Hoyek <gil_hoyek@hotmail.com>: support for capturing SS7 traffic on Intel Septel cards, and for filtering on SS7 MTP3 fields. Clean up indentation.
2005-06-20 21:27:07 +00:00
#ifdef HAVE_SEPTEL_API
if (strstr(device, "septel")) {
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
return septel_create(device, ebuf);
From Gilbert Hoyek <gil_hoyek@hotmail.com>: support for capturing SS7 traffic on Intel Septel cards, and for filtering on SS7 MTP3 fields. Clean up indentation.
2005-06-20 21:27:07 +00:00
}
#endif /* HAVE_SEPTEL_API */
Add Myricom SNF API support as a new pcap device. This patch adds support for our NICs when run in a specialized capture mode. It is diffed against the current master. The Myricom Sniffer10G software uses Myri-10G programmable Network Interface Cards (NICs), a firmware extension, a specialized driver and a user-level library (libsnf) to enable sustained capture of 10-Gigabit Ethernet traffic. Small-packet coalescing and an efficient zero-copy path to host memory allow Sniffer10G to capture streams at line rate for all Ethernet packet sizes. Optionally, libpcap can be used concurrently by multiple processes on a single NIC port to partition the incoming traffic across processes. While the Linux kernel enables this through multiple receive queues, the difference is that the myri_snf driver cooperates with libsnf to set up multiple queues that are each independently accessible through user-space. More information here: http://www.myri.com/scs/SNF/doc Signed-off-by: Guy Harris <guy@alum.mit.edu>
2010-01-26 19:58:37 +00:00
#ifdef HAVE_SNF_API
handle = snf_create(device, ebuf);
if (strstr(device, "snf") || handle != NULL)
return handle;
#endif /* HAVE_SNF_API */
From Paolo Abeni: Bluetooth support.
2006-10-13 17:34:53 +00:00
#ifdef PCAP_SUPPORT_BT
if (strstr(device, "bluetooth")) {
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
return bt_create(device, ebuf);
From Paolo Abeni: Bluetooth support.
2006-10-13 17:34:53 +00:00
}
#endif
Add support for CANbus capture. Signed-off-by: Guy Harris <guy@alum.mit.edu>
2009-12-29 09:04:20 +00:00
#ifdef PCAP_SUPPORT_CAN
if (strstr(device, "can") || strstr(device, "vcan")) {
return can_create(device, ebuf);
}
#endif
Move the Linux Bluetooth and USB declarations to a header file. Clean up some comments. Protect all references to the USB stuff from the common Linux code with PCAP_SUPPORT_USB, just as references to the Bluetooth code are protected with PCAP_SUPPORT_BT.
2006-10-13 17:46:45 +00:00
#ifdef PCAP_SUPPORT_USB
From Roman Francoise: rename the USB-sniffing devices to "usbmonN", so as not to collide with the "usbN" names for USB-based networking devices.
2009-03-19 16:37:03 +00:00
if (strstr(device, "usbmon")) {
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
return usb_create(device, ebuf);
From Paolo Abeni: Bluetooth support.
2006-10-13 17:34:53 +00:00
}
Move the Linux Bluetooth and USB declarations to a header file. Clean up some comments. Protect all references to the USB stuff from the common Linux code with PCAP_SUPPORT_USB, just as references to the Bluetooth code are protected with PCAP_SUPPORT_BT.
2006-10-13 17:46:45 +00:00
#endif
from Paolo Abeni <paolo.abeni@email.com>: USB capturing support on linux
2006-10-04 15:50:26 +00:00
Import pcap-dect-linux Signed-off-by: Patrick McHardy <kaber@trash.net>
2010-10-15 00:21:10 +00:00
#ifdef PCAP_SUPPORT_DECT
if (strstr(device, "dect")) {
return dect_create(device, ebuf);
}
#endif
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
handle = pcap_create_common(device, ebuf);
if (handle == NULL)
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
return NULL;
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
handle->activate_op = pcap_activate_linux;
handle->can_set_rfmon_op = pcap_can_set_rfmon_linux;
Add support for setting the time stamp type for a capture. Based on a patch from Scott Mcmillan <scott.a.mcmillan@intel.com>. (Second part of the commit.)
2010-08-23 00:36:27 +00:00
#if defined(HAVE_LINUX_NET_TSTAMP_H) && defined(PACKET_TIMESTAMP)
/*
* We claim that we support:
*
* software time stamps, with no details about their precision;
* hardware time stamps, synced to the host time;
* hardware time stamps, not synced to the host time.
*
* XXX - we can't ask a device whether it supports
* hardware time stamps, so we just claim all devices do.
*/
handle->tstamp_type_count = 3;
handle->tstamp_type_list = malloc(3 * sizeof(u_int));
if (handle->tstamp_type_list == NULL) {
free(handle);
return NULL;
}
handle->tstamp_type_list[0] = PCAP_TSTAMP_HOST;
handle->tstamp_type_list[1] = PCAP_TSTAMP_ADAPTER;
Fixes from Scott Mcmillan.
2010-08-23 19:50:19 +00:00
handle->tstamp_type_list[2] = PCAP_TSTAMP_ADAPTER_UNSYNCED;
Add support for setting the time stamp type for a capture. Based on a patch from Scott Mcmillan <scott.a.mcmillan@intel.com>. (Second part of the commit.)
2010-08-23 00:36:27 +00:00
#endif
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
return handle;
}
Move up the definition of get_mac80211_phydev() before all its uses.
2009-06-01 20:03:05 +00:00
#ifdef HAVE_LIBNL
/*
Clean up indentation.
2010-05-19 00:50:49 +00:00
* If interface {if} is a mac80211 driver, the file
* /sys/class/net/{if}/phy80211 is a symlink to
* /sys/class/ieee80211/{phydev}, for some {phydev}.
*
* On Fedora 9, with a 2.6.26.3-29 kernel, my Zydas stick, at
* least, has a "wmaster0" device and a "wlan0" device; the
* latter is the one with the IP address. Both show up in
* "tcpdump -D" output. Capturing on the wmaster0 device
* captures with 802.11 headers.
*
* airmon-ng searches through /sys/class/net for devices named
* monN, starting with mon0; as soon as one *doesn't* exist,
* it chooses that as the monitor device name. If the "iw"
* command exists, it does "iw dev {if} interface add {monif}
* type monitor", where {monif} is the monitor device. It
* then (sigh) sleeps .1 second, and then configures the
* device up. Otherwise, if /sys/class/ieee80211/{phydev}/add_iface
* is a file, it writes {mondev}, without a newline, to that file,
* and again (sigh) sleeps .1 second, and then iwconfig's that
* device into monitor mode and configures it up. Otherwise,
* you can't do monitor mode.
*
* All these devices are "glued" together by having the
* /sys/class/net/{device}/phy80211 links pointing to the same
* place, so, given a wmaster, wlan, or mon device, you can
* find the other devices by looking for devices with
* the same phy80211 link.
*
* To turn monitor mode off, delete the monitor interface,
* either with "iw dev {monif} interface del" or by sending
* {monif}, with no NL, down /sys/class/ieee80211/{phydev}/remove_iface
*
* Note: if you try to create a monitor device named "monN", and
* there's already a "monN" device, it fails, as least with
* the netlink interface (which is what iw uses), with a return
* value of -ENFILE. (Return values are negative errnos.) We
* could probably use that to find an unused device.
*
* Yes, you can have multiple monitor devices for a given
* physical device.
Move up the definition of get_mac80211_phydev() before all its uses.
2009-06-01 20:03:05 +00:00
*/
/*
* Is this a mac80211 device? If so, fill in the physical device path and
* return 1; if not, return 0. On an error, fill in handle->errbuf and
* return PCAP_ERROR.
*/
static int
get_mac80211_phydev(pcap_t *handle, const char *device, char *phydev_path,
size_t phydev_max_pathlen)
{
char *pathstr;
ssize_t bytes_read;
/*
* Generate the path string for the symlink to the physical device.
*/
if (asprintf(&pathstr, "/sys/class/net/%s/phy80211", device) == -1) {
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
"%s: Can't generate path name string for /sys/class/net device",
device);
return PCAP_ERROR;
}
bytes_read = readlink(pathstr, phydev_path, phydev_max_pathlen);
if (bytes_read == -1) {
if (errno == ENOENT || errno == EINVAL) {
/*
* Doesn't exist, or not a symlink; assume that
* means it's not a mac80211 device.
*/
free(pathstr);
return 0;
}
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
"%s: Can't readlink %s: %s", device, pathstr,
strerror(errno));
free(pathstr);
return PCAP_ERROR;
}
free(pathstr);
phydev_path[bytes_read] = '\0';
return 1;
}
Libnl 2.x returns its own error codes, not errnos; handle that. While we're at it, don't special-case ENFILE for "delete monitor device" operations; that's not like "add monitor device", where we want to drive on if a device with that name already exists.
2010-11-14 21:48:19 +00:00
#ifdef HAVE_LIBNL_2_x
#define get_nl_errmsg nl_geterror
#else
Add support for libnl 2.x, adapted from a newer version of the iw command.
2010-11-14 01:42:47 +00:00
/* libnl 2.x compatibility code */
#define nl_sock nl_handle
static inline struct nl_handle *
nl_socket_alloc(void)
{
return nl_handle_alloc();
}
static inline void
nl_socket_free(struct nl_handle *h)
{
nl_handle_destroy(h);
}
Libnl 2.x returns its own error codes, not errnos; handle that. While we're at it, don't special-case ENFILE for "delete monitor device" operations; that's not like "add monitor device", where we want to drive on if a device with that name already exists.
2010-11-14 21:48:19 +00:00
#define get_nl_errmsg strerror
Add support for libnl 2.x, adapted from a newer version of the iw command.
2010-11-14 01:42:47 +00:00
static inline int
__genl_ctrl_alloc_cache(struct nl_handle *h, struct nl_cache **cache)
{
struct nl_cache *tmp = genl_ctrl_alloc_cache(h);
if (!tmp)
return -ENOMEM;
*cache = tmp;
return 0;
}
#define genl_ctrl_alloc_cache __genl_ctrl_alloc_cache
#endif /* !HAVE_LIBNL_2_x */
To put mac80211 devices in monitor mode, create a "monN" device for the underlying adapter, bring it up, and capture on that. This means libpcap nees to be linked with -lnl.
2009-05-22 12:50:15 +00:00
struct nl80211_state {
Add support for libnl 2.x, adapted from a newer version of the iw command.
2010-11-14 01:42:47 +00:00
struct nl_sock *nl_sock;
To put mac80211 devices in monitor mode, create a "monN" device for the underlying adapter, bring it up, and capture on that. This means libpcap nees to be linked with -lnl.
2009-05-22 12:50:15 +00:00
struct nl_cache *nl_cache;
struct genl_family *nl80211;
};
static int
nl80211_init(pcap_t *handle, struct nl80211_state *state, const char *device)
{
Add support for libnl 2.x, adapted from a newer version of the iw command.
2010-11-14 01:42:47 +00:00
int err;
state->nl_sock = nl_socket_alloc();
if (!state->nl_sock) {
To put mac80211 devices in monitor mode, create a "monN" device for the underlying adapter, bring it up, and capture on that. This means libpcap nees to be linked with -lnl.
2009-05-22 12:50:15 +00:00
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
"%s: failed to allocate netlink handle", device);
return PCAP_ERROR;
}
Add support for libnl 2.x, adapted from a newer version of the iw command.
2010-11-14 01:42:47 +00:00
if (genl_connect(state->nl_sock)) {
To put mac80211 devices in monitor mode, create a "monN" device for the underlying adapter, bring it up, and capture on that. This means libpcap nees to be linked with -lnl.
2009-05-22 12:50:15 +00:00
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
"%s: failed to connect to generic netlink", device);
goto out_handle_destroy;
}
Add support for libnl 2.x, adapted from a newer version of the iw command.
2010-11-14 01:42:47 +00:00
err = genl_ctrl_alloc_cache(state->nl_sock, &state->nl_cache);
if (err < 0) {
To put mac80211 devices in monitor mode, create a "monN" device for the underlying adapter, bring it up, and capture on that. This means libpcap nees to be linked with -lnl.
2009-05-22 12:50:15 +00:00
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
Add support for libnl 2.x, adapted from a newer version of the iw command.
2010-11-14 01:42:47 +00:00
"%s: failed to allocate generic netlink cache: %s",
Libnl 2.x returns its own error codes, not errnos; handle that. While we're at it, don't special-case ENFILE for "delete monitor device" operations; that's not like "add monitor device", where we want to drive on if a device with that name already exists.
2010-11-14 21:48:19 +00:00
device, get_nl_errmsg(-err));
To put mac80211 devices in monitor mode, create a "monN" device for the underlying adapter, bring it up, and capture on that. This means libpcap nees to be linked with -lnl.
2009-05-22 12:50:15 +00:00
goto out_handle_destroy;
}
state->nl80211 = genl_ctrl_search_by_name(state->nl_cache, "nl80211");
if (!state->nl80211) {
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
"%s: nl80211 not found", device);
goto out_cache_free;
}
return 0;
out_cache_free:
nl_cache_free(state->nl_cache);
out_handle_destroy:
Add support for libnl 2.x, adapted from a newer version of the iw command.
2010-11-14 01:42:47 +00:00
nl_socket_free(state->nl_sock);
To put mac80211 devices in monitor mode, create a "monN" device for the underlying adapter, bring it up, and capture on that. This means libpcap nees to be linked with -lnl.
2009-05-22 12:50:15 +00:00
return PCAP_ERROR;
}
static void
nl80211_cleanup(struct nl80211_state *state)
{
genl_family_put(state->nl80211);
nl_cache_free(state->nl_cache);
Add support for libnl 2.x, adapted from a newer version of the iw command.
2010-11-14 01:42:47 +00:00
nl_socket_free(state->nl_sock);
To put mac80211 devices in monitor mode, create a "monN" device for the underlying adapter, bring it up, and capture on that. This means libpcap nees to be linked with -lnl.
2009-05-22 12:50:15 +00:00
}
static int
add_mon_if(pcap_t *handle, int sock_fd, struct nl80211_state *state,
const char *device, const char *mondevice)
{
int ifindex;
struct nl_msg *msg;
int err;
ifindex = iface_get_id(sock_fd, device, handle->errbuf);
if (ifindex == -1)
return PCAP_ERROR;
msg = nlmsg_alloc();
if (!msg) {
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
"%s: failed to allocate netlink msg", device);
return PCAP_ERROR;
}
genlmsg_put(msg, 0, 0, genl_family_get_id(state->nl80211), 0,
0, NL80211_CMD_NEW_INTERFACE, 0);
NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifindex);
NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, mondevice);
NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, NL80211_IFTYPE_MONITOR);
Add support for libnl 2.x, adapted from a newer version of the iw command.
2010-11-14 01:42:47 +00:00
err = nl_send_auto_complete(state->nl_sock, msg);
To put mac80211 devices in monitor mode, create a "monN" device for the underlying adapter, bring it up, and capture on that. This means libpcap nees to be linked with -lnl.
2009-05-22 12:50:15 +00:00
if (err < 0) {
Libnl 2.x returns its own error codes, not errnos; handle that. While we're at it, don't special-case ENFILE for "delete monitor device" operations; that's not like "add monitor device", where we want to drive on if a device with that name already exists.
2010-11-14 21:48:19 +00:00
#ifdef HAVE_LIBNL_2_x
if (err == -NLE_FAILURE) {
#else
To put mac80211 devices in monitor mode, create a "monN" device for the underlying adapter, bring it up, and capture on that. This means libpcap nees to be linked with -lnl.
2009-05-22 12:50:15 +00:00
if (err == -ENFILE) {
Libnl 2.x returns its own error codes, not errnos; handle that. While we're at it, don't special-case ENFILE for "delete monitor device" operations; that's not like "add monitor device", where we want to drive on if a device with that name already exists.
2010-11-14 21:48:19 +00:00
#endif
To put mac80211 devices in monitor mode, create a "monN" device for the underlying adapter, bring it up, and capture on that. This means libpcap nees to be linked with -lnl.
2009-05-22 12:50:15 +00:00
/*
* Device not available; our caller should just
Libnl 2.x returns its own error codes, not errnos; handle that. While we're at it, don't special-case ENFILE for "delete monitor device" operations; that's not like "add monitor device", where we want to drive on if a device with that name already exists.
2010-11-14 21:48:19 +00:00
* keep trying. (libnl 2.x maps ENFILE to
* NLE_FAILURE; it can also map other errors
* to that, but there's not much we can do
* about that.)
To put mac80211 devices in monitor mode, create a "monN" device for the underlying adapter, bring it up, and capture on that. This means libpcap nees to be linked with -lnl.
2009-05-22 12:50:15 +00:00
*/
nlmsg_free(msg);
return 0;
} else {
/*
* Real failure, not just "that device is not
* available.
*/
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
"%s: nl_send_auto_complete failed adding %s interface: %s",
Libnl 2.x returns its own error codes, not errnos; handle that. While we're at it, don't special-case ENFILE for "delete monitor device" operations; that's not like "add monitor device", where we want to drive on if a device with that name already exists.
2010-11-14 21:48:19 +00:00
device, mondevice, get_nl_errmsg(-err));
To put mac80211 devices in monitor mode, create a "monN" device for the underlying adapter, bring it up, and capture on that. This means libpcap nees to be linked with -lnl.
2009-05-22 12:50:15 +00:00
nlmsg_free(msg);
return PCAP_ERROR;
}
}
Add support for libnl 2.x, adapted from a newer version of the iw command.
2010-11-14 01:42:47 +00:00
err = nl_wait_for_ack(state->nl_sock);
To put mac80211 devices in monitor mode, create a "monN" device for the underlying adapter, bring it up, and capture on that. This means libpcap nees to be linked with -lnl.
2009-05-22 12:50:15 +00:00
if (err < 0) {
Libnl 2.x returns its own error codes, not errnos; handle that. While we're at it, don't special-case ENFILE for "delete monitor device" operations; that's not like "add monitor device", where we want to drive on if a device with that name already exists.
2010-11-14 21:48:19 +00:00
#ifdef HAVE_LIBNL_2_x
if (err == -NLE_FAILURE) {
#else
To put mac80211 devices in monitor mode, create a "monN" device for the underlying adapter, bring it up, and capture on that. This means libpcap nees to be linked with -lnl.
2009-05-22 12:50:15 +00:00
if (err == -ENFILE) {
Libnl 2.x returns its own error codes, not errnos; handle that. While we're at it, don't special-case ENFILE for "delete monitor device" operations; that's not like "add monitor device", where we want to drive on if a device with that name already exists.
2010-11-14 21:48:19 +00:00
#endif
To put mac80211 devices in monitor mode, create a "monN" device for the underlying adapter, bring it up, and capture on that. This means libpcap nees to be linked with -lnl.
2009-05-22 12:50:15 +00:00
/*
* Device not available; our caller should just
Libnl 2.x returns its own error codes, not errnos; handle that. While we're at it, don't special-case ENFILE for "delete monitor device" operations; that's not like "add monitor device", where we want to drive on if a device with that name already exists.
2010-11-14 21:48:19 +00:00
* keep trying. (libnl 2.x maps ENFILE to
* NLE_FAILURE; it can also map other errors
* to that, but there's not much we can do
* about that.)
To put mac80211 devices in monitor mode, create a "monN" device for the underlying adapter, bring it up, and capture on that. This means libpcap nees to be linked with -lnl.
2009-05-22 12:50:15 +00:00
*/
nlmsg_free(msg);
return 0;
} else {
/*
* Real failure, not just "that device is not
* available.
*/
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
"%s: nl_wait_for_ack failed adding %s interface: %s",
Libnl 2.x returns its own error codes, not errnos; handle that. While we're at it, don't special-case ENFILE for "delete monitor device" operations; that's not like "add monitor device", where we want to drive on if a device with that name already exists.
2010-11-14 21:48:19 +00:00
device, mondevice, get_nl_errmsg(-err));
To put mac80211 devices in monitor mode, create a "monN" device for the underlying adapter, bring it up, and capture on that. This means libpcap nees to be linked with -lnl.
2009-05-22 12:50:15 +00:00
nlmsg_free(msg);
return PCAP_ERROR;
}
}
/*
* Success.
*/
nlmsg_free(msg);
return 1;
nla_put_failure:
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
"%s: nl_put failed adding %s interface",
device, mondevice);
nlmsg_free(msg);
return PCAP_ERROR;
}
static int
del_mon_if(pcap_t *handle, int sock_fd, struct nl80211_state *state,
const char *device, const char *mondevice)
{
int ifindex;
struct nl_msg *msg;
int err;
ifindex = iface_get_id(sock_fd, mondevice, handle->errbuf);
if (ifindex == -1)
return PCAP_ERROR;
msg = nlmsg_alloc();
if (!msg) {
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
"%s: failed to allocate netlink msg", device);
return PCAP_ERROR;
}
genlmsg_put(msg, 0, 0, genl_family_get_id(state->nl80211), 0,
0, NL80211_CMD_DEL_INTERFACE, 0);
NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifindex);
Add support for libnl 2.x, adapted from a newer version of the iw command.
2010-11-14 01:42:47 +00:00
err = nl_send_auto_complete(state->nl_sock, msg);
To put mac80211 devices in monitor mode, create a "monN" device for the underlying adapter, bring it up, and capture on that. This means libpcap nees to be linked with -lnl.
2009-05-22 12:50:15 +00:00
if (err < 0) {
Libnl 2.x returns its own error codes, not errnos; handle that. While we're at it, don't special-case ENFILE for "delete monitor device" operations; that's not like "add monitor device", where we want to drive on if a device with that name already exists.
2010-11-14 21:48:19 +00:00
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
"%s: nl_send_auto_complete failed deleting %s interface: %s",
device, mondevice, get_nl_errmsg(-err));
nlmsg_free(msg);
return PCAP_ERROR;
To put mac80211 devices in monitor mode, create a "monN" device for the underlying adapter, bring it up, and capture on that. This means libpcap nees to be linked with -lnl.
2009-05-22 12:50:15 +00:00
}
Add support for libnl 2.x, adapted from a newer version of the iw command.
2010-11-14 01:42:47 +00:00
err = nl_wait_for_ack(state->nl_sock);
To put mac80211 devices in monitor mode, create a "monN" device for the underlying adapter, bring it up, and capture on that. This means libpcap nees to be linked with -lnl.
2009-05-22 12:50:15 +00:00
if (err < 0) {
Libnl 2.x returns its own error codes, not errnos; handle that. While we're at it, don't special-case ENFILE for "delete monitor device" operations; that's not like "add monitor device", where we want to drive on if a device with that name already exists.
2010-11-14 21:48:19 +00:00
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
"%s: nl_wait_for_ack failed adding %s interface: %s",
device, mondevice, get_nl_errmsg(-err));
nlmsg_free(msg);
return PCAP_ERROR;
To put mac80211 devices in monitor mode, create a "monN" device for the underlying adapter, bring it up, and capture on that. This means libpcap nees to be linked with -lnl.
2009-05-22 12:50:15 +00:00
}
/*
* Success.
*/
nlmsg_free(msg);
return 1;
nla_put_failure:
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
"%s: nl_put failed deleting %s interface",
device, mondevice);
nlmsg_free(msg);
return PCAP_ERROR;
}
Move some more stuff up before the first use.
2009-06-01 20:04:55 +00:00
static int
enter_rfmon_mode_mac80211(pcap_t *handle, int sock_fd, const char *device)
{
int ret;
char phydev_path[PATH_MAX+1];
struct nl80211_state nlstate;
struct ifreq ifr;
u_int n;
/*
* Is this a mac80211 device?
*/
ret = get_mac80211_phydev(handle, device, phydev_path, PATH_MAX);
if (ret < 0)
return ret; /* error */
if (ret == 0)
return 0; /* no error, but not mac80211 device */
/*
* XXX - is this already a monN device?
* If so, we're done.
* Is that determined by old Wireless Extensions ioctls?
*/
/*
* OK, it's apparently a mac80211 device.
* Try to find an unused monN device for it.
*/
ret = nl80211_init(handle, &nlstate, device);
if (ret != 0)
return ret;
for (n = 0; n < UINT_MAX; n++) {
/*
* Try mon{n}.
*/
char mondevice[3+10+1]; /* mon{UINT_MAX}\0 */
snprintf(mondevice, sizeof mondevice, "mon%u", n);
ret = add_mon_if(handle, sock_fd, &nlstate, device, mondevice);
if (ret == 1) {
handle->md.mondevice = strdup(mondevice);
goto added;
}
if (ret < 0) {
/*
* Hard failure. Just return ret; handle->errbuf
* has already been set.
*/
nl80211_cleanup(&nlstate);
return ret;
}
}
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
"%s: No free monN interfaces", device);
nl80211_cleanup(&nlstate);
return PCAP_ERROR;
added:
#if 0
/*
* Sleep for .1 seconds.
*/
delay.tv_sec = 0;
delay.tv_nsec = 500000000;
nanosleep(&delay, NULL);
#endif
/*
* Now configure the monitor interface up.
*/
memset(&ifr, 0, sizeof(ifr));
strncpy(ifr.ifr_name, handle->md.mondevice, sizeof(ifr.ifr_name));
if (ioctl(sock_fd, SIOCGIFFLAGS, &ifr) == -1) {
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
"%s: Can't get flags for %s: %s", device,
handle->md.mondevice, strerror(errno));
del_mon_if(handle, sock_fd, &nlstate, device,
handle->md.mondevice);
nl80211_cleanup(&nlstate);
return PCAP_ERROR;
}
ifr.ifr_flags |= IFF_UP|IFF_RUNNING;
if (ioctl(sock_fd, SIOCSIFFLAGS, &ifr) == -1) {
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
"%s: Can't set flags for %s: %s", device,
handle->md.mondevice, strerror(errno));
del_mon_if(handle, sock_fd, &nlstate, device,
handle->md.mondevice);
nl80211_cleanup(&nlstate);
return PCAP_ERROR;
}
/*
* Success. Clean up the libnl state.
*/
nl80211_cleanup(&nlstate);
/*
* Note that we have to delete the monitor device when we close
* the handle.
*/
handle->md.must_do_on_close |= MUST_DELETE_MONIF;
/*
* Add this to the list of pcaps to close when we exit.
*/
pcap_add_to_pcaps_to_close(handle);
return 1;
}
When checking whether a device will let you turn monitor mode on, assume mac80211 devices will, regardless of whether they support the Wireless Extensions - wmaster devices will let you turn monitor mode on but don't appear to support the Wireless Extensions. Support turning on monitor mode with libnl even if we don't have support for the Wireless Extensions, just in case the Wireless Extensions go away at some point in the future if every 802.11 device has a mac80211 driver.
2009-06-01 19:56:05 +00:00
#endif /* HAVE_LIBNL */
To put mac80211 devices in monitor mode, create a "monN" device for the underlying adapter, bring it up, and capture on that. This means libpcap nees to be linked with -lnl.
2009-05-22 12:50:15 +00:00
Move some more stuff up before the first use.
2009-06-01 20:04:55 +00:00
static int
pcap_can_set_rfmon_linux(pcap_t *handle)
{
#ifdef HAVE_LIBNL
char phydev_path[PATH_MAX+1];
int ret;
#endif
#ifdef IW_MODE_MONITOR
int sock_fd;
struct iwreq ireq;
#endif
if (strcmp(handle->opt.source, "any") == 0) {
/*
* Monitor mode makes no sense on the "any" device.
*/
return 0;
}
#ifdef HAVE_LIBNL
/*
* Bleah. There doesn't seem to be a way to ask a mac80211
* device, through libnl, whether it supports monitor mode;
* we'll just check whether the device appears to be a
* mac80211 device and, if so, assume the device supports
* monitor mode.
*
* wmaster devices don't appear to support the Wireless
* Extensions, but we can create a mon device for a
* wmaster device, so we don't bother checking whether
* a mac80211 device supports the Wireless Extensions.
*/
ret = get_mac80211_phydev(handle, handle->opt.source, phydev_path,
PATH_MAX);
if (ret < 0)
return ret; /* error */
if (ret == 1)
return 1; /* mac80211 device */
#endif
#ifdef IW_MODE_MONITOR
/*
* Bleah. There doesn't appear to be an ioctl to use to ask
* whether a device supports monitor mode; we'll just do
* SIOCGIWMODE and, if it succeeds, assume the device supports
* monitor mode.
*
* Open a socket on which to attempt to get the mode.
* (We assume that if we have Wireless Extensions support
* we also have PF_PACKET support.)
*/
sock_fd = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
if (sock_fd == -1) {
(void)snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
"socket: %s", pcap_strerror(errno));
return PCAP_ERROR;
}
/*
* Attempt to get the current mode.
*/
strncpy(ireq.ifr_ifrn.ifrn_name, handle->opt.source,
sizeof ireq.ifr_ifrn.ifrn_name);
ireq.ifr_ifrn.ifrn_name[sizeof ireq.ifr_ifrn.ifrn_name - 1] = 0;
if (ioctl(sock_fd, SIOCGIWMODE, &ireq) != -1) {
/*
* Well, we got the mode; assume we can set it.
*/
close(sock_fd);
return 1;
}
if (errno == ENODEV) {
/* The device doesn't even exist. */
The pcap_activate() man page says: If PCAP_WARNING_PROMISC_NOTSUP, PCAP_ERROR_NO_SUCH_DEVICE, or PCAP_ERROR_PERM_DENIED is returned, pcap_geterr() or pcap_perror() may be called with p as an argument to fetch or display an message giving additional details about the problem that might be useful for debugging the problem if it's unexpected. but we weren't always setting the error string in question. Do so. In pcap_open_live(), if the open fails with PCAP_ERROR, include the device name in the error string, and if it fails with PCAP_ERROR_NO_SUCH_DEVICE or PCAP_ERROR_PERM_DENIED, include the device name and both error messages in the error string.
2009-07-31 03:58:08 +00:00
(void)snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
"SIOCGIWMODE failed: %s", pcap_strerror(errno));
Move some more stuff up before the first use.
2009-06-01 20:04:55 +00:00
close(sock_fd);
return PCAP_ERROR_NO_SUCH_DEVICE;
}
close(sock_fd);
#endif
return 0;
}
Note some other ways to get link statistics.
2009-09-08 00:52:55 +00:00
/*
* Grabs the number of dropped packets by the interface from /proc/net/dev.
*
* XXX - what about /sys/class/net/{interface name}/rx_*? There are
* individual devices giving, in ASCII, various rx_ and tx_ statistics.
*
* Or can we get them in binary form from netlink?
*/
From Dustin Spicuzza: support ps_ifdrop on Linux, using /proc/net/dev. Fix the title of the pcap_stats man page, and give more detail - and a lot of caveats.
2009-09-07 23:23:15 +00:00
static long int
linux_if_drops(const char * if_name)
{
char buffer[512];
char * bufptr;
FILE * file;
int field_to_convert = 3, if_name_sz = strlen(if_name);
long int dropped_pkts = 0;
file = fopen("/proc/net/dev", "r");
if (!file)
return 0;
while (!dropped_pkts && fgets( buffer, sizeof(buffer), file ))
{
/* search for 'bytes' -- if its in there, then
that means we need to grab the fourth field. otherwise
grab the third field. */
if (field_to_convert != 4 && strstr(buffer, "bytes"))
{
field_to_convert = 4;
continue;
}
/* find iface and make sure it actually matches -- space before the name and : after it */
if ((bufptr = strstr(buffer, if_name)) &&
(bufptr == buffer || *(bufptr-1) == ' ') &&
*(bufptr + if_name_sz) == ':')
{
bufptr = bufptr + if_name_sz + 1;
/* grab the nth field from it */
while( --field_to_convert && *bufptr != '\0')
{
while (*bufptr != '\0' && *(bufptr++) == ' ');
while (*bufptr != '\0' && *(bufptr++) != ' ');
}
/* get rid of any final spaces */
while (*bufptr != '\0' && *bufptr == ' ') bufptr++;
if (*bufptr != '\0')
dropped_pkts = strtol(bufptr, NULL, 10);
break;
}
}
fclose(file);
return dropped_pkts;
}
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
/*
* With older kernels promiscuous mode is kind of interesting because we
* have to reset the interface before exiting. The problem can't really
* be solved without some daemon taking care of managing usage counts.
* If we put the interface into promiscuous mode, we set a flag indicating
* that we must take it out of that mode when the interface is closed,
* and, when closing the interface, if that flag is set we take it out
* of promiscuous mode.
*
* Even with newer kernels, we have the same issue with rfmon mode.
*/
Turn close_op into cleanup_op; the routine that handles it can also be used to clean up after a failed pcap_activate() call. Convert the existing close_op routines to cleanup_op routines, and use them to clean up; rename pcap_close_common() to pcap_cleanup_live_common(), and use it directly if there's no platform-dependent cleanup needed. That means we don't have to write the same cleanup code twice (and possibly forget stuff in the version done on a failed pcap_activate() call). Have the cleanup routines do whatever is necessary to indicate that cleanup has been done, and not do any particular cleaning up if it's already been done (i.e., don't free something if the pointer to it is null and null out the pointer once it's been freed, don't close an FD if it's -1 and set it to -1 once it's been closed, etc.). For device types/platforms where we don't support monitor mode, check for it and return PCAP_ERROR_RFMON_NOTSUP - but do so after we've checked whether we can open the device, so we return "no such device" or "permission denied" rather than "that device doesn't support monitor mode" if we can't open the device in the first place. Fix a comment.
2008-04-14 20:40:58 +00:00
static void pcap_cleanup_linux( pcap_t *handle )
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
{
struct ifreq ifr;
To put mac80211 devices in monitor mode, create a "monN" device for the underlying adapter, bring it up, and capture on that. This means libpcap nees to be linked with -lnl.
2009-05-22 12:50:15 +00:00
#ifdef HAVE_LIBNL
struct nl80211_state nlstate;
int ret;
#endif /* HAVE_LIBNL */
When checking whether a device will let you turn monitor mode on, assume mac80211 devices will, regardless of whether they support the Wireless Extensions - wmaster devices will let you turn monitor mode on but don't appear to support the Wireless Extensions. Support turning on monitor mode with libnl even if we don't have support for the Wireless Extensions, just in case the Wireless Extensions go away at some point in the future if every 802.11 device has a mac80211 driver.
2009-06-01 19:56:05 +00:00
#ifdef IW_MODE_MONITOR
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
struct iwreq ireq;
To put mac80211 devices in monitor mode, create a "monN" device for the underlying adapter, bring it up, and capture on that. This means libpcap nees to be linked with -lnl.
2009-05-22 12:50:15 +00:00
#endif /* IW_MODE_MONITOR */
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
To put mac80211 devices in monitor mode, create a "monN" device for the underlying adapter, bring it up, and capture on that. This means libpcap nees to be linked with -lnl.
2009-05-22 12:50:15 +00:00
if (handle->md.must_do_on_close != 0) {
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
/*
* There's something we have to do when closing this
* pcap_t.
*/
To put mac80211 devices in monitor mode, create a "monN" device for the underlying adapter, bring it up, and capture on that. This means libpcap nees to be linked with -lnl.
2009-05-22 12:50:15 +00:00
if (handle->md.must_do_on_close & MUST_CLEAR_PROMISC) {
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
/*
* We put the interface into promiscuous mode;
* take it out of promiscuous mode.
*
* XXX - if somebody else wants it in promiscuous
* mode, this code cannot know that, so it'll take
* it out of promiscuous mode. That's not fixable
* in 2.0[.x] kernels.
*/
memset(&ifr, 0, sizeof(ifr));
strncpy(ifr.ifr_name, handle->md.device,
sizeof(ifr.ifr_name));
if (ioctl(handle->fd, SIOCGIFFLAGS, &ifr) == -1) {
fprintf(stderr,
"Can't restore interface flags (SIOCGIFFLAGS failed: %s).\n"
"Please adjust manually.\n"
"Hint: This can't happen with Linux >= 2.2.0.\n",
strerror(errno));
} else {
if (ifr.ifr_flags & IFF_PROMISC) {
/*
* Promiscuous mode is currently on;
* turn it off.
*/
ifr.ifr_flags &= ~IFF_PROMISC;
if (ioctl(handle->fd, SIOCSIFFLAGS,
&ifr) == -1) {
fprintf(stderr,
"Can't restore interface flags (SIOCSIFFLAGS failed: %s).\n"
"Please adjust manually.\n"
"Hint: This can't happen with Linux >= 2.2.0.\n",
strerror(errno));
}
}
}
}
To put mac80211 devices in monitor mode, create a "monN" device for the underlying adapter, bring it up, and capture on that. This means libpcap nees to be linked with -lnl.
2009-05-22 12:50:15 +00:00
#ifdef HAVE_LIBNL
if (handle->md.must_do_on_close & MUST_DELETE_MONIF) {
ret = nl80211_init(handle, &nlstate, handle->md.device);
if (ret >= 0) {
ret = del_mon_if(handle, handle->fd, &nlstate,
handle->md.device, handle->md.mondevice);
nl80211_cleanup(&nlstate);
}
if (ret < 0) {
fprintf(stderr,
"Can't delete monitor interface %s (%s).\n"
"Please delete manually.\n",
handle->md.mondevice, handle->errbuf);
}
}
#endif /* HAVE_LIBNL */
When checking whether a device will let you turn monitor mode on, assume mac80211 devices will, regardless of whether they support the Wireless Extensions - wmaster devices will let you turn monitor mode on but don't appear to support the Wireless Extensions. Support turning on monitor mode with libnl even if we don't have support for the Wireless Extensions, just in case the Wireless Extensions go away at some point in the future if every 802.11 device has a mac80211 driver.
2009-06-01 19:56:05 +00:00
#ifdef IW_MODE_MONITOR
To put mac80211 devices in monitor mode, create a "monN" device for the underlying adapter, bring it up, and capture on that. This means libpcap nees to be linked with -lnl.
2009-05-22 12:50:15 +00:00
if (handle->md.must_do_on_close & MUST_CLEAR_RFMON) {
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
/*
* We put the interface into rfmon mode;
* take it out of rfmon mode.
*
* XXX - if somebody else wants it in rfmon
* mode, this code cannot know that, so it'll take
* it out of rfmon mode.
*/
strncpy(ireq.ifr_ifrn.ifrn_name, handle->md.device,
sizeof ireq.ifr_ifrn.ifrn_name);
ireq.ifr_ifrn.ifrn_name[sizeof ireq.ifr_ifrn.ifrn_name - 1]
= 0;
ireq.u.mode = handle->md.oldmode;
if (ioctl(handle->fd, SIOCSIWMODE, &ireq) == -1) {
/*
* Scientist, you've failed.
*/
fprintf(stderr,
"Can't restore interface wireless mode (SIOCSIWMODE failed: %s).\n"
"Please adjust manually.\n",
strerror(errno));
}
}
To put mac80211 devices in monitor mode, create a "monN" device for the underlying adapter, bring it up, and capture on that. This means libpcap nees to be linked with -lnl.
2009-05-22 12:50:15 +00:00
#endif /* IW_MODE_MONITOR */
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
/*
* Take this pcap out of the list of pcaps for which we
* have to take the interface out of some mode.
*/
pcap_remove_from_pcaps_to_close(handle);
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
}
To put mac80211 devices in monitor mode, create a "monN" device for the underlying adapter, bring it up, and capture on that. This means libpcap nees to be linked with -lnl.
2009-05-22 12:50:15 +00:00
if (handle->md.mondevice != NULL) {
free(handle->md.mondevice);
handle->md.mondevice = NULL;
}
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
if (handle->md.device != NULL) {
free(handle->md.device);
handle->md.device = NULL;
}
Fix a typo (sigh, using both "p" and "handle" for the pcap_t pointer in different modules can lead to confusion).
2008-04-14 21:04:51 +00:00
pcap_cleanup_live_common(handle);
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
}
/*
* Get a handle for a live capture from the given device. You can
* pass NULL as device to get all packages (without link level
* information of course). If you pass 1 as promisc the interface
* will be set to promiscous mode (XXX: I think this usage should
* be deprecated and functions be added to select that later allow
* modification of that values -- Torsten).
*/
static int
pcap_activate_linux(pcap_t *handle)
{
const char *device;
Add some PCAP_WARNING return values for "success, but you might want to know that..."; currently, only pcap_activate() returns them, but we might want some more warning returns for some other calls, such as the ones that set filters. It's a little cleaner than "clear out the error message buffer and, if it's not empty after a successful return, it has a warning", and a little cleaner than spewing a warning to the standard error (as that might not be visible to the user if they're running a GUI application).
2008-04-09 21:26:12 +00:00
int status = 0;
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
device = handle->opt.source;
Added support for an "any" device based on a patch from Sebastian Krahmer.
2000-09-20 15:10:28 +00:00
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
handle->inject_op = pcap_inject_linux;
handle->setfilter_op = pcap_setfilter_linux;
handle->setdirection_op = pcap_setdirection_linux;
handle->set_datalink_op = NULL; /* can't change data link type */
handle->getnonblock_op = pcap_getnonblock_fd;
handle->setnonblock_op = pcap_setnonblock_fd;
Turn close_op into cleanup_op; the routine that handles it can also be used to clean up after a failed pcap_activate() call. Convert the existing close_op routines to cleanup_op routines, and use them to clean up; rename pcap_close_common() to pcap_cleanup_live_common(), and use it directly if there's no platform-dependent cleanup needed. That means we don't have to write the same cleanup code twice (and possibly forget stuff in the version done on a failed pcap_activate() call). Have the cleanup routines do whatever is necessary to indicate that cleanup has been done, and not do any particular cleaning up if it's already been done (i.e., don't free something if the pointer to it is null and null out the pointer once it's been freed, don't close an FD if it's -1 and set it to -1 once it's been closed, etc.). For device types/platforms where we don't support monitor mode, check for it and return PCAP_ERROR_RFMON_NOTSUP - but do so after we've checked whether we can open the device, so we return "no such device" or "permission denied" rather than "that device doesn't support monitor mode" if we can't open the device in the first place. Fix a comment.
2008-04-14 20:40:58 +00:00
handle->cleanup_op = pcap_cleanup_linux;
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
handle->read_op = pcap_read_linux;
handle->stats_op = pcap_stats_linux;
Added support for an "any" device based on a patch from Sebastian Krahmer.
2000-09-20 15:10:28 +00:00
/*
Fix the handling of the "any" device, including making it reject attempts to open it in monitor mode.
2008-11-19 08:20:39 +00:00
* The "any" device is a special device which causes us not
* to bind to a particular device and thus to look at all
* devices.
Added support for an "any" device based on a patch from Sebastian Krahmer.
2000-09-20 15:10:28 +00:00
*/
Fix the handling of the "any" device, including making it reject attempts to open it in monitor mode.
2008-11-19 08:20:39 +00:00
if (strcmp(device, "any") == 0) {
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
if (handle->opt.promisc) {
handle->opt.promisc = 0;
From Scott Gifford: Add a new "pcap_findalldevs()" routine to get a list of all interfaces that can be opened with "pcap_open_live()", and a "pcap_freealldevs()" routine to free the list. Make "pcap_lookupdev()" use it, which also arranges that it will not return a device that cannot be opened by "pcap_open_live()". Allow the "any" device to be opened, on Linux, with "promisc" non-zero; ignore the request for promiscuity, and return a warning message indicating that promiscuous mode isn't supported on the "any" device. Document "pcap_findalldevs()" and "pcap_lookupdev()", and clean up some items in the libpcap man page.
2001-10-08 01:06:20 +00:00
/* Just a warning. */
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
From Scott Gifford: Add a new "pcap_findalldevs()" routine to get a list of all interfaces that can be opened with "pcap_open_live()", and a "pcap_freealldevs()" routine to free the list. Make "pcap_lookupdev()" use it, which also arranges that it will not return a device that cannot be opened by "pcap_open_live()". Allow the "any" device to be opened, on Linux, with "promisc" non-zero; ignore the request for promiscuity, and return a warning message indicating that promiscuous mode isn't supported on the "any" device. Document "pcap_findalldevs()" and "pcap_lookupdev()", and clean up some items in the libpcap man page.
2001-10-08 01:06:20 +00:00
"Promiscuous mode not supported on the \"any\" device");
Add some PCAP_WARNING return values for "success, but you might want to know that..."; currently, only pcap_activate() returns them, but we might want some more warning returns for some other calls, such as the ones that set filters. It's a little cleaner than "clear out the error message buffer and, if it's not empty after a successful return, it has a warning", and a little cleaner than spewing a warning to the standard error (as that might not be visible to the user if they're running a GUI application).
2008-04-09 21:26:12 +00:00
status = PCAP_WARNING_PROMISC_NOTSUP;
From Scott Gifford: Add a new "pcap_findalldevs()" routine to get a list of all interfaces that can be opened with "pcap_open_live()", and a "pcap_freealldevs()" routine to free the list. Make "pcap_lookupdev()" use it, which also arranges that it will not return a device that cannot be opened by "pcap_open_live()". Allow the "any" device to be opened, on Linux, with "promisc" non-zero; ignore the request for promiscuity, and return a warning message indicating that promiscuous mode isn't supported on the "any" device. Document "pcap_findalldevs()" and "pcap_lookupdev()", and clean up some items in the libpcap man page.
2001-10-08 01:06:20 +00:00
}
Fix the handling of the "any" device, including making it reject attempts to open it in monitor mode.
2008-11-19 08:20:39 +00:00
}
whitespace cleanup
2002-06-11 17:04:44 +00:00
Fix the handling of the "any" device, including making it reject attempts to open it in monitor mode.
2008-11-19 08:20:39 +00:00
handle->md.device = strdup(device);
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
if (handle->md.device == NULL) {
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "strdup: %s",
use snprintf instead of sprintf. From Juergen Schoenwaelder <schoenw@ibr.cs.tu-bs.de>
2000-07-04 12:24:01 +00:00
pcap_strerror(errno) );
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
return PCAP_ERROR;
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
}
From Dustin Spicuzza: support ps_ifdrop on Linux, using /proc/net/dev. Fix the title of the pcap_stats man page, and give more detail - and a lot of caveats.
2009-09-07 23:23:15 +00:00
/*
* If we're in promiscuous mode, then we probably want
* to see when the interface drops packets too, so get an
* initial count from /proc/net/dev
*/
if (handle->opt.promisc)
handle->md.proc_dropped = linux_if_drops(handle->md.device);
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
whitespace cleanup
2002-06-11 17:04:44 +00:00
/*
* Current Linux kernels use the protocol family PF_PACKET to
* allow direct access to all packets on the network while
* older kernels had a special socket type SOCK_PACKET to
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
* implement this feature.
* While this old implementation is kind of obsolete we need
whitespace cleanup
2002-06-11 17:04:44 +00:00
* to be compatible with older kernels for a while so we are
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
* trying both methods with the newer method preferred.
*/
If the specified time stamp type isn't supported, treat that as a warning.
2010-08-23 02:09:50 +00:00
status = activate_new(handle);
if (status < 0) {
/*
* Fatal error with the new way; just fail.
* status has the error return; if it's PCAP_ERROR,
* handle->errbuf has been set appropriately.
*/
goto fail;
}
if (status == 1) {
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
/*
If attempting to turn memory-mapped access on fails for any reason other than "the kernel doesn't support memory-mapped access to PF_PACKET sockets", treat that as an error. If it fails for that reason, don't leave gunk behind in the pcap_t's error buffer. Clean up the error messages a bit (the result of strerror() suffices; we don't need the numeric value of errno, nor do we need the file descriptor number of the socket on which we're working).
2008-11-19 10:01:30 +00:00
* Success.
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
* Try to use memory-mapped access.
*/
If the specified time stamp type isn't supported, treat that as a warning.
2010-08-23 02:09:50 +00:00
switch (activate_mmap(handle, &status)) {
If attempting to turn memory-mapped access on fails for any reason other than "the kernel doesn't support memory-mapped access to PF_PACKET sockets", treat that as an error. If it fails for that reason, don't leave gunk behind in the pcap_t's error buffer. Clean up the error messages a bit (the result of strerror() suffices; we don't need the numeric value of errno, nor do we need the file descriptor number of the socket on which we're working).
2008-11-19 10:01:30 +00:00
case 1:
If the specified time stamp type isn't supported, treat that as a warning.
2010-08-23 02:09:50 +00:00
/*
* We succeeded. status has been
* set to the status to return,
* which might be 0, or might be
* a PCAP_WARNING_ value.
*/
return status;
If attempting to turn memory-mapped access on fails for any reason other than "the kernel doesn't support memory-mapped access to PF_PACKET sockets", treat that as an error. If it fails for that reason, don't leave gunk behind in the pcap_t's error buffer. Clean up the error messages a bit (the result of strerror() suffices; we don't need the numeric value of errno, nor do we need the file descriptor number of the socket on which we're working).
2008-11-19 10:01:30 +00:00
case 0:
/*
* Kernel doesn't support it - just continue
* with non-memory-mapped access.
*/
break;
If the specified time stamp type isn't supported, treat that as a warning.
2010-08-23 02:09:50 +00:00
case -1:
If attempting to turn memory-mapped access on fails for any reason other than "the kernel doesn't support memory-mapped access to PF_PACKET sockets", treat that as an error. If it fails for that reason, don't leave gunk behind in the pcap_t's error buffer. Clean up the error messages a bit (the result of strerror() suffices; we don't need the numeric value of errno, nor do we need the file descriptor number of the socket on which we're working).
2008-11-19 10:01:30 +00:00
/*
If the specified time stamp type isn't supported, treat that as a warning.
2010-08-23 02:09:50 +00:00
* We failed to set up to use it, or the kernel
* supports it, but we failed to enable it.
* status has been set to the error status to
Add support for setting the time stamp type for a capture. Based on a patch from Scott Mcmillan <scott.a.mcmillan@intel.com>. (Second part of the commit.)
2010-08-23 00:36:27 +00:00
* return and, if it's PCAP_ERROR, handle->errbuf
* contains the error message.
If attempting to turn memory-mapped access on fails for any reason other than "the kernel doesn't support memory-mapped access to PF_PACKET sockets", treat that as an error. If it fails for that reason, don't leave gunk behind in the pcap_t's error buffer. Clean up the error messages a bit (the result of strerror() suffices; we don't need the numeric value of errno, nor do we need the file descriptor number of the socket on which we're working).
2008-11-19 10:01:30 +00:00
*/
goto fail;
}
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
}
Add some PCAP_WARNING return values for "success, but you might want to know that..."; currently, only pcap_activate() returns them, but we might want some more warning returns for some other calls, such as the ones that set filters. It's a little cleaner than "clear out the error message buffer and, if it's not empty after a successful return, it has a warning", and a little cleaner than spewing a warning to the standard error (as that might not be visible to the user if they're running a GUI application).
2008-04-09 21:26:12 +00:00
else if (status == 0) {
Bug fixes from Graeme Hewson <ghewson@cix.compulink.co.uk>: 1. During termination processing set up by atexit() under a 2.0.x kernel, if a socket had been previously closed and the handle freed due to an error, pcap_close_all() and pcap_close_linux() would nevertheless try to work with these structures and then crash. pcap_close_linux() is now called directly when necessary during error processing. 2. atexit() could get called more than once because the did_atexit flag wasn't being set. 3. If iface_get_arptype() returns an error because the ioctl() call failed (probably due to "no such device"), live_open_new() now returns a fatal error to pcap_open_live() and the call to live_open_old() is short-circuited. 4. Applications using libpcap would appear to listen on an interface that was down. a. iface_bind() and iface_bind_old() now check for pending errors after bind(). In turn, pcap_open_live() now returns an error status if there was a pending error after bind(). b. After draining the socket, set_kernel_filter() now checks to see if the error was the expected EAGAIN and returns a fatal error to pcap_setfilter() if not. In turn, pcap_setfilter() now returns an error status if there was a network error. 5. pcap_setfilter() was putting an error message into errbuf after a failed call to install_bpf_program(). This was unnecessary since install_bpf_program() puts its own error message into errbuf.
2002-02-22 09:20:11 +00:00
/* Non-fatal error; try old way */
If attempting to turn memory-mapped access on fails for any reason other than "the kernel doesn't support memory-mapped access to PF_PACKET sockets", treat that as an error. If it fails for that reason, don't leave gunk behind in the pcap_t's error buffer. Clean up the error messages a bit (the result of strerror() suffices; we don't need the numeric value of errno, nor do we need the file descriptor number of the socket on which we're working).
2008-11-19 10:01:30 +00:00
if ((status = activate_old(handle)) != 1) {
/*
* Both methods to open the packet socket failed.
* Tidy up and report our failure (handle->errbuf
* is expected to be set by the functions above).
*/
goto fail;
}
For Linux non-mmapped captures, Linux bluetooth captures, and Irix captures, set the socket buffer size to the value specified by pcap_set_buffer_size() if a value was set. Clean up if memory buffer allocation fails on Linux.
2008-04-07 03:57:32 +00:00
}
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
If attempting to turn memory-mapped access on fails for any reason other than "the kernel doesn't support memory-mapped access to PF_PACKET sockets", treat that as an error. If it fails for that reason, don't leave gunk behind in the pcap_t's error buffer. Clean up the error messages a bit (the result of strerror() suffices; we don't need the numeric value of errno, nor do we need the file descriptor number of the socket on which we're working).
2008-11-19 10:01:30 +00:00
/*
* We set up the socket, but not with memory-mapped access.
*/
If the specified time stamp type isn't supported, treat that as a warning.
2010-08-23 02:09:50 +00:00
status = 0;
From Patrick McHardy: pcap-linux: fix invalid rcvbuf size Libpcap issues a SO_RCVBUF when the buffer size if unspecified (zero). The intention is to set it when its *not* zero.
2008-08-06 07:53:34 +00:00
if (handle->opt.buffer_size != 0) {
For Linux non-mmapped captures, Linux bluetooth captures, and Irix captures, set the socket buffer size to the value specified by pcap_set_buffer_size() if a value was set. Clean up if memory buffer allocation fails on Linux.
2008-04-07 03:57:32 +00:00
/*
* Set the socket buffer size to the specified value.
*/
if (setsockopt(handle->fd, SOL_SOCKET, SO_RCVBUF,
&handle->opt.buffer_size,
sizeof(handle->opt.buffer_size)) == -1) {
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
"SO_RCVBUF: %s", pcap_strerror(errno));
Add some PCAP_WARNING return values for "success, but you might want to know that..."; currently, only pcap_activate() returns them, but we might want some more warning returns for some other calls, such as the ones that set filters. It's a little cleaner than "clear out the error message buffer and, if it's not empty after a successful return, it has a warning", and a little cleaner than spewing a warning to the standard error (as that might not be visible to the user if they're running a GUI application).
2008-04-09 21:26:12 +00:00
status = PCAP_ERROR;
For Linux non-mmapped captures, Linux bluetooth captures, and Irix captures, set the socket buffer size to the value specified by pcap_set_buffer_size() if a value was set. Clean up if memory buffer allocation fails on Linux.
2008-04-07 03:57:32 +00:00
goto fail;
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
}
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
}
The Linux "pcap_setfilter()" makes a copy of the filter it's handed, and installs that copy; when closing a pcap_t on Linux, free that copy.
2000-10-25 06:59:09 +00:00
Define MSG_TRUNC as 0x20 if it's not defined, so that if this is compiled on a system that doesn't have it, it'll use it on systems that do have it. On systems with MSG_TRUNC support (i.e., 2.2 and later kernels), there's no need to read in the entire packet in order to find out how large it is, so just allocate a buffer big enough for a snapshot length's worth of data, and just read that much data. There's no need for a "readlen" member of the "pcap_md" structure, as the byte count to "recvfrom()" is just the "bufsize" member of the "pcap_t" structure.
2001-08-24 07:46:52 +00:00
/* Allocate the buffer */
handle->buffer = malloc(handle->bufsize + handle->offset);
if (!handle->buffer) {
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
Define MSG_TRUNC as 0x20 if it's not defined, so that if this is compiled on a system that doesn't have it, it'll use it on systems that do have it. On systems with MSG_TRUNC support (i.e., 2.2 and later kernels), there's no need to read in the entire packet in order to find out how large it is, so just allocate a buffer big enough for a snapshot length's worth of data, and just read that much data. There's no need for a "readlen" member of the "pcap_md" structure, as the byte count to "recvfrom()" is just the "bufsize" member of the "pcap_t" structure.
2001-08-24 07:46:52 +00:00
"malloc: %s", pcap_strerror(errno));
Add some PCAP_WARNING return values for "success, but you might want to know that..."; currently, only pcap_activate() returns them, but we might want some more warning returns for some other calls, such as the ones that set filters. It's a little cleaner than "clear out the error message buffer and, if it's not empty after a successful return, it has a warning", and a little cleaner than spewing a warning to the standard error (as that might not be visible to the user if they're running a GUI application).
2008-04-09 21:26:12 +00:00
status = PCAP_ERROR;
For Linux non-mmapped captures, Linux bluetooth captures, and Irix captures, set the socket buffer size to the value specified by pcap_set_buffer_size() if a value was set. Clean up if memory buffer allocation fails on Linux.
2008-04-07 03:57:32 +00:00
goto fail;
Move the code to allocate the packet buffer into "pcap_open_live()", so that we don't have almost-duplicate code in "live_open_old()" and "live_open_new()". This fixes a bug wherein "live_open_new()" wasn't making the buffer size the maximum of "enough to hold packets of the MTU obtained from the socket" and "the snapshot length" (for some reason, "recvfrom()" was copying more data than the MTU obtained from the socket).
2001-08-23 16:36:41 +00:00
}
Add a "pcap_get_selectable_fd()" API to get an FD on which you can do a "select()" or "poll()" - or -1 if that won't work.
2003-11-21 10:19:33 +00:00
/*
* "handle->fd" is a socket, so "select()" and "poll()"
* should work on it.
*/
handle->selectable_fd = handle->fd;
Add some PCAP_WARNING return values for "success, but you might want to know that..."; currently, only pcap_activate() returns them, but we might want some more warning returns for some other calls, such as the ones that set filters. It's a little cleaner than "clear out the error message buffer and, if it's not empty after a successful return, it has a warning", and a little cleaner than spewing a warning to the standard error (as that might not be visible to the user if they're running a GUI application).
2008-04-09 21:26:12 +00:00
return status;
For Linux non-mmapped captures, Linux bluetooth captures, and Irix captures, set the socket buffer size to the value specified by pcap_set_buffer_size() if a value was set. Clean up if memory buffer allocation fails on Linux.
2008-04-07 03:57:32 +00:00
fail:
Turn close_op into cleanup_op; the routine that handles it can also be used to clean up after a failed pcap_activate() call. Convert the existing close_op routines to cleanup_op routines, and use them to clean up; rename pcap_close_common() to pcap_cleanup_live_common(), and use it directly if there's no platform-dependent cleanup needed. That means we don't have to write the same cleanup code twice (and possibly forget stuff in the version done on a failed pcap_activate() call). Have the cleanup routines do whatever is necessary to indicate that cleanup has been done, and not do any particular cleaning up if it's already been done (i.e., don't free something if the pointer to it is null and null out the pointer once it's been freed, don't close an FD if it's -1 and set it to -1 once it's been closed, etc.). For device types/platforms where we don't support monitor mode, check for it and return PCAP_ERROR_RFMON_NOTSUP - but do so after we've checked whether we can open the device, so we return "no such device" or "permission denied" rather than "that device doesn't support monitor mode" if we can't open the device in the first place. Fix a comment.
2008-04-14 20:40:58 +00:00
pcap_cleanup_linux(handle);
Add some PCAP_WARNING return values for "success, but you might want to know that..."; currently, only pcap_activate() returns them, but we might want some more warning returns for some other calls, such as the ones that set filters. It's a little cleaner than "clear out the error message buffer and, if it's not empty after a successful return, it has a warning", and a little cleaner than spewing a warning to the standard error (as that might not be visible to the user if they're running a GUI application).
2008-04-09 21:26:12 +00:00
return status;
Initial revision
1999-10-07 23:46:40 +00:00
}
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
/*
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
* Read at most max_packets from the capture stream and call the callback
* for each of them. Returns the number of packets handled or -1 if an
whitespace cleanup
2002-06-11 17:04:44 +00:00
* error occured.
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
*/
Add a "read" function pointer to the pcap_t structure, which handles reading packets from a pcap_t, and make "pcap_read()" call it. That removes the last place where we have to check for a pcap_t that refers to a DAG card rather than a live capture, so get rid of the "is_dag" flag.
2003-07-25 05:32:02 +00:00
static int
pcap_read_linux(pcap_t *handle, int max_packets, pcap_handler callback, u_char *user)
Initial revision
1999-10-07 23:46:40 +00:00
{
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
/*
Remove the "select()" from the code path for reading live captures on Linux; Linux isn't the only platform whose kernel doesn't support a read timeout, and even some that *do* don't start the timer until at least one packet has arrived (Solaris, for example), so no portable application can depend on "pcap_dispatch()", say, blocking for no longer than the timeout - they must do a "select()" themselves. For applications that do the "select()" themselves, or that don't need the timeout for polling (tcpdump, for example), doing a "select()" in libpcap just adds another system call to the code path.
2001-01-03 01:06:16 +00:00
* Currently, on Linux only one packet is delivered per read,
* so we don't loop.
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
*/
Remove the "select()" from the code path for reading live captures on Linux; Linux isn't the only platform whose kernel doesn't support a read timeout, and even some that *do* don't start the timer until at least one packet has arrived (Solaris, for example), so no portable application can depend on "pcap_dispatch()", say, blocking for no longer than the timeout - they must do a "select()" themselves. For applications that do the "select()" themselves, or that don't need the timeout for polling (tcpdump, for example), doing a "select()" in libpcap just adds another system call to the code path.
2001-01-03 01:06:16 +00:00
return pcap_read_packet(handle, callback, user);
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
}
The Linux "pcap_setfilter()" makes a copy of the filter it's handed, and installs that copy; when closing a pcap_t on Linux, free that copy.
2000-10-25 06:59:09 +00:00
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
/*
whitespace cleanup
2002-06-11 17:04:44 +00:00
* Read a packet from the socket calling the handler provided by
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
* the user. Returns the number of packets received or -1 if an
* error occured.
*/
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
static int
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
pcap_read_packet(pcap_t *handle, pcap_handler callback, u_char *userdata)
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
{
In "pcap_read_packet()", always use "handle->buffer + handle->offset" as the pointer to the beginning of the link-layer header; never use just "handle->buffer", as, if "handle->offset" is non-zero (as is the case with many link-layer types, including Ethernet), "handle->buffer" doesn't point to the beginning of the link-layer header.
2001-08-24 09:27:14 +00:00
u_char *bp;
Add support for a new link layer type DLT_LINUX_SLL, for use when doing live captures with a "cooked" (SOCK_DGRAM) rather than a "raw" (SOCK_RAW) PF_PACKET socket; it includes a bunch of the fields from the "struct sockaddr_ll" you get in a "recvfrom()", including the Ethernet protocol field. This requires us to rewrite the BPF program if we're stuffing it into the kernel; as long as we're doing *ex post facto* rewriting, we might as well also do the "ret <snaplen>" -> "ret 65535" fixup there as well, rather than in the code generator.
2000-12-21 10:29:21 +00:00
int offset;
Some platforms that lack <netpacket/packet.h> define PF_PACKET but don't support PF_PACKET sockets, and, in particular, don't define in <linux/if_packet.h> any of the stuff needed by the code to handle PF_PACKET sockets. Define HAVE_PF_PACKET_SOCKETS if either 1) we have <netpacket/packet.h> or 2) PF_PACKET is defined *and* PACKET_HOST is defined by <linux/if_packet.h> and use HAVE_PF_PACKET_SOCKETS, not PF_PACKET, be what we use in #ifdefs to conditionally compile in support for PF_PACKET sockets. Not all platforms define ARPHRD_SIT, either; #define it if it's not already defined.
2001-01-18 03:58:22 +00:00
#ifdef HAVE_PF_PACKET_SOCKETS
If we're receiving packets from a PF_PACKET socket, check whether the interface index of the interface for the packet is the interface index of the loopback interface and, if it is, check if the packet is an outgoing packet; if so, ignore it, as we'll also be seeing that packet as a received packet. If we don't handle the arphrd type of an interface, and fall back on cooked mode, report the arphrd type, so we know what type we should consider supporting (if that type can't be supported well, e.g. if you don't get any link-layer header, as happens with PPP, we'd be silent).
2000-10-25 07:46:49 +00:00
struct sockaddr_ll from;
Add support for a new link layer type DLT_LINUX_SLL, for use when doing live captures with a "cooked" (SOCK_DGRAM) rather than a "raw" (SOCK_RAW) PF_PACKET socket; it includes a bunch of the fields from the "struct sockaddr_ll" you get in a "recvfrom()", including the Ethernet protocol field. This requires us to rewrite the BPF program if we're stuffing it into the kernel; as long as we're doing *ex post facto* rewriting, we might as well also do the "ret <snaplen>" -> "ret 65535" fixup there as well, rather than in the code generator.
2000-12-21 10:29:21 +00:00
struct sll_header *hdrp;
If we're receiving packets from a PF_PACKET socket, check whether the interface index of the interface for the packet is the interface index of the loopback interface and, if it is, check if the packet is an outgoing packet; if so, ignore it, as we'll also be seeing that packet as a received packet. If we don't handle the arphrd type of an interface, and fall back on cooked mode, report the arphrd type, so we know what type we should consider supporting (if that type can't be supported well, e.g. if you don't get any link-layer header, as happens with PPP, we'd be silent).
2000-10-25 07:46:49 +00:00
#else
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
struct sockaddr from;
If we're receiving packets from a PF_PACKET socket, check whether the interface index of the interface for the packet is the interface index of the loopback interface and, if it is, check if the packet is an outgoing packet; if so, ignore it, as we'll also be seeing that packet as a received packet. If we don't handle the arphrd type of an interface, and fall back on cooked mode, report the arphrd type, so we know what type we should consider supporting (if that type can't be supported well, e.g. if you don't get any link-layer header, as happens with PPP, we'd be silent).
2000-10-25 07:46:49 +00:00
#endif
Don't do all the recvmsg() stuff if we don't have "struct tpacket_auxdata".
2008-10-28 00:50:20 +00:00
#if defined(HAVE_PACKET_AUXDATA) && defined(HAVE_LINUX_TPACKET_AUXDATA_TP_VLAN_TCI)
From Patrick McHardy: Convert pcap-linux to use recvmsg() as preparation for using PACKET_AUXDATA cmsgs.
2008-08-06 07:39:44 +00:00
struct iovec iov;
struct msghdr msg;
From Patrick McHardy: VLAN packets sent over devices supporting VLAN tagging/stripping in hardware don't have a VLAN header when they are received on packet sockets. The VLAN TCI is available through the PACKET_AUXDATA cmsg, reconstruct the entire header when necessary.
2008-08-06 07:45:00 +00:00
struct cmsghdr *cmsg;
union {
struct cmsghdr cmsg;
char buf[CMSG_SPACE(sizeof(struct tpacket_auxdata))];
} cmsg_buf;
Don't do all the recvmsg() stuff if we don't have "struct tpacket_auxdata".
2008-10-28 00:50:20 +00:00
#else /* defined(HAVE_PACKET_AUXDATA) && defined(HAVE_LINUX_TPACKET_AUXDATA_TP_VLAN_TCI) */
socklen_t fromlen;
#endif /* defined(HAVE_PACKET_AUXDATA) && defined(HAVE_LINUX_TPACKET_AUXDATA_TP_VLAN_TCI) */
int packet_len, caplen;
struct pcap_pkthdr pcap_header;
Some platforms that lack <netpacket/packet.h> define PF_PACKET but don't support PF_PACKET sockets, and, in particular, don't define in <linux/if_packet.h> any of the stuff needed by the code to handle PF_PACKET sockets. Define HAVE_PF_PACKET_SOCKETS if either 1) we have <netpacket/packet.h> or 2) PF_PACKET is defined *and* PACKET_HOST is defined by <linux/if_packet.h> and use HAVE_PF_PACKET_SOCKETS, not PF_PACKET, be what we use in #ifdefs to conditionally compile in support for PF_PACKET sockets. Not all platforms define ARPHRD_SIT, either; #define it if it's not already defined.
2001-01-18 03:58:22 +00:00
#ifdef HAVE_PF_PACKET_SOCKETS
Add support for a new link layer type DLT_LINUX_SLL, for use when doing live captures with a "cooked" (SOCK_DGRAM) rather than a "raw" (SOCK_RAW) PF_PACKET socket; it includes a bunch of the fields from the "struct sockaddr_ll" you get in a "recvfrom()", including the Ethernet protocol field. This requires us to rewrite the BPF program if we're stuffing it into the kernel; as long as we're doing *ex post facto* rewriting, we might as well also do the "ret <snaplen>" -> "ret 65535" fixup there as well, rather than in the code generator.
2000-12-21 10:29:21 +00:00
/*
* If this is a cooked device, leave extra room for a
* fake packet header.
*/
if (handle->md.cooked)
offset = SLL_HDR_LEN;
else
offset = 0;
#else
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
/*
Add support for a new link layer type DLT_LINUX_SLL, for use when doing live captures with a "cooked" (SOCK_DGRAM) rather than a "raw" (SOCK_RAW) PF_PACKET socket; it includes a bunch of the fields from the "struct sockaddr_ll" you get in a "recvfrom()", including the Ethernet protocol field. This requires us to rewrite the BPF program if we're stuffing it into the kernel; as long as we're doing *ex post facto* rewriting, we might as well also do the "ret <snaplen>" -> "ret 65535" fixup there as well, rather than in the code generator.
2000-12-21 10:29:21 +00:00
* This system doesn't have PF_PACKET sockets, so it doesn't
* support cooked devices.
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
*/
Add support for a new link layer type DLT_LINUX_SLL, for use when doing live captures with a "cooked" (SOCK_DGRAM) rather than a "raw" (SOCK_RAW) PF_PACKET socket; it includes a bunch of the fields from the "struct sockaddr_ll" you get in a "recvfrom()", including the Ethernet protocol field. This requires us to rewrite the BPF program if we're stuffing it into the kernel; as long as we're doing *ex post facto* rewriting, we might as well also do the "ret <snaplen>" -> "ret 65535" fixup there as well, rather than in the code generator.
2000-12-21 10:29:21 +00:00
offset = 0;
#endif
The Linux "pcap_setfilter()" makes a copy of the filter it's handed, and installs that copy; when closing a pcap_t on Linux, free that copy.
2000-10-25 06:59:09 +00:00
When activating a device, return PCAP_ERROR_IFACE_NOT_UP if the device isn't up, so applications can report that differently from a generic error (the latter could mean there's a bug somewhere in libpcap). When capturing on a device without mmap on Linux, ignore ENETDOWN, so that we can continue to capture traffic if the interface goes down and comes back up again; comments in the kernel indicate that we'll just block waiting for packets if we try to receive from a socket that delivered ENETDOWN, and, if we're using a memory-mapped buffer, we won't even get notified of "network down" events.
2008-07-01 08:02:33 +00:00
/*
* Receive a single packet from the kernel.
* We ignore EINTR, as that might just be due to a signal
* being delivered - if the signal should interrupt the
* loop, the signal handler should call pcap_breakloop()
* to set handle->break_loop (we ignore it on other
* platforms as well).
* We also ignore ENETDOWN, so that we can continue to
* capture traffic if the interface goes down and comes
* back up again; comments in the kernel indicate that
* we'll just block waiting for packets if we try to
* receive from a socket that delivered ENETDOWN, and,
* if we're using a memory-mapped buffer, we won't even
* get notified of "network down" events.
*/
In "pcap_read_packet()", always use "handle->buffer + handle->offset" as the pointer to the beginning of the link-layer header; never use just "handle->buffer", as, if "handle->offset" is non-zero (as is the case with many link-layer types, including Ethernet), "handle->buffer" doesn't point to the beginning of the link-layer header.
2001-08-24 09:27:14 +00:00
bp = handle->buffer + handle->offset;
From Patrick McHardy: Convert pcap-linux to use recvmsg() as preparation for using PACKET_AUXDATA cmsgs.
2008-08-06 07:39:44 +00:00
Don't do all the recvmsg() stuff if we don't have "struct tpacket_auxdata".
2008-10-28 00:50:20 +00:00
#if defined(HAVE_PACKET_AUXDATA) && defined(HAVE_LINUX_TPACKET_AUXDATA_TP_VLAN_TCI)
From Patrick McHardy: Convert pcap-linux to use recvmsg() as preparation for using PACKET_AUXDATA cmsgs.
2008-08-06 07:39:44 +00:00
msg.msg_name = &from;
msg.msg_namelen = sizeof(from);
msg.msg_iov = &iov;
msg.msg_iovlen = 1;
From Patrick McHardy: VLAN packets sent over devices supporting VLAN tagging/stripping in hardware don't have a VLAN header when they are received on packet sockets. The VLAN TCI is available through the PACKET_AUXDATA cmsg, reconstruct the entire header when necessary.
2008-08-06 07:45:00 +00:00
msg.msg_control = &cmsg_buf;
msg.msg_controllen = sizeof(cmsg_buf);
From Patrick McHardy: Convert pcap-linux to use recvmsg() as preparation for using PACKET_AUXDATA cmsgs.
2008-08-06 07:39:44 +00:00
msg.msg_flags = 0;
iov.iov_len = handle->bufsize - offset;
iov.iov_base = bp + offset;
Don't do all the recvmsg() stuff if we don't have "struct tpacket_auxdata".
2008-10-28 00:50:20 +00:00
#endif /* defined(HAVE_PACKET_AUXDATA) && defined(HAVE_LINUX_TPACKET_AUXDATA_TP_VLAN_TCI) */
From Patrick McHardy: Convert pcap-linux to use recvmsg() as preparation for using PACKET_AUXDATA cmsgs.
2008-08-06 07:39:44 +00:00
Initial revision
1999-10-07 23:46:40 +00:00
do {
Add a "pcap_breakloop()" API to break out of the loop in "pcap_dispatch()" and "pcap_loop()".
2003-11-04 07:05:32 +00:00
/*
* Has "pcap_breakloop()" been called?
*/
From Jesper Peterson: fix a cut-and-pasteo (the Linux libpcap code calls its pcap_t pointer "handle", not "p", unlike most other libpcap code).
2003-11-05 04:25:24 +00:00
if (handle->break_loop) {
Add a "pcap_breakloop()" API to break out of the loop in "pcap_dispatch()" and "pcap_loop()".
2003-11-04 07:05:32 +00:00
/*
When reading from a BPF device, if we get ENXIO, which means "The device went down" on at least some OSes, return a message indicating that. When reading from a Linux PF_PACKET socket, if we get ENETDOWN, which means "The device went down", return a message indicating that. When doing a poll() on a PF_PACKET socket, check for various "something happened on this, but it's not readable" conditions.
2009-10-12 03:12:34 +00:00
* Yes - clear the flag that indicates that it has,
* and return PCAP_ERROR_BREAK as an indication that
* we were told to break out of the loop.
Add a "pcap_breakloop()" API to break out of the loop in "pcap_dispatch()" and "pcap_loop()".
2003-11-04 07:05:32 +00:00
*/
From Jesper Peterson: fix a cut-and-pasteo (the Linux libpcap code calls its pcap_t pointer "handle", not "p", unlike most other libpcap code).
2003-11-05 04:25:24 +00:00
handle->break_loop = 0;
When reading from a BPF device, if we get ENXIO, which means "The device went down" on at least some OSes, return a message indicating that. When reading from a Linux PF_PACKET socket, if we get ENETDOWN, which means "The device went down", return a message indicating that. When doing a poll() on a PF_PACKET socket, check for various "something happened on this, but it's not readable" conditions.
2009-10-12 03:12:34 +00:00
return PCAP_ERROR_BREAK;
Add a "pcap_breakloop()" API to break out of the loop in "pcap_dispatch()" and "pcap_loop()".
2003-11-04 07:05:32 +00:00
}
From Patrick McHardy: Convert pcap-linux to use recvmsg() as preparation for using PACKET_AUXDATA cmsgs.
2008-08-06 07:39:44 +00:00
Don't do all the recvmsg() stuff if we don't have "struct tpacket_auxdata".
2008-10-28 00:50:20 +00:00
#if defined(HAVE_PACKET_AUXDATA) && defined(HAVE_LINUX_TPACKET_AUXDATA_TP_VLAN_TCI)
From Patrick McHardy: Convert pcap-linux to use recvmsg() as preparation for using PACKET_AUXDATA cmsgs.
2008-08-06 07:39:44 +00:00
packet_len = recvmsg(handle->fd, &msg, MSG_TRUNC);
Don't do all the recvmsg() stuff if we don't have "struct tpacket_auxdata".
2008-10-28 00:50:20 +00:00
#else /* defined(HAVE_PACKET_AUXDATA) && defined(HAVE_LINUX_TPACKET_AUXDATA_TP_VLAN_TCI) */
fromlen = sizeof(from);
packet_len = recvfrom(
handle->fd, bp + offset,
handle->bufsize - offset, MSG_TRUNC,
(struct sockaddr *) &from, &fromlen);
#endif /* defined(HAVE_PACKET_AUXDATA) && defined(HAVE_LINUX_TPACKET_AUXDATA_TP_VLAN_TCI) */
When reading from a BPF device, if we get ENXIO, which means "The device went down" on at least some OSes, return a message indicating that. When reading from a Linux PF_PACKET socket, if we get ENETDOWN, which means "The device went down", return a message indicating that. When doing a poll() on a PF_PACKET socket, check for various "something happened on this, but it's not readable" conditions.
2009-10-12 03:12:34 +00:00
} while (packet_len == -1 && errno == EINTR);
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
/* Check if an error occured */
if (packet_len == -1) {
When reading from a BPF device, if we get ENXIO, which means "The device went down" on at least some OSes, return a message indicating that. When reading from a Linux PF_PACKET socket, if we get ENETDOWN, which means "The device went down", return a message indicating that. When doing a poll() on a PF_PACKET socket, check for various "something happened on this, but it's not readable" conditions.
2009-10-12 03:12:34 +00:00
switch (errno) {
case EAGAIN:
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
return 0; /* no packet there */
When reading from a BPF device, if we get ENXIO, which means "The device went down" on at least some OSes, return a message indicating that. When reading from a Linux PF_PACKET socket, if we get ENETDOWN, which means "The device went down", return a message indicating that. When doing a poll() on a PF_PACKET socket, check for various "something happened on this, but it's not readable" conditions.
2009-10-12 03:12:34 +00:00
case ENETDOWN:
/*
* The device on which we're capturing went away.
*
* XXX - we should really return
* PCAP_ERROR_IFACE_NOT_UP, but pcap_dispatch()
If we get POLLERR when polling a socket in memory-mapped mode, do a recv() on the socket to get the error code.
2009-10-12 05:15:24 +00:00
* etc. aren't defined to return that.
When reading from a BPF device, if we get ENXIO, which means "The device went down" on at least some OSes, return a message indicating that. When reading from a Linux PF_PACKET socket, if we get ENETDOWN, which means "The device went down", return a message indicating that. When doing a poll() on a PF_PACKET socket, check for various "something happened on this, but it's not readable" conditions.
2009-10-12 03:12:34 +00:00
*/
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
"The interface went down");
return PCAP_ERROR;
Fix typo.
2009-10-02 21:07:11 +00:00
default:
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
use snprintf instead of sprintf. From Juergen Schoenwaelder <schoenw@ibr.cs.tu-bs.de>
2000-07-04 12:24:01 +00:00
"recvfrom: %s", pcap_strerror(errno));
When reading from a BPF device, if we get ENXIO, which means "The device went down" on at least some OSes, return a message indicating that. When reading from a Linux PF_PACKET socket, if we get ENETDOWN, which means "The device went down", return a message indicating that. When doing a poll() on a PF_PACKET socket, check for various "something happened on this, but it's not readable" conditions.
2009-10-12 03:12:34 +00:00
return PCAP_ERROR;
Initial revision
1999-10-07 23:46:40 +00:00
}
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
}
Some platforms that lack <netpacket/packet.h> define PF_PACKET but don't support PF_PACKET sockets, and, in particular, don't define in <linux/if_packet.h> any of the stuff needed by the code to handle PF_PACKET sockets. Define HAVE_PF_PACKET_SOCKETS if either 1) we have <netpacket/packet.h> or 2) PF_PACKET is defined *and* PACKET_HOST is defined by <linux/if_packet.h> and use HAVE_PF_PACKET_SOCKETS, not PF_PACKET, be what we use in #ifdefs to conditionally compile in support for PF_PACKET sockets. Not all platforms define ARPHRD_SIT, either; #define it if it's not already defined.
2001-01-18 03:58:22 +00:00
#ifdef HAVE_PF_PACKET_SOCKETS
From Pawel Pokrywka: add support for requesting that only received packets, only sent packets, or all packets be accepted, with an implementation for Linux. Add an implementation for BPF platforms that support BIOCSSEESENT.
2005-05-03 18:53:58 +00:00
if (!handle->md.sock_packet) {
From Ollie Wild: if we're bound to an interface, discard incoming packets that didn't arrive on that interface, so packets from other interfaces that get onto the socket queue before we bind the socket to the interface don't get supplied to the application (binding the socket doesn't discard incoming packets).
2006-04-07 08:02:28 +00:00
/*
* Unfortunately, there is a window between socket() and
* bind() where the kernel may queue packets from any
* interface. If we're bound to a particular interface,
* discard packets not from that interface.
*
* (If socket filters are supported, we could do the
* same thing we do when changing the filter; however,
* that won't handle packet sockets without socket
* filter support, and it's a bit more complicated.
* It would save some instructions per packet, however.)
*/
if (handle->md.ifindex != -1 &&
from.sll_ifindex != handle->md.ifindex)
return 0;
From Pawel Pokrywka: add support for requesting that only received packets, only sent packets, or all packets be accepted, with an implementation for Linux. Add an implementation for BPF platforms that support BIOCSSEESENT.
2005-05-03 18:53:58 +00:00
/*
* Do checks based on packet direction.
* We can only do this if we're using PF_PACKET; the
* address returned for SOCK_PACKET is a "sockaddr_pkt"
* which lacks the relevant packet type information.
*/
if (from.sll_pkttype == PACKET_OUTGOING) {
/*
* Outgoing packet.
* If this is from the loopback device, reject it;
* we'll see the packet as an incoming packet as well,
* and we don't want to see it twice.
*/
if (from.sll_ifindex == handle->md.lo_ifindex)
return 0;
/*
* If the user only wants incoming packets, reject it.
*/
OK, we'll be putting out 0.9.2 soon, so add the API changes back in again.
2005-07-07 01:57:00 +00:00
if (handle->direction == PCAP_D_IN)
From Pawel Pokrywka: add support for requesting that only received packets, only sent packets, or all packets be accepted, with an implementation for Linux. Add an implementation for BPF platforms that support BIOCSSEESENT.
2005-05-03 18:53:58 +00:00
return 0;
} else {
/*
* Incoming packet.
* If the user only wants outgoing packets, reject it.
*/
OK, we'll be putting out 0.9.2 soon, so add the API changes back in again.
2005-07-07 01:57:00 +00:00
if (handle->direction == PCAP_D_OUT)
From Pawel Pokrywka: add support for requesting that only received packets, only sent packets, or all packets be accepted, with an implementation for Linux. Add an implementation for BPF platforms that support BIOCSSEESENT.
2005-05-03 18:53:58 +00:00
return 0;
}
}
If we're receiving packets from a PF_PACKET socket, check whether the interface index of the interface for the packet is the interface index of the loopback interface and, if it is, check if the packet is an outgoing packet; if so, ignore it, as we'll also be seeing that packet as a received packet. If we don't handle the arphrd type of an interface, and fall back on cooked mode, report the arphrd type, so we know what type we should consider supporting (if that type can't be supported well, e.g. if you don't get any link-layer header, as happens with PPP, we'd be silent).
2000-10-25 07:46:49 +00:00
#endif
Some platforms that lack <netpacket/packet.h> define PF_PACKET but don't support PF_PACKET sockets, and, in particular, don't define in <linux/if_packet.h> any of the stuff needed by the code to handle PF_PACKET sockets. Define HAVE_PF_PACKET_SOCKETS if either 1) we have <netpacket/packet.h> or 2) PF_PACKET is defined *and* PACKET_HOST is defined by <linux/if_packet.h> and use HAVE_PF_PACKET_SOCKETS, not PF_PACKET, be what we use in #ifdefs to conditionally compile in support for PF_PACKET sockets. Not all platforms define ARPHRD_SIT, either; #define it if it's not already defined.
2001-01-18 03:58:22 +00:00
#ifdef HAVE_PF_PACKET_SOCKETS
Add support for a new link layer type DLT_LINUX_SLL, for use when doing live captures with a "cooked" (SOCK_DGRAM) rather than a "raw" (SOCK_RAW) PF_PACKET socket; it includes a bunch of the fields from the "struct sockaddr_ll" you get in a "recvfrom()", including the Ethernet protocol field. This requires us to rewrite the BPF program if we're stuffing it into the kernel; as long as we're doing *ex post facto* rewriting, we might as well also do the "ret <snaplen>" -> "ret 65535" fixup there as well, rather than in the code generator.
2000-12-21 10:29:21 +00:00
/*
* If this is a cooked device, fill in the fake packet header.
*/
if (handle->md.cooked) {
/*
* Add the length of the fake header to the length
* of packet data we read.
*/
packet_len += SLL_HDR_LEN;
In "pcap_read_packet()", always use "handle->buffer + handle->offset" as the pointer to the beginning of the link-layer header; never use just "handle->buffer", as, if "handle->offset" is non-zero (as is the case with many link-layer types, including Ethernet), "handle->buffer" doesn't point to the beginning of the link-layer header.
2001-08-24 09:27:14 +00:00
hdrp = (struct sll_header *)bp;
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
hdrp->sll_pkttype = map_packet_type_to_sll_type(from.sll_pkttype);
Add support for a new link layer type DLT_LINUX_SLL, for use when doing live captures with a "cooked" (SOCK_DGRAM) rather than a "raw" (SOCK_RAW) PF_PACKET socket; it includes a bunch of the fields from the "struct sockaddr_ll" you get in a "recvfrom()", including the Ethernet protocol field. This requires us to rewrite the BPF program if we're stuffing it into the kernel; as long as we're doing *ex post facto* rewriting, we might as well also do the "ret <snaplen>" -> "ret 65535" fixup there as well, rather than in the code generator.
2000-12-21 10:29:21 +00:00
hdrp->sll_hatype = htons(from.sll_hatype);
hdrp->sll_halen = htons(from.sll_halen);
memcpy(hdrp->sll_addr, from.sll_addr,
(from.sll_halen > SLL_ADDRLEN) ?
SLL_ADDRLEN :
from.sll_halen);
It's a bit more convenient for Ethereal if the "sll_protocol" field is at the end of the link-layer header; put it there. Put in a comment indicating that the layout of the link-layer header shouldn't be changed; if a new header is necessary, a new DLL_ type should be introduced for it.
2000-12-23 07:50:18 +00:00
hdrp->sll_protocol = from.sll_protocol;
Add support for a new link layer type DLT_LINUX_SLL, for use when doing live captures with a "cooked" (SOCK_DGRAM) rather than a "raw" (SOCK_RAW) PF_PACKET socket; it includes a bunch of the fields from the "struct sockaddr_ll" you get in a "recvfrom()", including the Ethernet protocol field. This requires us to rewrite the BPF program if we're stuffing it into the kernel; as long as we're doing *ex post facto* rewriting, we might as well also do the "ret <snaplen>" -> "ret 65535" fixup there as well, rather than in the code generator.
2000-12-21 10:29:21 +00:00
}
From Patrick McHardy: VLAN packets sent over devices supporting VLAN tagging/stripping in hardware don't have a VLAN header when they are received on packet sockets. The VLAN TCI is available through the PACKET_AUXDATA cmsg, reconstruct the entire header when necessary.
2008-08-06 07:45:00 +00:00
Check whether the tpacket_auxdata structure has a tp_vlan_tci member before using that member. Don't define variables if we aren't going to use them. If we have an unknown tpacket version (this "can't happen"), return an error.
2008-08-06 08:29:07 +00:00
#if defined(HAVE_PACKET_AUXDATA) && defined(HAVE_LINUX_TPACKET_AUXDATA_TP_VLAN_TCI)
From Patrick McHardy: VLAN packets sent over devices supporting VLAN tagging/stripping in hardware don't have a VLAN header when they are received on packet sockets. The VLAN TCI is available through the PACKET_AUXDATA cmsg, reconstruct the entire header when necessary.
2008-08-06 07:45:00 +00:00
for (cmsg = CMSG_FIRSTHDR(&msg); cmsg; cmsg = CMSG_NXTHDR(&msg, cmsg)) {
struct tpacket_auxdata *aux;
unsigned int len;
struct vlan_tag *tag;
if (cmsg->cmsg_len < CMSG_LEN(sizeof(struct tpacket_auxdata)) ||
cmsg->cmsg_level != SOL_PACKET ||
cmsg->cmsg_type != PACKET_AUXDATA)
continue;
aux = (struct tpacket_auxdata *)CMSG_DATA(cmsg);
if (aux->tp_vlan_tci == 0)
continue;
len = packet_len > iov.iov_len ? iov.iov_len : packet_len;
if (len < 2 * ETH_ALEN)
break;
bp -= VLAN_TAG_LEN;
memmove(bp, bp + VLAN_TAG_LEN, 2 * ETH_ALEN);
tag = (struct vlan_tag *)(bp + 2 * ETH_ALEN);
tag->vlan_tpid = htons(ETH_P_8021Q);
tag->vlan_tci = htons(aux->tp_vlan_tci);
packet_len += VLAN_TAG_LEN;
}
Check whether the tpacket_auxdata structure has a tp_vlan_tci member before using that member. Don't define variables if we aren't going to use them. If we have an unknown tpacket version (this "can't happen"), return an error.
2008-08-06 08:29:07 +00:00
#endif /* defined(HAVE_PACKET_AUXDATA) && defined(HAVE_LINUX_TPACKET_AUXDATA_TP_VLAN_TCI) */
#endif /* HAVE_PF_PACKET_SOCKETS */
Add support for a new link layer type DLT_LINUX_SLL, for use when doing live captures with a "cooked" (SOCK_DGRAM) rather than a "raw" (SOCK_RAW) PF_PACKET socket; it includes a bunch of the fields from the "struct sockaddr_ll" you get in a "recvfrom()", including the Ethernet protocol field. This requires us to rewrite the BPF program if we're stuffing it into the kernel; as long as we're doing *ex post facto* rewriting, we might as well also do the "ret <snaplen>" -> "ret 65535" fixup there as well, rather than in the code generator.
2000-12-21 10:29:21 +00:00
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
/*
whitespace cleanup
2002-06-11 17:04:44 +00:00
* XXX: According to the kernel source we should get the real
* packet len if calling recvfrom with MSG_TRUNC set. It does
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
* not seem to work here :(, but it is supported by this code
whitespace cleanup
2002-06-11 17:04:44 +00:00
* anyway.
Updated the comment on the MSG_TRUNC problem in connection with the Linux packet filter. Work around to come.
2000-08-04 18:35:48 +00:00
* To be honest the code RELIES on that feature so this is really
* broken with 2.2.x kernels.
* I spend a day to figure out what's going on and I found out
whitespace cleanup
2002-06-11 17:04:44 +00:00
* that the following is happening:
Updated the comment on the MSG_TRUNC problem in connection with the Linux packet filter. Work around to come.
2000-08-04 18:35:48 +00:00
*
whitespace cleanup
2002-06-11 17:04:44 +00:00
* The packet comes from a random interface and the packet_rcv
Updated the comment on the MSG_TRUNC problem in connection with the Linux packet filter. Work around to come.
2000-08-04 18:35:48 +00:00
* hook is called with a clone of the packet. That code inserts
* the packet into the receive queue of the packet socket.
* If a filter is attached to that socket that filter is run
* first - and there lies the problem. The default filter always
* cuts the packet at the snaplen:
*
* # tcpdump -d
* (000) ret #68
*
whitespace cleanup
2002-06-11 17:04:44 +00:00
* So the packet filter cuts down the packet. The recvfrom call
Updated the comment on the MSG_TRUNC problem in connection with the Linux packet filter. Work around to come.
2000-08-04 18:35:48 +00:00
* says "hey, it's only 68 bytes, it fits into the buffer" with
whitespace cleanup
2002-06-11 17:04:44 +00:00
* the result that we don't get the real packet length. This
* is valid at least until kernel 2.2.17pre6.
Updated the comment on the MSG_TRUNC problem in connection with the Linux packet filter. Work around to come.
2000-08-04 18:35:48 +00:00
*
Add support for a new link layer type DLT_LINUX_SLL, for use when doing live captures with a "cooked" (SOCK_DGRAM) rather than a "raw" (SOCK_RAW) PF_PACKET socket; it includes a bunch of the fields from the "struct sockaddr_ll" you get in a "recvfrom()", including the Ethernet protocol field. This requires us to rewrite the BPF program if we're stuffing it into the kernel; as long as we're doing *ex post facto* rewriting, we might as well also do the "ret <snaplen>" -> "ret 65535" fixup there as well, rather than in the code generator.
2000-12-21 10:29:21 +00:00
* We currently handle this by making a copy of the filter
* program, fixing all "ret" instructions with non-zero
* operands to have an operand of 65535 so that the filter
* doesn't truncate the packet, and supplying that modified
* filter to the kernel.
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
*/
The Linux "pcap_setfilter()" makes a copy of the filter it's handed, and installs that copy; when closing a pcap_t on Linux, free that copy.
2000-10-25 06:59:09 +00:00
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
caplen = packet_len;
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
if (caplen > handle->snapshot)
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
caplen = handle->snapshot;
/* Run the packet filter if not using kernel filter */
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
if (!handle->md.use_bpf && handle->fcode.bf_insns) {
In "pcap_read_packet()", always use "handle->buffer + handle->offset" as the pointer to the beginning of the link-layer header; never use just "handle->buffer", as, if "handle->offset" is non-zero (as is the case with many link-layer types, including Ethernet), "handle->buffer" doesn't point to the beginning of the link-layer header.
2001-08-24 09:27:14 +00:00
if (bpf_filter(handle->fcode.bf_insns, bp,
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
packet_len, caplen) == 0)
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
{
/* rejected by filter */
return 0;
Initial revision
1999-10-07 23:46:40 +00:00
}
}
The Linux "pcap_setfilter()" makes a copy of the filter it's handed, and installs that copy; when closing a pcap_t on Linux, free that copy.
2000-10-25 06:59:09 +00:00
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
/* Fill in our own header data */
The Linux "pcap_setfilter()" makes a copy of the filter it's handed, and installs that copy; when closing a pcap_t on Linux, free that copy.
2000-10-25 06:59:09 +00:00
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
if (ioctl(handle->fd, SIOCGSTAMP, &pcap_header.ts) == -1) {
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
Indicate *which* ioctl failed.
2006-09-18 17:32:30 +00:00
"SIOCGSTAMP: %s", pcap_strerror(errno));
When reading from a BPF device, if we get ENXIO, which means "The device went down" on at least some OSes, return a message indicating that. When reading from a Linux PF_PACKET socket, if we get ENETDOWN, which means "The device went down", return a message indicating that. When doing a poll() on a PF_PACKET socket, check for various "something happened on this, but it's not readable" conditions.
2009-10-12 03:12:34 +00:00
return PCAP_ERROR;
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
}
pcap_header.caplen = caplen;
pcap_header.len = packet_len;
The Linux "pcap_setfilter()" makes a copy of the filter it's handed, and installs that copy; when closing a pcap_t on Linux, free that copy.
2000-10-25 06:59:09 +00:00
From Scott Barron <sb125499@ohiou.edu>: use the SOL_PACKET/PACKET_STATISTICS "getsockopt()" call, on Linux kernels that support it, to get packet statistics, so that we can report the number of dropped packets, and always use <linux/if_packet.h> to get definitions for PF_PACKET sockets, so that we don't depend on glibc's header files having been updated to support all the latest shiniest kernel features (many systems with 2.4[.x] kernels don't have a <netpacket/packet.h> that defines "struct tpacket_stats", for example, so we wouldn't have been able to support that kernel feature on those systems).
2001-07-29 18:25:46 +00:00
/*
* Count the packet.
*
* Arguably, we should count them before we check the filter,
* as on many other platforms "ps_recv" counts packets
* handed to the filter rather than packets that passed
* the filter, but if filtering is done in the kernel, we
* can't get a count of packets that passed the filter,
* and that would mean the meaning of "ps_recv" wouldn't
* be the same on all Linux systems.
*
* XXX - it's not the same on all systems in any case;
* ideally, we should have a "get the statistics" call
* that supplies more counts and indicates which of them
* it supplies, so that we supply a count of packets
* handed to the filter only on platforms where that
* information is available.
*
* We count them here even if we can get the packet count
* from the kernel, as we can only determine at run time
* whether we'll be able to get it from the kernel (if
* HAVE_TPACKET_STATS isn't defined, we can't get it from
* the kernel, but if it is defined, the library might
* have been built with a 2.4 or later kernel, but we
* might be running on a 2.2[.x] kernel without Alexey
* Kuznetzov's turbopacket patches, and thus the kernel
* might not be able to supply those statistics). We
* could, I guess, try, when opening the socket, to get
* the statistics, and if we can not increment the count
* here, but it's not clear that always incrementing
* the count is more expensive than always testing a flag
* in memory.
Don't double-count received packets on Linux systems that support the PACKET_STATISTICS getsockopt() argument on PF_PACKET sockets.
2005-11-24 19:27:42 +00:00
*
* We keep the count in "md.packets_read", and use that for
* "ps_recv" if we can't get the statistics from the kernel.
* We do that because, if we *can* get the statistics from
* the kernel, we use "md.stat.ps_recv" and "md.stat.ps_drop"
* as running counts, as reading the statistics from the
* kernel resets the kernel statistics, and if we directly
* increment "md.stat.ps_recv" here, that means it will
* count packets *twice* on systems where we can get kernel
* statistics - once here, and once in pcap_stats_linux().
From Scott Barron <sb125499@ohiou.edu>: use the SOL_PACKET/PACKET_STATISTICS "getsockopt()" call, on Linux kernels that support it, to get packet statistics, so that we can report the number of dropped packets, and always use <linux/if_packet.h> to get definitions for PF_PACKET sockets, so that we don't depend on glibc's header files having been updated to support all the latest shiniest kernel features (many systems with 2.4[.x] kernels don't have a <netpacket/packet.h> that defines "struct tpacket_stats", for example, so we wouldn't have been able to support that kernel feature on those systems).
2001-07-29 18:25:46 +00:00
*/
Don't double-count received packets on Linux systems that support the PACKET_STATISTICS getsockopt() argument on PF_PACKET sockets.
2005-11-24 19:27:42 +00:00
handle->md.packets_read++;
From Scott Barron <sb125499@ohiou.edu>: use the SOL_PACKET/PACKET_STATISTICS "getsockopt()" call, on Linux kernels that support it, to get packet statistics, so that we can report the number of dropped packets, and always use <linux/if_packet.h> to get definitions for PF_PACKET sockets, so that we don't depend on glibc's header files having been updated to support all the latest shiniest kernel features (many systems with 2.4[.x] kernels don't have a <netpacket/packet.h> that defines "struct tpacket_stats", for example, so we wouldn't have been able to support that kernel feature on those systems).
2001-07-29 18:25:46 +00:00
/* Call the user supplied callback function */
In "pcap_read_packet()", always use "handle->buffer + handle->offset" as the pointer to the beginning of the link-layer header; never use just "handle->buffer", as, if "handle->offset" is non-zero (as is the case with many link-layer types, including Ethernet), "handle->buffer" doesn't point to the beginning of the link-layer header.
2001-08-24 09:27:14 +00:00
callback(userdata, &pcap_header, bp);
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
return 1;
Initial revision
1999-10-07 23:46:40 +00:00
}
Add support for sending packets; includes contributions from Mark Pizzolato <List-tcpdump-workers@subscriptions.pizzolato.net>.
2004-03-23 19:18:04 +00:00
static int
pcap_inject_linux(pcap_t *handle, const void *buf, size_t size)
{
int ret;
#ifdef HAVE_PF_PACKET_SOCKETS
Fixes from Mark Pizzolato.
2004-03-24 06:49:16 +00:00
if (!handle->md.sock_packet) {
Add support for sending packets; includes contributions from Mark Pizzolato <List-tcpdump-workers@subscriptions.pizzolato.net>.
2004-03-23 19:18:04 +00:00
/* PF_PACKET socket */
if (handle->md.ifindex == -1) {
/*
As per Mark Pizzolato, "sendto()" isn't necessary for sending packets, at least on 2.2 and later kernels; the socket is bound (except for sending on the "any" device, which we don't support), so a destination address isn't necessary. Generate the right error string for attempts to send on the "any" device, and also disallow sends if we're in cooked mode.
2004-04-07 08:03:32 +00:00
* We don't support sending on the "any" device.
Add support for sending packets; includes contributions from Mark Pizzolato <List-tcpdump-workers@subscriptions.pizzolato.net>.
2004-03-23 19:18:04 +00:00
*/
strlcpy(handle->errbuf,
As per Mark Pizzolato, "sendto()" isn't necessary for sending packets, at least on 2.2 and later kernels; the socket is bound (except for sending on the "any" device, which we don't support), so a destination address isn't necessary. Generate the right error string for attempts to send on the "any" device, and also disallow sends if we're in cooked mode.
2004-04-07 08:03:32 +00:00
"Sending packets isn't supported on the \"any\" device",
Add support for sending packets; includes contributions from Mark Pizzolato <List-tcpdump-workers@subscriptions.pizzolato.net>.
2004-03-23 19:18:04 +00:00
PCAP_ERRBUF_SIZE);
return (-1);
}
As per Mark Pizzolato, "sendto()" isn't necessary for sending packets, at least on 2.2 and later kernels; the socket is bound (except for sending on the "any" device, which we don't support), so a destination address isn't necessary. Generate the right error string for attempts to send on the "any" device, and also disallow sends if we're in cooked mode.
2004-04-07 08:03:32 +00:00
if (handle->md.cooked) {
/*
* We don't support sending on the "any" device.
*
* XXX - how do you send on a bound cooked-mode
* socket?
* Is a "sendto()" required there?
*/
strlcpy(handle->errbuf,
"Sending packets isn't supported in cooked mode",
PCAP_ERRBUF_SIZE);
Add support for sending packets; includes contributions from Mark Pizzolato <List-tcpdump-workers@subscriptions.pizzolato.net>.
2004-03-23 19:18:04 +00:00
return (-1);
}
}
#endif
As per Mark Pizzolato, "sendto()" isn't necessary for sending packets, at least on 2.2 and later kernels; the socket is bound (except for sending on the "any" device, which we don't support), so a destination address isn't necessary. Generate the right error string for attempts to send on the "any" device, and also disallow sends if we're in cooked mode.
2004-04-07 08:03:32 +00:00
ret = send(handle->fd, buf, size, 0);
Add support for sending packets; includes contributions from Mark Pizzolato <List-tcpdump-workers@subscriptions.pizzolato.net>.
2004-03-23 19:18:04 +00:00
if (ret == -1) {
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "send: %s",
pcap_strerror(errno));
return (-1);
}
return (ret);
}
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
/*
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
* Get the statistics for the given packet capture handle.
From Scott Barron <sb125499@ohiou.edu>: use the SOL_PACKET/PACKET_STATISTICS "getsockopt()" call, on Linux kernels that support it, to get packet statistics, so that we can report the number of dropped packets, and always use <linux/if_packet.h> to get definitions for PF_PACKET sockets, so that we don't depend on glibc's header files having been updated to support all the latest shiniest kernel features (many systems with 2.4[.x] kernels don't have a <netpacket/packet.h> that defines "struct tpacket_stats", for example, so we wouldn't have been able to support that kernel feature on those systems).
2001-07-29 18:25:46 +00:00
* Reports the number of dropped packets iff the kernel supports
* the PACKET_STATISTICS "getsockopt()" argument (2.4 and later
* kernels, and 2.2[.x] kernels with Alexey Kuznetzov's turbopacket
* patches); otherwise, that information isn't available, and we lie
* and report 0 as the count of dropped packets.
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
*/
Add a "stats" function pointer to the pcap_t structure, which handles getting statistics for a pcap_t. Have "pcap_stats()" call it, rather than being a per-platform function; have stats routines for non-live pcap_t's that return an error.
2003-07-25 04:04:56 +00:00
static int
pcap_stats_linux(pcap_t *handle, struct pcap_stat *stats)
Initial revision
1999-10-07 23:46:40 +00:00
{
From Scott Barron <sb125499@ohiou.edu>: use the SOL_PACKET/PACKET_STATISTICS "getsockopt()" call, on Linux kernels that support it, to get packet statistics, so that we can report the number of dropped packets, and always use <linux/if_packet.h> to get definitions for PF_PACKET sockets, so that we don't depend on glibc's header files having been updated to support all the latest shiniest kernel features (many systems with 2.4[.x] kernels don't have a <netpacket/packet.h> that defines "struct tpacket_stats", for example, so we wouldn't have been able to support that kernel feature on those systems).
2001-07-29 18:25:46 +00:00
#ifdef HAVE_TPACKET_STATS
struct tpacket_stats kstats;
Fixes from Phil Wood: Don't subtract "tp_drops" from "tp_packets" - "ps_recv", on BSD, at least, includes packets dropped due to lack of buffer space, so it should do so on Linux as well. The "len" argument to "getsockopt()" is a value-result parameter, initially containing the size of the buffer being supplied; set it before the call. Catch "getsockopt()" errors and, if it's an error other than EOPNOTSUPP, return an error.
2001-12-10 05:49:40 +00:00
socklen_t len = sizeof (struct tpacket_stats);
From Jesper Peterson <jesper@endace.com>: support for capturing from Endace DAG devices.
2003-07-23 05:29:19 +00:00
#endif
From Dustin Spicuzza: support ps_ifdrop on Linux, using /proc/net/dev. Fix the title of the pcap_stats man page, and give more detail - and a lot of caveats.
2009-09-07 23:23:15 +00:00
long if_dropped = 0;
/*
* To fill in ps_ifdrop, we parse /proc/net/dev for the number
*/
if (handle->opt.promisc)
{
if_dropped = handle->md.proc_dropped;
handle->md.proc_dropped = linux_if_drops(handle->md.device);
handle->md.stat.ps_ifdrop += (handle->md.proc_dropped - if_dropped);
}
From Jesper Peterson <jesper@endace.com>: support for capturing from Endace DAG devices.
2003-07-23 05:29:19 +00:00
#ifdef HAVE_TPACKET_STATS
From Scott Barron <sb125499@ohiou.edu>: use the SOL_PACKET/PACKET_STATISTICS "getsockopt()" call, on Linux kernels that support it, to get packet statistics, so that we can report the number of dropped packets, and always use <linux/if_packet.h> to get definitions for PF_PACKET sockets, so that we don't depend on glibc's header files having been updated to support all the latest shiniest kernel features (many systems with 2.4[.x] kernels don't have a <netpacket/packet.h> that defines "struct tpacket_stats", for example, so we wouldn't have been able to support that kernel feature on those systems).
2001-07-29 18:25:46 +00:00
/*
* Try to get the packet counts from the kernel.
*/
if (getsockopt(handle->fd, SOL_PACKET, PACKET_STATISTICS,
&kstats, &len) > -1) {
Fixes from Phil Wood: Don't subtract "tp_drops" from "tp_packets" - "ps_recv", on BSD, at least, includes packets dropped due to lack of buffer space, so it should do so on Linux as well. The "len" argument to "getsockopt()" is a value-result parameter, initially containing the size of the buffer being supplied; set it before the call. Catch "getsockopt()" errors and, if it's an error other than EOPNOTSUPP, return an error.
2001-12-10 05:49:40 +00:00
/*
If we succeed in getting packet statistics with the PACKET_STATISTICS "getsockopt()" argument, return those statistics, rather than falling through and returning the statistics the way we would if PACKET_STATISTICS weren't supported.
2006-02-23 07:35:08 +00:00
* On systems where the PACKET_STATISTICS "getsockopt()"
* argument is supported on PF_PACKET sockets:
*
* "ps_recv" counts only packets that *passed* the
* filter, not packets that didn't pass the filter.
* This includes packets later dropped because we
* ran out of buffer space.
*
* "ps_drop" counts packets dropped because we ran
* out of buffer space. It doesn't count packets
* dropped by the interface driver. It counts only
* packets that passed the filter.
*
From Dustin Spicuzza: support ps_ifdrop on Linux, using /proc/net/dev. Fix the title of the pcap_stats man page, and give more detail - and a lot of caveats.
2009-09-07 23:23:15 +00:00
* See above for ps_ifdrop.
*
If we succeed in getting packet statistics with the PACKET_STATISTICS "getsockopt()" argument, return those statistics, rather than falling through and returning the statistics the way we would if PACKET_STATISTICS weren't supported.
2006-02-23 07:35:08 +00:00
* Both statistics include packets not yet read from
* the kernel by libpcap, and thus not yet seen by
* the application.
*
Fixes from Phil Wood: Don't subtract "tp_drops" from "tp_packets" - "ps_recv", on BSD, at least, includes packets dropped due to lack of buffer space, so it should do so on Linux as well. The "len" argument to "getsockopt()" is a value-result parameter, initially containing the size of the buffer being supplied; set it before the call. Catch "getsockopt()" errors and, if it's an error other than EOPNOTSUPP, return an error.
2001-12-10 05:49:40 +00:00
* In "linux/net/packet/af_packet.c", at least in the
* 2.4.9 kernel, "tp_packets" is incremented for every
* packet that passes the packet filter *and* is
* successfully queued on the socket; "tp_drops" is
* incremented for every packet dropped because there's
* not enough free space in the socket buffer.
*
* When the statistics are returned for a PACKET_STATISTICS
* "getsockopt()" call, "tp_drops" is added to "tp_packets",
* so that "tp_packets" counts all packets handed to
* the PF_PACKET socket, including packets dropped because
* there wasn't room on the socket buffer - but not
* including packets that didn't pass the filter.
*
* In the BSD BPF, the count of received packets is
* incremented for every packet handed to BPF, regardless
* of whether it passed the filter.
*
* We can't make "pcap_stats()" work the same on both
* platforms, but the best approximation is to return
* "tp_packets" as the count of packets and "tp_drops"
* as the count of drops.
Don't use a static variable for the accumulated statistics, accumulate the statistics in "handle->md.stat", so that the statistics are maintained correctly if more than one pcap_t is in use.
2004-01-14 01:56:10 +00:00
*
* Keep a running total because each call to
* getsockopt(handle->fd, SOL_PACKET, PACKET_STATISTICS, ....
* resets the counters to zero.
Fixes from Phil Wood: Don't subtract "tp_drops" from "tp_packets" - "ps_recv", on BSD, at least, includes packets dropped due to lack of buffer space, so it should do so on Linux as well. The "len" argument to "getsockopt()" is a value-result parameter, initially containing the size of the buffer being supplied; set it before the call. Catch "getsockopt()" errors and, if it's an error other than EOPNOTSUPP, return an error.
2001-12-10 05:49:40 +00:00
*/
Don't use a static variable for the accumulated statistics, accumulate the statistics in "handle->md.stat", so that the statistics are maintained correctly if more than one pcap_t is in use.
2004-01-14 01:56:10 +00:00
handle->md.stat.ps_recv += kstats.tp_packets;
handle->md.stat.ps_drop += kstats.tp_drops;
If we succeed in getting packet statistics with the PACKET_STATISTICS "getsockopt()" argument, return those statistics, rather than falling through and returning the statistics the way we would if PACKET_STATISTICS weren't supported.
2006-02-23 07:35:08 +00:00
*stats = handle->md.stat;
return 0;
From Scott Barron <sb125499@ohiou.edu>: use the SOL_PACKET/PACKET_STATISTICS "getsockopt()" call, on Linux kernels that support it, to get packet statistics, so that we can report the number of dropped packets, and always use <linux/if_packet.h> to get definitions for PF_PACKET sockets, so that we don't depend on glibc's header files having been updated to support all the latest shiniest kernel features (many systems with 2.4[.x] kernels don't have a <netpacket/packet.h> that defines "struct tpacket_stats", for example, so we wouldn't have been able to support that kernel feature on those systems).
2001-07-29 18:25:46 +00:00
}
Fixes from Phil Wood: Don't subtract "tp_drops" from "tp_packets" - "ps_recv", on BSD, at least, includes packets dropped due to lack of buffer space, so it should do so on Linux as well. The "len" argument to "getsockopt()" is a value-result parameter, initially containing the size of the buffer being supplied; set it before the call. Catch "getsockopt()" errors and, if it's an error other than EOPNOTSUPP, return an error.
2001-12-10 05:49:40 +00:00
else
{
/*
* If the error was EOPNOTSUPP, fall through, so that
* if you build the library on a system with
* "struct tpacket_stats" and run it on a system
* that doesn't, it works as it does if the library
* is built on a system without "struct tpacket_stats".
*/
if (errno != EOPNOTSUPP) {
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
"pcap_stats: %s", pcap_strerror(errno));
return -1;
}
}
From Scott Barron <sb125499@ohiou.edu>: use the SOL_PACKET/PACKET_STATISTICS "getsockopt()" call, on Linux kernels that support it, to get packet statistics, so that we can report the number of dropped packets, and always use <linux/if_packet.h> to get definitions for PF_PACKET sockets, so that we don't depend on glibc's header files having been updated to support all the latest shiniest kernel features (many systems with 2.4[.x] kernels don't have a <netpacket/packet.h> that defines "struct tpacket_stats", for example, so we wouldn't have been able to support that kernel feature on those systems).
2001-07-29 18:25:46 +00:00
#endif
Add comments to "pcap_stats()" indicating what the counters mean on the various platforms (assuming the vendors' documentation is correct and that I've correctly interpreted it).
2001-07-29 01:22:40 +00:00
/*
Put more information into the comments for "pcap_stats()".
2001-12-10 07:14:14 +00:00
* On systems where the PACKET_STATISTICS "getsockopt()" argument
* is not supported on PF_PACKET sockets:
*
* "ps_recv" counts only packets that *passed* the filter,
* not packets that didn't pass the filter. It does not
* count packets dropped because we ran out of buffer
* space.
*
* "ps_drop" is not supported.
Add comments to "pcap_stats()" indicating what the counters mean on the various platforms (assuming the vendors' documentation is correct and that I've correctly interpreted it).
2001-07-29 01:22:40 +00:00
*
From Dustin Spicuzza: support ps_ifdrop on Linux, using /proc/net/dev. Fix the title of the pcap_stats man page, and give more detail - and a lot of caveats.
2009-09-07 23:23:15 +00:00
* "ps_ifdrop" is supported. It will return the number
Note that we might not get an interface drop count from /proc/net/dev.
2009-09-07 23:49:10 +00:00
* of drops the interface reports in /proc/net/dev,
* if that is available.
From Dustin Spicuzza: support ps_ifdrop on Linux, using /proc/net/dev. Fix the title of the pcap_stats man page, and give more detail - and a lot of caveats.
2009-09-07 23:23:15 +00:00
*
Put more information into the comments for "pcap_stats()".
2001-12-10 07:14:14 +00:00
* "ps_recv" doesn't include packets not yet read from
* the kernel by libpcap.
Don't double-count received packets on Linux systems that support the PACKET_STATISTICS getsockopt() argument on PF_PACKET sockets.
2005-11-24 19:27:42 +00:00
*
* We maintain the count of packets processed by libpcap in
* "md.packets_read", for reasons described in the comment
* at the end of pcap_read_packet(). We have no idea how many
From Dustin Spicuzza: support ps_ifdrop on Linux, using /proc/net/dev. Fix the title of the pcap_stats man page, and give more detail - and a lot of caveats.
2009-09-07 23:23:15 +00:00
* packets were dropped by the kernel buffers -- but we know
* how many the interface dropped, so we can return that.
Add comments to "pcap_stats()" indicating what the counters mean on the various platforms (assuming the vendors' documentation is correct and that I've correctly interpreted it).
2001-07-29 01:22:40 +00:00
*/
From Dustin Spicuzza: support ps_ifdrop on Linux, using /proc/net/dev. Fix the title of the pcap_stats man page, and give more detail - and a lot of caveats.
2009-09-07 23:23:15 +00:00
Don't double-count received packets on Linux systems that support the PACKET_STATISTICS getsockopt() argument on PF_PACKET sockets.
2005-11-24 19:27:42 +00:00
stats->ps_recv = handle->md.packets_read;
stats->ps_drop = 0;
Copy the right value to the ps_ifdrop statistic.
2009-09-21 17:26:37 +00:00
stats->ps_ifdrop = handle->md.stat.ps_ifdrop;
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
return 0;
}
Scan /proc/net/dev on Linux regardless of how we get the interface list. It's a Linuxism, so it's not necessary on other platforms, and is useful even if we have getifaddrs().
2010-01-10 02:46:02 +00:00
/*
Scan /sys/class/net if we have it. It's a bit easier to scan than /proc/net/dev, as it's a directory.
2010-01-10 18:56:25 +00:00
* Get from "/sys/class/net" all interfaces listed there; if they're
Scan /proc/net/dev on Linux regardless of how we get the interface list. It's a Linuxism, so it's not necessary on other platforms, and is useful even if we have getifaddrs().
2010-01-10 02:46:02 +00:00
* already in the list of interfaces we have, that won't add another
* instance, but if they're not, that'll add them.
*
* We don't bother getting any addresses for them; it appears you can't
* use SIOCGIFADDR on Linux to get IPv6 addresses for interfaces, and,
* although some other types of addresses can be fetched with SIOCGIFADDR,
* we don't bother with them for now.
*
Scan /sys/class/net if we have it. It's a bit easier to scan than /proc/net/dev, as it's a directory.
2010-01-10 18:56:25 +00:00
* We also don't fail if we couldn't open "/sys/class/net"; we just leave
* the list of interfaces as is, and return 0, so that we can try
* scanning /proc/net/dev.
*/
static int
scan_sys_class_net(pcap_if_t **devlistp, char *errbuf)
{
DIR *sys_class_net_d;
int fd;
struct dirent *ent;
char *p;
char name[512]; /* XXX - pick a size */
char *q, *saveq;
struct ifreq ifrflags;
int ret = 1;
sys_class_net_d = opendir("/sys/class/net");
if (sys_class_net_d == NULL && errno == ENOENT)
return (0);
/*
* Create a socket from which to fetch interface information.
*/
fd = socket(AF_INET, SOCK_DGRAM, 0);
if (fd < 0) {
(void)snprintf(errbuf, PCAP_ERRBUF_SIZE,
"socket: %s", pcap_strerror(errno));
return (-1);
}
for (;;) {
errno = 0;
ent = readdir(sys_class_net_d);
if (ent == NULL) {
/*
* Error or EOF; if errno != 0, it's an error.
*/
break;
}
Ignore directories in /sys/class/net.
2010-01-10 19:05:00 +00:00
/*
* Ignore directories (".", "..", and any subdirectories).
*/
if (ent->d_type == DT_DIR)
continue;
Scan /sys/class/net if we have it. It's a bit easier to scan than /proc/net/dev, as it's a directory.
2010-01-10 18:56:25 +00:00
/*
* Get the interface name.
*/
Fix some errors in the previous checkin.
2010-01-10 18:59:22 +00:00
p = &ent->d_name[0];
q = &name[0];
Scan /sys/class/net if we have it. It's a bit easier to scan than /proc/net/dev, as it's a directory.
2010-01-10 18:56:25 +00:00
while (*p != '\0' && isascii(*p) && !isspace(*p)) {
if (*p == ':') {
/*
* This could be the separator between a
* name and an alias number, or it could be
* the separator between a name with no
* alias number and the next field.
*
* If there's a colon after digits, it
* separates the name and the alias number,
* otherwise it separates the name and the
* next field.
*/
saveq = q;
while (isascii(*p) && isdigit(*p))
*q++ = *p++;
if (*p != ':') {
/*
* That was the next field,
* not the alias number.
*/
q = saveq;
}
break;
} else
*q++ = *p++;
}
*q = '\0';
/*
* Get the flags for this interface, and skip it if
* it's not up.
*/
strncpy(ifrflags.ifr_name, name, sizeof(ifrflags.ifr_name));
if (ioctl(fd, SIOCGIFFLAGS, (char *)&ifrflags) < 0) {
Ignore /sys/net/dev files if we get ENODEV for them, not just ENXIO. Both of them are indications that there's no such interface, so the file probably corresponds to something other than a device. Reviewed-By: Guy Harris <guy@alum.mit.edu>
2010-04-28 06:33:23 +00:00
if (errno == ENXIO || errno == ENODEV)
Scan /sys/class/net if we have it. It's a bit easier to scan than /proc/net/dev, as it's a directory.
2010-01-10 18:56:25 +00:00
continue;
(void)snprintf(errbuf, PCAP_ERRBUF_SIZE,
"SIOCGIFFLAGS: %.*s: %s",
(int)sizeof(ifrflags.ifr_name),
ifrflags.ifr_name,
pcap_strerror(errno));
ret = -1;
break;
}
if (!(ifrflags.ifr_flags & IFF_UP))
continue;
/*
* Add an entry for this interface, with no addresses.
*/
if (pcap_add_if(devlistp, name, ifrflags.ifr_flags, NULL,
errbuf) == -1) {
/*
* Failure.
*/
ret = -1;
break;
}
}
Correctly handle errors other than problems reading /sys/class/net.
2010-01-10 19:01:56 +00:00
if (ret != -1) {
Scan /sys/class/net if we have it. It's a bit easier to scan than /proc/net/dev, as it's a directory.
2010-01-10 18:56:25 +00:00
/*
Correctly handle errors other than problems reading /sys/class/net.
2010-01-10 19:01:56 +00:00
* Well, we didn't fail for any other reason; did we
* fail due to an error reading the directory?
Scan /sys/class/net if we have it. It's a bit easier to scan than /proc/net/dev, as it's a directory.
2010-01-10 18:56:25 +00:00
*/
Correctly handle errors other than problems reading /sys/class/net.
2010-01-10 19:01:56 +00:00
if (errno != 0) {
(void)snprintf(errbuf, PCAP_ERRBUF_SIZE,
"Error reading /sys/class/net: %s",
pcap_strerror(errno));
ret = -1;
}
Scan /sys/class/net if we have it. It's a bit easier to scan than /proc/net/dev, as it's a directory.
2010-01-10 18:56:25 +00:00
}
(void)close(fd);
(void)closedir(sys_class_net_d);
return (ret);
}
/*
* Get from "/proc/net/dev" all interfaces listed there; if they're
* already in the list of interfaces we have, that won't add another
* instance, but if they're not, that'll add them.
*
* See comments from scan_sys_class_net().
Scan /proc/net/dev on Linux regardless of how we get the interface list. It's a Linuxism, so it's not necessary on other platforms, and is useful even if we have getifaddrs().
2010-01-10 02:46:02 +00:00
*/
static int
scan_proc_net_dev(pcap_if_t **devlistp, char *errbuf)
{
FILE *proc_net_f;
int fd;
char linebuf[512];
int linenum;
Include <ctype.h>, as we use macros from it. Also, use isascii() to avoid surprises from characters with the 8th bit set, rather than playing signed vs. unsigned character games.
2010-01-10 02:50:52 +00:00
char *p;
Scan /proc/net/dev on Linux regardless of how we get the interface list. It's a Linuxism, so it's not necessary on other platforms, and is useful even if we have getifaddrs().
2010-01-10 02:46:02 +00:00
char name[512]; /* XXX - pick a size */
char *q, *saveq;
struct ifreq ifrflags;
int ret = 0;
proc_net_f = fopen("/proc/net/dev", "r");
Scan /sys/class/net if we have it. It's a bit easier to scan than /proc/net/dev, as it's a directory.
2010-01-10 18:56:25 +00:00
if (proc_net_f == NULL && errno == ENOENT)
Scan /proc/net/dev on Linux regardless of how we get the interface list. It's a Linuxism, so it's not necessary on other platforms, and is useful even if we have getifaddrs().
2010-01-10 02:46:02 +00:00
return (0);
/*
* Create a socket from which to fetch interface information.
*/
fd = socket(AF_INET, SOCK_DGRAM, 0);
if (fd < 0) {
(void)snprintf(errbuf, PCAP_ERRBUF_SIZE,
"socket: %s", pcap_strerror(errno));
return (-1);
}
for (linenum = 1;
fgets(linebuf, sizeof linebuf, proc_net_f) != NULL; linenum++) {
/*
* Skip the first two lines - they're headers.
*/
if (linenum <= 2)
continue;
p = &linebuf[0];
/*
* Skip leading white space.
*/
Include <ctype.h>, as we use macros from it. Also, use isascii() to avoid surprises from characters with the 8th bit set, rather than playing signed vs. unsigned character games.
2010-01-10 02:50:52 +00:00
while (*p != '\0' && isascii(*p) && isspace(*p))
Scan /proc/net/dev on Linux regardless of how we get the interface list. It's a Linuxism, so it's not necessary on other platforms, and is useful even if we have getifaddrs().
2010-01-10 02:46:02 +00:00
p++;
if (*p == '\0' || *p == '\n')
continue; /* blank line */
/*
* Get the interface name.
*/
q = &name[0];
Include <ctype.h>, as we use macros from it. Also, use isascii() to avoid surprises from characters with the 8th bit set, rather than playing signed vs. unsigned character games.
2010-01-10 02:50:52 +00:00
while (*p != '\0' && isascii(*p) && !isspace(*p)) {
Scan /proc/net/dev on Linux regardless of how we get the interface list. It's a Linuxism, so it's not necessary on other platforms, and is useful even if we have getifaddrs().
2010-01-10 02:46:02 +00:00
if (*p == ':') {
/*
* This could be the separator between a
* name and an alias number, or it could be
* the separator between a name with no
* alias number and the next field.
*
* If there's a colon after digits, it
* separates the name and the alias number,
* otherwise it separates the name and the
* next field.
*/
saveq = q;
Include <ctype.h>, as we use macros from it. Also, use isascii() to avoid surprises from characters with the 8th bit set, rather than playing signed vs. unsigned character games.
2010-01-10 02:50:52 +00:00
while (isascii(*p) && isdigit(*p))
Scan /proc/net/dev on Linux regardless of how we get the interface list. It's a Linuxism, so it's not necessary on other platforms, and is useful even if we have getifaddrs().
2010-01-10 02:46:02 +00:00
*q++ = *p++;
if (*p != ':') {
/*
* That was the next field,
* not the alias number.
*/
q = saveq;
}
break;
} else
*q++ = *p++;
}
*q = '\0';
/*
* Get the flags for this interface, and skip it if
* it's not up.
*/
strncpy(ifrflags.ifr_name, name, sizeof(ifrflags.ifr_name));
if (ioctl(fd, SIOCGIFFLAGS, (char *)&ifrflags) < 0) {
if (errno == ENXIO)
continue;
(void)snprintf(errbuf, PCAP_ERRBUF_SIZE,
"SIOCGIFFLAGS: %.*s: %s",
(int)sizeof(ifrflags.ifr_name),
ifrflags.ifr_name,
pcap_strerror(errno));
ret = -1;
break;
}
if (!(ifrflags.ifr_flags & IFF_UP))
continue;
/*
* Add an entry for this interface, with no addresses.
*/
if (pcap_add_if(devlistp, name, ifrflags.ifr_flags, NULL,
errbuf) == -1) {
/*
* Failure.
*/
ret = -1;
break;
}
}
if (ret != -1) {
/*
* Well, we didn't fail for any other reason; did we
* fail due to an error reading the file?
*/
if (ferror(proc_net_f)) {
(void)snprintf(errbuf, PCAP_ERRBUF_SIZE,
"Error reading /proc/net/dev: %s",
pcap_strerror(errno));
ret = -1;
}
}
(void)close(fd);
(void)fclose(proc_net_f);
return (ret);
}
Add SunATM support, based on code from Yen Yen Lim at North Dakota State University.
2002-07-11 09:06:30 +00:00
/*
* Description string for the "any" device.
*/
static const char any_descr[] = "Pseudo-device that captures on all interfaces";
int
pcap_platform_finddevs(pcap_if_t **alldevsp, char *errbuf)
{
Scan /sys/class/net if we have it. It's a bit easier to scan than /proc/net/dev, as it's a directory.
2010-01-10 18:56:25 +00:00
int ret;
Scan /proc/net/dev on Linux regardless of how we get the interface list. It's a Linuxism, so it's not necessary on other platforms, and is useful even if we have getifaddrs().
2010-01-10 02:46:02 +00:00
/*
Scan /sys/class/net if we have it. It's a bit easier to scan than /proc/net/dev, as it's a directory.
2010-01-10 18:56:25 +00:00
* Read "/sys/class/net", and add to the list of interfaces all
Scan /proc/net/dev on Linux regardless of how we get the interface list. It's a Linuxism, so it's not necessary on other platforms, and is useful even if we have getifaddrs().
2010-01-10 02:46:02 +00:00
* interfaces listed there that we don't already have, because,
* on Linux, SIOCGIFCONF reports only interfaces with IPv4 addresses,
* and even getifaddrs() won't return information about
Scan /sys/class/net if we have it. It's a bit easier to scan than /proc/net/dev, as it's a directory.
2010-01-10 18:56:25 +00:00
* interfaces with no addresses, so you need to read "/sys/class/net"
Scan /proc/net/dev on Linux regardless of how we get the interface list. It's a Linuxism, so it's not necessary on other platforms, and is useful even if we have getifaddrs().
2010-01-10 02:46:02 +00:00
* to get the names of the rest of the interfaces.
*/
Scan /sys/class/net if we have it. It's a bit easier to scan than /proc/net/dev, as it's a directory.
2010-01-10 18:56:25 +00:00
ret = scan_sys_class_net(alldevsp, errbuf);
if (ret == -1)
return (-1); /* failed */
if (ret == 0) {
/*
* No /sys/class/net; try reading /proc/net/dev instead.
*/
if (scan_proc_net_dev(alldevsp, errbuf) == -1)
return (-1);
}
Scan /proc/net/dev on Linux regardless of how we get the interface list. It's a Linuxism, so it's not necessary on other platforms, and is useful even if we have getifaddrs().
2010-01-10 02:46:02 +00:00
/*
* Add the "any" device.
*/
Cut-and-pasteo fix, from Greg Stark <gsstark@mit.edu>.
2002-07-12 07:51:15 +00:00
if (pcap_add_if(alldevsp, "any", 0, any_descr, errbuf) < 0)
Add SunATM support, based on code from Yen Yen Lim at North Dakota State University.
2002-07-11 09:06:30 +00:00
return (-1);
From Jesper Peterson <jesper@endace.com>: support for capturing from Endace DAG devices.
2003-07-23 05:29:19 +00:00
#ifdef HAVE_DAG_API
Scan /proc/net/dev on Linux regardless of how we get the interface list. It's a Linuxism, so it's not necessary on other platforms, and is useful even if we have getifaddrs().
2010-01-10 02:46:02 +00:00
/*
* Add DAG devices.
*/
From Jesper Peterson <jesper@endace.com>: support for capturing from Endace DAG devices.
2003-07-23 05:29:19 +00:00
if (dag_platform_finddevs(alldevsp, errbuf) < 0)
return (-1);
#endif /* HAVE_DAG_API */
From Gilbert Hoyek <gil_hoyek@hotmail.com>: support for capturing SS7 traffic on Intel Septel cards, and for filtering on SS7 MTP3 fields. Clean up indentation.
2005-06-20 21:27:07 +00:00
#ifdef HAVE_SEPTEL_API
Scan /proc/net/dev on Linux regardless of how we get the interface list. It's a Linuxism, so it's not necessary on other platforms, and is useful even if we have getifaddrs().
2010-01-10 02:46:02 +00:00
/*
* Add Septel devices.
*/
From Gilbert Hoyek <gil_hoyek@hotmail.com>: support for capturing SS7 traffic on Intel Septel cards, and for filtering on SS7 MTP3 fields. Clean up indentation.
2005-06-20 21:27:07 +00:00
if (septel_platform_finddevs(alldevsp, errbuf) < 0)
return (-1);
#endif /* HAVE_SEPTEL_API */
Add Myricom SNF API support as a new pcap device. This patch adds support for our NICs when run in a specialized capture mode. It is diffed against the current master. The Myricom Sniffer10G software uses Myri-10G programmable Network Interface Cards (NICs), a firmware extension, a specialized driver and a user-level library (libsnf) to enable sustained capture of 10-Gigabit Ethernet traffic. Small-packet coalescing and an efficient zero-copy path to host memory allow Sniffer10G to capture streams at line rate for all Ethernet packet sizes. Optionally, libpcap can be used concurrently by multiple processes on a single NIC port to partition the incoming traffic across processes. While the Linux kernel enables this through multiple receive queues, the difference is that the myri_snf driver cooperates with libsnf to set up multiple queues that are each independently accessible through user-space. More information here: http://www.myri.com/scs/SNF/doc Signed-off-by: Guy Harris <guy@alum.mit.edu>
2010-01-26 19:58:37 +00:00
#ifdef HAVE_SNF_API
if (snf_platform_finddevs(alldevsp, errbuf) < 0)
return (-1);
#endif /* HAVE_SNF_API */
From Paolo Abeni: Bluetooth support.
2006-10-13 17:34:53 +00:00
#ifdef PCAP_SUPPORT_BT
Scan /proc/net/dev on Linux regardless of how we get the interface list. It's a Linuxism, so it's not necessary on other platforms, and is useful even if we have getifaddrs().
2010-01-10 02:46:02 +00:00
/*
* Add Bluetooth devices.
*/
From Paolo Abeni: Bluetooth support.
2006-10-13 17:34:53 +00:00
if (bt_platform_finddevs(alldevsp, errbuf) < 0)
return (-1);
#endif
#ifdef PCAP_SUPPORT_USB
Scan /proc/net/dev on Linux regardless of how we get the interface list. It's a Linuxism, so it's not necessary on other platforms, and is useful even if we have getifaddrs().
2010-01-10 02:46:02 +00:00
/*
* Add USB devices.
*/
from Paolo Abeni <paolo.abeni@email.com>: USB capturing support on linux
2006-10-04 15:50:26 +00:00
if (usb_platform_finddevs(alldevsp, errbuf) < 0)
return (-1);
From Paolo Abeni: Bluetooth support.
2006-10-13 17:34:53 +00:00
#endif
from Paolo Abeni <paolo.abeni@email.com>: USB capturing support on linux
2006-10-04 15:50:26 +00:00
Import pcap-dect-linux Signed-off-by: Patrick McHardy <kaber@trash.net>
2010-10-15 00:21:10 +00:00
#ifdef PCAP_SUPPORT_DECT
if (dect_platform_finddevs(alldevsp, errbuf) < 0)
return (-1);
#endif
Add SunATM support, based on code from Yen Yen Lim at North Dakota State University.
2002-07-11 09:06:30 +00:00
return (0);
}
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
/*
whitespace cleanup
2002-06-11 17:04:44 +00:00
* Attach the given BPF code to the packet capture device.
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
*/
Add a "setfilter" function pointer to the pcap_t structure, which handles setting a filter for a pcap_t. Have "pcap_setfilter()" call it, rather than being a per-platform function. The per-platform functions don't need to check for an offline capture any more, as they're not called for an offline capture (and the ones that just call "install_bpf_program()" don't need to exist at all).
2003-07-25 04:42:02 +00:00
static int
When doing Linux mmapped capture: Allocate a buffer into which to copy a packet, and have the callback for pcap_next() and pcap_next_ex() copy to that buffer and return a pointer to that buffer; we can't return the packet data pointer passed to the callback, as, once the callback returns, that buffer can be overwritten, even before you read the next packet. Don't tweak filter programs passed into the kernel to return 65535 on success - we don't have to, as we're not reading packets with recvfrom(), and we don't want to, as, if we return the actual snapshot length, the kernel will copy less data to the ring buffer. Truncate the packet snapshot length to the specified length, as we might not have a filter to do that.
2009-07-16 22:08:12 +00:00
pcap_setfilter_linux_common(pcap_t *handle, struct bpf_program *filter,
int is_mmapped)
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
{
#ifdef SO_ATTACH_FILTER
struct sock_fprog fcode;
Add support for a new link layer type DLT_LINUX_SLL, for use when doing live captures with a "cooked" (SOCK_DGRAM) rather than a "raw" (SOCK_RAW) PF_PACKET socket; it includes a bunch of the fields from the "struct sockaddr_ll" you get in a "recvfrom()", including the Ethernet protocol field. This requires us to rewrite the BPF program if we're stuffing it into the kernel; as long as we're doing *ex post facto* rewriting, we might as well also do the "ret <snaplen>" -> "ret 65535" fixup there as well, rather than in the code generator.
2000-12-21 10:29:21 +00:00
int can_filter_in_kernel;
Bug fixes from Graeme Hewson <ghewson@cix.compulink.co.uk>: 1. During termination processing set up by atexit() under a 2.0.x kernel, if a socket had been previously closed and the handle freed due to an error, pcap_close_all() and pcap_close_linux() would nevertheless try to work with these structures and then crash. pcap_close_linux() is now called directly when necessary during error processing. 2. atexit() could get called more than once because the did_atexit flag wasn't being set. 3. If iface_get_arptype() returns an error because the ioctl() call failed (probably due to "no such device"), live_open_new() now returns a fatal error to pcap_open_live() and the call to live_open_old() is short-circuited. 4. Applications using libpcap would appear to listen on an interface that was down. a. iface_bind() and iface_bind_old() now check for pending errors after bind(). In turn, pcap_open_live() now returns an error status if there was a pending error after bind(). b. After draining the socket, set_kernel_filter() now checks to see if the error was the expected EAGAIN and returns a fatal error to pcap_setfilter() if not. In turn, pcap_setfilter() now returns an error status if there was a network error. 5. pcap_setfilter() was putting an error message into errbuf after a failed call to install_bpf_program(). This was unnecessary since install_bpf_program() puts its own error message into errbuf.
2002-02-22 09:20:11 +00:00
int err = 0;
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
#endif
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
if (!handle)
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
return -1;
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
if (!filter) {
use snprintf instead of sprintf. From Juergen Schoenwaelder <schoenw@ibr.cs.tu-bs.de>
2000-07-04 12:24:01 +00:00
strncpy(handle->errbuf, "setfilter: No filter specified",
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
PCAP_ERRBUF_SIZE);
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
return -1;
Initial revision
1999-10-07 23:46:40 +00:00
}
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
/* Make our private copy of the filter */
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
Bug fixes from Graeme Hewson <ghewson@cix.compulink.co.uk>: 1. During termination processing set up by atexit() under a 2.0.x kernel, if a socket had been previously closed and the handle freed due to an error, pcap_close_all() and pcap_close_linux() would nevertheless try to work with these structures and then crash. pcap_close_linux() is now called directly when necessary during error processing. 2. atexit() could get called more than once because the did_atexit flag wasn't being set. 3. If iface_get_arptype() returns an error because the ioctl() call failed (probably due to "no such device"), live_open_new() now returns a fatal error to pcap_open_live() and the call to live_open_old() is short-circuited. 4. Applications using libpcap would appear to listen on an interface that was down. a. iface_bind() and iface_bind_old() now check for pending errors after bind(). In turn, pcap_open_live() now returns an error status if there was a pending error after bind(). b. After draining the socket, set_kernel_filter() now checks to see if the error was the expected EAGAIN and returns a fatal error to pcap_setfilter() if not. In turn, pcap_setfilter() now returns an error status if there was a network error. 5. pcap_setfilter() was putting an error message into errbuf after a failed call to install_bpf_program(). This was unnecessary since install_bpf_program() puts its own error message into errbuf.
2002-02-22 09:20:11 +00:00
if (install_bpf_program(handle, filter) < 0)
/* install_bpf_program() filled in errbuf */
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
return -1;
whitespace cleanup
2002-06-11 17:04:44 +00:00
/*
* Run user level packet filter by default. Will be overriden if
* installing a kernel filter succeeds.
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
*/
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
handle->md.use_bpf = 0;
/* Install kernel level filter if possible */
The Linux "pcap_setfilter()" makes a copy of the filter it's handed, and installs that copy; when closing a pcap_t on Linux, free that copy.
2000-10-25 06:59:09 +00:00
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
#ifdef SO_ATTACH_FILTER
conditionalize on USHRT_MAX and SOL_PACKET. From Love <lha@stacken.kth.se>
2000-07-11 01:09:16 +00:00
#ifdef USHRT_MAX
Add support for a new link layer type DLT_LINUX_SLL, for use when doing live captures with a "cooked" (SOCK_DGRAM) rather than a "raw" (SOCK_RAW) PF_PACKET socket; it includes a bunch of the fields from the "struct sockaddr_ll" you get in a "recvfrom()", including the Ethernet protocol field. This requires us to rewrite the BPF program if we're stuffing it into the kernel; as long as we're doing *ex post facto* rewriting, we might as well also do the "ret <snaplen>" -> "ret 65535" fixup there as well, rather than in the code generator.
2000-12-21 10:29:21 +00:00
if (handle->fcode.bf_len > USHRT_MAX) {
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
/*
whitespace cleanup
2002-06-11 17:04:44 +00:00
* fcode.len is an unsigned short for current kernel.
Add support for a new link layer type DLT_LINUX_SLL, for use when doing live captures with a "cooked" (SOCK_DGRAM) rather than a "raw" (SOCK_RAW) PF_PACKET socket; it includes a bunch of the fields from the "struct sockaddr_ll" you get in a "recvfrom()", including the Ethernet protocol field. This requires us to rewrite the BPF program if we're stuffing it into the kernel; as long as we're doing *ex post facto* rewriting, we might as well also do the "ret <snaplen>" -> "ret 65535" fixup there as well, rather than in the code generator.
2000-12-21 10:29:21 +00:00
* I have yet to see BPF-Code with that much
* instructions but still it is possible. So for the
* sake of correctness I added this check.
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
*/
Add support for a new link layer type DLT_LINUX_SLL, for use when doing live captures with a "cooked" (SOCK_DGRAM) rather than a "raw" (SOCK_RAW) PF_PACKET socket; it includes a bunch of the fields from the "struct sockaddr_ll" you get in a "recvfrom()", including the Ethernet protocol field. This requires us to rewrite the BPF program if we're stuffing it into the kernel; as long as we're doing *ex post facto* rewriting, we might as well also do the "ret <snaplen>" -> "ret 65535" fixup there as well, rather than in the code generator.
2000-12-21 10:29:21 +00:00
fprintf(stderr, "Warning: Filter too complex for kernel\n");
Squelch a valgrind warning.
2006-09-28 07:34:36 +00:00
fcode.len = 0;
Add support for a new link layer type DLT_LINUX_SLL, for use when doing live captures with a "cooked" (SOCK_DGRAM) rather than a "raw" (SOCK_RAW) PF_PACKET socket; it includes a bunch of the fields from the "struct sockaddr_ll" you get in a "recvfrom()", including the Ethernet protocol field. This requires us to rewrite the BPF program if we're stuffing it into the kernel; as long as we're doing *ex post facto* rewriting, we might as well also do the "ret <snaplen>" -> "ret 65535" fixup there as well, rather than in the code generator.
2000-12-21 10:29:21 +00:00
fcode.filter = NULL;
can_filter_in_kernel = 0;
} else
#endif /* USHRT_MAX */
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
{
Add support for a new link layer type DLT_LINUX_SLL, for use when doing live captures with a "cooked" (SOCK_DGRAM) rather than a "raw" (SOCK_RAW) PF_PACKET socket; it includes a bunch of the fields from the "struct sockaddr_ll" you get in a "recvfrom()", including the Ethernet protocol field. This requires us to rewrite the BPF program if we're stuffing it into the kernel; as long as we're doing *ex post facto* rewriting, we might as well also do the "ret <snaplen>" -> "ret 65535" fixup there as well, rather than in the code generator.
2000-12-21 10:29:21 +00:00
/*
* Oh joy, the Linux kernel uses struct sock_fprog instead
* of struct bpf_program and of course the length field is
* of different size. Pointed out by Sebastian
*
* Oh, and we also need to fix it up so that all "ret"
* instructions with non-zero operands have 65535 as the
When doing Linux mmapped capture: Allocate a buffer into which to copy a packet, and have the callback for pcap_next() and pcap_next_ex() copy to that buffer and return a pointer to that buffer; we can't return the packet data pointer passed to the callback, as, once the callback returns, that buffer can be overwritten, even before you read the next packet. Don't tweak filter programs passed into the kernel to return 65535 on success - we don't have to, as we're not reading packets with recvfrom(), and we don't want to, as, if we return the actual snapshot length, the kernel will copy less data to the ring buffer. Truncate the packet snapshot length to the specified length, as we might not have a filter to do that.
2009-07-16 22:08:12 +00:00
* operand if we're not capturing in memory-mapped modee,
* and so that, if we're in cooked mode, all memory-reference
* instructions use special magic offsets in references to
* the link-layer header and assume that the link-layer
* payload begins at 0; "fix_program()" will do that.
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
*/
When doing Linux mmapped capture: Allocate a buffer into which to copy a packet, and have the callback for pcap_next() and pcap_next_ex() copy to that buffer and return a pointer to that buffer; we can't return the packet data pointer passed to the callback, as, once the callback returns, that buffer can be overwritten, even before you read the next packet. Don't tweak filter programs passed into the kernel to return 65535 on success - we don't have to, as we're not reading packets with recvfrom(), and we don't want to, as, if we return the actual snapshot length, the kernel will copy less data to the ring buffer. Truncate the packet snapshot length to the specified length, as we might not have a filter to do that.
2009-07-16 22:08:12 +00:00
switch (fix_program(handle, &fcode, is_mmapped)) {
Add support for a new link layer type DLT_LINUX_SLL, for use when doing live captures with a "cooked" (SOCK_DGRAM) rather than a "raw" (SOCK_RAW) PF_PACKET socket; it includes a bunch of the fields from the "struct sockaddr_ll" you get in a "recvfrom()", including the Ethernet protocol field. This requires us to rewrite the BPF program if we're stuffing it into the kernel; as long as we're doing *ex post facto* rewriting, we might as well also do the "ret <snaplen>" -> "ret 65535" fixup there as well, rather than in the code generator.
2000-12-21 10:29:21 +00:00
case -1:
default:
/*
* Fatal error; just quit.
* (The "default" case shouldn't happen; we
* return -1 for that reason.)
*/
return -1;
case 0:
/*
* The program performed checks that we can't make
* work in the kernel.
*/
can_filter_in_kernel = 0;
break;
case 1:
/*
* We have a filter that'll work in the kernel.
*/
can_filter_in_kernel = 1;
break;
}
}
if (can_filter_in_kernel) {
Bug fixes from Graeme Hewson <ghewson@cix.compulink.co.uk>: 1. During termination processing set up by atexit() under a 2.0.x kernel, if a socket had been previously closed and the handle freed due to an error, pcap_close_all() and pcap_close_linux() would nevertheless try to work with these structures and then crash. pcap_close_linux() is now called directly when necessary during error processing. 2. atexit() could get called more than once because the did_atexit flag wasn't being set. 3. If iface_get_arptype() returns an error because the ioctl() call failed (probably due to "no such device"), live_open_new() now returns a fatal error to pcap_open_live() and the call to live_open_old() is short-circuited. 4. Applications using libpcap would appear to listen on an interface that was down. a. iface_bind() and iface_bind_old() now check for pending errors after bind(). In turn, pcap_open_live() now returns an error status if there was a pending error after bind(). b. After draining the socket, set_kernel_filter() now checks to see if the error was the expected EAGAIN and returns a fatal error to pcap_setfilter() if not. In turn, pcap_setfilter() now returns an error status if there was a network error. 5. pcap_setfilter() was putting an error message into errbuf after a failed call to install_bpf_program(). This was unnecessary since install_bpf_program() puts its own error message into errbuf.
2002-02-22 09:20:11 +00:00
if ((err = set_kernel_filter(handle, &fcode)) == 0)
Add support for a new link layer type DLT_LINUX_SLL, for use when doing live captures with a "cooked" (SOCK_DGRAM) rather than a "raw" (SOCK_RAW) PF_PACKET socket; it includes a bunch of the fields from the "struct sockaddr_ll" you get in a "recvfrom()", including the Ethernet protocol field. This requires us to rewrite the BPF program if we're stuffing it into the kernel; as long as we're doing *ex post facto* rewriting, we might as well also do the "ret <snaplen>" -> "ret 65535" fixup there as well, rather than in the code generator.
2000-12-21 10:29:21 +00:00
{
/* Installation succeded - using kernel filter. */
handle->md.use_bpf = 1;
}
Bug fixes from Graeme Hewson <ghewson@cix.compulink.co.uk>: 1. During termination processing set up by atexit() under a 2.0.x kernel, if a socket had been previously closed and the handle freed due to an error, pcap_close_all() and pcap_close_linux() would nevertheless try to work with these structures and then crash. pcap_close_linux() is now called directly when necessary during error processing. 2. atexit() could get called more than once because the did_atexit flag wasn't being set. 3. If iface_get_arptype() returns an error because the ioctl() call failed (probably due to "no such device"), live_open_new() now returns a fatal error to pcap_open_live() and the call to live_open_old() is short-circuited. 4. Applications using libpcap would appear to listen on an interface that was down. a. iface_bind() and iface_bind_old() now check for pending errors after bind(). In turn, pcap_open_live() now returns an error status if there was a pending error after bind(). b. After draining the socket, set_kernel_filter() now checks to see if the error was the expected EAGAIN and returns a fatal error to pcap_setfilter() if not. In turn, pcap_setfilter() now returns an error status if there was a network error. 5. pcap_setfilter() was putting an error message into errbuf after a failed call to install_bpf_program(). This was unnecessary since install_bpf_program() puts its own error message into errbuf.
2002-02-22 09:20:11 +00:00
else if (err == -1) /* Non-fatal error */
Add support for a new link layer type DLT_LINUX_SLL, for use when doing live captures with a "cooked" (SOCK_DGRAM) rather than a "raw" (SOCK_RAW) PF_PACKET socket; it includes a bunch of the fields from the "struct sockaddr_ll" you get in a "recvfrom()", including the Ethernet protocol field. This requires us to rewrite the BPF program if we're stuffing it into the kernel; as long as we're doing *ex post facto* rewriting, we might as well also do the "ret <snaplen>" -> "ret 65535" fixup there as well, rather than in the code generator.
2000-12-21 10:29:21 +00:00
{
whitespace cleanup
2002-06-11 17:04:44 +00:00
/*
Add support for a new link layer type DLT_LINUX_SLL, for use when doing live captures with a "cooked" (SOCK_DGRAM) rather than a "raw" (SOCK_RAW) PF_PACKET socket; it includes a bunch of the fields from the "struct sockaddr_ll" you get in a "recvfrom()", including the Ethernet protocol field. This requires us to rewrite the BPF program if we're stuffing it into the kernel; as long as we're doing *ex post facto* rewriting, we might as well also do the "ret <snaplen>" -> "ret 65535" fixup there as well, rather than in the code generator.
2000-12-21 10:29:21 +00:00
* Print a warning if we weren't able to install
* the filter for a reason other than "this kernel
* isn't configured to support socket filters.
*/
if (errno != ENOPROTOOPT && errno != EOPNOTSUPP) {
fprintf(stderr,
whitespace cleanup
2002-06-11 17:04:44 +00:00
"Warning: Kernel filter failed: %s\n",
Add support for a new link layer type DLT_LINUX_SLL, for use when doing live captures with a "cooked" (SOCK_DGRAM) rather than a "raw" (SOCK_RAW) PF_PACKET socket; it includes a bunch of the fields from the "struct sockaddr_ll" you get in a "recvfrom()", including the Ethernet protocol field. This requires us to rewrite the BPF program if we're stuffing it into the kernel; as long as we're doing *ex post facto* rewriting, we might as well also do the "ret <snaplen>" -> "ret 65535" fixup there as well, rather than in the code generator.
2000-12-21 10:29:21 +00:00
pcap_strerror(errno));
}
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
}
Initial revision
1999-10-07 23:46:40 +00:00
}
Add support for a new link layer type DLT_LINUX_SLL, for use when doing live captures with a "cooked" (SOCK_DGRAM) rather than a "raw" (SOCK_RAW) PF_PACKET socket; it includes a bunch of the fields from the "struct sockaddr_ll" you get in a "recvfrom()", including the Ethernet protocol field. This requires us to rewrite the BPF program if we're stuffing it into the kernel; as long as we're doing *ex post facto* rewriting, we might as well also do the "ret <snaplen>" -> "ret 65535" fixup there as well, rather than in the code generator.
2000-12-21 10:29:21 +00:00
Changes from Pavel Kankovsky to reset the kernel filter in "pcap_setfilter()" if we're not using a kernel filter, in case a previous call to "pcap_setfilter()" had succeeded in adding a kernel filter, as if we're doing userland filtering we need to get rid of all kernel filters that might discard packets that'd pass the userland filter.
2001-08-30 03:08:43 +00:00
/*
* If we're not using the kernel filter, get rid of any kernel
* filter that might've been there before, e.g. because the
* previous filter could work in the kernel, or because some other
* code attached a filter to the socket by some means other than
* calling "pcap_setfilter()". Otherwise, the kernel filter may
* filter out packets that would pass the new userland filter.
*/
if (!handle->md.use_bpf)
reset_kernel_filter(handle);
Add support for a new link layer type DLT_LINUX_SLL, for use when doing live captures with a "cooked" (SOCK_DGRAM) rather than a "raw" (SOCK_RAW) PF_PACKET socket; it includes a bunch of the fields from the "struct sockaddr_ll" you get in a "recvfrom()", including the Ethernet protocol field. This requires us to rewrite the BPF program if we're stuffing it into the kernel; as long as we're doing *ex post facto* rewriting, we might as well also do the "ret <snaplen>" -> "ret 65535" fixup there as well, rather than in the code generator.
2000-12-21 10:29:21 +00:00
/*
* Free up the copy of the filter that was made by "fix_program()".
*/
if (fcode.filter != NULL)
free(fcode.filter);
Bug fixes from Graeme Hewson <ghewson@cix.compulink.co.uk>: 1. During termination processing set up by atexit() under a 2.0.x kernel, if a socket had been previously closed and the handle freed due to an error, pcap_close_all() and pcap_close_linux() would nevertheless try to work with these structures and then crash. pcap_close_linux() is now called directly when necessary during error processing. 2. atexit() could get called more than once because the did_atexit flag wasn't being set. 3. If iface_get_arptype() returns an error because the ioctl() call failed (probably due to "no such device"), live_open_new() now returns a fatal error to pcap_open_live() and the call to live_open_old() is short-circuited. 4. Applications using libpcap would appear to listen on an interface that was down. a. iface_bind() and iface_bind_old() now check for pending errors after bind(). In turn, pcap_open_live() now returns an error status if there was a pending error after bind(). b. After draining the socket, set_kernel_filter() now checks to see if the error was the expected EAGAIN and returns a fatal error to pcap_setfilter() if not. In turn, pcap_setfilter() now returns an error status if there was a network error. 5. pcap_setfilter() was putting an error message into errbuf after a failed call to install_bpf_program(). This was unnecessary since install_bpf_program() puts its own error message into errbuf.
2002-02-22 09:20:11 +00:00
if (err == -2)
/* Fatal error */
return -1;
Add support for a new link layer type DLT_LINUX_SLL, for use when doing live captures with a "cooked" (SOCK_DGRAM) rather than a "raw" (SOCK_RAW) PF_PACKET socket; it includes a bunch of the fields from the "struct sockaddr_ll" you get in a "recvfrom()", including the Ethernet protocol field. This requires us to rewrite the BPF program if we're stuffing it into the kernel; as long as we're doing *ex post facto* rewriting, we might as well also do the "ret <snaplen>" -> "ret 65535" fixup there as well, rather than in the code generator.
2000-12-21 10:29:21 +00:00
#endif /* SO_ATTACH_FILTER */
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
return 0;
}
Initial revision
1999-10-07 23:46:40 +00:00
When doing Linux mmapped capture: Allocate a buffer into which to copy a packet, and have the callback for pcap_next() and pcap_next_ex() copy to that buffer and return a pointer to that buffer; we can't return the packet data pointer passed to the callback, as, once the callback returns, that buffer can be overwritten, even before you read the next packet. Don't tweak filter programs passed into the kernel to return 65535 on success - we don't have to, as we're not reading packets with recvfrom(), and we don't want to, as, if we return the actual snapshot length, the kernel will copy less data to the ring buffer. Truncate the packet snapshot length to the specified length, as we might not have a filter to do that.
2009-07-16 22:08:12 +00:00
static int
pcap_setfilter_linux(pcap_t *handle, struct bpf_program *filter)
{
return pcap_setfilter_linux_common(handle, filter, 0);
}
From Pawel Pokrywka: add support for requesting that only received packets, only sent packets, or all packets be accepted, with an implementation for Linux. Add an implementation for BPF platforms that support BIOCSSEESENT.
2005-05-03 18:53:58 +00:00
/*
* Set direction flag: Which packets do we accept on a forwarding
* single device? IN, OUT or both?
*/
static int
OK, we'll be putting out 0.9.2 soon, so add the API changes back in again.
2005-07-07 01:57:00 +00:00
pcap_setdirection_linux(pcap_t *handle, pcap_direction_t d)
From Pawel Pokrywka: add support for requesting that only received packets, only sent packets, or all packets be accepted, with an implementation for Linux. Add an implementation for BPF platforms that support BIOCSSEESENT.
2005-05-03 18:53:58 +00:00
{
#ifdef HAVE_PF_PACKET_SOCKETS
if (!handle->md.sock_packet) {
handle->direction = d;
return 0;
}
#endif
/*
* We're not using PF_PACKET sockets, so we can't determine
* the direction of the packet.
*/
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
From Pawel Pokrywka: add support for requesting that only received packets, only sent packets, or all packets be accepted, with an implementation for Linux. Add an implementation for BPF platforms that support BIOCSSEESENT.
2005-05-03 18:53:58 +00:00
"Setting direction is not supported on SOCK_PACKET sockets");
return -1;
}
map_packet_type_to_sll_type() isn't used - and won't compile - if you don't have PF_PACKET support; #ifdef it out. Move the code to compute the buffer size into live_open_new() and live_open_old(), as it's dependent on the mechanism being used; there's little code shared between the two variants.
2008-01-24 20:20:08 +00:00
#ifdef HAVE_PF_PACKET_SOCKETS
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
/*
* Map the PACKET_ value to a LINUX_SLL_ value; we
* want the same numerical value to be used in
* the link-layer header even if the numerical values
* for the PACKET_ #defines change, so that programs
* that look at the packet type field will always be
* able to handle DLT_LINUX_SLL captures.
*/
static short int
map_packet_type_to_sll_type(short int sll_pkttype)
{
switch (sll_pkttype) {
case PACKET_HOST:
return htons(LINUX_SLL_HOST);
case PACKET_BROADCAST:
return htons(LINUX_SLL_BROADCAST);
case PACKET_MULTICAST:
return htons(LINUX_SLL_MULTICAST);
case PACKET_OTHERHOST:
return htons(LINUX_SLL_OTHERHOST);
case PACKET_OUTGOING:
return htons(LINUX_SLL_OUTGOING);
default:
return -1;
}
}
map_packet_type_to_sll_type() isn't used - and won't compile - if you don't have PF_PACKET support; #ifdef it out. Move the code to compute the buffer size into live_open_new() and live_open_old(), as it's dependent on the mechanism being used; there's little code shared between the two variants.
2008-01-24 20:20:08 +00:00
#endif
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
/*
whitespace cleanup
2002-06-11 17:04:44 +00:00
* Linux uses the ARP hardware type to identify the type of an
* interface. pcap uses the DLT_xxx constants for this. This
Attempt to put the link-layer payload of packets on a 4-byte boundary, as is done in some other "pcap-XXX.c" modules.
2001-03-20 05:50:33 +00:00
* function takes a pointer to a "pcap_t", and an ARPHRD_xxx
* constant, as arguments, and sets "handle->linktype" to the
* appropriate DLT_XXX constant and sets "handle->offset" to
* the appropriate value (to make "handle->offset" plus link-layer
* header length be a multiple of 4, so that the link-layer payload
* will be aligned on a 4-byte boundary when capturing packets).
* (If the offset isn't set here, it'll be 0; add code as appropriate
* for cases where it shouldn't be 0.)
Have "map_arphrd_to_dlt()" take a flag indicating whether it's OK to return DLT_LINUX_SLL or not, and, if that flag is false, for those interface types where we'd used DLT_LINUX_SLL, pick a DLT_ type that works as well as possible in raw mode, or fail. Pass 1 as that flag if we're using a PF_PACKET socket; pass 0 as that flag if we're using a PF_INET/SOCK_PACKET socket. For PF_INET/SOCK_PACKET sockets, try to get the link-layer type and map it to a DLT_ value *before* turning promiscuous mode on, so that we don't try to put the interface into promiscuous mode unless we know we can handle its link-layer type (and thus that we can use the interface).
2002-02-10 00:05:14 +00:00
*
* If "cooked_ok" is non-zero, we can use DLT_LINUX_SLL and capture
* in cooked mode; otherwise, we can't use cooked mode, so we have
* to pick some type that works in raw mode, or fail.
whitespace cleanup
2002-06-11 17:04:44 +00:00
*
We weren't returning a warning if the interface had an ARPHRD_ type we didn't handle; fix the code to do so. Remove the word "Warning" from the warning - tcpdump will add it when it prints the warning, as will Ethereal and Tethereal.
2001-10-25 08:27:18 +00:00
* Sets the link type to -1 if unable to map the type.
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
*/
Have "map_arphrd_to_dlt()" take a flag indicating whether it's OK to return DLT_LINUX_SLL or not, and, if that flag is false, for those interface types where we'd used DLT_LINUX_SLL, pick a DLT_ type that works as well as possible in raw mode, or fail. Pass 1 as that flag if we're using a PF_PACKET socket; pass 0 as that flag if we're using a PF_INET/SOCK_PACKET socket. For PF_INET/SOCK_PACKET sockets, try to get the link-layer type and map it to a DLT_ value *before* turning promiscuous mode on, so that we don't try to put the interface into promiscuous mode unless we know we can handle its link-layer type (and thus that we can use the interface).
2002-02-10 00:05:14 +00:00
static void map_arphrd_to_dlt(pcap_t *handle, int arptype, int cooked_ok)
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
{
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
switch (arptype) {
Attempt to put the link-layer payload of packets on a 4-byte boundary, as is done in some other "pcap-XXX.c" modules.
2001-03-20 05:50:33 +00:00
Initial revision
1999-10-07 23:46:40 +00:00
case ARPHRD_ETHER:
For devices that we have some reason to believe are real live Ethernet devices, offer DLT_DOCSIS as one of the choices of link-layer type, and support setting that type as meaning just "set libpcap's notion of the link-layer type to DLT_DOCSIS" without telling the driver to use DLT_DOCSIS.
2003-12-18 23:32:31 +00:00
/*
* This is (presumably) a real Ethernet capture; give it a
* link-layer-type list with DLT_EN10MB and DLT_DOCSIS, so
* that an application can let you choose it, in case you're
* capturing DOCSIS traffic that a Cisco Cable Modem
* Termination System is putting out onto an Ethernet (it
* doesn't put an Ethernet header onto the wire, it puts raw
* DOCSIS frames out on the wire inside the low-level
* Ethernet framing).
*
* XXX - are there any sorts of "fake Ethernet" that have
* ARPHRD_ETHER but that *shouldn't offer DLT_DOCSIS as
* a Cisco CMTS won't put traffic onto it or get traffic
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
* bridged onto it? ISDN is handled in "activate_new()",
For devices that we have some reason to believe are real live Ethernet devices, offer DLT_DOCSIS as one of the choices of link-layer type, and support setting that type as meaning just "set libpcap's notion of the link-layer type to DLT_DOCSIS" without telling the driver to use DLT_DOCSIS.
2003-12-18 23:32:31 +00:00
* as we fall back on cooked mode there; are there any
* others?
*/
handle->dlt_list = (u_int *) malloc(sizeof(u_int) * 2);
/*
* If that fails, just leave the list empty.
*/
if (handle->dlt_list != NULL) {
handle->dlt_list[0] = DLT_EN10MB;
handle->dlt_list[1] = DLT_DOCSIS;
handle->dlt_count = 2;
}
/* FALLTHROUGH */
Initial revision
1999-10-07 23:46:40 +00:00
case ARPHRD_METRICOM:
Attempt to put the link-layer payload of packets on a 4-byte boundary, as is done in some other "pcap-XXX.c" modules.
2001-03-20 05:50:33 +00:00
case ARPHRD_LOOPBACK:
handle->linktype = DLT_EN10MB;
handle->offset = 2;
break;
case ARPHRD_EETHER:
handle->linktype = DLT_EN3MB;
break;
case ARPHRD_AX25:
Add DLT_AX25_KISS, for AX.25 with a KISS header, as per discussions in the tcpdump-workers mailing list in early April, 2007. Add Richard Stearn's support for DLT_AX25_KISS.
2007-10-05 01:40:14 +00:00
handle->linktype = DLT_AX25_KISS;
Attempt to put the link-layer payload of packets on a 4-byte boundary, as is done in some other "pcap-XXX.c" modules.
2001-03-20 05:50:33 +00:00
break;
case ARPHRD_PRONET:
handle->linktype = DLT_PRONET;
break;
case ARPHRD_CHAOS:
handle->linktype = DLT_CHAOS;
break;
Add support for CANbus capture. Signed-off-by: Guy Harris <guy@alum.mit.edu>
2009-12-29 09:04:20 +00:00
#ifndef ARPHRD_CAN
#define ARPHRD_CAN 280
#endif
case ARPHRD_CAN:
handle->linktype = DLT_CAN_SOCKETCAN;
break;
Attempt to put the link-layer payload of packets on a 4-byte boundary, as is done in some other "pcap-XXX.c" modules.
2001-03-20 05:50:33 +00:00
The Linux 2.4 kernel supplies ARPHRD_IEEE802_TR, rather than ARPHRD_IEEE802, as the hardware type for Token Ring interfaces. Map both of them to DLT_IEEE802 (as that has become the DLT_ type for Token Ring, the fact that it just says "802", not "802_5" or whatever, nonwithstanding), and, if ARPHRD_IEEE802_TR isn't defined, define it with the value it has in 2.4 (so that the resulting libpcap will work on a 2.4 system regardless of whether the system on which it was built defined ARPHRD_IEEE802_TR).
2000-12-03 09:07:27 +00:00
#ifndef ARPHRD_IEEE802_TR
#define ARPHRD_IEEE802_TR 800 /* From Linux 2.4 */
#endif
case ARPHRD_IEEE802_TR:
Attempt to put the link-layer payload of packets on a 4-byte boundary, as is done in some other "pcap-XXX.c" modules.
2001-03-20 05:50:33 +00:00
case ARPHRD_IEEE802:
handle->linktype = DLT_IEEE802;
handle->offset = 2;
break;
case ARPHRD_ARCNET:
From Peter Fales <peter@fales-lorenz.net>: support for Linux ARCNET, which supplies different headers from BSD ARCNET, and fixes to the ARCNET code generator (the protocol ID field is 1 byte, so the values for it shouldn't be byte-swapped). Whitespace cleanups. The "NetBSD-style" ARCNET headers are used in other BSDs as well, so just call them "BSD-style".
2003-01-23 07:24:51 +00:00
handle->linktype = DLT_ARCNET_LINUX;
Attempt to put the link-layer payload of packets on a 4-byte boundary, as is done in some other "pcap-XXX.c" modules.
2001-03-20 05:50:33 +00:00
break;
From Jan-Philip Velders <jpv@veldersjes.net>: Linux 2.0[.x] kernels didn't define ARPHRD_HDLC - define it as per Linux 2.1.13, if it's not defined. Do the same with ARPHRD_FDDI, as that's not defined by 2.0, either.
2002-02-03 23:02:07 +00:00
#ifndef ARPHRD_FDDI /* From Linux 2.2.13 */
#define ARPHRD_FDDI 774
#endif
Attempt to put the link-layer payload of packets on a 4-byte boundary, as is done in some other "pcap-XXX.c" modules.
2001-03-20 05:50:33 +00:00
case ARPHRD_FDDI:
handle->linktype = DLT_FDDI;
handle->offset = 3;
break;
Introduce a set of PCAP_ENCAP_ codes to specify packet encapsulations. For those PCAP_ENCAP_ codes corresponding to DLT_ codes that are (believed to be) the same in all BSDs, the PCAP_ENCAP_ codes have the same values as the corresponding DLT_ codes. For those PCAP_ENCAP_ codes corresponding to DLT_ codes that were added in libpcap 0.5 as "non-kernel" DLT_ codes, or had their values changed in libpcap 0.5 in order to cope with the fact that those DLT_ codes have different values in different systems, the PCAP_ENCAP_ codes have the same values as the corresponding DLT_ codes. We add some additional PCAP_ENCAP_ codes to handle IEEE 802.11 (which currently has its link-layer information turned into an Ethernet header by at least some of the BSDs, but John Hawkinson at MIT wants to add a DLT_ value for 802.11 and pass up the full link-layer header) and the Classical IP encapsulation for ATM on Linux (which isn't always the same as DLT_ATM_RFC1483, from what I can tell, alas). "pcap-bpf.c" maps DLT_ codes to PCAP_ENCAP_ codes, so as not to supply to libpcap's callers any DLT_ codes other than the ones that have the same values on all platforms; it supplies PCAP_ENCAP_ codes for all others. In libpcap's "bpf/net/bpf.h", we define the DLT_ values that aren't the same on all platforms with the new values starting at 100 (to keep them out of the way of the values various BSDs might assign to them), as we did in 0.5, but do so only if they're not already defined; platforms with <net/bpf.h> headers that come with the kernel (e.g., the BSDs) should define them with the values that they have always had on that platform, *not* with the values we used in 0.5. (Code using this version of libpcap should check for the new PCAP_ENCAP_ codes; those are given the values that the corresponding DLT_ values had in 0.5, so code that checks for them will handle 0.5 libpcap files correctly even if the platform defines DLT_RAW, say, as something other than 101. If that code also checks for DLT_RAW - which means it can't just use a switch statement, as DLT_RAW might be defined as 101 if the platform doesn't itself define DLT_RAW with some other value - then it will also handle old DLT_RAW captures, as long as they were made on the same platform or on another platform that used the same value for DLT_RAW. It can't handle captures from a platform that uses that value for another DLT_ code, but that's always been the case, and isn't easily fixable.) The intent here is to decouple the values that are returned by "pcap_datalink()" and put into the header of tcpdump/libpcap save files from the DLT_ values returned by BIOCGDLT in BSD kernels, allowing the BSDs to assign values to DLT_ codes, in their kernels, as they choose, without creating more incompatibilities between tcpdump/libpcap save files from different platforms.
2000-09-17 04:04:36 +00:00
#ifndef ARPHRD_ATM /* FIXME: How to #include this? */
#define ARPHRD_ATM 19
#endif
Attempt to put the link-layer payload of packets on a 4-byte boundary, as is done in some other "pcap-XXX.c" modules.
2001-03-20 05:50:33 +00:00
case ARPHRD_ATM:
ARPHRD_ARP doesn't uniquely specify the header that will appear on packets before the network-layer header; we already deal with that in tcpdump, and we could probably try to deal with that in the code generator, but it's less of a pain to just punt to DLT_LINUX_SLL.
2001-09-23 22:43:57 +00:00
/*
* The Classical IP implementation in ATM for Linux
* supports both what RFC 1483 calls "LLC Encapsulation",
* in which each packet has an LLC header, possibly
* with a SNAP header as well, prepended to it, and
* what RFC 1483 calls "VC Based Multiplexing", in which
* different virtual circuits carry different network
* layer protocols, and no header is prepended to packets.
*
* They both have an ARPHRD_ type of ARPHRD_ATM, so
* you can't use the ARPHRD_ type to find out whether
* captured packets will have an LLC header, and,
* while there's a socket ioctl to *set* the encapsulation
* type, there's no ioctl to *get* the encapsulation type.
*
* This means that
*
* programs that dissect Linux Classical IP frames
* would have to check for an LLC header and,
* depending on whether they see one or not, dissect
* the frame as LLC-encapsulated or as raw IP (I
* don't know whether there's any traffic other than
* IP that would show up on the socket, or whether
* there's any support for IPv6 in the Linux
* Classical IP code);
*
* filter expressions would have to compile into
* code that checks for an LLC header and does
* the right thing.
*
* Both of those are a nuisance - and, at least on systems
* that support PF_PACKET sockets, we don't have to put
* up with those nuisances; instead, we can just capture
Have "map_arphrd_to_dlt()" take a flag indicating whether it's OK to return DLT_LINUX_SLL or not, and, if that flag is false, for those interface types where we'd used DLT_LINUX_SLL, pick a DLT_ type that works as well as possible in raw mode, or fail. Pass 1 as that flag if we're using a PF_PACKET socket; pass 0 as that flag if we're using a PF_INET/SOCK_PACKET socket. For PF_INET/SOCK_PACKET sockets, try to get the link-layer type and map it to a DLT_ value *before* turning promiscuous mode on, so that we don't try to put the interface into promiscuous mode unless we know we can handle its link-layer type (and thus that we can use the interface).
2002-02-10 00:05:14 +00:00
* in cooked mode. That's what we'll do, if we can.
* Otherwise, we'll just fail.
ARPHRD_ARP doesn't uniquely specify the header that will appear on packets before the network-layer header; we already deal with that in tcpdump, and we could probably try to deal with that in the code generator, but it's less of a pain to just punt to DLT_LINUX_SLL.
2001-09-23 22:43:57 +00:00
*/
Have "map_arphrd_to_dlt()" take a flag indicating whether it's OK to return DLT_LINUX_SLL or not, and, if that flag is false, for those interface types where we'd used DLT_LINUX_SLL, pick a DLT_ type that works as well as possible in raw mode, or fail. Pass 1 as that flag if we're using a PF_PACKET socket; pass 0 as that flag if we're using a PF_INET/SOCK_PACKET socket. For PF_INET/SOCK_PACKET sockets, try to get the link-layer type and map it to a DLT_ value *before* turning promiscuous mode on, so that we don't try to put the interface into promiscuous mode unless we know we can handle its link-layer type (and thus that we can use the interface).
2002-02-10 00:05:14 +00:00
if (cooked_ok)
handle->linktype = DLT_LINUX_SLL;
else
handle->linktype = -1;
Attempt to put the link-layer payload of packets on a 4-byte boundary, as is done in some other "pcap-XXX.c" modules.
2001-03-20 05:50:33 +00:00
break;
802.11 support, from Javier Achirica <achirica@ttd.net>.
2001-06-10 01:11:39 +00:00
#ifndef ARPHRD_IEEE80211 /* From Linux 2.4.6 */
#define ARPHRD_IEEE80211 801
#endif
case ARPHRD_IEEE80211:
handle->linktype = DLT_IEEE802_11;
break;
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
From Solomon Peachy <pizza@shaftnet.org>: Linux 2.4.18pre4 defines ARPHRD_IEEE80211_PRISM, for sniffing on Prism II-based 802.11 interfaces and getting the special Prism header, so we should map it to DLT_PRISM_HEADER.
2002-02-05 05:47:14 +00:00
#ifndef ARPHRD_IEEE80211_PRISM /* From Linux 2.4.18 */
#define ARPHRD_IEEE80211_PRISM 802
#endif
case ARPHRD_IEEE80211_PRISM:
handle->linktype = DLT_PRISM_HEADER;
break;
From Mike "Dragorn" Kershaw: add support for the new ARPHRD_ value for 802.11 with a radiotap header (used by the madwifi driver, and in the pipeline to be officially assigned).
2005-08-16 04:18:32 +00:00
#ifndef ARPHRD_IEEE80211_RADIOTAP /* new */
#define ARPHRD_IEEE80211_RADIOTAP 803
#endif
case ARPHRD_IEEE80211_RADIOTAP:
handle->linktype = DLT_IEEE802_11_RADIO;
break;
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
case ARPHRD_PPP:
Patch from Marcus Felipe Pereira <marcus@task.com.br> to map ARPHRD_HDLC to DLT_C_HDLC. Arrange that if "map_arphrd_to_dlt()" supplies DLT_LINUX_SLL as the link-layer DLT_ value, we capture in cooked mode. Return DLT_LINUX_SLL for ARPHRD_PPP, as some PPP code in the kernel supplies no link-layer header whatsoever to PF_PACKET sockets, other PPP code supplies PPP link-layer headers ("syncppp.c"), and PPP-over-ISDN appears to supply random link-layer headers (there's code in Ethereal, for example, to cope with PPP-over-ISDN captures with which the Ethereal developers have had to cope, heuristically trying to determine which of the oddball link-layer headers particular packets have).
2001-04-09 05:55:39 +00:00
/*
* Some PPP code in the kernel supplies no link-layer
* header whatsoever to PF_PACKET sockets; other PPP
* code supplies PPP link-layer headers ("syncppp.c");
* some PPP code might supply random link-layer
* headers (PPP over ISDN - there's code in Ethereal,
* for example, to cope with PPP-over-ISDN captures
* with which the Ethereal developers have had to cope,
* heuristically trying to determine which of the
* oddball link-layer headers particular packets have).
*
* As such, we just punt, and run all PPP interfaces
Have "map_arphrd_to_dlt()" take a flag indicating whether it's OK to return DLT_LINUX_SLL or not, and, if that flag is false, for those interface types where we'd used DLT_LINUX_SLL, pick a DLT_ type that works as well as possible in raw mode, or fail. Pass 1 as that flag if we're using a PF_PACKET socket; pass 0 as that flag if we're using a PF_INET/SOCK_PACKET socket. For PF_INET/SOCK_PACKET sockets, try to get the link-layer type and map it to a DLT_ value *before* turning promiscuous mode on, so that we don't try to put the interface into promiscuous mode unless we know we can handle its link-layer type (and thus that we can use the interface).
2002-02-10 00:05:14 +00:00
* in cooked mode, if we can; otherwise, we just treat
* it as DLT_RAW, for now - if somebody needs to capture,
* on a 2.0[.x] kernel, on PPP devices that supply a
* link-layer header, they'll have to add code here to
* map to the appropriate DLT_ type (possibly adding a
* new DLT_ type, if necessary).
Patch from Marcus Felipe Pereira <marcus@task.com.br> to map ARPHRD_HDLC to DLT_C_HDLC. Arrange that if "map_arphrd_to_dlt()" supplies DLT_LINUX_SLL as the link-layer DLT_ value, we capture in cooked mode. Return DLT_LINUX_SLL for ARPHRD_PPP, as some PPP code in the kernel supplies no link-layer header whatsoever to PF_PACKET sockets, other PPP code supplies PPP link-layer headers ("syncppp.c"), and PPP-over-ISDN appears to supply random link-layer headers (there's code in Ethereal, for example, to cope with PPP-over-ISDN captures with which the Ethereal developers have had to cope, heuristically trying to determine which of the oddball link-layer headers particular packets have).
2001-04-09 05:55:39 +00:00
*/
Have "map_arphrd_to_dlt()" take a flag indicating whether it's OK to return DLT_LINUX_SLL or not, and, if that flag is false, for those interface types where we'd used DLT_LINUX_SLL, pick a DLT_ type that works as well as possible in raw mode, or fail. Pass 1 as that flag if we're using a PF_PACKET socket; pass 0 as that flag if we're using a PF_INET/SOCK_PACKET socket. For PF_INET/SOCK_PACKET sockets, try to get the link-layer type and map it to a DLT_ value *before* turning promiscuous mode on, so that we don't try to put the interface into promiscuous mode unless we know we can handle its link-layer type (and thus that we can use the interface).
2002-02-10 00:05:14 +00:00
if (cooked_ok)
handle->linktype = DLT_LINUX_SLL;
else {
/*
* XXX - handle ISDN types here? We can't fall
* back on cooked sockets, so we'd have to
* figure out from the device name what type of
* link-layer encapsulation it's using, and map
* that to an appropriate DLT_ value, meaning
* we'd map "isdnN" devices to DLT_RAW (they
* supply raw IP packets with no link-layer
* header) and "isdY" devices to a new DLT_I4L_IP
* type that has only an Ethernet packet type as
* a link-layer header.
*
* But sometimes we seem to get random crap
* in the link-layer header when capturing on
* ISDN devices....
*/
handle->linktype = DLT_RAW;
}
Patch from Marcus Felipe Pereira <marcus@task.com.br> to map ARPHRD_HDLC to DLT_C_HDLC. Arrange that if "map_arphrd_to_dlt()" supplies DLT_LINUX_SLL as the link-layer DLT_ value, we capture in cooked mode. Return DLT_LINUX_SLL for ARPHRD_PPP, as some PPP code in the kernel supplies no link-layer header whatsoever to PF_PACKET sockets, other PPP code supplies PPP link-layer headers ("syncppp.c"), and PPP-over-ISDN appears to supply random link-layer headers (there's code in Ethereal, for example, to cope with PPP-over-ISDN captures with which the Ethereal developers have had to cope, heuristically trying to determine which of the oddball link-layer headers particular packets have).
2001-04-09 05:55:39 +00:00
break;
From Krzysztof Halasa <khc@pm.waw.pl>: support Linux Frame Relay ARPHRD_FRAD as Frame Relay with an FR header; support Linux Frame Relay ARPHRD_DLCI in cooked mode; current Linux kernels use the name ARPHRD_CISCO for Cisco HDLC (513).
2003-10-06 07:04:55 +00:00
#ifndef ARPHRD_CISCO
#define ARPHRD_CISCO 513 /* previously ARPHRD_HDLC */
From Jan-Philip Velders <jpv@veldersjes.net>: Linux 2.0[.x] kernels didn't define ARPHRD_HDLC - define it as per Linux 2.1.13, if it's not defined. Do the same with ARPHRD_FDDI, as that's not defined by 2.0, either.
2002-02-03 23:02:07 +00:00
#endif
From Krzysztof Halasa <khc@pm.waw.pl>: support Linux Frame Relay ARPHRD_FRAD as Frame Relay with an FR header; support Linux Frame Relay ARPHRD_DLCI in cooked mode; current Linux kernels use the name ARPHRD_CISCO for Cisco HDLC (513).
2003-10-06 07:04:55 +00:00
case ARPHRD_CISCO:
Patch from Marcus Felipe Pereira <marcus@task.com.br> to map ARPHRD_HDLC to DLT_C_HDLC. Arrange that if "map_arphrd_to_dlt()" supplies DLT_LINUX_SLL as the link-layer DLT_ value, we capture in cooked mode. Return DLT_LINUX_SLL for ARPHRD_PPP, as some PPP code in the kernel supplies no link-layer header whatsoever to PF_PACKET sockets, other PPP code supplies PPP link-layer headers ("syncppp.c"), and PPP-over-ISDN appears to supply random link-layer headers (there's code in Ethereal, for example, to cope with PPP-over-ISDN captures with which the Ethereal developers have had to cope, heuristically trying to determine which of the oddball link-layer headers particular packets have).
2001-04-09 05:55:39 +00:00
handle->linktype = DLT_C_HDLC;
break;
Patch from Olaf Kirch to add support for ARPHRD_TUNNEL (or at least for some tunnels).
2000-12-22 11:53:27 +00:00
/* Not sure if this is correct for all tunnels, but it
* works for CIPE */
case ARPHRD_TUNNEL:
Some platforms that lack <netpacket/packet.h> define PF_PACKET but don't support PF_PACKET sockets, and, in particular, don't define in <linux/if_packet.h> any of the stuff needed by the code to handle PF_PACKET sockets. Define HAVE_PF_PACKET_SOCKETS if either 1) we have <netpacket/packet.h> or 2) PF_PACKET is defined *and* PACKET_HOST is defined by <linux/if_packet.h> and use HAVE_PF_PACKET_SOCKETS, not PF_PACKET, be what we use in #ifdefs to conditionally compile in support for PF_PACKET sockets. Not all platforms define ARPHRD_SIT, either; #define it if it's not already defined.
2001-01-18 03:58:22 +00:00
#ifndef ARPHRD_SIT
From Jan-Philip Velders <jpv@veldersjes.net>: Linux 2.0[.x] kernels didn't define ARPHRD_HDLC - define it as per Linux 2.1.13, if it's not defined. Do the same with ARPHRD_FDDI, as that's not defined by 2.0, either.
2002-02-03 23:02:07 +00:00
#define ARPHRD_SIT 776 /* From Linux 2.2.13 */
Some platforms that lack <netpacket/packet.h> define PF_PACKET but don't support PF_PACKET sockets, and, in particular, don't define in <linux/if_packet.h> any of the stuff needed by the code to handle PF_PACKET sockets. Define HAVE_PF_PACKET_SOCKETS if either 1) we have <netpacket/packet.h> or 2) PF_PACKET is defined *and* PACKET_HOST is defined by <linux/if_packet.h> and use HAVE_PF_PACKET_SOCKETS, not PF_PACKET, be what we use in #ifdefs to conditionally compile in support for PF_PACKET sockets. Not all platforms define ARPHRD_SIT, either; #define it if it's not already defined.
2001-01-18 03:58:22 +00:00
#endif
Patch from Olaf Kirch to add support for ARPHRD_TUNNEL (or at least for some tunnels).
2000-12-22 11:53:27 +00:00
case ARPHRD_SIT:
Initial revision
1999-10-07 23:46:40 +00:00
case ARPHRD_CSLIP:
case ARPHRD_SLIP6:
case ARPHRD_CSLIP6:
Patch from Igor Khristophorov <igor@atdot.org> to handle adaptive SLIP interfaces on Linux just like standard SLIP interfaces.
2001-01-20 07:47:53 +00:00
case ARPHRD_ADAPT:
Attempt to put the link-layer payload of packets on a 4-byte boundary, as is done in some other "pcap-XXX.c" modules.
2001-03-20 05:50:33 +00:00
case ARPHRD_SLIP:
Support for ARPHRD_RAWHDLC, as used by, for example, the Cyclades PC300 synchronous board in Raw HDLC mode, from Octavian Cerna <tavy@ylabs.com>.
2002-03-07 11:27:57 +00:00
#ifndef ARPHRD_RAWHDLC
#define ARPHRD_RAWHDLC 518
#endif
case ARPHRD_RAWHDLC:
From Krzysztof Halasa <khc@pm.waw.pl>: support Linux Frame Relay ARPHRD_FRAD as Frame Relay with an FR header; support Linux Frame Relay ARPHRD_DLCI in cooked mode; current Linux kernels use the name ARPHRD_CISCO for Cisco HDLC (513).
2003-10-06 07:04:55 +00:00
#ifndef ARPHRD_DLCI
#define ARPHRD_DLCI 15
#endif
case ARPHRD_DLCI:
Patch from Marcus Felipe Pereira <marcus@task.com.br> to map ARPHRD_HDLC to DLT_C_HDLC. Arrange that if "map_arphrd_to_dlt()" supplies DLT_LINUX_SLL as the link-layer DLT_ value, we capture in cooked mode. Return DLT_LINUX_SLL for ARPHRD_PPP, as some PPP code in the kernel supplies no link-layer header whatsoever to PF_PACKET sockets, other PPP code supplies PPP link-layer headers ("syncppp.c"), and PPP-over-ISDN appears to supply random link-layer headers (there's code in Ethereal, for example, to cope with PPP-over-ISDN captures with which the Ethereal developers have had to cope, heuristically trying to determine which of the oddball link-layer headers particular packets have).
2001-04-09 05:55:39 +00:00
/*
* XXX - should some of those be mapped to DLT_LINUX_SLL
* instead? Should we just map all of them to DLT_LINUX_SLL?
*/
Attempt to put the link-layer payload of packets on a 4-byte boundary, as is done in some other "pcap-XXX.c" modules.
2001-03-20 05:50:33 +00:00
handle->linktype = DLT_RAW;
break;
Initial revision
1999-10-07 23:46:40 +00:00
From Krzysztof Halasa <khc@pm.waw.pl>: support Linux Frame Relay ARPHRD_FRAD as Frame Relay with an FR header; support Linux Frame Relay ARPHRD_DLCI in cooked mode; current Linux kernels use the name ARPHRD_CISCO for Cisco HDLC (513).
2003-10-06 07:04:55 +00:00
#ifndef ARPHRD_FRAD
#define ARPHRD_FRAD 770
#endif
case ARPHRD_FRAD:
handle->linktype = DLT_FRELAY;
break;
Support for LocalTalk hardware, from Uns Lider <unslider@miranda.org>.
2001-06-18 08:46:28 +00:00
case ARPHRD_LOCALTLK:
handle->linktype = DLT_LTALK;
break;
Add support for RFC 2625 IP-over-Fibre Channel, mapping all the Linux ARPHRD_FC* types to it.
2002-10-18 08:46:13 +00:00
#ifndef ARPHRD_FCPP
#define ARPHRD_FCPP 784
#endif
case ARPHRD_FCPP:
#ifndef ARPHRD_FCAL
#define ARPHRD_FCAL 785
#endif
case ARPHRD_FCAL:
#ifndef ARPHRD_FCPL
#define ARPHRD_FCPL 786
#endif
case ARPHRD_FCPL:
#ifndef ARPHRD_FCFABRIC
#define ARPHRD_FCFABRIC 787
#endif
case ARPHRD_FCFABRIC:
/*
* We assume that those all mean RFC 2625 IP-over-
* Fibre Channel, with the RFC 2625 header at
* the beginning of the packet.
*/
handle->linktype = DLT_IP_OVER_FC;
break;
Not all Linuxes define ARPHRD_IRDA; define it if it's not defined.
2004-09-06 01:23:17 +00:00
#ifndef ARPHRD_IRDA
#define ARPHRD_IRDA 783
#endif
From Jean Tourrilhes <jean2@sourceforge.net>: IrDA capture support for Linux.
2003-11-18 21:06:50 +00:00
case ARPHRD_IRDA:
/* Don't expect IP packet out of this interfaces... */
handle->linktype = DLT_LINUX_IRDA;
/* We need to save packet direction for IrDA decoding,
* so let's use "Linux-cooked" mode. Jean II */
//handle->md.cooked = 1;
break;
From Daniele Orlandi <daniele@orlandi.com>: add support for capturing LAPD frames with vISDN.
2006-01-22 20:11:26 +00:00
/* ARPHRD_LAPD is unofficial and randomly allocated, if reallocation
* is needed, please report it to <daniele@orlandi.com> */
#ifndef ARPHRD_LAPD
#define ARPHRD_LAPD 8445
#endif
case ARPHRD_LAPD:
/* Don't expect IP packet out of this interfaces... */
handle->linktype = DLT_LINUX_LAPD;
break;
Handle ARPHRD_NONE, used by some tunnel devices, by mapping to DLT_RAW, as it has a zero-length link-layer header.
2008-06-24 06:44:32 +00:00
#ifndef ARPHRD_NONE
#define ARPHRD_NONE 0xFFFE
#endif
case ARPHRD_NONE:
/*
* No link-layer header; packets are just IP
* packets, so use DLT_RAW.
*/
handle->linktype = DLT_RAW;
break;
Fix previous checkin.
2010-08-06 21:58:16 +00:00
#ifndef ARPHRD_IEEE802154
#define ARPHRD_IEEE802154 804
#endif
case ARPHRD_IEEE802154:
handle->linktype = DLT_IEEE802_15_4_NOFCS;
break;
Attempt to put the link-layer payload of packets on a 4-byte boundary, as is done in some other "pcap-XXX.c" modules.
2001-03-20 05:50:33 +00:00
default:
We weren't returning a warning if the interface had an ARPHRD_ type we didn't handle; fix the code to do so. Remove the word "Warning" from the warning - tcpdump will add it when it prints the warning, as will Ethereal and Tethereal.
2001-10-25 08:27:18 +00:00
handle->linktype = -1;
break;
Attempt to put the link-layer payload of packets on a 4-byte boundary, as is done in some other "pcap-XXX.c" modules.
2001-03-20 05:50:33 +00:00
}
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
}
/* ===== Functions to interface to the newer kernels ================== */
/*
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
* Try to open a packet socket using the new kernel PF_PACKET interface.
* Returns 1 on success, 0 on an error that means the new interface isn't
* present (so the old SOCK_PACKET interface should be tried), and a
* PCAP_ERROR_ value on an error that means that the old mechanism won't
* work either (so it shouldn't be tried).
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
*/
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
static int
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
activate_new(pcap_t *handle)
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
{
Some platforms that lack <netpacket/packet.h> define PF_PACKET but don't support PF_PACKET sockets, and, in particular, don't define in <linux/if_packet.h> any of the stuff needed by the code to handle PF_PACKET sockets. Define HAVE_PF_PACKET_SOCKETS if either 1) we have <netpacket/packet.h> or 2) PF_PACKET is defined *and* PACKET_HOST is defined by <linux/if_packet.h> and use HAVE_PF_PACKET_SOCKETS, not PF_PACKET, be what we use in #ifdefs to conditionally compile in support for PF_PACKET sockets. Not all platforms define ARPHRD_SIT, either; #define it if it's not already defined.
2001-01-18 03:58:22 +00:00
#ifdef HAVE_PF_PACKET_SOCKETS
Fix the handling of the "any" device, including making it reject attempts to open it in monitor mode.
2008-11-19 08:20:39 +00:00
const char *device = handle->opt.source;
int is_any_device = (strcmp(device, "any") == 0);
If HAVE_PACKET_AUXDATA isn't defined, don't declare a variable that's used only if HAVE_PACKET_AUXDATA is defined.
2009-07-02 19:31:02 +00:00
int sock_fd = -1, arptype;
#ifdef HAVE_PACKET_AUXDATA
int val;
#endif
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
int err = 0;
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
struct packet_mreq mr;
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
/*
Fix the handling of the "any" device, including making it reject attempts to open it in monitor mode.
2008-11-19 08:20:39 +00:00
* Open a socket with protocol family packet. If the
* "any" device was specified, we open a SOCK_DGRAM
* socket for the cooked interface, otherwise we first
* try a SOCK_RAW socket for the raw interface.
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
*/
Fix the handling of the "any" device, including making it reject attempts to open it in monitor mode.
2008-11-19 08:20:39 +00:00
sock_fd = is_any_device ?
socket(PF_PACKET, SOCK_DGRAM, htons(ETH_P_ALL)) :
socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
if (sock_fd == -1) {
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "socket: %s",
pcap_strerror(errno) );
return 0; /* try old mechanism */
}
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
/* It seems the kernel supports the new interface. */
handle->md.sock_packet = 0;
If we're receiving packets from a PF_PACKET socket, check whether the interface index of the interface for the packet is the interface index of the loopback interface and, if it is, check if the packet is an outgoing packet; if so, ignore it, as we'll also be seeing that packet as a received packet. If we don't handle the arphrd type of an interface, and fall back on cooked mode, report the arphrd type, so we know what type we should consider supporting (if that type can't be supported well, e.g. if you don't get any link-layer header, as happens with PPP, we'd be silent).
2000-10-25 07:46:49 +00:00
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
/*
* Get the interface index of the loopback device.
* If the attempt fails, don't fail, just set the
* "md.lo_ifindex" to -1.
*
* XXX - can there be more than one device that loops
* packets back, i.e. devices other than "lo"? If so,
* we'd need to find them all, and have an array of
* indices for them, and check all of them in
* "pcap_read_packet()".
*/
handle->md.lo_ifindex = iface_get_id(sock_fd, "lo", handle->errbuf);
Attempt to put the link-layer payload of packets on a 4-byte boundary, as is done in some other "pcap-XXX.c" modules.
2001-03-20 05:50:33 +00:00
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
/*
* Default value for offset to align link-layer payload
* on a 4-byte boundary.
*/
handle->offset = 0;
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
/*
* What kind of frames do we have to deal with? Fall back
* to cooked mode if we have an unknown interface type
* or a type we know doesn't work well in raw mode.
*/
Fix the handling of the "any" device, including making it reject attempts to open it in monitor mode.
2008-11-19 08:20:39 +00:00
if (!is_any_device) {
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
/* Assume for now we don't need cooked mode. */
handle->md.cooked = 0;
Add support for a new link layer type DLT_LINUX_SLL, for use when doing live captures with a "cooked" (SOCK_DGRAM) rather than a "raw" (SOCK_RAW) PF_PACKET socket; it includes a bunch of the fields from the "struct sockaddr_ll" you get in a "recvfrom()", including the Ethernet protocol field. This requires us to rewrite the BPF program if we're stuffing it into the kernel; as long as we're doing *ex post facto* rewriting, we might as well also do the "ret <snaplen>" -> "ret 65535" fixup there as well, rather than in the code generator.
2000-12-21 10:29:21 +00:00
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
if (handle->opt.rfmon) {
/*
* We were asked to turn on monitor mode.
* Do so before we get the link-layer type,
* because entering monitor mode could change
* the link-layer type.
*/
To put mac80211 devices in monitor mode, create a "monN" device for the underlying adapter, bring it up, and capture on that. This means libpcap nees to be linked with -lnl.
2009-05-22 12:50:15 +00:00
err = enter_rfmon_mode(handle, sock_fd, device);
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
if (err < 0) {
/* Hard failure */
close(sock_fd);
return err;
Bug fixes from Graeme Hewson <ghewson@cix.compulink.co.uk>: 1. During termination processing set up by atexit() under a 2.0.x kernel, if a socket had been previously closed and the handle freed due to an error, pcap_close_all() and pcap_close_linux() would nevertheless try to work with these structures and then crash. pcap_close_linux() is now called directly when necessary during error processing. 2. atexit() could get called more than once because the did_atexit flag wasn't being set. 3. If iface_get_arptype() returns an error because the ioctl() call failed (probably due to "no such device"), live_open_new() now returns a fatal error to pcap_open_live() and the call to live_open_old() is short-circuited. 4. Applications using libpcap would appear to listen on an interface that was down. a. iface_bind() and iface_bind_old() now check for pending errors after bind(). In turn, pcap_open_live() now returns an error status if there was a pending error after bind(). b. After draining the socket, set_kernel_filter() now checks to see if the error was the expected EAGAIN and returns a fatal error to pcap_setfilter() if not. In turn, pcap_setfilter() now returns an error status if there was a network error. 5. pcap_setfilter() was putting an error message into errbuf after a failed call to install_bpf_program(). This was unnecessary since install_bpf_program() puts its own error message into errbuf.
2002-02-22 09:20:11 +00:00
}
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
if (err == 0) {
For devices that we have some reason to believe are real live Ethernet devices, offer DLT_DOCSIS as one of the choices of link-layer type, and support setting that type as meaning just "set libpcap's notion of the link-layer type to DLT_DOCSIS" without telling the driver to use DLT_DOCSIS.
2003-12-18 23:32:31 +00:00
/*
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
* Nothing worked for turning monitor mode
* on.
For devices that we have some reason to believe are real live Ethernet devices, offer DLT_DOCSIS as one of the choices of link-layer type, and support setting that type as meaning just "set libpcap's notion of the link-layer type to DLT_DOCSIS" without telling the driver to use DLT_DOCSIS.
2003-12-18 23:32:31 +00:00
*/
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
close(sock_fd);
return PCAP_ERROR_RFMON_NOTSUP;
Bug fixes from Graeme Hewson <ghewson@cix.compulink.co.uk>: 1. During termination processing set up by atexit() under a 2.0.x kernel, if a socket had been previously closed and the handle freed due to an error, pcap_close_all() and pcap_close_linux() would nevertheless try to work with these structures and then crash. pcap_close_linux() is now called directly when necessary during error processing. 2. atexit() could get called more than once because the did_atexit flag wasn't being set. 3. If iface_get_arptype() returns an error because the ioctl() call failed (probably due to "no such device"), live_open_new() now returns a fatal error to pcap_open_live() and the call to live_open_old() is short-circuited. 4. Applications using libpcap would appear to listen on an interface that was down. a. iface_bind() and iface_bind_old() now check for pending errors after bind(). In turn, pcap_open_live() now returns an error status if there was a pending error after bind(). b. After draining the socket, set_kernel_filter() now checks to see if the error was the expected EAGAIN and returns a fatal error to pcap_setfilter() if not. In turn, pcap_setfilter() now returns an error status if there was a network error. 5. pcap_setfilter() was putting an error message into errbuf after a failed call to install_bpf_program(). This was unnecessary since install_bpf_program() puts its own error message into errbuf.
2002-02-22 09:20:11 +00:00
}
To put mac80211 devices in monitor mode, create a "monN" device for the underlying adapter, bring it up, and capture on that. This means libpcap nees to be linked with -lnl.
2009-05-22 12:50:15 +00:00
/*
* Either monitor mode has been turned on for
* the device, or we've been given a different
* device to open for monitor mode. If we've
* been given a different device, use it.
*/
if (handle->md.mondevice != NULL)
device = handle->md.mondevice;
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
}
arptype = iface_get_arptype(sock_fd, device, handle->errbuf);
if (arptype < 0) {
close(sock_fd);
return arptype;
}
map_arphrd_to_dlt(handle, arptype, 1);
if (handle->linktype == -1 ||
handle->linktype == DLT_LINUX_SLL ||
handle->linktype == DLT_LINUX_IRDA ||
handle->linktype == DLT_LINUX_LAPD ||
(handle->linktype == DLT_EN10MB &&
(strncmp("isdn", device, 4) == 0 ||
strncmp("isdY", device, 4) == 0))) {
Add support for a new link layer type DLT_LINUX_SLL, for use when doing live captures with a "cooked" (SOCK_DGRAM) rather than a "raw" (SOCK_RAW) PF_PACKET socket; it includes a bunch of the fields from the "struct sockaddr_ll" you get in a "recvfrom()", including the Ethernet protocol field. This requires us to rewrite the BPF program if we're stuffing it into the kernel; as long as we're doing *ex post facto* rewriting, we might as well also do the "ret <snaplen>" -> "ret 65535" fixup there as well, rather than in the code generator.
2000-12-21 10:29:21 +00:00
/*
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
* Unknown interface type (-1), or a
* device we explicitly chose to run
* in cooked mode (e.g., PPP devices),
* or an ISDN device (whose link-layer
* type we can only determine by using
* APIs that may be different on different
* kernels) - reopen in cooked mode.
Add support for a new link layer type DLT_LINUX_SLL, for use when doing live captures with a "cooked" (SOCK_DGRAM) rather than a "raw" (SOCK_RAW) PF_PACKET socket; it includes a bunch of the fields from the "struct sockaddr_ll" you get in a "recvfrom()", including the Ethernet protocol field. This requires us to rewrite the BPF program if we're stuffing it into the kernel; as long as we're doing *ex post facto* rewriting, we might as well also do the "ret <snaplen>" -> "ret 65535" fixup there as well, rather than in the code generator.
2000-12-21 10:29:21 +00:00
*/
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
if (close(sock_fd) == -1) {
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
"close: %s", pcap_strerror(errno));
return PCAP_ERROR;
}
sock_fd = socket(PF_PACKET, SOCK_DGRAM,
htons(ETH_P_ALL));
if (sock_fd == -1) {
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
"socket: %s", pcap_strerror(errno));
return PCAP_ERROR;
}
Add support for a new link layer type DLT_LINUX_SLL, for use when doing live captures with a "cooked" (SOCK_DGRAM) rather than a "raw" (SOCK_RAW) PF_PACKET socket; it includes a bunch of the fields from the "struct sockaddr_ll" you get in a "recvfrom()", including the Ethernet protocol field. This requires us to rewrite the BPF program if we're stuffing it into the kernel; as long as we're doing *ex post facto* rewriting, we might as well also do the "ret <snaplen>" -> "ret 65535" fixup there as well, rather than in the code generator.
2000-12-21 10:29:21 +00:00
handle->md.cooked = 1;
If we're receiving packets from a PF_PACKET socket, check whether the interface index of the interface for the packet is the interface index of the loopback interface and, if it is, check if the packet is an outgoing packet; if so, ignore it, as we'll also be seeing that packet as a received packet. If we don't handle the arphrd type of an interface, and fall back on cooked mode, report the arphrd type, so we know what type we should consider supporting (if that type can't be supported well, e.g. if you don't get any link-layer header, as happens with PPP, we'd be silent).
2000-10-25 07:46:49 +00:00
/*
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
* Get rid of any link-layer type list
* we allocated - this only supports cooked
* capture.
*/
if (handle->dlt_list != NULL) {
free(handle->dlt_list);
handle->dlt_list = NULL;
handle->dlt_count = 0;
}
if (handle->linktype == -1) {
/*
* Warn that we're falling back on
* cooked mode; we may want to
* update "map_arphrd_to_dlt()"
* to handle the new type.
*/
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
"arptype %d not "
"supported by libpcap - "
"falling back to cooked "
"socket",
arptype);
}
/*
* IrDA capture is not a real "cooked" capture,
* it's IrLAP frames, not IP packets. The
* same applies to LAPD capture.
If we're receiving packets from a PF_PACKET socket, check whether the interface index of the interface for the packet is the interface index of the loopback interface and, if it is, check if the packet is an outgoing packet; if so, ignore it, as we'll also be seeing that packet as a received packet. If we don't handle the arphrd type of an interface, and fall back on cooked mode, report the arphrd type, so we know what type we should consider supporting (if that type can't be supported well, e.g. if you don't get any link-layer header, as happens with PPP, we'd be silent).
2000-10-25 07:46:49 +00:00
*/
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
if (handle->linktype != DLT_LINUX_IRDA &&
handle->linktype != DLT_LINUX_LAPD)
handle->linktype = DLT_LINUX_SLL;
Added support for an "any" device based on a patch from Sebastian Krahmer.
2000-09-20 15:10:28 +00:00
}
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
handle->md.ifindex = iface_get_id(sock_fd, device,
handle->errbuf);
if (handle->md.ifindex == -1) {
close(sock_fd);
return PCAP_ERROR;
}
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
if ((err = iface_bind(sock_fd, handle->md.ifindex,
When activating a device, return PCAP_ERROR_IFACE_NOT_UP if the device isn't up, so applications can report that differently from a generic error (the latter could mean there's a bug somewhere in libpcap). When capturing on a device without mmap on Linux, ignore ENETDOWN, so that we can continue to capture traffic if the interface goes down and comes back up again; comments in the kernel indicate that we'll just block waiting for packets if we try to receive from a socket that delivered ENETDOWN, and, if we're using a memory-mapped buffer, we won't even get notified of "network down" events.
2008-07-01 08:02:33 +00:00
handle->errbuf)) != 1) {
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
close(sock_fd);
When activating a device, return PCAP_ERROR_IFACE_NOT_UP if the device isn't up, so applications can report that differently from a generic error (the latter could mean there's a bug somewhere in libpcap). When capturing on a device without mmap on Linux, ignore ENETDOWN, so that we can continue to capture traffic if the interface goes down and comes back up again; comments in the kernel indicate that we'll just block waiting for packets if we try to receive from a socket that delivered ENETDOWN, and, if we're using a memory-mapped buffer, we won't even get notified of "network down" events.
2008-07-01 08:02:33 +00:00
if (err < 0)
return err;
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
else
return 0; /* try old mechanism */
}
} else {
whitespace cleanup
2002-06-11 17:04:44 +00:00
/*
Fix the handling of the "any" device, including making it reject attempts to open it in monitor mode.
2008-11-19 08:20:39 +00:00
* The "any" device.
*/
if (handle->opt.rfmon) {
/*
* It doesn't support monitor mode.
*/
return PCAP_ERROR_RFMON_NOTSUP;
}
/*
* It uses cooked mode.
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
*/
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
handle->md.cooked = 1;
handle->linktype = DLT_LINUX_SLL;
The Linux "pcap_setfilter()" makes a copy of the filter it's handed, and installs that copy; when closing a pcap_t on Linux, free that copy.
2000-10-25 06:59:09 +00:00
map_packet_type_to_sll_type() isn't used - and won't compile - if you don't have PF_PACKET support; #ifdef it out. Move the code to compute the buffer size into live_open_new() and live_open_old(), as it's dependent on the mechanism being used; there's little code shared between the two variants.
2008-01-24 20:20:08 +00:00
/*
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
* We're not bound to a device.
* For now, we're using this as an indication
* that we can't transmit; stop doing that only
* if we figure out how to transmit in cooked
* mode.
map_packet_type_to_sll_type() isn't used - and won't compile - if you don't have PF_PACKET support; #ifdef it out. Move the code to compute the buffer size into live_open_new() and live_open_old(), as it's dependent on the mechanism being used; there's little code shared between the two variants.
2008-01-24 20:20:08 +00:00
*/
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
handle->md.ifindex = -1;
}
map_packet_type_to_sll_type() isn't used - and won't compile - if you don't have PF_PACKET support; #ifdef it out. Move the code to compute the buffer size into live_open_new() and live_open_old(), as it's dependent on the mechanism being used; there's little code shared between the two variants.
2008-01-24 20:20:08 +00:00
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
/*
* Select promiscuous mode on if "promisc" is set.
*
* Do not turn allmulti mode on if we don't select
* promiscuous mode - on some devices (e.g., Orinoco
* wireless interfaces), allmulti mode isn't supported
* and the driver implements it by turning promiscuous
* mode on, and that screws up the operation of the
* card as a normal networking interface, and on no
* other platform I know of does starting a non-
* promiscuous capture affect which multicast packets
* are received by the interface.
*/
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
/*
* Hmm, how can we set promiscuous mode on all interfaces?
Fix the handling of the "any" device, including making it reject attempts to open it in monitor mode.
2008-11-19 08:20:39 +00:00
* I am not sure if that is possible at all. For now, we
* silently ignore attempts to turn promiscuous mode on
* for the "any" device (so you don't have to explicitly
* disable it in programs such as tcpdump).
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
*/
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
Fix the handling of the "any" device, including making it reject attempts to open it in monitor mode.
2008-11-19 08:20:39 +00:00
if (!is_any_device && handle->opt.promisc) {
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
memset(&mr, 0, sizeof(mr));
mr.mr_ifindex = handle->md.ifindex;
mr.mr_type = PACKET_MR_PROMISC;
if (setsockopt(sock_fd, SOL_PACKET, PACKET_ADD_MEMBERSHIP,
&mr, sizeof(mr)) == -1) {
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
"setsockopt: %s", pcap_strerror(errno));
close(sock_fd);
return PCAP_ERROR;
}
}
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
From Patrick McHardy: VLAN packets sent over devices supporting VLAN tagging/stripping in hardware don't have a VLAN header when they are received on packet sockets. The VLAN TCI is available through the PACKET_AUXDATA cmsg, reconstruct the entire header when necessary.
2008-08-06 07:45:00 +00:00
/* Enable auxillary data if supported and reserve room for
* reconstructing VLAN headers. */
#ifdef HAVE_PACKET_AUXDATA
val = 1;
if (setsockopt(sock_fd, SOL_PACKET, PACKET_AUXDATA, &val,
sizeof(val)) == -1 && errno != ENOPROTOOPT) {
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
"setsockopt: %s", pcap_strerror(errno));
close(sock_fd);
return PCAP_ERROR;
}
handle->offset += VLAN_TAG_LEN;
#endif /* HAVE_PACKET_AUXDATA */
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
/*
* This is a 2.2[.x] or later kernel (we know that
* because we're not using a SOCK_PACKET socket -
* PF_PACKET is supported only in 2.2 and later
* kernels).
*
* We can safely pass "recvfrom()" a byte count
* based on the snapshot length.
*
* If we're in cooked mode, make the snapshot length
* large enough to hold a "cooked mode" header plus
* 1 byte of packet data (so we don't pass a byte
* count of 0 to "recvfrom()").
*/
if (handle->md.cooked) {
if (handle->snapshot < SLL_HDR_LEN + 1)
handle->snapshot = SLL_HDR_LEN + 1;
}
handle->bufsize = handle->snapshot;
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
/* Save the socket FD in the pcap structure */
For Linux non-mmapped captures, Linux bluetooth captures, and Irix captures, set the socket buffer size to the value specified by pcap_set_buffer_size() if a value was set. Clean up if memory buffer allocation fails on Linux.
2008-04-07 03:57:32 +00:00
handle->fd = sock_fd;
Bug fixes from Graeme Hewson <ghewson@cix.compulink.co.uk>: 1. During termination processing set up by atexit() under a 2.0.x kernel, if a socket had been previously closed and the handle freed due to an error, pcap_close_all() and pcap_close_linux() would nevertheless try to work with these structures and then crash. pcap_close_linux() is now called directly when necessary during error processing. 2. atexit() could get called more than once because the did_atexit flag wasn't being set. 3. If iface_get_arptype() returns an error because the ioctl() call failed (probably due to "no such device"), live_open_new() now returns a fatal error to pcap_open_live() and the call to live_open_old() is short-circuited. 4. Applications using libpcap would appear to listen on an interface that was down. a. iface_bind() and iface_bind_old() now check for pending errors after bind(). In turn, pcap_open_live() now returns an error status if there was a pending error after bind(). b. After draining the socket, set_kernel_filter() now checks to see if the error was the expected EAGAIN and returns a fatal error to pcap_setfilter() if not. In turn, pcap_setfilter() now returns an error status if there was a network error. 5. pcap_setfilter() was putting an error message into errbuf after a failed call to install_bpf_program(). This was unnecessary since install_bpf_program() puts its own error message into errbuf.
2002-02-22 09:20:11 +00:00
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
return 1;
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
#else
whitespace cleanup
2002-06-11 17:04:44 +00:00
strncpy(ebuf,
"New packet capturing interface not supported by build "
use snprintf instead of sprintf. From Juergen Schoenwaelder <schoenw@ibr.cs.tu-bs.de>
2000-07-04 12:24:01 +00:00
"environment", PCAP_ERRBUF_SIZE);
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
return 0;
Initial revision
1999-10-07 23:46:40 +00:00
#endif
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
}
If the specified time stamp type isn't supported, treat that as a warning.
2010-08-23 02:09:50 +00:00
#ifdef HAVE_PACKET_RING
/*
* Attempt to activate with memory-mapped access.
*
* On success, returns 1, and sets *status to 0 if there are no warnings
* or to a PCAP_WARNING_ code if there is a warning.
*
* On failure due to lack of support for memory-mapped capture, returns
* 0.
*
* On error, returns -1, and sets *status to the appropriate error code;
* if that is PCAP_ERROR, sets handle->errbuf to the appropriate message.
*/
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
static int
If the specified time stamp type isn't supported, treat that as a warning.
2010-08-23 02:09:50 +00:00
activate_mmap(pcap_t *handle, int *status)
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
{
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
int ret;
When doing Linux mmapped capture: Allocate a buffer into which to copy a packet, and have the callback for pcap_next() and pcap_next_ex() copy to that buffer and return a pointer to that buffer; we can't return the packet data pointer passed to the callback, as, once the callback returns, that buffer can be overwritten, even before you read the next packet. Don't tweak filter programs passed into the kernel to return 65535 on success - we don't have to, as we're not reading packets with recvfrom(), and we don't want to, as, if we return the actual snapshot length, the kernel will copy less data to the ring buffer. Truncate the packet snapshot length to the specified length, as we might not have a filter to do that.
2009-07-16 22:08:12 +00:00
/*
* Attempt to allocate a buffer to hold the contents of one
* packet, for use by the oneshot callback.
*/
handle->md.oneshot_buffer = malloc(handle->snapshot);
if (handle->md.oneshot_buffer == NULL) {
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
"can't allocate oneshot buffer: %s",
pcap_strerror(errno));
If the specified time stamp type isn't supported, treat that as a warning.
2010-08-23 02:09:50 +00:00
*status = PCAP_ERROR;
return -1;
When doing Linux mmapped capture: Allocate a buffer into which to copy a packet, and have the callback for pcap_next() and pcap_next_ex() copy to that buffer and return a pointer to that buffer; we can't return the packet data pointer passed to the callback, as, once the callback returns, that buffer can be overwritten, even before you read the next packet. Don't tweak filter programs passed into the kernel to return 65535 on success - we don't have to, as we're not reading packets with recvfrom(), and we don't want to, as, if we return the actual snapshot length, the kernel will copy less data to the ring buffer. Truncate the packet snapshot length to the specified length, as we might not have a filter to do that.
2009-07-16 22:08:12 +00:00
}
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
if (handle->opt.buffer_size == 0) {
/* by default request 2M for the ring buffer */
handle->opt.buffer_size = 2*1024*1024;
}
From Patrick McHardy: The tpacket_hdr is not clean for 64 bit kernel/32 bit userspace and is not extendable because the struct sockaddr_ll following it is expected at a fixed offset. Linux 2.6.27-rc supports a new tpacket frame header that removes these two limitations. Convert the mmap ring support to support both formats and probe for availability of the new version.
2008-08-06 07:49:19 +00:00
ret = prepare_tpacket_socket(handle);
If the specified time stamp type isn't supported, treat that as a warning.
2010-08-23 02:09:50 +00:00
if (ret == -1) {
When doing Linux mmapped capture: Allocate a buffer into which to copy a packet, and have the callback for pcap_next() and pcap_next_ex() copy to that buffer and return a pointer to that buffer; we can't return the packet data pointer passed to the callback, as, once the callback returns, that buffer can be overwritten, even before you read the next packet. Don't tweak filter programs passed into the kernel to return 65535 on success - we don't have to, as we're not reading packets with recvfrom(), and we don't want to, as, if we return the actual snapshot length, the kernel will copy less data to the ring buffer. Truncate the packet snapshot length to the specified length, as we might not have a filter to do that.
2009-07-16 22:08:12 +00:00
free(handle->md.oneshot_buffer);
If the specified time stamp type isn't supported, treat that as a warning.
2010-08-23 02:09:50 +00:00
*status = PCAP_ERROR;
From Patrick McHardy: The tpacket_hdr is not clean for 64 bit kernel/32 bit userspace and is not extendable because the struct sockaddr_ll following it is expected at a fixed offset. Linux 2.6.27-rc supports a new tpacket frame header that removes these two limitations. Convert the mmap ring support to support both formats and probe for availability of the new version.
2008-08-06 07:49:19 +00:00
return ret;
When doing Linux mmapped capture: Allocate a buffer into which to copy a packet, and have the callback for pcap_next() and pcap_next_ex() copy to that buffer and return a pointer to that buffer; we can't return the packet data pointer passed to the callback, as, once the callback returns, that buffer can be overwritten, even before you read the next packet. Don't tweak filter programs passed into the kernel to return 65535 on success - we don't have to, as we're not reading packets with recvfrom(), and we don't want to, as, if we return the actual snapshot length, the kernel will copy less data to the ring buffer. Truncate the packet snapshot length to the specified length, as we might not have a filter to do that.
2009-07-16 22:08:12 +00:00
}
If the specified time stamp type isn't supported, treat that as a warning.
2010-08-23 02:09:50 +00:00
ret = create_ring(handle, status);
if (ret == 0) {
/*
* We don't support memory-mapped capture; our caller
* will fall back on reading from the socket.
*/
When doing Linux mmapped capture: Allocate a buffer into which to copy a packet, and have the callback for pcap_next() and pcap_next_ex() copy to that buffer and return a pointer to that buffer; we can't return the packet data pointer passed to the callback, as, once the callback returns, that buffer can be overwritten, even before you read the next packet. Don't tweak filter programs passed into the kernel to return 65535 on success - we don't have to, as we're not reading packets with recvfrom(), and we don't want to, as, if we return the actual snapshot length, the kernel will copy less data to the ring buffer. Truncate the packet snapshot length to the specified length, as we might not have a filter to do that.
2009-07-16 22:08:12 +00:00
free(handle->md.oneshot_buffer);
If the specified time stamp type isn't supported, treat that as a warning.
2010-08-23 02:09:50 +00:00
return 0;
}
if (ret == -1) {
/*
* Error attempting to enable memory-mapped capture;
* fail. create_ring() has set *status.
*/
free(handle->md.oneshot_buffer);
return -1;
When doing Linux mmapped capture: Allocate a buffer into which to copy a packet, and have the callback for pcap_next() and pcap_next_ex() copy to that buffer and return a pointer to that buffer; we can't return the packet data pointer passed to the callback, as, once the callback returns, that buffer can be overwritten, even before you read the next packet. Don't tweak filter programs passed into the kernel to return 65535 on success - we don't have to, as we're not reading packets with recvfrom(), and we don't want to, as, if we return the actual snapshot length, the kernel will copy less data to the ring buffer. Truncate the packet snapshot length to the specified length, as we might not have a filter to do that.
2009-07-16 22:08:12 +00:00
}
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
If the specified time stamp type isn't supported, treat that as a warning.
2010-08-23 02:09:50 +00:00
/*
* Success. *status has been set either to 0 if there are no
* warnings or to a PCAP_WARNING_ value if there is a warning.
*
* Override some defaults and inherit the other fields from
* activate_new.
* handle->offset is used to get the current position into the rx ring.
* handle->cc is used to store the ring size.
*/
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
handle->read_op = pcap_read_linux_mmap;
Turn close_op into cleanup_op; the routine that handles it can also be used to clean up after a failed pcap_activate() call. Convert the existing close_op routines to cleanup_op routines, and use them to clean up; rename pcap_close_common() to pcap_cleanup_live_common(), and use it directly if there's no platform-dependent cleanup needed. That means we don't have to write the same cleanup code twice (and possibly forget stuff in the version done on a failed pcap_activate() call). Have the cleanup routines do whatever is necessary to indicate that cleanup has been done, and not do any particular cleaning up if it's already been done (i.e., don't free something if the pointer to it is null and null out the pointer once it's been freed, don't close an FD if it's -1 and set it to -1 once it's been closed, etc.). For device types/platforms where we don't support monitor mode, check for it and return PCAP_ERROR_RFMON_NOTSUP - but do so after we've checked whether we can open the device, so we return "no such device" or "permission denied" rather than "that device doesn't support monitor mode" if we can't open the device in the first place. Fix a comment.
2008-04-14 20:40:58 +00:00
handle->cleanup_op = pcap_cleanup_linux_mmap;
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
handle->setfilter_op = pcap_setfilter_linux_mmap;
handle->setnonblock_op = pcap_setnonblock_mmap;
handle->getnonblock_op = pcap_getnonblock_mmap;
When doing Linux mmapped capture: Allocate a buffer into which to copy a packet, and have the callback for pcap_next() and pcap_next_ex() copy to that buffer and return a pointer to that buffer; we can't return the packet data pointer passed to the callback, as, once the callback returns, that buffer can be overwritten, even before you read the next packet. Don't tweak filter programs passed into the kernel to return 65535 on success - we don't have to, as we're not reading packets with recvfrom(), and we don't want to, as, if we return the actual snapshot length, the kernel will copy less data to the ring buffer. Truncate the packet snapshot length to the specified length, as we might not have a filter to do that.
2009-07-16 22:08:12 +00:00
handle->oneshot_callback = pcap_oneshot_mmap;
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
handle->selectable_fd = handle->fd;
return 1;
If the specified time stamp type isn't supported, treat that as a warning.
2010-08-23 02:09:50 +00:00
}
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
#else /* HAVE_PACKET_RING */
If the specified time stamp type isn't supported, treat that as a warning.
2010-08-23 02:09:50 +00:00
static int
activate_mmap(pcap_t *handle _U_, int *status _U_)
{
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
return 0;
}
If the specified time stamp type isn't supported, treat that as a warning.
2010-08-23 02:09:50 +00:00
#endif /* HAVE_PACKET_RING */
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
#ifdef HAVE_PACKET_RING
If the specified time stamp type isn't supported, treat that as a warning.
2010-08-23 02:09:50 +00:00
/*
* Attempt to set the socket to version 2 of the memory-mapped header.
* Return 1 if we succeed or if we fail because version 2 isn't
* supported; return -1 on any other error, and set handle->errbuf.
*/
From Patrick McHardy: The tpacket_hdr is not clean for 64 bit kernel/32 bit userspace and is not extendable because the struct sockaddr_ll following it is expected at a fixed offset. Linux 2.6.27-rc supports a new tpacket frame header that removes these two limitations. Convert the mmap ring support to support both formats and probe for availability of the new version.
2008-08-06 07:49:19 +00:00
static int
prepare_tpacket_socket(pcap_t *handle)
{
Check whether the tpacket_auxdata structure has a tp_vlan_tci member before using that member. Don't define variables if we aren't going to use them. If we have an unknown tpacket version (this "can't happen"), return an error.
2008-08-06 08:29:07 +00:00
#ifdef HAVE_TPACKET2
From Patrick McHardy: The tpacket_hdr is not clean for 64 bit kernel/32 bit userspace and is not extendable because the struct sockaddr_ll following it is expected at a fixed offset. Linux 2.6.27-rc supports a new tpacket frame header that removes these two limitations. Convert the mmap ring support to support both formats and probe for availability of the new version.
2008-08-06 07:49:19 +00:00
socklen_t len;
int val;
Check whether the tpacket_auxdata structure has a tp_vlan_tci member before using that member. Don't define variables if we aren't going to use them. If we have an unknown tpacket version (this "can't happen"), return an error.
2008-08-06 08:29:07 +00:00
#endif
From Patrick McHardy: The tpacket_hdr is not clean for 64 bit kernel/32 bit userspace and is not extendable because the struct sockaddr_ll following it is expected at a fixed offset. Linux 2.6.27-rc supports a new tpacket frame header that removes these two limitations. Convert the mmap ring support to support both formats and probe for availability of the new version.
2008-08-06 07:49:19 +00:00
handle->md.tp_version = TPACKET_V1;
handle->md.tp_hdrlen = sizeof(struct tpacket_hdr);
#ifdef HAVE_TPACKET2
/* Probe whether kernel supports TPACKET_V2 */
val = TPACKET_V2;
len = sizeof(val);
if (getsockopt(handle->fd, SOL_PACKET, PACKET_HDRLEN, &val, &len) < 0) {
if (errno == ENOPROTOOPT)
If attempting to turn memory-mapped access on fails for any reason other than "the kernel doesn't support memory-mapped access to PF_PACKET sockets", treat that as an error. If it fails for that reason, don't leave gunk behind in the pcap_t's error buffer. Clean up the error messages a bit (the result of strerror() suffices; we don't need the numeric value of errno, nor do we need the file descriptor number of the socket on which we're working).
2008-11-19 10:01:30 +00:00
return 1; /* no - just drive on */
/* Yes - treat as a failure. */
From Patrick McHardy: The tpacket_hdr is not clean for 64 bit kernel/32 bit userspace and is not extendable because the struct sockaddr_ll following it is expected at a fixed offset. Linux 2.6.27-rc supports a new tpacket frame header that removes these two limitations. Convert the mmap ring support to support both formats and probe for availability of the new version.
2008-08-06 07:49:19 +00:00
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
If attempting to turn memory-mapped access on fails for any reason other than "the kernel doesn't support memory-mapped access to PF_PACKET sockets", treat that as an error. If it fails for that reason, don't leave gunk behind in the pcap_t's error buffer. Clean up the error messages a bit (the result of strerror() suffices; we don't need the numeric value of errno, nor do we need the file descriptor number of the socket on which we're working).
2008-11-19 10:01:30 +00:00
"can't get TPACKET_V2 header len on packet socket: %s",
pcap_strerror(errno));
return -1;
From Patrick McHardy: The tpacket_hdr is not clean for 64 bit kernel/32 bit userspace and is not extendable because the struct sockaddr_ll following it is expected at a fixed offset. Linux 2.6.27-rc supports a new tpacket frame header that removes these two limitations. Convert the mmap ring support to support both formats and probe for availability of the new version.
2008-08-06 07:49:19 +00:00
}
handle->md.tp_hdrlen = val;
val = TPACKET_V2;
if (setsockopt(handle->fd, SOL_PACKET, PACKET_VERSION, &val,
sizeof(val)) < 0) {
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
If attempting to turn memory-mapped access on fails for any reason other than "the kernel doesn't support memory-mapped access to PF_PACKET sockets", treat that as an error. If it fails for that reason, don't leave gunk behind in the pcap_t's error buffer. Clean up the error messages a bit (the result of strerror() suffices; we don't need the numeric value of errno, nor do we need the file descriptor number of the socket on which we're working).
2008-11-19 10:01:30 +00:00
"can't activate TPACKET_V2 on packet socket: %s",
pcap_strerror(errno));
return -1;
From Patrick McHardy: The tpacket_hdr is not clean for 64 bit kernel/32 bit userspace and is not extendable because the struct sockaddr_ll following it is expected at a fixed offset. Linux 2.6.27-rc supports a new tpacket frame header that removes these two limitations. Convert the mmap ring support to support both formats and probe for availability of the new version.
2008-08-06 07:49:19 +00:00
}
handle->md.tp_version = TPACKET_V2;
From Patrick McHardy: Similar to PACKET_AUXDATA for non-mmaped sockets, the VLAN TCI is present in a new member of struct tpacket2_hdr. Use it to reconstruct the VLAN header when necessary.
2008-08-06 07:51:29 +00:00
/* Reserve space for VLAN tag reconstruction */
val = VLAN_TAG_LEN;
if (setsockopt(handle->fd, SOL_PACKET, PACKET_RESERVE, &val,
sizeof(val)) < 0) {
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
If attempting to turn memory-mapped access on fails for any reason other than "the kernel doesn't support memory-mapped access to PF_PACKET sockets", treat that as an error. If it fails for that reason, don't leave gunk behind in the pcap_t's error buffer. Clean up the error messages a bit (the result of strerror() suffices; we don't need the numeric value of errno, nor do we need the file descriptor number of the socket on which we're working).
2008-11-19 10:01:30 +00:00
"can't set up reserve on packet socket: %s",
pcap_strerror(errno));
return -1;
From Patrick McHardy: Similar to PACKET_AUXDATA for non-mmaped sockets, the VLAN TCI is present in a new member of struct tpacket2_hdr. Use it to reconstruct the VLAN header when necessary.
2008-08-06 07:51:29 +00:00
}
From Patrick McHardy: The tpacket_hdr is not clean for 64 bit kernel/32 bit userspace and is not extendable because the struct sockaddr_ll following it is expected at a fixed offset. Linux 2.6.27-rc supports a new tpacket frame header that removes these two limitations. Convert the mmap ring support to support both formats and probe for availability of the new version.
2008-08-06 07:49:19 +00:00
#endif /* HAVE_TPACKET2 */
return 1;
}
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
If the specified time stamp type isn't supported, treat that as a warning.
2010-08-23 02:09:50 +00:00
/*
* Attempt to set up memory-mapped access.
*
* On success, returns 1, and sets *status to 0 if there are no warnings
* or to a PCAP_WARNING_ code if there is a warning.
*
* On failure due to lack of support for memory-mapped capture, returns
* 0.
*
* On error, returns -1, and sets *status to the appropriate error code;
* if that is PCAP_ERROR, sets handle->errbuf to the appropriate message.
*/
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
static int
If the specified time stamp type isn't supported, treat that as a warning.
2010-08-23 02:09:50 +00:00
create_ring(pcap_t *handle, int *status)
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
{
Get rid of an assigned-to-but-unused variable.
2009-07-11 21:06:57 +00:00
unsigned i, j, frames_per_block;
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
struct tpacket_req req;
If the specified time stamp type isn't supported, treat that as a warning.
2010-08-23 02:09:50 +00:00
/*
* Start out assuming no warnings or errors.
*/
*status = 0;
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
/* Note that with large snapshot (say 64K) only a few frames
* will be available in the ring even with pretty large ring size
* (and a lot of memory will be unused).
* The snap len should be carefully chosen to achive best
* performance */
From Patrick McHardy: The tpacket_hdr is not clean for 64 bit kernel/32 bit userspace and is not extendable because the struct sockaddr_ll following it is expected at a fixed offset. Linux 2.6.27-rc supports a new tpacket frame header that removes these two limitations. Convert the mmap ring support to support both formats and probe for availability of the new version.
2008-08-06 07:49:19 +00:00
req.tp_frame_size = TPACKET_ALIGN(handle->snapshot +
TPACKET_ALIGN(handle->md.tp_hdrlen) +
sizeof(struct sockaddr_ll));
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
req.tp_frame_nr = handle->opt.buffer_size/req.tp_frame_size;
For Linux, add to the pcap_md structure a pointer to a memory-mapped region and the size of the region; use that pointer rather than the bp or buffer member (that means we don't have to worry about pcap_cleanup_live_common() attempting to free that buffer). Use the saved size when unmapping the memory-mapped region. Use that for Linux USB memory-mapped access as well - and unmap the memory-mapped region when we close the pcap_t, because we *do* have to unmap it.
2009-07-11 18:59:04 +00:00
/* compute the minumum block size that will handle this frame.
* The block has to be page size aligned.
* The max block size allowed by the kernel is arch-dependent and
* it's not explicitly checked here. */
req.tp_block_size = getpagesize();
while (req.tp_block_size < req.tp_frame_size)
req.tp_block_size <<= 1;
frames_per_block = req.tp_block_size/req.tp_frame_size;
Add support for setting the time stamp type for a capture. Based on a patch from Scott Mcmillan <scott.a.mcmillan@intel.com>. (Second part of the commit.)
2010-08-23 00:36:27 +00:00
/*
* PACKET_TIMESTAMP was added after linux/net_tstamp.h was,
* so we check for PACKET_TIMESTAMP. We check for
* linux/net_tstamp.h just in case a system somehow has
* PACKET_TIMESTAMP but not linux/net_tstamp.h; that might
* be unnecessary.
*
* SIOCSHWTSTAMP was introduced in the patch that introduced
* linux/net_tstamp.h, so we don't bother checking whether
* SIOCSHWTSTAMP is defined (if your Linux system has
* linux/net_tstamp.h but doesn't define SIOCSHWTSTAMP, your
* Linux system is badly broken).
*/
#if defined(HAVE_LINUX_NET_TSTAMP_H) && defined(PACKET_TIMESTAMP)
/*
* If we were told to do so, ask the kernel and the driver
* to use hardware timestamps.
*
* Hardware timestamps are only supported with mmapped
* captures.
*/
if (handle->opt.tstamp_type == PCAP_TSTAMP_ADAPTER ||
handle->opt.tstamp_type == PCAP_TSTAMP_ADAPTER_UNSYNCED) {
struct hwtstamp_config hwconfig;
struct ifreq ifr;
int timesource;
/*
* Ask for hardware time stamps on all packets,
* including transmitted packets.
*/
memset(&hwconfig, 0, sizeof(hwconfig));
hwconfig.tx_type = HWTSTAMP_TX_ON;
hwconfig.rx_filter = HWTSTAMP_FILTER_ALL;
memset(&ifr, 0, sizeof(ifr));
strcpy(ifr.ifr_name, handle->opt.source);
ifr.ifr_data = (void *)&hwconfig;
if (ioctl(handle->fd, SIOCSHWTSTAMP, &ifr) < 0) {
switch (errno) {
case EPERM:
If the specified time stamp type isn't supported, treat that as a warning.
2010-08-23 02:09:50 +00:00
/*
* Treat this as an error, as the
* user should try to run this
* with the appropriate privileges -
* and, if they can't, shouldn't
* try requesting hardware time stamps.
*/
*status = PCAP_ERROR_PERM_DENIED;
return -1;
Add support for setting the time stamp type for a capture. Based on a patch from Scott Mcmillan <scott.a.mcmillan@intel.com>. (Second part of the commit.)
2010-08-23 00:36:27 +00:00
case EOPNOTSUPP:
If the specified time stamp type isn't supported, treat that as a warning.
2010-08-23 02:09:50 +00:00
/*
* Treat this as a warning, as the
* only way to fix the warning is to
* get an adapter that supports hardware
* time stamps. We'll just fall back
* on the standard host time stamps.
*/
Fixes from Scott Mcmillan.
2010-08-23 19:50:19 +00:00
*status = PCAP_WARNING_TSTAMP_TYPE_NOTSUP;
If the specified time stamp type isn't supported, treat that as a warning.
2010-08-23 02:09:50 +00:00
break;
Add support for setting the time stamp type for a capture. Based on a patch from Scott Mcmillan <scott.a.mcmillan@intel.com>. (Second part of the commit.)
2010-08-23 00:36:27 +00:00
default:
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
"SIOCSHWTSTAMP failed: %s",
pcap_strerror(errno));
If the specified time stamp type isn't supported, treat that as a warning.
2010-08-23 02:09:50 +00:00
*status = PCAP_ERROR;
return -1;
Add support for setting the time stamp type for a capture. Based on a patch from Scott Mcmillan <scott.a.mcmillan@intel.com>. (Second part of the commit.)
2010-08-23 00:36:27 +00:00
}
} else {
/*
If the specified time stamp type isn't supported, treat that as a warning.
2010-08-23 02:09:50 +00:00
* Well, that worked. Now specify the type of
* hardware time stamp we want for this
* socket.
Add support for setting the time stamp type for a capture. Based on a patch from Scott Mcmillan <scott.a.mcmillan@intel.com>. (Second part of the commit.)
2010-08-23 00:36:27 +00:00
*/
If the specified time stamp type isn't supported, treat that as a warning.
2010-08-23 02:09:50 +00:00
if (handle->opt.tstamp_type == PCAP_TSTAMP_ADAPTER) {
/*
* Hardware timestamp, synchronized
* with the system clock.
*/
timesource = SOF_TIMESTAMPING_SYS_HARDWARE;
} else {
/*
* PCAP_TSTAMP_ADAPTER_UNSYNCED - hardware
* timestamp, not synchronized with the
* system clock.
*/
timesource = SOF_TIMESTAMPING_RAW_HARDWARE;
}
if (setsockopt(handle->fd, SOL_PACKET, PACKET_TIMESTAMP,
(void *)&timesource, sizeof(timesource))) {
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
"can't set PACKET_TIMESTAMP: %s",
pcap_strerror(errno));
*status = PCAP_ERROR;
return -1;
}
Add support for setting the time stamp type for a capture. Based on a patch from Scott Mcmillan <scott.a.mcmillan@intel.com>. (Second part of the commit.)
2010-08-23 00:36:27 +00:00
}
}
#endif /* HAVE_LINUX_NET_TSTAMP_H && PACKET_TIMESTAMP */
From Dustin Spicuzza: - Fixed bug where create_ring would fail for particular snaplen and buffer size combinations - Changed ring allocation to retry with 5% less buffer size instead of 50%
2009-07-15 20:16:36 +00:00
/* ask the kernel to create the ring */
retry:
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
req.tp_block_nr = req.tp_frame_nr / frames_per_block;
/* req.tp_frame_nr is requested to match frames_per_block*req.tp_block_nr */
req.tp_frame_nr = req.tp_block_nr * frames_per_block;
From Dustin Spicuzza: - Fixed bug where create_ring would fail for particular snaplen and buffer size combinations - Changed ring allocation to retry with 5% less buffer size instead of 50%
2009-07-15 20:16:36 +00:00
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
if (setsockopt(handle->fd, SOL_PACKET, PACKET_RX_RING,
(void *) &req, sizeof(req))) {
if ((errno == ENOMEM) && (req.tp_block_nr > 1)) {
From Dustin Spicuzza: - Fixed bug where create_ring would fail for particular snaplen and buffer size combinations - Changed ring allocation to retry with 5% less buffer size instead of 50%
2009-07-15 20:16:36 +00:00
/*
* Memory failure; try to reduce the requested ring
* size.
*
* We used to reduce this by half -- do 5% instead.
* That may result in more iterations and a longer
* startup, but the user will be much happier with
* the resulting buffer size.
*/
if (req.tp_frame_nr < 20)
req.tp_frame_nr -= 1;
else
req.tp_frame_nr -= req.tp_frame_nr/20;
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
goto retry;
}
If attempting to turn memory-mapped access on fails for any reason other than "the kernel doesn't support memory-mapped access to PF_PACKET sockets", treat that as an error. If it fails for that reason, don't leave gunk behind in the pcap_t's error buffer. Clean up the error messages a bit (the result of strerror() suffices; we don't need the numeric value of errno, nor do we need the file descriptor number of the socket on which we're working).
2008-11-19 10:01:30 +00:00
if (errno == ENOPROTOOPT) {
/*
* We don't have ring buffer support in this kernel.
*/
return 0;
}
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
"can't create rx ring on packet socket: %s",
pcap_strerror(errno));
If the specified time stamp type isn't supported, treat that as a warning.
2010-08-23 02:09:50 +00:00
*status = PCAP_ERROR;
return -1;
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
}
/* memory map the rx ring */
For Linux, add to the pcap_md structure a pointer to a memory-mapped region and the size of the region; use that pointer rather than the bp or buffer member (that means we don't have to worry about pcap_cleanup_live_common() attempting to free that buffer). Use the saved size when unmapping the memory-mapped region. Use that for Linux USB memory-mapped access as well - and unmap the memory-mapped region when we close the pcap_t, because we *do* have to unmap it.
2009-07-11 18:59:04 +00:00
handle->md.mmapbuflen = req.tp_block_nr * req.tp_block_size;
handle->md.mmapbuf = mmap(0, handle->md.mmapbuflen,
PROT_READ|PROT_WRITE, MAP_SHARED, handle->fd, 0);
if (handle->md.mmapbuf == MAP_FAILED) {
Return -1 for all failures to create a packet ring other than "this kernel doesn't support the packet ring", and make sure we set handle->errbuf in all such cases.
2008-11-19 17:36:52 +00:00
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
"can't mmap rx ring: %s", pcap_strerror(errno));
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
/* clear the allocated ring on error*/
destroy_ring(handle);
If the specified time stamp type isn't supported, treat that as a warning.
2010-08-23 02:09:50 +00:00
*status = PCAP_ERROR;
return -1;
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
}
/* allocate a ring for each frame header pointer*/
handle->cc = req.tp_frame_nr;
From Patrick McHardy: The tpacket_hdr is not clean for 64 bit kernel/32 bit userspace and is not extendable because the struct sockaddr_ll following it is expected at a fixed offset. Linux 2.6.27-rc supports a new tpacket frame header that removes these two limitations. Convert the mmap ring support to support both formats and probe for availability of the new version.
2008-08-06 07:49:19 +00:00
handle->buffer = malloc(handle->cc * sizeof(union thdr *));
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
if (!handle->buffer) {
Return -1 for all failures to create a packet ring other than "this kernel doesn't support the packet ring", and make sure we set handle->errbuf in all such cases.
2008-11-19 17:36:52 +00:00
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
"can't allocate ring of frame headers: %s",
pcap_strerror(errno));
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
destroy_ring(handle);
If the specified time stamp type isn't supported, treat that as a warning.
2010-08-23 02:09:50 +00:00
*status = PCAP_ERROR;
return -1;
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
}
/* fill the header ring with proper frame ptr*/
handle->offset = 0;
for (i=0; i<req.tp_block_nr; ++i) {
For Linux, add to the pcap_md structure a pointer to a memory-mapped region and the size of the region; use that pointer rather than the bp or buffer member (that means we don't have to worry about pcap_cleanup_live_common() attempting to free that buffer). Use the saved size when unmapping the memory-mapped region. Use that for Linux USB memory-mapped access as well - and unmap the memory-mapped region when we close the pcap_t, because we *do* have to unmap it.
2009-07-11 18:59:04 +00:00
void *base = &handle->md.mmapbuf[i*req.tp_block_size];
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
for (j=0; j<frames_per_block; ++j, ++handle->offset) {
From Patrick McHardy: The tpacket_hdr is not clean for 64 bit kernel/32 bit userspace and is not extendable because the struct sockaddr_ll following it is expected at a fixed offset. Linux 2.6.27-rc supports a new tpacket frame header that removes these two limitations. Convert the mmap ring support to support both formats and probe for availability of the new version.
2008-08-06 07:49:19 +00:00
RING_GET_FRAME(handle) = base;
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
base += req.tp_frame_size;
}
}
handle->bufsize = req.tp_frame_size;
handle->offset = 0;
return 1;
}
/* free all ring related resources*/
static void
destroy_ring(pcap_t *handle)
{
/* tell the kernel to destroy the ring*/
struct tpacket_req req;
memset(&req, 0, sizeof(req));
setsockopt(handle->fd, SOL_PACKET, PACKET_RX_RING,
(void *) &req, sizeof(req));
/* if ring is mapped, unmap it*/
For Linux, add to the pcap_md structure a pointer to a memory-mapped region and the size of the region; use that pointer rather than the bp or buffer member (that means we don't have to worry about pcap_cleanup_live_common() attempting to free that buffer). Use the saved size when unmapping the memory-mapped region. Use that for Linux USB memory-mapped access as well - and unmap the memory-mapped region when we close the pcap_t, because we *do* have to unmap it.
2009-07-11 18:59:04 +00:00
if (handle->md.mmapbuf) {
/* do not test for mmap failure, as we can't recover from any error */
munmap(handle->md.mmapbuf, handle->md.mmapbuflen);
handle->md.mmapbuf = NULL;
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
}
}
When doing Linux mmapped capture: Allocate a buffer into which to copy a packet, and have the callback for pcap_next() and pcap_next_ex() copy to that buffer and return a pointer to that buffer; we can't return the packet data pointer passed to the callback, as, once the callback returns, that buffer can be overwritten, even before you read the next packet. Don't tweak filter programs passed into the kernel to return 65535 on success - we don't have to, as we're not reading packets with recvfrom(), and we don't want to, as, if we return the actual snapshot length, the kernel will copy less data to the ring buffer. Truncate the packet snapshot length to the specified length, as we might not have a filter to do that.
2009-07-16 22:08:12 +00:00
/*
* Special one-shot callback, used for pcap_next() and pcap_next_ex(),
* for Linux mmapped capture.
*
* The problem is that pcap_next() and pcap_next_ex() expect the packet
* data handed to the callback to be valid after the callback returns,
* but pcap_read_linux_mmap() has to release that packet as soon as
* the callback returns (otherwise, the kernel thinks there's still
* at least one unprocessed packet available in the ring, so a select()
* will immediately return indicating that there's data to process), so,
* in the callback, we have to make a copy of the packet.
*
* Yes, this means that, if the capture is using the ring buffer, using
* pcap_next() or pcap_next_ex() requires more copies than using
* pcap_loop() or pcap_dispatch(). If that bothers you, don't use
* pcap_next() or pcap_next_ex().
*/
static void
pcap_oneshot_mmap(u_char *user, const struct pcap_pkthdr *h,
const u_char *bytes)
{
From Peter Volkov: Fix typo pkt_for_oneshot is not difined anywhere, but oneshot_userdata is.
2009-07-23 06:53:22 +00:00
struct oneshot_userdata *sp = (struct oneshot_userdata *)user;
When doing Linux mmapped capture: Allocate a buffer into which to copy a packet, and have the callback for pcap_next() and pcap_next_ex() copy to that buffer and return a pointer to that buffer; we can't return the packet data pointer passed to the callback, as, once the callback returns, that buffer can be overwritten, even before you read the next packet. Don't tweak filter programs passed into the kernel to return 65535 on success - we don't have to, as we're not reading packets with recvfrom(), and we don't want to, as, if we return the actual snapshot length, the kernel will copy less data to the ring buffer. Truncate the packet snapshot length to the specified length, as we might not have a filter to do that.
2009-07-16 22:08:12 +00:00
*sp->hdr = *h;
memcpy(sp->pd->md.oneshot_buffer, bytes, h->caplen);
*sp->pkt = sp->pd->md.oneshot_buffer;
}
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
static void
Turn close_op into cleanup_op; the routine that handles it can also be used to clean up after a failed pcap_activate() call. Convert the existing close_op routines to cleanup_op routines, and use them to clean up; rename pcap_close_common() to pcap_cleanup_live_common(), and use it directly if there's no platform-dependent cleanup needed. That means we don't have to write the same cleanup code twice (and possibly forget stuff in the version done on a failed pcap_activate() call). Have the cleanup routines do whatever is necessary to indicate that cleanup has been done, and not do any particular cleaning up if it's already been done (i.e., don't free something if the pointer to it is null and null out the pointer once it's been freed, don't close an FD if it's -1 and set it to -1 once it's been closed, etc.). For device types/platforms where we don't support monitor mode, check for it and return PCAP_ERROR_RFMON_NOTSUP - but do so after we've checked whether we can open the device, so we return "no such device" or "permission denied" rather than "that device doesn't support monitor mode" if we can't open the device in the first place. Fix a comment.
2008-04-14 20:40:58 +00:00
pcap_cleanup_linux_mmap( pcap_t *handle )
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
{
destroy_ring(handle);
When doing Linux mmapped capture: Allocate a buffer into which to copy a packet, and have the callback for pcap_next() and pcap_next_ex() copy to that buffer and return a pointer to that buffer; we can't return the packet data pointer passed to the callback, as, once the callback returns, that buffer can be overwritten, even before you read the next packet. Don't tweak filter programs passed into the kernel to return 65535 on success - we don't have to, as we're not reading packets with recvfrom(), and we don't want to, as, if we return the actual snapshot length, the kernel will copy less data to the ring buffer. Truncate the packet snapshot length to the specified length, as we might not have a filter to do that.
2009-07-16 22:08:12 +00:00
if (handle->md.oneshot_buffer != NULL) {
free(handle->md.oneshot_buffer);
handle->md.oneshot_buffer = NULL;
}
Turn close_op into cleanup_op; the routine that handles it can also be used to clean up after a failed pcap_activate() call. Convert the existing close_op routines to cleanup_op routines, and use them to clean up; rename pcap_close_common() to pcap_cleanup_live_common(), and use it directly if there's no platform-dependent cleanup needed. That means we don't have to write the same cleanup code twice (and possibly forget stuff in the version done on a failed pcap_activate() call). Have the cleanup routines do whatever is necessary to indicate that cleanup has been done, and not do any particular cleaning up if it's already been done (i.e., don't free something if the pointer to it is null and null out the pointer once it's been freed, don't close an FD if it's -1 and set it to -1 once it's been closed, etc.). For device types/platforms where we don't support monitor mode, check for it and return PCAP_ERROR_RFMON_NOTSUP - but do so after we've checked whether we can open the device, so we return "no such device" or "permission denied" rather than "that device doesn't support monitor mode" if we can't open the device in the first place. Fix a comment.
2008-04-14 20:40:58 +00:00
pcap_cleanup_linux(handle);
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
}
From Hagen Paul Pfeifer: define some routines as static, to match the way they're declared (and the way they're intended to be).
2008-02-08 01:34:49 +00:00
static int
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
pcap_getnonblock_mmap(pcap_t *p, char *errbuf)
{
/* use negative value of timeout to indicate non blocking ops */
return (p->md.timeout<0);
}
From Hagen Paul Pfeifer: define some routines as static, to match the way they're declared (and the way they're intended to be).
2008-02-08 01:34:49 +00:00
static int
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
pcap_setnonblock_mmap(pcap_t *p, int nonblock, char *errbuf)
{
/* map each value to the corresponding 2's complement, to
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
* preserve the timeout value provided with pcap_set_timeout */
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
if (nonblock) {
In memory-mapped mode, when turning non-blocking mode on when it's off, map all non-negative timeouts, including 0, to negative values, so that, even with no timeout set, non-blocking mode will skip the poll() call.
2009-07-06 18:35:52 +00:00
if (p->md.timeout >= 0) {
/*
* Timeout is non-negative, so we're not already
* in non-blocking mode; set it to the 2's
* complement, to make it negative, as an
* indication that we're in non-blocking mode.
*/
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
p->md.timeout = p->md.timeout*-1 - 1;
In memory-mapped mode, when turning non-blocking mode on when it's off, map all non-negative timeouts, including 0, to negative values, so that, even with no timeout set, non-blocking mode will skip the poll() call.
2009-07-06 18:35:52 +00:00
}
} else {
if (p->md.timeout < 0) {
/*
* Timeout is negative, so we're not already
* in blocking mode; reverse the previous
* operation, to make the timeout non-negative
* again.
*/
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
p->md.timeout = (p->md.timeout+1)*-1;
In memory-mapped mode, when turning non-blocking mode on when it's off, map all non-negative timeouts, including 0, to negative values, so that, even with no timeout set, non-blocking mode will skip the poll() call.
2009-07-06 18:35:52 +00:00
}
}
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
return 0;
}
From Patrick McHardy: The tpacket_hdr is not clean for 64 bit kernel/32 bit userspace and is not extendable because the struct sockaddr_ll following it is expected at a fixed offset. Linux 2.6.27-rc supports a new tpacket frame header that removes these two limitations. Convert the mmap ring support to support both formats and probe for availability of the new version.
2008-08-06 07:49:19 +00:00
static inline union thdr *
pcap_get_ring_frame(pcap_t *handle, int status)
{
union thdr h;
h.raw = RING_GET_FRAME(handle);
switch (handle->md.tp_version) {
case TPACKET_V1:
if (status != (h.h1->tp_status ? TP_STATUS_USER :
TP_STATUS_KERNEL))
return NULL;
break;
#ifdef HAVE_TPACKET2
case TPACKET_V2:
if (status != (h.h2->tp_status ? TP_STATUS_USER :
TP_STATUS_KERNEL))
return NULL;
break;
#endif
}
return h.raw;
}
In pcap_read_linux_mmap(), if there are no frames available, call poll() even if we're in non-blocking mode, to pick up any error indications - in that case, use a timeout of 0, so poll() doesn't block. Don't test individual exceptional-condition bits in the poll() return unless one of them is set, so we just do one test in the typical (no exceptional condition) case.
2009-10-12 23:24:57 +00:00
#ifndef POLLRDHUP
#define POLLRDHUP 0
#endif
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
static int
pcap_read_linux_mmap(pcap_t *handle, int max_packets, pcap_handler callback,
u_char *user)
{
In pcap_read_linux_mmap(), if there are no frames available, call poll() even if we're in non-blocking mode, to pick up any error indications - in that case, use a timeout of 0, so poll() doesn't block. Don't test individual exceptional-condition bits in the poll() return unless one of them is set, so we just do one test in the typical (no exceptional condition) case.
2009-10-12 23:24:57 +00:00
int timeout;
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
int pkts = 0;
If we get POLLERR when polling a socket in memory-mapped mode, do a recv() on the socket to get the error code.
2009-10-12 05:15:24 +00:00
char c;
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
/* wait for frames availability.*/
In pcap_read_linux_mmap(), if there are no frames available, call poll() even if we're in non-blocking mode, to pick up any error indications - in that case, use a timeout of 0, so poll() doesn't block. Don't test individual exceptional-condition bits in the poll() return unless one of them is set, so we just do one test in the typical (no exceptional condition) case.
2009-10-12 23:24:57 +00:00
if (!pcap_get_ring_frame(handle, TP_STATUS_USER)) {
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
struct pollfd pollinfo;
int ret;
pollinfo.fd = handle->fd;
pollinfo.events = POLLIN;
In pcap_read_linux_mmap(), if there are no frames available, call poll() even if we're in non-blocking mode, to pick up any error indications - in that case, use a timeout of 0, so poll() doesn't block. Don't test individual exceptional-condition bits in the poll() return unless one of them is set, so we just do one test in the typical (no exceptional condition) case.
2009-10-12 23:24:57 +00:00
if (handle->md.timeout == 0)
timeout = -1; /* block forever */
else if (handle->md.timeout > 0)
timeout = handle->md.timeout; /* block for that amount of time */
else
timeout = 0; /* non-blocking mode - poll to pick up errors */
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
do {
In pcap_read_linux_mmap(), if there are no frames available, call poll() even if we're in non-blocking mode, to pick up any error indications - in that case, use a timeout of 0, so poll() doesn't block. Don't test individual exceptional-condition bits in the poll() return unless one of them is set, so we just do one test in the typical (no exceptional condition) case.
2009-10-12 23:24:57 +00:00
ret = poll(&pollinfo, 1, timeout);
if (ret < 0 && errno != EINTR) {
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
When reading from a BPF device, if we get ENXIO, which means "The device went down" on at least some OSes, return a message indicating that. When reading from a Linux PF_PACKET socket, if we get ENETDOWN, which means "The device went down", return a message indicating that. When doing a poll() on a PF_PACKET socket, check for various "something happened on this, but it's not readable" conditions.
2009-10-12 03:12:34 +00:00
"can't poll on packet socket: %s",
pcap_strerror(errno));
return PCAP_ERROR;
In pcap_read_linux_mmap(), if there are no frames available, call poll() even if we're in non-blocking mode, to pick up any error indications - in that case, use a timeout of 0, so poll() doesn't block. Don't test individual exceptional-condition bits in the poll() return unless one of them is set, so we just do one test in the typical (no exceptional condition) case.
2009-10-12 23:24:57 +00:00
} else if (ret > 0 &&
(pollinfo.revents & (POLLHUP|POLLRDHUP|POLLERR|POLLNVAL))) {
When reading from a BPF device, if we get ENXIO, which means "The device went down" on at least some OSes, return a message indicating that. When reading from a Linux PF_PACKET socket, if we get ENETDOWN, which means "The device went down", return a message indicating that. When doing a poll() on a PF_PACKET socket, check for various "something happened on this, but it's not readable" conditions.
2009-10-12 03:12:34 +00:00
/*
In pcap_read_linux_mmap(), if there are no frames available, call poll() even if we're in non-blocking mode, to pick up any error indications - in that case, use a timeout of 0, so poll() doesn't block. Don't test individual exceptional-condition bits in the poll() return unless one of them is set, so we just do one test in the typical (no exceptional condition) case.
2009-10-12 23:24:57 +00:00
* There's some indication other than
* "you can read on this descriptor" on
* the descriptor.
When reading from a BPF device, if we get ENXIO, which means "The device went down" on at least some OSes, return a message indicating that. When reading from a Linux PF_PACKET socket, if we get ENETDOWN, which means "The device went down", return a message indicating that. When doing a poll() on a PF_PACKET socket, check for various "something happened on this, but it's not readable" conditions.
2009-10-12 03:12:34 +00:00
*/
if (pollinfo.revents & (POLLHUP | POLLRDHUP)) {
snprintf(handle->errbuf,
PCAP_ERRBUF_SIZE,
"Hangup on packet socket");
return PCAP_ERROR;
}
if (pollinfo.revents & POLLERR) {
If we get POLLERR when polling a socket in memory-mapped mode, do a recv() on the socket to get the error code.
2009-10-12 05:15:24 +00:00
/*
* A recv() will give us the
* actual error code.
*
* XXX - make the socket non-blocking?
*/
Fix typo^Wbraino.
2009-10-13 00:06:11 +00:00
if (recv(handle->fd, &c, sizeof c,
If we get POLLERR when polling a socket in memory-mapped mode, do a recv() on the socket to get the error code.
2009-10-12 05:15:24 +00:00
MSG_PEEK) != -1)
continue; /* what, no error? */
if (errno == ENETDOWN) {
/*
* The device on which we're
* capturing went away.
*
* XXX - we should really return
* PCAP_ERROR_IFACE_NOT_UP,
* but pcap_dispatch() etc.
* aren't defined to return
* that.
*/
snprintf(handle->errbuf,
PCAP_ERRBUF_SIZE,
"The interface went down");
} else {
snprintf(handle->errbuf,
PCAP_ERRBUF_SIZE,
"Error condition on packet socket: %s",
strerror(errno));
}
When reading from a BPF device, if we get ENXIO, which means "The device went down" on at least some OSes, return a message indicating that. When reading from a Linux PF_PACKET socket, if we get ENETDOWN, which means "The device went down", return a message indicating that. When doing a poll() on a PF_PACKET socket, check for various "something happened on this, but it's not readable" conditions.
2009-10-12 03:12:34 +00:00
return PCAP_ERROR;
}
if (pollinfo.revents & POLLNVAL) {
snprintf(handle->errbuf,
PCAP_ERRBUF_SIZE,
"Invalid polling request on packet socket");
return PCAP_ERROR;
}
}
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
/* check for break loop condition on interrupted syscall*/
if (handle->break_loop) {
handle->break_loop = 0;
When reading from a BPF device, if we get ENXIO, which means "The device went down" on at least some OSes, return a message indicating that. When reading from a Linux PF_PACKET socket, if we get ENETDOWN, which means "The device went down", return a message indicating that. When doing a poll() on a PF_PACKET socket, check for various "something happened on this, but it's not readable" conditions.
2009-10-12 03:12:34 +00:00
return PCAP_ERROR_BREAK;
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
}
} while (ret < 0);
}
Treat a max_packets value of 0 the same way that we treat a max_packets value of -1.
2008-02-02 20:56:48 +00:00
/* non-positive values of max_packets are used to require all
* packets currently available in the ring */
while ((pkts < max_packets) || (max_packets <= 0)) {
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
int run_bpf;
struct sockaddr_ll *sll;
struct pcap_pkthdr pcaphdr;
unsigned char *bp;
From Patrick McHardy: The tpacket_hdr is not clean for 64 bit kernel/32 bit userspace and is not extendable because the struct sockaddr_ll following it is expected at a fixed offset. Linux 2.6.27-rc supports a new tpacket frame header that removes these two limitations. Convert the mmap ring support to support both formats and probe for availability of the new version.
2008-08-06 07:49:19 +00:00
union thdr h;
unsigned int tp_len;
unsigned int tp_mac;
unsigned int tp_snaplen;
unsigned int tp_sec;
unsigned int tp_usec;
h.raw = pcap_get_ring_frame(handle, TP_STATUS_USER);
if (!h.raw)
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
break;
From Patrick McHardy: The tpacket_hdr is not clean for 64 bit kernel/32 bit userspace and is not extendable because the struct sockaddr_ll following it is expected at a fixed offset. Linux 2.6.27-rc supports a new tpacket frame header that removes these two limitations. Convert the mmap ring support to support both formats and probe for availability of the new version.
2008-08-06 07:49:19 +00:00
switch (handle->md.tp_version) {
case TPACKET_V1:
tp_len = h.h1->tp_len;
tp_mac = h.h1->tp_mac;
tp_snaplen = h.h1->tp_snaplen;
tp_sec = h.h1->tp_sec;
tp_usec = h.h1->tp_usec;
break;
#ifdef HAVE_TPACKET2
case TPACKET_V2:
tp_len = h.h2->tp_len;
tp_mac = h.h2->tp_mac;
tp_snaplen = h.h2->tp_snaplen;
tp_sec = h.h2->tp_sec;
tp_usec = h.h2->tp_nsec / 1000;
break;
#endif
Check whether the tpacket_auxdata structure has a tp_vlan_tci member before using that member. Don't define variables if we aren't going to use them. If we have an unknown tpacket version (this "can't happen"), return an error.
2008-08-06 08:29:07 +00:00
default:
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
"unsupported tpacket version %d",
handle->md.tp_version);
return -1;
From Patrick McHardy: The tpacket_hdr is not clean for 64 bit kernel/32 bit userspace and is not extendable because the struct sockaddr_ll following it is expected at a fixed offset. Linux 2.6.27-rc supports a new tpacket frame header that removes these two limitations. Convert the mmap ring support to support both formats and probe for availability of the new version.
2008-08-06 07:49:19 +00:00
}
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
/* perform sanity check on internal offset. */
From Patrick McHardy: The tpacket_hdr is not clean for 64 bit kernel/32 bit userspace and is not extendable because the struct sockaddr_ll following it is expected at a fixed offset. Linux 2.6.27-rc supports a new tpacket frame header that removes these two limitations. Convert the mmap ring support to support both formats and probe for availability of the new version.
2008-08-06 07:49:19 +00:00
if (tp_mac + tp_snaplen > handle->bufsize) {
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
"corrupted frame on kernel ring mac "
Error messages returned in the pcap_t's error buffer shouldn't have a newline in them. If we're in cooked mode, the packet pointer argument we pass to the callback should point to the beginning of the constructed sll header, not to the packet data itself. While we're at it, have a paranoid check to make sure that we were given enough space to construct the sll header, so we don't stomp on the tpacket header.
2008-02-02 22:25:51 +00:00
"offset %d + caplen %d > frame len %d",
From Patrick McHardy: The tpacket_hdr is not clean for 64 bit kernel/32 bit userspace and is not extendable because the struct sockaddr_ll following it is expected at a fixed offset. Linux 2.6.27-rc supports a new tpacket frame header that removes these two limitations. Convert the mmap ring support to support both formats and probe for availability of the new version.
2008-08-06 07:49:19 +00:00
tp_mac, tp_snaplen, handle->bufsize);
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
return -1;
}
/* run filter on received packet
* If the kernel filtering is enabled we need to run the
* filter until all the frames present into the ring
* at filter creation time are processed.
* In such case md.use_bpf is used as a counter for the
* packet we need to filter.
* Note: alternatively it could be possible to stop applying
* the filter when the ring became empty, but it can possibly
* happen a lot later... */
From Patrick McHardy: The tpacket_hdr is not clean for 64 bit kernel/32 bit userspace and is not extendable because the struct sockaddr_ll following it is expected at a fixed offset. Linux 2.6.27-rc supports a new tpacket frame header that removes these two limitations. Convert the mmap ring support to support both formats and probe for availability of the new version.
2008-08-06 07:49:19 +00:00
bp = (unsigned char*)h.raw + tp_mac;
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
run_bpf = (!handle->md.use_bpf) ||
((handle->md.use_bpf>1) && handle->md.use_bpf--);
if (run_bpf && handle->fcode.bf_insns &&
(bpf_filter(handle->fcode.bf_insns, bp,
From Patrick McHardy: The tpacket_hdr is not clean for 64 bit kernel/32 bit userspace and is not extendable because the struct sockaddr_ll following it is expected at a fixed offset. Linux 2.6.27-rc supports a new tpacket frame header that removes these two limitations. Convert the mmap ring support to support both formats and probe for availability of the new version.
2008-08-06 07:49:19 +00:00
tp_len, tp_snaplen) == 0))
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
goto skip;
From Tobias Poschwatta: correctly check the requested packet directions when processing packets in memory-mapped mode.
2009-02-14 21:19:13 +00:00
/*
* Do checks based on packet direction.
*/
From Patrick McHardy: The tpacket_hdr is not clean for 64 bit kernel/32 bit userspace and is not extendable because the struct sockaddr_ll following it is expected at a fixed offset. Linux 2.6.27-rc supports a new tpacket frame header that removes these two limitations. Convert the mmap ring support to support both formats and probe for availability of the new version.
2008-08-06 07:49:19 +00:00
sll = (void *)h.raw + TPACKET_ALIGN(handle->md.tp_hdrlen);
From Tobias Poschwatta: correctly check the requested packet directions when processing packets in memory-mapped mode.
2009-02-14 21:19:13 +00:00
if (sll->sll_pkttype == PACKET_OUTGOING) {
/*
* Outgoing packet.
* If this is from the loopback device, reject it;
* we'll see the packet as an incoming packet as well,
* and we don't want to see it twice.
*/
if (sll->sll_ifindex == handle->md.lo_ifindex)
goto skip;
/*
* If the user only wants incoming packets, reject it.
*/
if (handle->direction == PCAP_D_IN)
goto skip;
} else {
/*
* Incoming packet.
* If the user only wants outgoing packets, reject it.
*/
if (handle->direction == PCAP_D_OUT)
goto skip;
}
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
/* get required packet info from ring header */
From Patrick McHardy: The tpacket_hdr is not clean for 64 bit kernel/32 bit userspace and is not extendable because the struct sockaddr_ll following it is expected at a fixed offset. Linux 2.6.27-rc supports a new tpacket frame header that removes these two limitations. Convert the mmap ring support to support both formats and probe for availability of the new version.
2008-08-06 07:49:19 +00:00
pcaphdr.ts.tv_sec = tp_sec;
pcaphdr.ts.tv_usec = tp_usec;
pcaphdr.caplen = tp_snaplen;
pcaphdr.len = tp_len;
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
/* if required build in place the sll header*/
if (handle->md.cooked) {
Error messages returned in the pcap_t's error buffer shouldn't have a newline in them. If we're in cooked mode, the packet pointer argument we pass to the callback should point to the beginning of the constructed sll header, not to the packet data itself. While we're at it, have a paranoid check to make sure that we were given enough space to construct the sll header, so we don't stomp on the tpacket header.
2008-02-02 22:25:51 +00:00
struct sll_header *hdrp;
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
Error messages returned in the pcap_t's error buffer shouldn't have a newline in them. If we're in cooked mode, the packet pointer argument we pass to the callback should point to the beginning of the constructed sll header, not to the packet data itself. While we're at it, have a paranoid check to make sure that we were given enough space to construct the sll header, so we don't stomp on the tpacket header.
2008-02-02 22:25:51 +00:00
/*
* The kernel should have left us with enough
* space for an sll header; back up the packet
* data pointer into that space, as that'll be
* the beginning of the packet we pass to the
* callback.
*/
bp -= SLL_HDR_LEN;
/*
* Let's make sure that's past the end of
* the tpacket header, i.e. >=
* ((u_char *)thdr + TPACKET_HDRLEN), so we
* don't step on the header when we construct
* the sll header.
*/
From Patrick McHardy: The tpacket_hdr is not clean for 64 bit kernel/32 bit userspace and is not extendable because the struct sockaddr_ll following it is expected at a fixed offset. Linux 2.6.27-rc supports a new tpacket frame header that removes these two limitations. Convert the mmap ring support to support both formats and probe for availability of the new version.
2008-08-06 07:49:19 +00:00
if (bp < (u_char *)h.raw +
TPACKET_ALIGN(handle->md.tp_hdrlen) +
sizeof(struct sockaddr_ll)) {
Error messages returned in the pcap_t's error buffer shouldn't have a newline in them. If we're in cooked mode, the packet pointer argument we pass to the callback should point to the beginning of the constructed sll header, not to the packet data itself. While we're at it, have a paranoid check to make sure that we were given enough space to construct the sll header, so we don't stomp on the tpacket header.
2008-02-02 22:25:51 +00:00
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
"cooked-mode frame doesn't have room for sll header");
return -1;
}
/*
* OK, that worked; construct the sll header.
*/
hdrp = (struct sll_header *)bp;
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
hdrp->sll_pkttype = map_packet_type_to_sll_type(
sll->sll_pkttype);
hdrp->sll_hatype = htons(sll->sll_hatype);
hdrp->sll_halen = htons(sll->sll_halen);
memcpy(hdrp->sll_addr, sll->sll_addr, SLL_ADDRLEN);
hdrp->sll_protocol = sll->sll_protocol;
/* update packet len */
pcaphdr.caplen += SLL_HDR_LEN;
pcaphdr.len += SLL_HDR_LEN;
}
From Patrick McHardy: Similar to PACKET_AUXDATA for non-mmaped sockets, the VLAN TCI is present in a new member of struct tpacket2_hdr. Use it to reconstruct the VLAN header when necessary.
2008-08-06 07:51:29 +00:00
#ifdef HAVE_TPACKET2
if (handle->md.tp_version == TPACKET_V2 && h.h2->tp_vlan_tci &&
tp_snaplen >= 2 * ETH_ALEN) {
struct vlan_tag *tag;
bp -= VLAN_TAG_LEN;
memmove(bp, bp + VLAN_TAG_LEN, 2 * ETH_ALEN);
tag = (struct vlan_tag *)(bp + 2 * ETH_ALEN);
tag->vlan_tpid = htons(ETH_P_8021Q);
tag->vlan_tci = htons(h.h2->tp_vlan_tci);
pcaphdr.caplen += VLAN_TAG_LEN;
pcaphdr.len += VLAN_TAG_LEN;
}
#endif
When doing Linux mmapped capture: Allocate a buffer into which to copy a packet, and have the callback for pcap_next() and pcap_next_ex() copy to that buffer and return a pointer to that buffer; we can't return the packet data pointer passed to the callback, as, once the callback returns, that buffer can be overwritten, even before you read the next packet. Don't tweak filter programs passed into the kernel to return 65535 on success - we don't have to, as we're not reading packets with recvfrom(), and we don't want to, as, if we return the actual snapshot length, the kernel will copy less data to the ring buffer. Truncate the packet snapshot length to the specified length, as we might not have a filter to do that.
2009-07-16 22:08:12 +00:00
/*
* The only way to tell the kernel to cut off the
* packet at a snapshot length is with a filter program;
* if there's no filter program, the kernel won't cut
* the packet off.
*
* Trim the snapshot length to be no longer than the
* specified snapshot length.
*/
Fix typo.
2009-07-16 22:10:42 +00:00
if (pcaphdr.caplen > handle->snapshot)
pcaphdr.caplen = handle->snapshot;
When doing Linux mmapped capture: Allocate a buffer into which to copy a packet, and have the callback for pcap_next() and pcap_next_ex() copy to that buffer and return a pointer to that buffer; we can't return the packet data pointer passed to the callback, as, once the callback returns, that buffer can be overwritten, even before you read the next packet. Don't tweak filter programs passed into the kernel to return 65535 on success - we don't have to, as we're not reading packets with recvfrom(), and we don't want to, as, if we return the actual snapshot length, the kernel will copy less data to the ring buffer. Truncate the packet snapshot length to the specified length, as we might not have a filter to do that.
2009-07-16 22:08:12 +00:00
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
/* pass the packet to the user */
pkts++;
callback(user, &pcaphdr, bp);
handle->md.packets_read++;
skip:
Not releasing a packet in Linux memory-mapped mode until we try to read the next packet breaks select(). Back those changes out; we'll have to fix the behavior of pcap_next* by making a copy of the packet.
2009-07-03 21:37:06 +00:00
/* next packet */
switch (handle->md.tp_version) {
case TPACKET_V1:
h.h1->tp_status = TP_STATUS_KERNEL;
break;
#ifdef HAVE_TPACKET2
case TPACKET_V2:
h.h2->tp_status = TP_STATUS_KERNEL;
break;
#endif
}
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
if (++handle->offset >= handle->cc)
handle->offset = 0;
/* check for break loop condition*/
if (handle->break_loop) {
handle->break_loop = 0;
When reading from a BPF device, if we get ENXIO, which means "The device went down" on at least some OSes, return a message indicating that. When reading from a Linux PF_PACKET socket, if we get ENETDOWN, which means "The device went down", return a message indicating that. When doing a poll() on a PF_PACKET socket, check for various "something happened on this, but it's not readable" conditions.
2009-10-12 03:12:34 +00:00
return PCAP_ERROR_BREAK;
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
}
}
return pkts;
}
static int
pcap_setfilter_linux_mmap(pcap_t *handle, struct bpf_program *filter)
{
int n, offset;
When doing Linux mmapped capture: Allocate a buffer into which to copy a packet, and have the callback for pcap_next() and pcap_next_ex() copy to that buffer and return a pointer to that buffer; we can't return the packet data pointer passed to the callback, as, once the callback returns, that buffer can be overwritten, even before you read the next packet. Don't tweak filter programs passed into the kernel to return 65535 on success - we don't have to, as we're not reading packets with recvfrom(), and we don't want to, as, if we return the actual snapshot length, the kernel will copy less data to the ring buffer. Truncate the packet snapshot length to the specified length, as we might not have a filter to do that.
2009-07-16 22:08:12 +00:00
int ret;
/*
* Don't rewrite "ret" instructions; we don't need to, as
* we're not reading packets with recvmsg(), and we don't
* want to, as, by not rewriting them, the kernel can avoid
* copying extra data.
*/
ret = pcap_setfilter_linux_common(handle, filter, 1);
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
if (ret < 0)
return ret;
/* if the kernel filter is enabled, we need to apply the filter on
* all packets present into the ring. Get an upper bound of their number
*/
if (!handle->md.use_bpf)
return ret;
/* walk the ring backward and count the free slot */
offset = handle->offset;
if (--handle->offset < 0)
handle->offset = handle->cc - 1;
for (n=0; n < handle->cc; ++n) {
if (--handle->offset < 0)
handle->offset = handle->cc - 1;
From Patrick McHardy: The tpacket_hdr is not clean for 64 bit kernel/32 bit userspace and is not extendable because the struct sockaddr_ll following it is expected at a fixed offset. Linux 2.6.27-rc supports a new tpacket frame header that removes these two limitations. Convert the mmap ring support to support both formats and probe for availability of the new version.
2008-08-06 07:49:19 +00:00
if (!pcap_get_ring_frame(handle, TP_STATUS_KERNEL))
From Paolo Abeni: support for a memory-mapped capture buffer.
2008-01-05 22:32:31 +00:00
break;
}
/* be careful to not change current ring position */
handle->offset = offset;
/* store the number of packets currently present in the ring */
handle->md.use_bpf = 1 + (handle->cc - n);
return ret;
}
#endif /* HAVE_PACKET_RING */
Some platforms that lack <netpacket/packet.h> define PF_PACKET but don't support PF_PACKET sockets, and, in particular, don't define in <linux/if_packet.h> any of the stuff needed by the code to handle PF_PACKET sockets. Define HAVE_PF_PACKET_SOCKETS if either 1) we have <netpacket/packet.h> or 2) PF_PACKET is defined *and* PACKET_HOST is defined by <linux/if_packet.h> and use HAVE_PF_PACKET_SOCKETS, not PF_PACKET, be what we use in #ifdefs to conditionally compile in support for PF_PACKET sockets. Not all platforms define ARPHRD_SIT, either; #define it if it's not already defined.
2001-01-18 03:58:22 +00:00
#ifdef HAVE_PF_PACKET_SOCKETS
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
/*
whitespace cleanup
2002-06-11 17:04:44 +00:00
* Return the index of the given device name. Fill ebuf and return
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
* -1 on failure.
*/
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
static int
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
iface_get_id(int fd, const char *device, char *ebuf)
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
{
struct ifreq ifr;
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
memset(&ifr, 0, sizeof(ifr));
strncpy(ifr.ifr_name, device, sizeof(ifr.ifr_name));
Initial revision
1999-10-07 23:46:40 +00:00
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
if (ioctl(fd, SIOCGIFINDEX, &ifr) == -1) {
use snprintf instead of sprintf. From Juergen Schoenwaelder <schoenw@ibr.cs.tu-bs.de>
2000-07-04 12:24:01 +00:00
snprintf(ebuf, PCAP_ERRBUF_SIZE,
Indicate *which* ioctl failed.
2006-09-18 17:32:30 +00:00
"SIOCGIFINDEX: %s", pcap_strerror(errno));
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
return -1;
Initial revision
1999-10-07 23:46:40 +00:00
}
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
return ifr.ifr_ifindex;
}
/*
whitespace cleanup
2002-06-11 17:04:44 +00:00
* Bind the socket associated with FD to the given device.
When activating a device, return PCAP_ERROR_IFACE_NOT_UP if the device isn't up, so applications can report that differently from a generic error (the latter could mean there's a bug somewhere in libpcap). When capturing on a device without mmap on Linux, ignore ENETDOWN, so that we can continue to capture traffic if the interface goes down and comes back up again; comments in the kernel indicate that we'll just block waiting for packets if we try to receive from a socket that delivered ENETDOWN, and, if we're using a memory-mapped buffer, we won't even get notified of "network down" events.
2008-07-01 08:02:33 +00:00
* Return 1 on success, 0 if we should try a SOCK_PACKET socket,
* or a PCAP_ERROR_ value on a hard error.
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
*/
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
static int
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
iface_bind(int fd, int ifindex, char *ebuf)
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
{
struct sockaddr_ll sll;
Bug fixes from Graeme Hewson <ghewson@cix.compulink.co.uk>: 1. During termination processing set up by atexit() under a 2.0.x kernel, if a socket had been previously closed and the handle freed due to an error, pcap_close_all() and pcap_close_linux() would nevertheless try to work with these structures and then crash. pcap_close_linux() is now called directly when necessary during error processing. 2. atexit() could get called more than once because the did_atexit flag wasn't being set. 3. If iface_get_arptype() returns an error because the ioctl() call failed (probably due to "no such device"), live_open_new() now returns a fatal error to pcap_open_live() and the call to live_open_old() is short-circuited. 4. Applications using libpcap would appear to listen on an interface that was down. a. iface_bind() and iface_bind_old() now check for pending errors after bind(). In turn, pcap_open_live() now returns an error status if there was a pending error after bind(). b. After draining the socket, set_kernel_filter() now checks to see if the error was the expected EAGAIN and returns a fatal error to pcap_setfilter() if not. In turn, pcap_setfilter() now returns an error status if there was a network error. 5. pcap_setfilter() was putting an error message into errbuf after a failed call to install_bpf_program(). This was unnecessary since install_bpf_program() puts its own error message into errbuf.
2002-02-22 09:20:11 +00:00
int err;
socklen_t errlen = sizeof(err);
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
memset(&sll, 0, sizeof(sll));
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
sll.sll_family = AF_PACKET;
sll.sll_ifindex = ifindex;
sll.sll_protocol = htons(ETH_P_ALL);
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
if (bind(fd, (struct sockaddr *) &sll, sizeof(sll)) == -1) {
When activating a device, return PCAP_ERROR_IFACE_NOT_UP if the device isn't up, so applications can report that differently from a generic error (the latter could mean there's a bug somewhere in libpcap). When capturing on a device without mmap on Linux, ignore ENETDOWN, so that we can continue to capture traffic if the interface goes down and comes back up again; comments in the kernel indicate that we'll just block waiting for packets if we try to receive from a socket that delivered ENETDOWN, and, if we're using a memory-mapped buffer, we won't even get notified of "network down" events.
2008-07-01 08:02:33 +00:00
if (errno == ENETDOWN) {
/*
* Return a "network down" indication, so that
* the application can report that rather than
* saying we had a mysterious failure and
* suggest that they report a problem to the
* libpcap developers.
*/
return PCAP_ERROR_IFACE_NOT_UP;
} else {
snprintf(ebuf, PCAP_ERRBUF_SIZE,
"bind: %s", pcap_strerror(errno));
return PCAP_ERROR;
}
Initial revision
1999-10-07 23:46:40 +00:00
}
Bug fixes from Graeme Hewson <ghewson@cix.compulink.co.uk>: 1. During termination processing set up by atexit() under a 2.0.x kernel, if a socket had been previously closed and the handle freed due to an error, pcap_close_all() and pcap_close_linux() would nevertheless try to work with these structures and then crash. pcap_close_linux() is now called directly when necessary during error processing. 2. atexit() could get called more than once because the did_atexit flag wasn't being set. 3. If iface_get_arptype() returns an error because the ioctl() call failed (probably due to "no such device"), live_open_new() now returns a fatal error to pcap_open_live() and the call to live_open_old() is short-circuited. 4. Applications using libpcap would appear to listen on an interface that was down. a. iface_bind() and iface_bind_old() now check for pending errors after bind(). In turn, pcap_open_live() now returns an error status if there was a pending error after bind(). b. After draining the socket, set_kernel_filter() now checks to see if the error was the expected EAGAIN and returns a fatal error to pcap_setfilter() if not. In turn, pcap_setfilter() now returns an error status if there was a network error. 5. pcap_setfilter() was putting an error message into errbuf after a failed call to install_bpf_program(). This was unnecessary since install_bpf_program() puts its own error message into errbuf.
2002-02-22 09:20:11 +00:00
/* Any pending errors, e.g., network is down? */
if (getsockopt(fd, SOL_SOCKET, SO_ERROR, &err, &errlen) == -1) {
snprintf(ebuf, PCAP_ERRBUF_SIZE,
"getsockopt: %s", pcap_strerror(errno));
When activating a device, return PCAP_ERROR_IFACE_NOT_UP if the device isn't up, so applications can report that differently from a generic error (the latter could mean there's a bug somewhere in libpcap). When capturing on a device without mmap on Linux, ignore ENETDOWN, so that we can continue to capture traffic if the interface goes down and comes back up again; comments in the kernel indicate that we'll just block waiting for packets if we try to receive from a socket that delivered ENETDOWN, and, if we're using a memory-mapped buffer, we won't even get notified of "network down" events.
2008-07-01 08:02:33 +00:00
return 0;
Bug fixes from Graeme Hewson <ghewson@cix.compulink.co.uk>: 1. During termination processing set up by atexit() under a 2.0.x kernel, if a socket had been previously closed and the handle freed due to an error, pcap_close_all() and pcap_close_linux() would nevertheless try to work with these structures and then crash. pcap_close_linux() is now called directly when necessary during error processing. 2. atexit() could get called more than once because the did_atexit flag wasn't being set. 3. If iface_get_arptype() returns an error because the ioctl() call failed (probably due to "no such device"), live_open_new() now returns a fatal error to pcap_open_live() and the call to live_open_old() is short-circuited. 4. Applications using libpcap would appear to listen on an interface that was down. a. iface_bind() and iface_bind_old() now check for pending errors after bind(). In turn, pcap_open_live() now returns an error status if there was a pending error after bind(). b. After draining the socket, set_kernel_filter() now checks to see if the error was the expected EAGAIN and returns a fatal error to pcap_setfilter() if not. In turn, pcap_setfilter() now returns an error status if there was a network error. 5. pcap_setfilter() was putting an error message into errbuf after a failed call to install_bpf_program(). This was unnecessary since install_bpf_program() puts its own error message into errbuf.
2002-02-22 09:20:11 +00:00
}
When activating a device, return PCAP_ERROR_IFACE_NOT_UP if the device isn't up, so applications can report that differently from a generic error (the latter could mean there's a bug somewhere in libpcap). When capturing on a device without mmap on Linux, ignore ENETDOWN, so that we can continue to capture traffic if the interface goes down and comes back up again; comments in the kernel indicate that we'll just block waiting for packets if we try to receive from a socket that delivered ENETDOWN, and, if we're using a memory-mapped buffer, we won't even get notified of "network down" events.
2008-07-01 08:02:33 +00:00
if (err == ENETDOWN) {
/*
* Return a "network down" indication, so that
* the application can report that rather than
* saying we had a mysterious failure and
* suggest that they report a problem to the
* libpcap developers.
*/
return PCAP_ERROR_IFACE_NOT_UP;
} else if (err > 0) {
Bug fixes from Graeme Hewson <ghewson@cix.compulink.co.uk>: 1. During termination processing set up by atexit() under a 2.0.x kernel, if a socket had been previously closed and the handle freed due to an error, pcap_close_all() and pcap_close_linux() would nevertheless try to work with these structures and then crash. pcap_close_linux() is now called directly when necessary during error processing. 2. atexit() could get called more than once because the did_atexit flag wasn't being set. 3. If iface_get_arptype() returns an error because the ioctl() call failed (probably due to "no such device"), live_open_new() now returns a fatal error to pcap_open_live() and the call to live_open_old() is short-circuited. 4. Applications using libpcap would appear to listen on an interface that was down. a. iface_bind() and iface_bind_old() now check for pending errors after bind(). In turn, pcap_open_live() now returns an error status if there was a pending error after bind(). b. After draining the socket, set_kernel_filter() now checks to see if the error was the expected EAGAIN and returns a fatal error to pcap_setfilter() if not. In turn, pcap_setfilter() now returns an error status if there was a network error. 5. pcap_setfilter() was putting an error message into errbuf after a failed call to install_bpf_program(). This was unnecessary since install_bpf_program() puts its own error message into errbuf.
2002-02-22 09:20:11 +00:00
snprintf(ebuf, PCAP_ERRBUF_SIZE,
whitespace cleanup
2002-06-11 17:04:44 +00:00
"bind: %s", pcap_strerror(err));
When activating a device, return PCAP_ERROR_IFACE_NOT_UP if the device isn't up, so applications can report that differently from a generic error (the latter could mean there's a bug somewhere in libpcap). When capturing on a device without mmap on Linux, ignore ENETDOWN, so that we can continue to capture traffic if the interface goes down and comes back up again; comments in the kernel indicate that we'll just block waiting for packets if we try to receive from a socket that delivered ENETDOWN, and, if we're using a memory-mapped buffer, we won't even get notified of "network down" events.
2008-07-01 08:02:33 +00:00
return 0;
Bug fixes from Graeme Hewson <ghewson@cix.compulink.co.uk>: 1. During termination processing set up by atexit() under a 2.0.x kernel, if a socket had been previously closed and the handle freed due to an error, pcap_close_all() and pcap_close_linux() would nevertheless try to work with these structures and then crash. pcap_close_linux() is now called directly when necessary during error processing. 2. atexit() could get called more than once because the did_atexit flag wasn't being set. 3. If iface_get_arptype() returns an error because the ioctl() call failed (probably due to "no such device"), live_open_new() now returns a fatal error to pcap_open_live() and the call to live_open_old() is short-circuited. 4. Applications using libpcap would appear to listen on an interface that was down. a. iface_bind() and iface_bind_old() now check for pending errors after bind(). In turn, pcap_open_live() now returns an error status if there was a pending error after bind(). b. After draining the socket, set_kernel_filter() now checks to see if the error was the expected EAGAIN and returns a fatal error to pcap_setfilter() if not. In turn, pcap_setfilter() now returns an error status if there was a network error. 5. pcap_setfilter() was putting an error message into errbuf after a failed call to install_bpf_program(). This was unnecessary since install_bpf_program() puts its own error message into errbuf.
2002-02-22 09:20:11 +00:00
}
When activating a device, return PCAP_ERROR_IFACE_NOT_UP if the device isn't up, so applications can report that differently from a generic error (the latter could mean there's a bug somewhere in libpcap). When capturing on a device without mmap on Linux, ignore ENETDOWN, so that we can continue to capture traffic if the interface goes down and comes back up again; comments in the kernel indicate that we'll just block waiting for packets if we try to receive from a socket that delivered ENETDOWN, and, if we're using a memory-mapped buffer, we won't even get notified of "network down" events.
2008-07-01 08:02:33 +00:00
return 1;
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
}
When checking whether a device will let you turn monitor mode on, assume mac80211 devices will, regardless of whether they support the Wireless Extensions - wmaster devices will let you turn monitor mode on but don't appear to support the Wireless Extensions. Support turning on monitor mode with libnl even if we don't have support for the Wireless Extensions, just in case the Wireless Extensions go away at some point in the future if every 802.11 device has a mac80211 driver.
2009-06-01 19:56:05 +00:00
#ifdef IW_MODE_MONITOR
/*
* Check whether the device supports the Wireless Extensions.
* Returns 1 if it does, 0 if it doesn't, PCAP_ERROR_NO_SUCH_DEVICE
* if the device doesn't even exist.
*/
static int
has_wext(int sock_fd, const char *device, char *ebuf)
{
struct iwreq ireq;
strncpy(ireq.ifr_ifrn.ifrn_name, device,
sizeof ireq.ifr_ifrn.ifrn_name);
ireq.ifr_ifrn.ifrn_name[sizeof ireq.ifr_ifrn.ifrn_name - 1] = 0;
if (ioctl(sock_fd, SIOCGIWNAME, &ireq) >= 0)
return 1; /* yes */
snprintf(ebuf, PCAP_ERRBUF_SIZE,
"%s: SIOCGIWPRIV: %s", device, pcap_strerror(errno));
if (errno == ENODEV)
return PCAP_ERROR_NO_SUCH_DEVICE;
return 0;
}
/*
* Per me si va ne la citta dolente,
* Per me si va ne l'etterno dolore,
* ...
* Lasciate ogne speranza, voi ch'intrate.
*
* XXX - airmon-ng does special stuff with the Orinoco driver and the
* wlan-ng driver.
*/
typedef enum {
MONITOR_WEXT,
MONITOR_HOSTAP,
MONITOR_PRISM,
MONITOR_PRISM54,
MONITOR_ACX100,
MONITOR_RT2500,
MONITOR_RT2570,
MONITOR_RT73,
MONITOR_RTL8XXX
} monitor_type;
Clean up promiscuous mode, when using SOCK_PACKET, as best we can; remember which pcap_t's were opened (with SOCK_PACKET) in promiscuous mode on interfaces not already in promiscuous mode, turn promiscuous mode off when closing such a pcap_t, and arrange that, when the program exits, all pcap_t's of that sort not already closed have their interfaces taken out of promiscuous mode. (It's not sufficient to do this on exit - applications may close a pcap_t without exiting, e.g. Ethereal.) This won't always work right (if somebody else requests promiscuous mode after it's opened by libpcap, we'll turn promiscuous mode off when we close the pcap_t, and if the program doesn't exit cleanly, it won't clean up the interfaces), but neither of those problems are fixable - the only way to get things to work correctly is to use PF_PACKET sockets, which requires a 2.2 or later kernel. On a 2.0[.x] kernel, when doing a "recvfrom()" on a SOCK_PACKET socket to read a captured packet, don't pass a byte count value based on the snapshot length - "recvfrom()" won't return the actual packet length if you do that. (2.2 and later kernels will return the actual packet length if MSG_TRUNC is passed in.)
2000-12-16 10:43:26 +00:00
/*
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
* Use the Wireless Extensions, if we have them, to try to turn monitor mode
* on if it's not already on.
*
* Returns 1 on success, 0 if we don't support the Wireless Extensions
* on this device, or a PCAP_ERROR_ value if we do support them but
* we weren't able to turn monitor mode on.
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
*/
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
static int
enter_rfmon_mode_wext(pcap_t *handle, int sock_fd, const char *device)
{
/*
* XXX - at least some adapters require non-Wireless Extensions
* mechanisms to turn monitor mode on.
*
* Atheros cards might require that a separate "monitor virtual access
* point" be created, with later versions of the madwifi driver.
A pile of comments, from looking at aircrack-ng's airmon-ng, and experimenting with an adapter with a mac80211 driver.
2008-09-22 01:12:34 +00:00
* airmon-ng does "wlanconfig ath create wlandev {if} wlanmode
* monitor -bssid", which apparently spits out a line "athN"
* where "athN" is the monitor mode device. To leave monitor
* mode, it destroys the monitor mode device.
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
*
* Some Intel Centrino adapters might require private ioctls to get
* radio headers; the ipw2200 and ipw3945 drivers allow you to
* configure a separate "rtapN" interface to capture in monitor
* mode without preventing the adapter from operating normally.
A pile of comments, from looking at aircrack-ng's airmon-ng, and experimenting with an adapter with a mac80211 driver.
2008-09-22 01:12:34 +00:00
* (airmon-ng doesn't appear to use that, though.)
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
*
* It would be Truly Wonderful if mac80211 and nl80211 cleaned this
* up, and if all drivers were converted to mac80211 drivers.
A pile of comments, from looking at aircrack-ng's airmon-ng, and experimenting with an adapter with a mac80211 driver.
2008-09-22 01:12:34 +00:00
*
* If interface {if} is a mac80211 driver, the file
* /sys/class/net/{if}/phy80211 is a symlink to
* /sys/class/ieee80211/{phydev}, for some {phydev}.
*
* On Fedora 9, with a 2.6.26.3-29 kernel, my Zydas stick, at
* least, has a "wmaster0" device and a "wlan0" device; the
* latter is the one with the IP address. Both show up in
* "tcpdump -D" output. Capturing on the wmaster0 device
* captures with 802.11 headers.
*
* airmon-ng searches through /sys/class/net for devices named
* monN, starting with mon0; as soon as one *doesn't* exist,
* it chooses that as the monitor device name. If the "iw"
* command exists, it does "iw dev {if} interface add {monif}
* type monitor", where {monif} is the monitor device. It
* then (sigh) sleeps .1 second, and then configures the
* device up. Otherwise, if /sys/class/ieee80211/{phydev}/add_iface
* is a file, it writes {mondev}, without a newline, to that file,
* and again (sigh) sleeps .1 second, and then iwconfig's that
* device into monitor mode and configures it up. Otherwise,
* you can't do monitor mode.
*
* All these devices are "glued" together by having the
* /sys/class/net/{device}/phy80211 links pointing to the same
* place, so, given a wmaster, wlan, or mon device, you can
* find the other devices by looking for devices with
* the same phy80211 link.
*
* To turn monitor mode off, delete the monitor interface,
* either with "iw dev {monif} interface del" or by sending
* {monif}, with no NL, down /sys/class/ieee80211/{phydev}/remove_iface
*
* Note: if you try to create a monitor device named "monN", and
* there's already a "monN" device, it fails, as least with
* the netlink interface (which is what iw uses), with a return
* value of -ENFILE. (Return values are negative errnos.) We
* could probably use that to find an unused device.
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
*/
int err;
struct iwreq ireq;
struct iw_priv_args *priv;
monitor_type montype;
int i;
__u32 cmd;
int args[2];
int channel;
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
/*
* Does this device *support* the Wireless Extensions?
*/
Add an error for "you don't have permission to open that device", as that often means "sorry, this platform requires you to run as root or to somehow tweak the system to give you capture privileges", and applications might want to explain that in a way that does a better job of letting the user know what they have to do. Try to return or PCAP_ERROR_PERM_DENIED for open errors, rather than just returning PCAP_ERROR, so that the application can, if it chooses, try to explain the error better (as those two errors are the ones that don't mean "there's probably some obscure OS or libpcap problem", but mean, instead, "you made an error" or "you need to get permission to capture"). Check for monitor mode *after* checking whether the device exists in the first place; a non-existent device doesn't support monitor mode, but that's because it doesn't, well, exist, and the latter would be a more meaningful error. Have pcap_open_live() supply an error message for return values other than PCAP_ERROR, PCAP_ERROR_NO_SUCH_DEVICE, and PCAP_ERROR_PERM_DENIED - those all supply error strings (PCAP_ERROR because it's for various OS problems that might require debugging, and the other two because there might be multiple causes).
2008-04-09 19:58:02 +00:00
err = has_wext(sock_fd, device, handle->errbuf);
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
if (err <= 0)
return err; /* either it doesn't or the device doesn't even exist */
/*
* Try to get all the Wireless Extensions private ioctls
* supported by this device.
*
* First, get the size of the buffer we need, by supplying no
* buffer and a length of 0. If the device supports private
* ioctls, it should return E2BIG, with ireq.u.data.length set
* to the length we need. If it doesn't support them, it should
* return EOPNOTSUPP.
*/
memset(&ireq, 0, sizeof ireq);
strncpy(ireq.ifr_ifrn.ifrn_name, device,
sizeof ireq.ifr_ifrn.ifrn_name);
ireq.ifr_ifrn.ifrn_name[sizeof ireq.ifr_ifrn.ifrn_name - 1] = 0;
Squelch some compile warnings with older Linux kernels.
2009-07-04 21:17:36 +00:00
ireq.u.data.pointer = (void *)args;
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
ireq.u.data.length = 0;
ireq.u.data.flags = 0;
if (ioctl(sock_fd, SIOCGIWPRIV, &ireq) != -1) {
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
"%s: SIOCGIWPRIV with a zero-length buffer didn't fail!",
device);
return PCAP_ERROR;
}
if (errno == EOPNOTSUPP) {
/*
* No private ioctls, so we assume that there's only one
* DLT_ for monitor mode.
*/
return 0;
}
if (errno != E2BIG) {
/*
* Failed.
*/
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
"%s: SIOCGIWPRIV: %s", device, pcap_strerror(errno));
return PCAP_ERROR;
}
The value you get back from a SIOCGIWPRIV querying how much stuff you get back is in units of struct iw_priv_args, not in units of bytes.
2008-04-04 20:51:43 +00:00
priv = malloc(ireq.u.data.length * sizeof (struct iw_priv_args));
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
if (priv == NULL) {
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
"malloc: %s", pcap_strerror(errno));
return PCAP_ERROR;
}
Squelch some compile warnings with older Linux kernels.
2009-07-04 21:17:36 +00:00
ireq.u.data.pointer = (void *)priv;
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
if (ioctl(sock_fd, SIOCGIWPRIV, &ireq) == -1) {
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
"%s: SIOCGIWPRIV: %s", device, pcap_strerror(errno));
Free the memory allocated for the Wireless Extensions private ioctl list before returning.
2008-04-07 00:31:47 +00:00
free(priv);
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
return PCAP_ERROR;
}
Clean up promiscuous mode, when using SOCK_PACKET, as best we can; remember which pcap_t's were opened (with SOCK_PACKET) in promiscuous mode on interfaces not already in promiscuous mode, turn promiscuous mode off when closing such a pcap_t, and arrange that, when the program exits, all pcap_t's of that sort not already closed have their interfaces taken out of promiscuous mode. (It's not sufficient to do this on exit - applications may close a pcap_t without exiting, e.g. Ethereal.) This won't always work right (if somebody else requests promiscuous mode after it's opened by libpcap, we'll turn promiscuous mode off when we close the pcap_t, and if the program doesn't exit cleanly, it won't clean up the interfaces), but neither of those problems are fixable - the only way to get things to work correctly is to use PF_PACKET sockets, which requires a 2.2 or later kernel. On a 2.0[.x] kernel, when doing a "recvfrom()" on a SOCK_PACKET socket to read a captured packet, don't pass a byte count value based on the snapshot length - "recvfrom()" won't return the actual packet length if you do that. (2.2 and later kernels will return the actual packet length if MSG_TRUNC is passed in.)
2000-12-16 10:43:26 +00:00
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
/*
* Look for private ioctls to turn monitor mode on or, if
* monitor mode is on, to set the header type.
*/
montype = MONITOR_WEXT;
cmd = 0;
for (i = 0; i < ireq.u.data.length; i++) {
if (strcmp(priv[i].name, "monitor_type") == 0) {
/*
* Hostap driver, use this one.
* Set monitor mode first.
* You can set it to 0 to get DLT_IEEE80211,
From a quick look at the hostap driver, it appears that newer versions support the Radiotap header.
2009-04-07 20:20:07 +00:00
* 1 to get DLT_PRISM, 2 to get
* DLT_IEEE80211_RADIO_AVS, and, with more
* recent versions of the driver, 3 to get
* DLT_IEEE80211_RADIO.
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
*/
if ((priv[i].set_args & IW_PRIV_TYPE_MASK) != IW_PRIV_TYPE_INT)
break;
if (!(priv[i].set_args & IW_PRIV_SIZE_FIXED))
break;
if ((priv[i].set_args & IW_PRIV_SIZE_MASK) != 1)
break;
montype = MONITOR_HOSTAP;
cmd = priv[i].cmd;
break;
}
if (strcmp(priv[i].name, "set_prismhdr") == 0) {
/*
* Prism54 driver, use this one.
* Set monitor mode first.
* You can set it to 2 to get DLT_IEEE80211
* or 3 or get DLT_PRISM.
*/
if ((priv[i].set_args & IW_PRIV_TYPE_MASK) != IW_PRIV_TYPE_INT)
break;
if (!(priv[i].set_args & IW_PRIV_SIZE_FIXED))
break;
if ((priv[i].set_args & IW_PRIV_SIZE_MASK) != 1)
break;
montype = MONITOR_PRISM54;
cmd = priv[i].cmd;
break;
}
if (strcmp(priv[i].name, "forceprismheader") == 0) {
/*
* RT2570 driver, use this one.
* Do this after turning monitor mode on.
* You can set it to 1 to get DLT_PRISM or 2
* to get DLT_IEEE80211.
*/
if ((priv[i].set_args & IW_PRIV_TYPE_MASK) != IW_PRIV_TYPE_INT)
break;
if (!(priv[i].set_args & IW_PRIV_SIZE_FIXED))
break;
if ((priv[i].set_args & IW_PRIV_SIZE_MASK) != 1)
break;
montype = MONITOR_RT2570;
cmd = priv[i].cmd;
break;
}
if (strcmp(priv[i].name, "forceprism") == 0) {
/*
* RT73 driver, use this one.
* Do this after turning monitor mode on.
* Its argument is a *string*; you can
* set it to "1" to get DLT_PRISM or "2"
* to get DLT_IEEE80211.
*/
if ((priv[i].set_args & IW_PRIV_TYPE_MASK) != IW_PRIV_TYPE_CHAR)
break;
if (priv[i].set_args & IW_PRIV_SIZE_FIXED)
break;
montype = MONITOR_RT73;
cmd = priv[i].cmd;
break;
}
if (strcmp(priv[i].name, "prismhdr") == 0) {
/*
* One of the RTL8xxx drivers, use this one.
* It can only be done after monitor mode
* has been turned on. You can set it to 1
* to get DLT_PRISM or 0 to get DLT_IEEE80211.
*/
if ((priv[i].set_args & IW_PRIV_TYPE_MASK) != IW_PRIV_TYPE_INT)
break;
if (!(priv[i].set_args & IW_PRIV_SIZE_FIXED))
break;
if ((priv[i].set_args & IW_PRIV_SIZE_MASK) != 1)
break;
montype = MONITOR_RTL8XXX;
cmd = priv[i].cmd;
break;
}
if (strcmp(priv[i].name, "rfmontx") == 0) {
/*
* RT2500 or RT61 driver, use this one.
* It has one one-byte parameter; set
* u.data.length to 1 and u.data.pointer to
* point to the parameter.
* It doesn't itself turn monitor mode on.
* You can set it to 1 to allow transmitting
* in monitor mode(?) and get DLT_IEEE80211,
* or set it to 0 to disallow transmitting in
* monitor mode(?) and get DLT_PRISM.
*/
if ((priv[i].set_args & IW_PRIV_TYPE_MASK) != IW_PRIV_TYPE_INT)
break;
if ((priv[i].set_args & IW_PRIV_SIZE_MASK) != 2)
break;
montype = MONITOR_RT2500;
cmd = priv[i].cmd;
break;
}
if (strcmp(priv[i].name, "monitor") == 0) {
/*
* Either ACX100 or hostap, use this one.
* It turns monitor mode on.
* If it takes two arguments, it's ACX100;
* the first argument is 1 for DLT_PRISM
* or 2 for DLT_IEEE80211, and the second
* argument is the channel on which to
* run. If it takes one argument, it's
* HostAP, and the argument is 2 for
* DLT_IEEE80211 and 3 for DLT_PRISM.
*
* If we see this, we don't quit, as this
* might be a version of the hostap driver
* that also supports "monitor_type".
*/
if ((priv[i].set_args & IW_PRIV_TYPE_MASK) != IW_PRIV_TYPE_INT)
break;
if (!(priv[i].set_args & IW_PRIV_SIZE_FIXED))
break;
switch (priv[i].set_args & IW_PRIV_SIZE_MASK) {
Clean up promiscuous mode, when using SOCK_PACKET, as best we can; remember which pcap_t's were opened (with SOCK_PACKET) in promiscuous mode on interfaces not already in promiscuous mode, turn promiscuous mode off when closing such a pcap_t, and arrange that, when the program exits, all pcap_t's of that sort not already closed have their interfaces taken out of promiscuous mode. (It's not sufficient to do this on exit - applications may close a pcap_t without exiting, e.g. Ethereal.) This won't always work right (if somebody else requests promiscuous mode after it's opened by libpcap, we'll turn promiscuous mode off when we close the pcap_t, and if the program doesn't exit cleanly, it won't clean up the interfaces), but neither of those problems are fixable - the only way to get things to work correctly is to use PF_PACKET sockets, which requires a 2.2 or later kernel. On a 2.0[.x] kernel, when doing a "recvfrom()" on a SOCK_PACKET socket to read a captured packet, don't pass a byte count value based on the snapshot length - "recvfrom()" won't return the actual packet length if you do that. (2.2 and later kernels will return the actual packet length if MSG_TRUNC is passed in.)
2000-12-16 10:43:26 +00:00
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
case 1:
montype = MONITOR_PRISM;
cmd = priv[i].cmd;
break;
Clean up promiscuous mode, when using SOCK_PACKET, as best we can; remember which pcap_t's were opened (with SOCK_PACKET) in promiscuous mode on interfaces not already in promiscuous mode, turn promiscuous mode off when closing such a pcap_t, and arrange that, when the program exits, all pcap_t's of that sort not already closed have their interfaces taken out of promiscuous mode. (It's not sufficient to do this on exit - applications may close a pcap_t without exiting, e.g. Ethereal.) This won't always work right (if somebody else requests promiscuous mode after it's opened by libpcap, we'll turn promiscuous mode off when we close the pcap_t, and if the program doesn't exit cleanly, it won't clean up the interfaces), but neither of those problems are fixable - the only way to get things to work correctly is to use PF_PACKET sockets, which requires a 2.2 or later kernel. On a 2.0[.x] kernel, when doing a "recvfrom()" on a SOCK_PACKET socket to read a captured packet, don't pass a byte count value based on the snapshot length - "recvfrom()" won't return the actual packet length if you do that. (2.2 and later kernels will return the actual packet length if MSG_TRUNC is passed in.)
2000-12-16 10:43:26 +00:00
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
case 2:
montype = MONITOR_ACX100;
cmd = priv[i].cmd;
break;
default:
break;
}
}
}
Free the memory allocated for the Wireless Extensions private ioctl list before returning.
2008-04-07 00:31:47 +00:00
free(priv);
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
/*
* XXX - ipw3945? islism?
*/
/*
* Get the old mode.
*/
strncpy(ireq.ifr_ifrn.ifrn_name, device,
sizeof ireq.ifr_ifrn.ifrn_name);
ireq.ifr_ifrn.ifrn_name[sizeof ireq.ifr_ifrn.ifrn_name - 1] = 0;
if (ioctl(sock_fd, SIOCGIWMODE, &ireq) == -1) {
/*
* We probably won't be able to set the mode, either.
*/
return PCAP_ERROR_RFMON_NOTSUP;
}
/*
* Is it currently in monitor mode?
*/
if (ireq.u.mode == IW_MODE_MONITOR) {
/*
* Yes. Just leave things as they are.
* We don't offer multiple link-layer types, as
* changing the link-layer type out from under
* somebody else capturing in monitor mode would
* be considered rude.
*/
return 1;
}
/*
* No. We have to put the adapter into rfmon mode.
*/
/*
* If we haven't already done so, arrange to have
* "pcap_close_all()" called when we exit.
*/
if (!pcap_do_addexit(handle)) {
/*
* "atexit()" failed; don't put the interface
* in rfmon mode, just give up.
*/
return PCAP_ERROR_RFMON_NOTSUP;
}
/*
* Save the old mode.
*/
handle->md.oldmode = ireq.u.mode;
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
/*
* Put the adapter in rfmon mode. How we do this depends
* on whether we have a special private ioctl or not.
*/
if (montype == MONITOR_PRISM) {
Clean up promiscuous mode, when using SOCK_PACKET, as best we can; remember which pcap_t's were opened (with SOCK_PACKET) in promiscuous mode on interfaces not already in promiscuous mode, turn promiscuous mode off when closing such a pcap_t, and arrange that, when the program exits, all pcap_t's of that sort not already closed have their interfaces taken out of promiscuous mode. (It's not sufficient to do this on exit - applications may close a pcap_t without exiting, e.g. Ethereal.) This won't always work right (if somebody else requests promiscuous mode after it's opened by libpcap, we'll turn promiscuous mode off when we close the pcap_t, and if the program doesn't exit cleanly, it won't clean up the interfaces), but neither of those problems are fixable - the only way to get things to work correctly is to use PF_PACKET sockets, which requires a 2.2 or later kernel. On a 2.0[.x] kernel, when doing a "recvfrom()" on a SOCK_PACKET socket to read a captured packet, don't pass a byte count value based on the snapshot length - "recvfrom()" won't return the actual packet length if you do that. (2.2 and later kernels will return the actual packet length if MSG_TRUNC is passed in.)
2000-12-16 10:43:26 +00:00
/*
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
* We have the "monitor" private ioctl, but none of
* the other private ioctls. Use this, and select
* the Prism header.
Clean up promiscuous mode, when using SOCK_PACKET, as best we can; remember which pcap_t's were opened (with SOCK_PACKET) in promiscuous mode on interfaces not already in promiscuous mode, turn promiscuous mode off when closing such a pcap_t, and arrange that, when the program exits, all pcap_t's of that sort not already closed have their interfaces taken out of promiscuous mode. (It's not sufficient to do this on exit - applications may close a pcap_t without exiting, e.g. Ethereal.) This won't always work right (if somebody else requests promiscuous mode after it's opened by libpcap, we'll turn promiscuous mode off when we close the pcap_t, and if the program doesn't exit cleanly, it won't clean up the interfaces), but neither of those problems are fixable - the only way to get things to work correctly is to use PF_PACKET sockets, which requires a 2.2 or later kernel. On a 2.0[.x] kernel, when doing a "recvfrom()" on a SOCK_PACKET socket to read a captured packet, don't pass a byte count value based on the snapshot length - "recvfrom()" won't return the actual packet length if you do that. (2.2 and later kernels will return the actual packet length if MSG_TRUNC is passed in.)
2000-12-16 10:43:26 +00:00
*
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
* If it fails, just fall back on SIOCSIWMODE.
Clean up promiscuous mode, when using SOCK_PACKET, as best we can; remember which pcap_t's were opened (with SOCK_PACKET) in promiscuous mode on interfaces not already in promiscuous mode, turn promiscuous mode off when closing such a pcap_t, and arrange that, when the program exits, all pcap_t's of that sort not already closed have their interfaces taken out of promiscuous mode. (It's not sufficient to do this on exit - applications may close a pcap_t without exiting, e.g. Ethereal.) This won't always work right (if somebody else requests promiscuous mode after it's opened by libpcap, we'll turn promiscuous mode off when we close the pcap_t, and if the program doesn't exit cleanly, it won't clean up the interfaces), but neither of those problems are fixable - the only way to get things to work correctly is to use PF_PACKET sockets, which requires a 2.2 or later kernel. On a 2.0[.x] kernel, when doing a "recvfrom()" on a SOCK_PACKET socket to read a captured packet, don't pass a byte count value based on the snapshot length - "recvfrom()" won't return the actual packet length if you do that. (2.2 and later kernels will return the actual packet length if MSG_TRUNC is passed in.)
2000-12-16 10:43:26 +00:00
*/
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
memset(&ireq, 0, sizeof ireq);
strncpy(ireq.ifr_ifrn.ifrn_name, device,
sizeof ireq.ifr_ifrn.ifrn_name);
ireq.ifr_ifrn.ifrn_name[sizeof ireq.ifr_ifrn.ifrn_name - 1] = 0;
ireq.u.data.length = 1; /* 1 argument */
args[0] = 3; /* request Prism header */
memcpy(ireq.u.name, args, IFNAMSIZ);
if (ioctl(sock_fd, cmd, &ireq) != -1) {
/*
* Success.
* Note that we have to put the old mode back
* when we close the device.
*/
To put mac80211 devices in monitor mode, create a "monN" device for the underlying adapter, bring it up, and capture on that. This means libpcap nees to be linked with -lnl.
2009-05-22 12:50:15 +00:00
handle->md.must_do_on_close |= MUST_CLEAR_RFMON;
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
/*
* Add this to the list of pcaps to close
* when we exit.
*/
pcap_add_to_pcaps_to_close(handle);
return 1;
Clean up promiscuous mode, when using SOCK_PACKET, as best we can; remember which pcap_t's were opened (with SOCK_PACKET) in promiscuous mode on interfaces not already in promiscuous mode, turn promiscuous mode off when closing such a pcap_t, and arrange that, when the program exits, all pcap_t's of that sort not already closed have their interfaces taken out of promiscuous mode. (It's not sufficient to do this on exit - applications may close a pcap_t without exiting, e.g. Ethereal.) This won't always work right (if somebody else requests promiscuous mode after it's opened by libpcap, we'll turn promiscuous mode off when we close the pcap_t, and if the program doesn't exit cleanly, it won't clean up the interfaces), but neither of those problems are fixable - the only way to get things to work correctly is to use PF_PACKET sockets, which requires a 2.2 or later kernel. On a 2.0[.x] kernel, when doing a "recvfrom()" on a SOCK_PACKET socket to read a captured packet, don't pass a byte count value based on the snapshot length - "recvfrom()" won't return the actual packet length if you do that. (2.2 and later kernels will return the actual packet length if MSG_TRUNC is passed in.)
2000-12-16 10:43:26 +00:00
}
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
Clean up promiscuous mode, when using SOCK_PACKET, as best we can; remember which pcap_t's were opened (with SOCK_PACKET) in promiscuous mode on interfaces not already in promiscuous mode, turn promiscuous mode off when closing such a pcap_t, and arrange that, when the program exits, all pcap_t's of that sort not already closed have their interfaces taken out of promiscuous mode. (It's not sufficient to do this on exit - applications may close a pcap_t without exiting, e.g. Ethereal.) This won't always work right (if somebody else requests promiscuous mode after it's opened by libpcap, we'll turn promiscuous mode off when we close the pcap_t, and if the program doesn't exit cleanly, it won't clean up the interfaces), but neither of those problems are fixable - the only way to get things to work correctly is to use PF_PACKET sockets, which requires a 2.2 or later kernel. On a 2.0[.x] kernel, when doing a "recvfrom()" on a SOCK_PACKET socket to read a captured packet, don't pass a byte count value based on the snapshot length - "recvfrom()" won't return the actual packet length if you do that. (2.2 and later kernels will return the actual packet length if MSG_TRUNC is passed in.)
2000-12-16 10:43:26 +00:00
/*
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
* Failure. Fall back on SIOCSIWMODE.
Clean up promiscuous mode, when using SOCK_PACKET, as best we can; remember which pcap_t's were opened (with SOCK_PACKET) in promiscuous mode on interfaces not already in promiscuous mode, turn promiscuous mode off when closing such a pcap_t, and arrange that, when the program exits, all pcap_t's of that sort not already closed have their interfaces taken out of promiscuous mode. (It's not sufficient to do this on exit - applications may close a pcap_t without exiting, e.g. Ethereal.) This won't always work right (if somebody else requests promiscuous mode after it's opened by libpcap, we'll turn promiscuous mode off when we close the pcap_t, and if the program doesn't exit cleanly, it won't clean up the interfaces), but neither of those problems are fixable - the only way to get things to work correctly is to use PF_PACKET sockets, which requires a 2.2 or later kernel. On a 2.0[.x] kernel, when doing a "recvfrom()" on a SOCK_PACKET socket to read a captured packet, don't pass a byte count value based on the snapshot length - "recvfrom()" won't return the actual packet length if you do that. (2.2 and later kernels will return the actual packet length if MSG_TRUNC is passed in.)
2000-12-16 10:43:26 +00:00
*/
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
}
/*
* First, turn monitor mode on.
*/
strncpy(ireq.ifr_ifrn.ifrn_name, device,
sizeof ireq.ifr_ifrn.ifrn_name);
ireq.ifr_ifrn.ifrn_name[sizeof ireq.ifr_ifrn.ifrn_name - 1] = 0;
ireq.u.mode = IW_MODE_MONITOR;
if (ioctl(sock_fd, SIOCSIWMODE, &ireq) == -1) {
/*
* Scientist, you've failed.
*/
return PCAP_ERROR_RFMON_NOTSUP;
}
A pile of comments, from looking at aircrack-ng's airmon-ng, and experimenting with an adapter with a mac80211 driver.
2008-09-22 01:12:34 +00:00
/*
* XXX - airmon-ng does "iwconfig {if} key off" after setting
* monitor mode and setting the channel, and then does
* "iwconfig up".
*/
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
/*
* Now select the appropriate radio header.
*/
switch (montype) {
case MONITOR_WEXT:
/*
* We don't have any private ioctl to set the header.
*/
break;
case MONITOR_HOSTAP:
/*
From a quick look at the hostap driver, it appears that newer versions support the Radiotap header.
2009-04-07 20:20:07 +00:00
* Try to select the radiotap header.
*/
memset(&ireq, 0, sizeof ireq);
strncpy(ireq.ifr_ifrn.ifrn_name, device,
sizeof ireq.ifr_ifrn.ifrn_name);
ireq.ifr_ifrn.ifrn_name[sizeof ireq.ifr_ifrn.ifrn_name - 1] = 0;
args[0] = 3; /* request radiotap header */
memcpy(ireq.u.name, args, sizeof (int));
if (ioctl(sock_fd, cmd, &ireq) != -1)
break; /* success */
/*
* That failed. Try to select the AVS header.
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
*/
memset(&ireq, 0, sizeof ireq);
strncpy(ireq.ifr_ifrn.ifrn_name, device,
sizeof ireq.ifr_ifrn.ifrn_name);
ireq.ifr_ifrn.ifrn_name[sizeof ireq.ifr_ifrn.ifrn_name - 1] = 0;
args[0] = 2; /* request AVS header */
memcpy(ireq.u.name, args, sizeof (int));
From a quick look at the hostap driver, it appears that newer versions support the Radiotap header.
2009-04-07 20:20:07 +00:00
if (ioctl(sock_fd, cmd, &ireq) != -1)
break; /* success */
/*
* That failed. Try to select the Prism header.
*/
memset(&ireq, 0, sizeof ireq);
strncpy(ireq.ifr_ifrn.ifrn_name, device,
sizeof ireq.ifr_ifrn.ifrn_name);
ireq.ifr_ifrn.ifrn_name[sizeof ireq.ifr_ifrn.ifrn_name - 1] = 0;
args[0] = 1; /* request Prism header */
memcpy(ireq.u.name, args, sizeof (int));
ioctl(sock_fd, cmd, &ireq);
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
break;
case MONITOR_PRISM:
/*
* The private ioctl failed.
*/
break;
case MONITOR_PRISM54:
/*
* Select the Prism header.
*/
memset(&ireq, 0, sizeof ireq);
strncpy(ireq.ifr_ifrn.ifrn_name, device,
sizeof ireq.ifr_ifrn.ifrn_name);
ireq.ifr_ifrn.ifrn_name[sizeof ireq.ifr_ifrn.ifrn_name - 1] = 0;
args[0] = 3; /* request Prism header */
memcpy(ireq.u.name, args, sizeof (int));
ioctl(sock_fd, cmd, &ireq);
break;
case MONITOR_ACX100:
/*
* Get the current channel.
*/
memset(&ireq, 0, sizeof ireq);
strncpy(ireq.ifr_ifrn.ifrn_name, device,
sizeof ireq.ifr_ifrn.ifrn_name);
ireq.ifr_ifrn.ifrn_name[sizeof ireq.ifr_ifrn.ifrn_name - 1] = 0;
if (ioctl(sock_fd, SIOCGIWFREQ, &ireq) == -1) {
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
"%s: SIOCGIWFREQ: %s", device,
pcap_strerror(errno));
return PCAP_ERROR;
Clean up promiscuous mode, when using SOCK_PACKET, as best we can; remember which pcap_t's were opened (with SOCK_PACKET) in promiscuous mode on interfaces not already in promiscuous mode, turn promiscuous mode off when closing such a pcap_t, and arrange that, when the program exits, all pcap_t's of that sort not already closed have their interfaces taken out of promiscuous mode. (It's not sufficient to do this on exit - applications may close a pcap_t without exiting, e.g. Ethereal.) This won't always work right (if somebody else requests promiscuous mode after it's opened by libpcap, we'll turn promiscuous mode off when we close the pcap_t, and if the program doesn't exit cleanly, it won't clean up the interfaces), but neither of those problems are fixable - the only way to get things to work correctly is to use PF_PACKET sockets, which requires a 2.2 or later kernel. On a 2.0[.x] kernel, when doing a "recvfrom()" on a SOCK_PACKET socket to read a captured packet, don't pass a byte count value based on the snapshot length - "recvfrom()" won't return the actual packet length if you do that. (2.2 and later kernels will return the actual packet length if MSG_TRUNC is passed in.)
2000-12-16 10:43:26 +00:00
}
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
channel = ireq.u.freq.m;
/*
* Select the Prism header, and set the channel to the
* current value.
*/
memset(&ireq, 0, sizeof ireq);
strncpy(ireq.ifr_ifrn.ifrn_name, device,
sizeof ireq.ifr_ifrn.ifrn_name);
ireq.ifr_ifrn.ifrn_name[sizeof ireq.ifr_ifrn.ifrn_name - 1] = 0;
args[0] = 1; /* request Prism header */
args[1] = channel; /* set channel */
memcpy(ireq.u.name, args, 2*sizeof (int));
ioctl(sock_fd, cmd, &ireq);
break;
case MONITOR_RT2500:
/*
* Disallow transmission - that turns on the
* Prism header.
*/
memset(&ireq, 0, sizeof ireq);
strncpy(ireq.ifr_ifrn.ifrn_name, device,
sizeof ireq.ifr_ifrn.ifrn_name);
ireq.ifr_ifrn.ifrn_name[sizeof ireq.ifr_ifrn.ifrn_name - 1] = 0;
args[0] = 0; /* disallow transmitting */
memcpy(ireq.u.name, args, sizeof (int));
ioctl(sock_fd, cmd, &ireq);
break;
case MONITOR_RT2570:
/*
* Force the Prism header.
*/
memset(&ireq, 0, sizeof ireq);
strncpy(ireq.ifr_ifrn.ifrn_name, device,
sizeof ireq.ifr_ifrn.ifrn_name);
ireq.ifr_ifrn.ifrn_name[sizeof ireq.ifr_ifrn.ifrn_name - 1] = 0;
args[0] = 1; /* request Prism header */
memcpy(ireq.u.name, args, sizeof (int));
ioctl(sock_fd, cmd, &ireq);
break;
case MONITOR_RT73:
/*
* Force the Prism header.
*/
memset(&ireq, 0, sizeof ireq);
strncpy(ireq.ifr_ifrn.ifrn_name, device,
sizeof ireq.ifr_ifrn.ifrn_name);
ireq.ifr_ifrn.ifrn_name[sizeof ireq.ifr_ifrn.ifrn_name - 1] = 0;
ireq.u.data.length = 1; /* 1 argument */
ireq.u.data.pointer = "1";
ireq.u.data.flags = 0;
ioctl(sock_fd, cmd, &ireq);
break;
case MONITOR_RTL8XXX:
/*
* Force the Prism header.
*/
memset(&ireq, 0, sizeof ireq);
strncpy(ireq.ifr_ifrn.ifrn_name, device,
sizeof ireq.ifr_ifrn.ifrn_name);
ireq.ifr_ifrn.ifrn_name[sizeof ireq.ifr_ifrn.ifrn_name - 1] = 0;
args[0] = 1; /* request Prism header */
memcpy(ireq.u.name, args, sizeof (int));
ioctl(sock_fd, cmd, &ireq);
break;
Initial revision
1999-10-07 23:46:40 +00:00
}
Bug fixes from Graeme Hewson <ghewson@cix.compulink.co.uk>: 1. During termination processing set up by atexit() under a 2.0.x kernel, if a socket had been previously closed and the handle freed due to an error, pcap_close_all() and pcap_close_linux() would nevertheless try to work with these structures and then crash. pcap_close_linux() is now called directly when necessary during error processing. 2. atexit() could get called more than once because the did_atexit flag wasn't being set. 3. If iface_get_arptype() returns an error because the ioctl() call failed (probably due to "no such device"), live_open_new() now returns a fatal error to pcap_open_live() and the call to live_open_old() is short-circuited. 4. Applications using libpcap would appear to listen on an interface that was down. a. iface_bind() and iface_bind_old() now check for pending errors after bind(). In turn, pcap_open_live() now returns an error status if there was a pending error after bind(). b. After draining the socket, set_kernel_filter() now checks to see if the error was the expected EAGAIN and returns a fatal error to pcap_setfilter() if not. In turn, pcap_setfilter() now returns an error status if there was a network error. 5. pcap_setfilter() was putting an error message into errbuf after a failed call to install_bpf_program(). This was unnecessary since install_bpf_program() puts its own error message into errbuf.
2002-02-22 09:20:11 +00:00
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
/*
* Note that we have to put the old mode back when we
* close the device.
*/
To put mac80211 devices in monitor mode, create a "monN" device for the underlying adapter, bring it up, and capture on that. This means libpcap nees to be linked with -lnl.
2009-05-22 12:50:15 +00:00
handle->md.must_do_on_close |= MUST_CLEAR_RFMON;
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
/*
* Add this to the list of pcaps to close when we exit.
*/
pcap_add_to_pcaps_to_close(handle);
return 1;
To put mac80211 devices in monitor mode, create a "monN" device for the underlying adapter, bring it up, and capture on that. This means libpcap nees to be linked with -lnl.
2009-05-22 12:50:15 +00:00
}
#endif /* IW_MODE_MONITOR */
/*
* Try various mechanisms to enter monitor mode.
*/
static int
enter_rfmon_mode(pcap_t *handle, int sock_fd, const char *device)
{
When checking whether a device will let you turn monitor mode on, assume mac80211 devices will, regardless of whether they support the Wireless Extensions - wmaster devices will let you turn monitor mode on but don't appear to support the Wireless Extensions. Support turning on monitor mode with libnl even if we don't have support for the Wireless Extensions, just in case the Wireless Extensions go away at some point in the future if every 802.11 device has a mac80211 driver.
2009-06-01 19:56:05 +00:00
#if defined(HAVE_LIBNL) || defined(IW_MODE_MONITOR)
To put mac80211 devices in monitor mode, create a "monN" device for the underlying adapter, bring it up, and capture on that. This means libpcap nees to be linked with -lnl.
2009-05-22 12:50:15 +00:00
int ret;
When checking whether a device will let you turn monitor mode on, assume mac80211 devices will, regardless of whether they support the Wireless Extensions - wmaster devices will let you turn monitor mode on but don't appear to support the Wireless Extensions. Support turning on monitor mode with libnl even if we don't have support for the Wireless Extensions, just in case the Wireless Extensions go away at some point in the future if every 802.11 device has a mac80211 driver.
2009-06-01 19:56:05 +00:00
#endif
To put mac80211 devices in monitor mode, create a "monN" device for the underlying adapter, bring it up, and capture on that. This means libpcap nees to be linked with -lnl.
2009-05-22 12:50:15 +00:00
#ifdef HAVE_LIBNL
ret = enter_rfmon_mode_mac80211(handle, sock_fd, device);
if (ret < 0)
return ret; /* error attempting to do so */
if (ret == 1)
return 1; /* success */
#endif /* HAVE_LIBNL */
When checking whether a device will let you turn monitor mode on, assume mac80211 devices will, regardless of whether they support the Wireless Extensions - wmaster devices will let you turn monitor mode on but don't appear to support the Wireless Extensions. Support turning on monitor mode with libnl even if we don't have support for the Wireless Extensions, just in case the Wireless Extensions go away at some point in the future if every 802.11 device has a mac80211 driver.
2009-06-01 19:56:05 +00:00
#ifdef IW_MODE_MONITOR
To put mac80211 devices in monitor mode, create a "monN" device for the underlying adapter, bring it up, and capture on that. This means libpcap nees to be linked with -lnl.
2009-05-22 12:50:15 +00:00
ret = enter_rfmon_mode_wext(handle, sock_fd, device);
if (ret < 0)
return ret; /* error attempting to do so */
if (ret == 1)
return 1; /* success */
#endif /* IW_MODE_MONITOR */
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
/*
To put mac80211 devices in monitor mode, create a "monN" device for the underlying adapter, bring it up, and capture on that. This means libpcap nees to be linked with -lnl.
2009-05-22 12:50:15 +00:00
* Either none of the mechanisms we know about work or none
* of those mechanisms are available, so we can't do monitor
* mode.
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
*/
return 0;
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
}
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
#endif /* HAVE_PF_PACKET_SOCKETS */
/* ===== Functions to interface to the older kernels ================== */
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
/*
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
* Try to open a packet socket using the old kernel interface.
* Returns 1 on success and a PCAP_ERROR_ value on an error.
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
*/
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
static int
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
activate_old(pcap_t *handle)
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
{
Add a "close" function pointer to the pcap_t structure, which handles the platform-dependent part of closing a pcap_t (and the live-vs-savefile part as well, so that function must close the file descriptor and free up any buffers allocated). In the Digital UNIX support, add in a check for a memory allocation failure.
2003-07-25 03:25:45 +00:00
int arptype;
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
struct ifreq ifr;
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
const char *device = handle->opt.source;
map_packet_type_to_sll_type() isn't used - and won't compile - if you don't have PF_PACKET support; #ifdef it out. Move the code to compute the buffer size into live_open_new() and live_open_old(), as it's dependent on the mechanism being used; there's little code shared between the two variants.
2008-01-24 20:20:08 +00:00
struct utsname utsname;
int mtu;
Initial revision
1999-10-07 23:46:40 +00:00
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
/* Open the socket */
The Linux "pcap_setfilter()" makes a copy of the filter it's handed, and installs that copy; when closing a pcap_t on Linux, free that copy.
2000-10-25 06:59:09 +00:00
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
handle->fd = socket(PF_INET, SOCK_PACKET, htons(ETH_P_ALL));
if (handle->fd == -1) {
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
"socket: %s", pcap_strerror(errno));
Report PCAP_ERROR_PERM_DENIED if you don't have permission to open a PF_PACKET socket.
2008-04-10 01:26:43 +00:00
return PCAP_ERROR_PERM_DENIED;
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
}
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
/* It worked - we are using the old interface */
handle->md.sock_packet = 1;
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
/* ...which means we get the link-layer header. */
handle->md.cooked = 0;
Add support for a new link layer type DLT_LINUX_SLL, for use when doing live captures with a "cooked" (SOCK_DGRAM) rather than a "raw" (SOCK_RAW) PF_PACKET socket; it includes a bunch of the fields from the "struct sockaddr_ll" you get in a "recvfrom()", including the Ethernet protocol field. This requires us to rewrite the BPF program if we're stuffing it into the kernel; as long as we're doing *ex post facto* rewriting, we might as well also do the "ret <snaplen>" -> "ret 65535" fixup there as well, rather than in the code generator.
2000-12-21 10:29:21 +00:00
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
/* Bind to the given device */
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
Fix the handling of the "any" device, including making it reject attempts to open it in monitor mode.
2008-11-19 08:20:39 +00:00
if (strcmp(device, "any") == 0) {
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
strncpy(handle->errbuf, "pcap_activate: The \"any\" device isn't supported on 2.0[.x]-kernel systems",
PCAP_ERRBUF_SIZE);
return PCAP_ERROR;
}
if (iface_bind_old(handle->fd, device, handle->errbuf) == -1)
return PCAP_ERROR;
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
/*
* Try to get the link-layer type.
*/
arptype = iface_get_arptype(handle->fd, device, handle->errbuf);
if (arptype < 0)
return PCAP_ERROR;
Have "map_arphrd_to_dlt()" take a flag indicating whether it's OK to return DLT_LINUX_SLL or not, and, if that flag is false, for those interface types where we'd used DLT_LINUX_SLL, pick a DLT_ type that works as well as possible in raw mode, or fail. Pass 1 as that flag if we're using a PF_PACKET socket; pass 0 as that flag if we're using a PF_INET/SOCK_PACKET socket. For PF_INET/SOCK_PACKET sockets, try to get the link-layer type and map it to a DLT_ value *before* turning promiscuous mode on, so that we don't try to put the interface into promiscuous mode unless we know we can handle its link-layer type (and thus that we can use the interface).
2002-02-10 00:05:14 +00:00
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
/*
* Try to find the DLT_ type corresponding to that
* link-layer type.
*/
map_arphrd_to_dlt(handle, arptype, 0);
if (handle->linktype == -1) {
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
"unknown arptype %d", arptype);
return PCAP_ERROR;
}
Have "map_arphrd_to_dlt()" take a flag indicating whether it's OK to return DLT_LINUX_SLL or not, and, if that flag is false, for those interface types where we'd used DLT_LINUX_SLL, pick a DLT_ type that works as well as possible in raw mode, or fail. Pass 1 as that flag if we're using a PF_PACKET socket; pass 0 as that flag if we're using a PF_INET/SOCK_PACKET socket. For PF_INET/SOCK_PACKET sockets, try to get the link-layer type and map it to a DLT_ value *before* turning promiscuous mode on, so that we don't try to put the interface into promiscuous mode unless we know we can handle its link-layer type (and thus that we can use the interface).
2002-02-10 00:05:14 +00:00
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
/* Go to promisc mode if requested */
Have "map_arphrd_to_dlt()" take a flag indicating whether it's OK to return DLT_LINUX_SLL or not, and, if that flag is false, for those interface types where we'd used DLT_LINUX_SLL, pick a DLT_ type that works as well as possible in raw mode, or fail. Pass 1 as that flag if we're using a PF_PACKET socket; pass 0 as that flag if we're using a PF_INET/SOCK_PACKET socket. For PF_INET/SOCK_PACKET sockets, try to get the link-layer type and map it to a DLT_ value *before* turning promiscuous mode on, so that we don't try to put the interface into promiscuous mode unless we know we can handle its link-layer type (and thus that we can use the interface).
2002-02-10 00:05:14 +00:00
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
if (handle->opt.promisc) {
memset(&ifr, 0, sizeof(ifr));
strncpy(ifr.ifr_name, device, sizeof(ifr.ifr_name));
if (ioctl(handle->fd, SIOCGIFFLAGS, &ifr) == -1) {
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
"SIOCGIFFLAGS: %s", pcap_strerror(errno));
return PCAP_ERROR;
}
if ((ifr.ifr_flags & IFF_PROMISC) == 0) {
/*
* Promiscuous mode isn't currently on,
* so turn it on, and remember that
* we should turn it off when the
* pcap_t is closed.
*/
Clean up promiscuous mode, when using SOCK_PACKET, as best we can; remember which pcap_t's were opened (with SOCK_PACKET) in promiscuous mode on interfaces not already in promiscuous mode, turn promiscuous mode off when closing such a pcap_t, and arrange that, when the program exits, all pcap_t's of that sort not already closed have their interfaces taken out of promiscuous mode. (It's not sufficient to do this on exit - applications may close a pcap_t without exiting, e.g. Ethereal.) This won't always work right (if somebody else requests promiscuous mode after it's opened by libpcap, we'll turn promiscuous mode off when we close the pcap_t, and if the program doesn't exit cleanly, it won't clean up the interfaces), but neither of those problems are fixable - the only way to get things to work correctly is to use PF_PACKET sockets, which requires a 2.2 or later kernel. On a 2.0[.x] kernel, when doing a "recvfrom()" on a SOCK_PACKET socket to read a captured packet, don't pass a byte count value based on the snapshot length - "recvfrom()" won't return the actual packet length if you do that. (2.2 and later kernels will return the actual packet length if MSG_TRUNC is passed in.)
2000-12-16 10:43:26 +00:00
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
/*
* If we haven't already done so, arrange
* to have "pcap_close_all()" called when
* we exit.
*/
if (!pcap_do_addexit(handle)) {
Clean up promiscuous mode, when using SOCK_PACKET, as best we can; remember which pcap_t's were opened (with SOCK_PACKET) in promiscuous mode on interfaces not already in promiscuous mode, turn promiscuous mode off when closing such a pcap_t, and arrange that, when the program exits, all pcap_t's of that sort not already closed have their interfaces taken out of promiscuous mode. (It's not sufficient to do this on exit - applications may close a pcap_t without exiting, e.g. Ethereal.) This won't always work right (if somebody else requests promiscuous mode after it's opened by libpcap, we'll turn promiscuous mode off when we close the pcap_t, and if the program doesn't exit cleanly, it won't clean up the interfaces), but neither of those problems are fixable - the only way to get things to work correctly is to use PF_PACKET sockets, which requires a 2.2 or later kernel. On a 2.0[.x] kernel, when doing a "recvfrom()" on a SOCK_PACKET socket to read a captured packet, don't pass a byte count value based on the snapshot length - "recvfrom()" won't return the actual packet length if you do that. (2.2 and later kernels will return the actual packet length if MSG_TRUNC is passed in.)
2000-12-16 10:43:26 +00:00
/*
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
* "atexit()" failed; don't put
* the interface in promiscuous
* mode, just give up.
Clean up promiscuous mode, when using SOCK_PACKET, as best we can; remember which pcap_t's were opened (with SOCK_PACKET) in promiscuous mode on interfaces not already in promiscuous mode, turn promiscuous mode off when closing such a pcap_t, and arrange that, when the program exits, all pcap_t's of that sort not already closed have their interfaces taken out of promiscuous mode. (It's not sufficient to do this on exit - applications may close a pcap_t without exiting, e.g. Ethereal.) This won't always work right (if somebody else requests promiscuous mode after it's opened by libpcap, we'll turn promiscuous mode off when we close the pcap_t, and if the program doesn't exit cleanly, it won't clean up the interfaces), but neither of those problems are fixable - the only way to get things to work correctly is to use PF_PACKET sockets, which requires a 2.2 or later kernel. On a 2.0[.x] kernel, when doing a "recvfrom()" on a SOCK_PACKET socket to read a captured packet, don't pass a byte count value based on the snapshot length - "recvfrom()" won't return the actual packet length if you do that. (2.2 and later kernels will return the actual packet length if MSG_TRUNC is passed in.)
2000-12-16 10:43:26 +00:00
*/
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
return PCAP_ERROR;
}
Clean up promiscuous mode, when using SOCK_PACKET, as best we can; remember which pcap_t's were opened (with SOCK_PACKET) in promiscuous mode on interfaces not already in promiscuous mode, turn promiscuous mode off when closing such a pcap_t, and arrange that, when the program exits, all pcap_t's of that sort not already closed have their interfaces taken out of promiscuous mode. (It's not sufficient to do this on exit - applications may close a pcap_t without exiting, e.g. Ethereal.) This won't always work right (if somebody else requests promiscuous mode after it's opened by libpcap, we'll turn promiscuous mode off when we close the pcap_t, and if the program doesn't exit cleanly, it won't clean up the interfaces), but neither of those problems are fixable - the only way to get things to work correctly is to use PF_PACKET sockets, which requires a 2.2 or later kernel. On a 2.0[.x] kernel, when doing a "recvfrom()" on a SOCK_PACKET socket to read a captured packet, don't pass a byte count value based on the snapshot length - "recvfrom()" won't return the actual packet length if you do that. (2.2 and later kernels will return the actual packet length if MSG_TRUNC is passed in.)
2000-12-16 10:43:26 +00:00
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
ifr.ifr_flags |= IFF_PROMISC;
if (ioctl(handle->fd, SIOCSIFFLAGS, &ifr) == -1) {
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
"SIOCSIFFLAGS: %s",
pcap_strerror(errno));
return PCAP_ERROR;
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
}
To put mac80211 devices in monitor mode, create a "monN" device for the underlying adapter, bring it up, and capture on that. This means libpcap nees to be linked with -lnl.
2009-05-22 12:50:15 +00:00
handle->md.must_do_on_close |= MUST_CLEAR_PROMISC;
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
/*
* Add this to the list of pcaps
* to close when we exit.
*/
pcap_add_to_pcaps_to_close(handle);
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
}
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
}
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
/*
* Compute the buffer size.
*
* We're using SOCK_PACKET, so this might be a 2.0[.x]
* kernel, and might require special handling - check.
*/
if (uname(&utsname) < 0 ||
strncmp(utsname.release, "2.0", 3) == 0) {
map_packet_type_to_sll_type() isn't used - and won't compile - if you don't have PF_PACKET support; #ifdef it out. Move the code to compute the buffer size into live_open_new() and live_open_old(), as it's dependent on the mechanism being used; there's little code shared between the two variants.
2008-01-24 20:20:08 +00:00
/*
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
* Either we couldn't find out what kernel release
* this is, or it's a 2.0[.x] kernel.
*
* In the 2.0[.x] kernel, a "recvfrom()" on
* a SOCK_PACKET socket, with MSG_TRUNC set, will
* return the number of bytes read, so if we pass
* a length based on the snapshot length, it'll
* return the number of bytes from the packet
* copied to userland, not the actual length
* of the packet.
*
* This means that, for example, the IP dissector
* in tcpdump will get handed a packet length less
* than the length in the IP header, and will
* complain about "truncated-ip".
*
* So we don't bother trying to copy from the
* kernel only the bytes in which we're interested,
* but instead copy them all, just as the older
* versions of libpcap for Linux did.
*
* The buffer therefore needs to be big enough to
* hold the largest packet we can get from this
* device. Unfortunately, we can't get the MRU
* of the network; we can only get the MTU. The
* MTU may be too small, in which case a packet larger
* than the buffer size will be truncated *and* we
* won't get the actual packet size.
map_packet_type_to_sll_type() isn't used - and won't compile - if you don't have PF_PACKET support; #ifdef it out. Move the code to compute the buffer size into live_open_new() and live_open_old(), as it's dependent on the mechanism being used; there's little code shared between the two variants.
2008-01-24 20:20:08 +00:00
*
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
* However, if the snapshot length is larger than
* the buffer size based on the MTU, we use the
* snapshot length as the buffer size, instead;
* this means that with a sufficiently large snapshot
* length we won't artificially truncate packets
* to the MTU-based size.
*
* This mess just one of many problems with packet
* capture on 2.0[.x] kernels; you really want a
* 2.2[.x] or later kernel if you want packet capture
* to work well.
map_packet_type_to_sll_type() isn't used - and won't compile - if you don't have PF_PACKET support; #ifdef it out. Move the code to compute the buffer size into live_open_new() and live_open_old(), as it's dependent on the mechanism being used; there's little code shared between the two variants.
2008-01-24 20:20:08 +00:00
*/
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
mtu = iface_get_mtu(handle->fd, device, handle->errbuf);
if (mtu == -1)
return PCAP_ERROR;
handle->bufsize = MAX_LINKHEADER_SIZE + mtu;
if (handle->bufsize < handle->snapshot)
map_packet_type_to_sll_type() isn't used - and won't compile - if you don't have PF_PACKET support; #ifdef it out. Move the code to compute the buffer size into live_open_new() and live_open_old(), as it's dependent on the mechanism being used; there's little code shared between the two variants.
2008-01-24 20:20:08 +00:00
handle->bufsize = handle->snapshot;
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
} else {
Attempt to put the link-layer payload of packets on a 4-byte boundary, as is done in some other "pcap-XXX.c" modules.
2001-03-20 05:50:33 +00:00
/*
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
* This is a 2.2[.x] or later kernel.
*
* We can safely pass "recvfrom()" a byte count
* based on the snapshot length.
Attempt to put the link-layer payload of packets on a 4-byte boundary, as is done in some other "pcap-XXX.c" modules.
2001-03-20 05:50:33 +00:00
*/
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
handle->bufsize = handle->snapshot;
}
The Linux "pcap_setfilter()" makes a copy of the filter it's handed, and installs that copy; when closing a pcap_t on Linux, free that copy.
2000-10-25 06:59:09 +00:00
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
/*
* Default value for offset to align link-layer payload
* on a 4-byte boundary.
*/
handle->offset = 0;
The Linux "pcap_setfilter()" makes a copy of the filter it's handed, and installs that copy; when closing a pcap_t on Linux, free that copy.
2000-10-25 06:59:09 +00:00
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
return 1;
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
}
/*
whitespace cleanup
2002-06-11 17:04:44 +00:00
* Bind the socket associated with FD to the given device using the
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
* interface of the old kernels.
*/
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
static int
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
iface_bind_old(int fd, const char *device, char *ebuf)
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
{
struct sockaddr saddr;
Bug fixes from Graeme Hewson <ghewson@cix.compulink.co.uk>: 1. During termination processing set up by atexit() under a 2.0.x kernel, if a socket had been previously closed and the handle freed due to an error, pcap_close_all() and pcap_close_linux() would nevertheless try to work with these structures and then crash. pcap_close_linux() is now called directly when necessary during error processing. 2. atexit() could get called more than once because the did_atexit flag wasn't being set. 3. If iface_get_arptype() returns an error because the ioctl() call failed (probably due to "no such device"), live_open_new() now returns a fatal error to pcap_open_live() and the call to live_open_old() is short-circuited. 4. Applications using libpcap would appear to listen on an interface that was down. a. iface_bind() and iface_bind_old() now check for pending errors after bind(). In turn, pcap_open_live() now returns an error status if there was a pending error after bind(). b. After draining the socket, set_kernel_filter() now checks to see if the error was the expected EAGAIN and returns a fatal error to pcap_setfilter() if not. In turn, pcap_setfilter() now returns an error status if there was a network error. 5. pcap_setfilter() was putting an error message into errbuf after a failed call to install_bpf_program(). This was unnecessary since install_bpf_program() puts its own error message into errbuf.
2002-02-22 09:20:11 +00:00
int err;
socklen_t errlen = sizeof(err);
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
memset(&saddr, 0, sizeof(saddr));
strncpy(saddr.sa_data, device, sizeof(saddr.sa_data));
if (bind(fd, &saddr, sizeof(saddr)) == -1) {
use snprintf instead of sprintf. From Juergen Schoenwaelder <schoenw@ibr.cs.tu-bs.de>
2000-07-04 12:24:01 +00:00
snprintf(ebuf, PCAP_ERRBUF_SIZE,
"bind: %s", pcap_strerror(errno));
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
return -1;
Initial revision
1999-10-07 23:46:40 +00:00
}
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
Bug fixes from Graeme Hewson <ghewson@cix.compulink.co.uk>: 1. During termination processing set up by atexit() under a 2.0.x kernel, if a socket had been previously closed and the handle freed due to an error, pcap_close_all() and pcap_close_linux() would nevertheless try to work with these structures and then crash. pcap_close_linux() is now called directly when necessary during error processing. 2. atexit() could get called more than once because the did_atexit flag wasn't being set. 3. If iface_get_arptype() returns an error because the ioctl() call failed (probably due to "no such device"), live_open_new() now returns a fatal error to pcap_open_live() and the call to live_open_old() is short-circuited. 4. Applications using libpcap would appear to listen on an interface that was down. a. iface_bind() and iface_bind_old() now check for pending errors after bind(). In turn, pcap_open_live() now returns an error status if there was a pending error after bind(). b. After draining the socket, set_kernel_filter() now checks to see if the error was the expected EAGAIN and returns a fatal error to pcap_setfilter() if not. In turn, pcap_setfilter() now returns an error status if there was a network error. 5. pcap_setfilter() was putting an error message into errbuf after a failed call to install_bpf_program(). This was unnecessary since install_bpf_program() puts its own error message into errbuf.
2002-02-22 09:20:11 +00:00
/* Any pending errors, e.g., network is down? */
if (getsockopt(fd, SOL_SOCKET, SO_ERROR, &err, &errlen) == -1) {
snprintf(ebuf, PCAP_ERRBUF_SIZE,
"getsockopt: %s", pcap_strerror(errno));
return -1;
}
whitespace cleanup
2002-06-11 17:04:44 +00:00
if (err > 0) {
Bug fixes from Graeme Hewson <ghewson@cix.compulink.co.uk>: 1. During termination processing set up by atexit() under a 2.0.x kernel, if a socket had been previously closed and the handle freed due to an error, pcap_close_all() and pcap_close_linux() would nevertheless try to work with these structures and then crash. pcap_close_linux() is now called directly when necessary during error processing. 2. atexit() could get called more than once because the did_atexit flag wasn't being set. 3. If iface_get_arptype() returns an error because the ioctl() call failed (probably due to "no such device"), live_open_new() now returns a fatal error to pcap_open_live() and the call to live_open_old() is short-circuited. 4. Applications using libpcap would appear to listen on an interface that was down. a. iface_bind() and iface_bind_old() now check for pending errors after bind(). In turn, pcap_open_live() now returns an error status if there was a pending error after bind(). b. After draining the socket, set_kernel_filter() now checks to see if the error was the expected EAGAIN and returns a fatal error to pcap_setfilter() if not. In turn, pcap_setfilter() now returns an error status if there was a network error. 5. pcap_setfilter() was putting an error message into errbuf after a failed call to install_bpf_program(). This was unnecessary since install_bpf_program() puts its own error message into errbuf.
2002-02-22 09:20:11 +00:00
snprintf(ebuf, PCAP_ERRBUF_SIZE,
whitespace cleanup
2002-06-11 17:04:44 +00:00
"bind: %s", pcap_strerror(err));
Bug fixes from Graeme Hewson <ghewson@cix.compulink.co.uk>: 1. During termination processing set up by atexit() under a 2.0.x kernel, if a socket had been previously closed and the handle freed due to an error, pcap_close_all() and pcap_close_linux() would nevertheless try to work with these structures and then crash. pcap_close_linux() is now called directly when necessary during error processing. 2. atexit() could get called more than once because the did_atexit flag wasn't being set. 3. If iface_get_arptype() returns an error because the ioctl() call failed (probably due to "no such device"), live_open_new() now returns a fatal error to pcap_open_live() and the call to live_open_old() is short-circuited. 4. Applications using libpcap would appear to listen on an interface that was down. a. iface_bind() and iface_bind_old() now check for pending errors after bind(). In turn, pcap_open_live() now returns an error status if there was a pending error after bind(). b. After draining the socket, set_kernel_filter() now checks to see if the error was the expected EAGAIN and returns a fatal error to pcap_setfilter() if not. In turn, pcap_setfilter() now returns an error status if there was a network error. 5. pcap_setfilter() was putting an error message into errbuf after a failed call to install_bpf_program(). This was unnecessary since install_bpf_program() puts its own error message into errbuf.
2002-02-22 09:20:11 +00:00
return -1;
}
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
return 0;
Initial revision
1999-10-07 23:46:40 +00:00
}
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
/* ===== System calls available on all supported kernels ============== */
/*
whitespace cleanup
2002-06-11 17:04:44 +00:00
* Query the kernel for the MTU of the given interface.
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
*/
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
static int
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
iface_get_mtu(int fd, const char *device, char *ebuf)
Initial revision
1999-10-07 23:46:40 +00:00
{
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
struct ifreq ifr;
Added support for an "any" device based on a patch from Sebastian Krahmer.
2000-09-20 15:10:28 +00:00
if (!device)
return BIGGER_THAN_ALL_MTUS;
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
memset(&ifr, 0, sizeof(ifr));
strncpy(ifr.ifr_name, device, sizeof(ifr.ifr_name));
Initial revision
1999-10-07 23:46:40 +00:00
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
if (ioctl(fd, SIOCGIFMTU, &ifr) == -1) {
use snprintf instead of sprintf. From Juergen Schoenwaelder <schoenw@ibr.cs.tu-bs.de>
2000-07-04 12:24:01 +00:00
snprintf(ebuf, PCAP_ERRBUF_SIZE,
Indicate *which* ioctl failed.
2006-09-18 17:32:30 +00:00
"SIOCGIFMTU: %s", pcap_strerror(errno));
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
return -1;
}
return ifr.ifr_mtu;
Initial revision
1999-10-07 23:46:40 +00:00
}
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
/*
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
* Get the hardware type of the given interface as ARPHRD_xxx constant.
*/
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
static int
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
iface_get_arptype(int fd, const char *device, char *ebuf)
Initial revision
1999-10-07 23:46:40 +00:00
{
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
struct ifreq ifr;
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
memset(&ifr, 0, sizeof(ifr));
strncpy(ifr.ifr_name, device, sizeof(ifr.ifr_name));
Initial revision
1999-10-07 23:46:40 +00:00
Changed the indention of pcap-linux.c to match with the other source files of libpcap.
2000-08-13 21:25:26 +00:00
if (ioctl(fd, SIOCGIFHWADDR, &ifr) == -1) {
Add an error for "you don't have permission to open that device", as that often means "sorry, this platform requires you to run as root or to somehow tweak the system to give you capture privileges", and applications might want to explain that in a way that does a better job of letting the user know what they have to do. Try to return or PCAP_ERROR_PERM_DENIED for open errors, rather than just returning PCAP_ERROR, so that the application can, if it chooses, try to explain the error better (as those two errors are the ones that don't mean "there's probably some obscure OS or libpcap problem", but mean, instead, "you made an error" or "you need to get permission to capture"). Check for monitor mode *after* checking whether the device exists in the first place; a non-existent device doesn't support monitor mode, but that's because it doesn't, well, exist, and the latter would be a more meaningful error. Have pcap_open_live() supply an error message for return values other than PCAP_ERROR, PCAP_ERROR_NO_SUCH_DEVICE, and PCAP_ERROR_PERM_DENIED - those all supply error strings (PCAP_ERROR because it's for various OS problems that might require debugging, and the other two because there might be multiple causes).
2008-04-09 19:58:02 +00:00
snprintf(ebuf, PCAP_ERRBUF_SIZE,
"SIOCGIFHWADDR: %s", pcap_strerror(errno));
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
if (errno == ENODEV) {
/*
* No such device.
*/
return PCAP_ERROR_NO_SUCH_DEVICE;
}
return PCAP_ERROR;
Merged the Linux v2.2 packet support into the main trunk (from tag linux-2-2-packet). Please test this code :)
2000-06-08 06:40:09 +00:00
}
return ifr.ifr_hwaddr.sa_family;
Initial revision
1999-10-07 23:46:40 +00:00
}
Add support for a new link layer type DLT_LINUX_SLL, for use when doing live captures with a "cooked" (SOCK_DGRAM) rather than a "raw" (SOCK_RAW) PF_PACKET socket; it includes a bunch of the fields from the "struct sockaddr_ll" you get in a "recvfrom()", including the Ethernet protocol field. This requires us to rewrite the BPF program if we're stuffing it into the kernel; as long as we're doing *ex post facto* rewriting, we might as well also do the "ret <snaplen>" -> "ret 65535" fixup there as well, rather than in the code generator.
2000-12-21 10:29:21 +00:00
Patch, based on a patch from Pavel Kankovsky <kan@dcit.cz>, to flush all packets queued up on the socket when we set a kernel filter on the socket, so that if there are any queue-up packets that wouldn't have passed the new filter, we don't see them. (Some other packet capture mechanisms do this automatically; this prevents tcpdump, for example, from showing or saving, when run with a filter, some packets that wouldn't have passed the filter.) XXX - do we have to do this on any other platforms? Choose whether to compile in the code to modify filter programs for use in the kernel, and to flush queued-up packet and set a kernel filter, on whether SO_ATTACH_FILTER is defined (i.e., on whether we have kernel filter support in our build environment), rather than on whether HAVE_PF_PACKET_SOCKETS is defined (i.e., on whether we have PF_PACKET support in our build environment), as we choose whether to *use* that code based on whether SO_ATTACH_FILTER is defined.
2001-08-25 05:08:26 +00:00
#ifdef SO_ATTACH_FILTER
Add support for a new link layer type DLT_LINUX_SLL, for use when doing live captures with a "cooked" (SOCK_DGRAM) rather than a "raw" (SOCK_RAW) PF_PACKET socket; it includes a bunch of the fields from the "struct sockaddr_ll" you get in a "recvfrom()", including the Ethernet protocol field. This requires us to rewrite the BPF program if we're stuffing it into the kernel; as long as we're doing *ex post facto* rewriting, we might as well also do the "ret <snaplen>" -> "ret 65535" fixup there as well, rather than in the code generator.
2000-12-21 10:29:21 +00:00
static int
When doing Linux mmapped capture: Allocate a buffer into which to copy a packet, and have the callback for pcap_next() and pcap_next_ex() copy to that buffer and return a pointer to that buffer; we can't return the packet data pointer passed to the callback, as, once the callback returns, that buffer can be overwritten, even before you read the next packet. Don't tweak filter programs passed into the kernel to return 65535 on success - we don't have to, as we're not reading packets with recvfrom(), and we don't want to, as, if we return the actual snapshot length, the kernel will copy less data to the ring buffer. Truncate the packet snapshot length to the specified length, as we might not have a filter to do that.
2009-07-16 22:08:12 +00:00
fix_program(pcap_t *handle, struct sock_fprog *fcode, int is_mmapped)
Add support for a new link layer type DLT_LINUX_SLL, for use when doing live captures with a "cooked" (SOCK_DGRAM) rather than a "raw" (SOCK_RAW) PF_PACKET socket; it includes a bunch of the fields from the "struct sockaddr_ll" you get in a "recvfrom()", including the Ethernet protocol field. This requires us to rewrite the BPF program if we're stuffing it into the kernel; as long as we're doing *ex post facto* rewriting, we might as well also do the "ret <snaplen>" -> "ret 65535" fixup there as well, rather than in the code generator.
2000-12-21 10:29:21 +00:00
{
size_t prog_size;
register int i;
register struct bpf_insn *p;
struct bpf_insn *f;
int len;
/*
* Make a copy of the filter, and modify that copy if
* necessary.
*/
prog_size = sizeof(*handle->fcode.bf_insns) * handle->fcode.bf_len;
len = handle->fcode.bf_len;
f = (struct bpf_insn *)malloc(prog_size);
if (f == NULL) {
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
Add support for a new link layer type DLT_LINUX_SLL, for use when doing live captures with a "cooked" (SOCK_DGRAM) rather than a "raw" (SOCK_RAW) PF_PACKET socket; it includes a bunch of the fields from the "struct sockaddr_ll" you get in a "recvfrom()", including the Ethernet protocol field. This requires us to rewrite the BPF program if we're stuffing it into the kernel; as long as we're doing *ex post facto* rewriting, we might as well also do the "ret <snaplen>" -> "ret 65535" fixup there as well, rather than in the code generator.
2000-12-21 10:29:21 +00:00
"malloc: %s", pcap_strerror(errno));
return -1;
}
memcpy(f, handle->fcode.bf_insns, prog_size);
fcode->len = len;
fcode->filter = (struct sock_filter *) f;
for (i = 0; i < len; ++i) {
p = &f[i];
/*
* What type of instruction is this?
*/
switch (BPF_CLASS(p->code)) {
case BPF_RET:
/*
When doing Linux mmapped capture: Allocate a buffer into which to copy a packet, and have the callback for pcap_next() and pcap_next_ex() copy to that buffer and return a pointer to that buffer; we can't return the packet data pointer passed to the callback, as, once the callback returns, that buffer can be overwritten, even before you read the next packet. Don't tweak filter programs passed into the kernel to return 65535 on success - we don't have to, as we're not reading packets with recvfrom(), and we don't want to, as, if we return the actual snapshot length, the kernel will copy less data to the ring buffer. Truncate the packet snapshot length to the specified length, as we might not have a filter to do that.
2009-07-16 22:08:12 +00:00
* It's a return instruction; are we capturing
* in memory-mapped mode?
Add support for a new link layer type DLT_LINUX_SLL, for use when doing live captures with a "cooked" (SOCK_DGRAM) rather than a "raw" (SOCK_RAW) PF_PACKET socket; it includes a bunch of the fields from the "struct sockaddr_ll" you get in a "recvfrom()", including the Ethernet protocol field. This requires us to rewrite the BPF program if we're stuffing it into the kernel; as long as we're doing *ex post facto* rewriting, we might as well also do the "ret <snaplen>" -> "ret 65535" fixup there as well, rather than in the code generator.
2000-12-21 10:29:21 +00:00
*/
When doing Linux mmapped capture: Allocate a buffer into which to copy a packet, and have the callback for pcap_next() and pcap_next_ex() copy to that buffer and return a pointer to that buffer; we can't return the packet data pointer passed to the callback, as, once the callback returns, that buffer can be overwritten, even before you read the next packet. Don't tweak filter programs passed into the kernel to return 65535 on success - we don't have to, as we're not reading packets with recvfrom(), and we don't want to, as, if we return the actual snapshot length, the kernel will copy less data to the ring buffer. Truncate the packet snapshot length to the specified length, as we might not have a filter to do that.
2009-07-16 22:08:12 +00:00
if (!is_mmapped) {
Add support for a new link layer type DLT_LINUX_SLL, for use when doing live captures with a "cooked" (SOCK_DGRAM) rather than a "raw" (SOCK_RAW) PF_PACKET socket; it includes a bunch of the fields from the "struct sockaddr_ll" you get in a "recvfrom()", including the Ethernet protocol field. This requires us to rewrite the BPF program if we're stuffing it into the kernel; as long as we're doing *ex post facto* rewriting, we might as well also do the "ret <snaplen>" -> "ret 65535" fixup there as well, rather than in the code generator.
2000-12-21 10:29:21 +00:00
/*
When doing Linux mmapped capture: Allocate a buffer into which to copy a packet, and have the callback for pcap_next() and pcap_next_ex() copy to that buffer and return a pointer to that buffer; we can't return the packet data pointer passed to the callback, as, once the callback returns, that buffer can be overwritten, even before you read the next packet. Don't tweak filter programs passed into the kernel to return 65535 on success - we don't have to, as we're not reading packets with recvfrom(), and we don't want to, as, if we return the actual snapshot length, the kernel will copy less data to the ring buffer. Truncate the packet snapshot length to the specified length, as we might not have a filter to do that.
2009-07-16 22:08:12 +00:00
* No; is the snapshot length a constant,
* rather than the contents of the
* accumulator?
Add support for a new link layer type DLT_LINUX_SLL, for use when doing live captures with a "cooked" (SOCK_DGRAM) rather than a "raw" (SOCK_RAW) PF_PACKET socket; it includes a bunch of the fields from the "struct sockaddr_ll" you get in a "recvfrom()", including the Ethernet protocol field. This requires us to rewrite the BPF program if we're stuffing it into the kernel; as long as we're doing *ex post facto* rewriting, we might as well also do the "ret <snaplen>" -> "ret 65535" fixup there as well, rather than in the code generator.
2000-12-21 10:29:21 +00:00
*/
When doing Linux mmapped capture: Allocate a buffer into which to copy a packet, and have the callback for pcap_next() and pcap_next_ex() copy to that buffer and return a pointer to that buffer; we can't return the packet data pointer passed to the callback, as, once the callback returns, that buffer can be overwritten, even before you read the next packet. Don't tweak filter programs passed into the kernel to return 65535 on success - we don't have to, as we're not reading packets with recvfrom(), and we don't want to, as, if we return the actual snapshot length, the kernel will copy less data to the ring buffer. Truncate the packet snapshot length to the specified length, as we might not have a filter to do that.
2009-07-16 22:08:12 +00:00
if (BPF_MODE(p->code) == BPF_K) {
/*
* Yes - if the value to be returned,
* i.e. the snapshot length, is
* anything other than 0, make it
* 65535, so that the packet is
* truncated by "recvfrom()",
* not by the filter.
*
* XXX - there's nothing we can
* easily do if it's getting the
* value from the accumulator; we'd
* have to insert code to force
* non-zero values to be 65535.
*/
if (p->k != 0)
p->k = 65535;
}
Add support for a new link layer type DLT_LINUX_SLL, for use when doing live captures with a "cooked" (SOCK_DGRAM) rather than a "raw" (SOCK_RAW) PF_PACKET socket; it includes a bunch of the fields from the "struct sockaddr_ll" you get in a "recvfrom()", including the Ethernet protocol field. This requires us to rewrite the BPF program if we're stuffing it into the kernel; as long as we're doing *ex post facto* rewriting, we might as well also do the "ret <snaplen>" -> "ret 65535" fixup there as well, rather than in the code generator.
2000-12-21 10:29:21 +00:00
}
break;
case BPF_LD:
case BPF_LDX:
/*
* It's a load instruction; is it loading
* from the packet?
*/
switch (BPF_MODE(p->code)) {
case BPF_ABS:
case BPF_IND:
case BPF_MSH:
/*
* Yes; are we in cooked mode?
*/
if (handle->md.cooked) {
/*
* Yes, so we need to fix this
* instruction.
*/
if (fix_offset(p) < 0) {
/*
* We failed to do so.
* Return 0, so our caller
* knows to punt to userland.
*/
return 0;
}
}
break;
}
break;
}
}
return 1; /* we succeeded */
}
static int
fix_offset(struct bpf_insn *p)
{
/*
* What's the offset?
*/
if (p->k >= SLL_HDR_LEN) {
/*
* It's within the link-layer payload; that starts at an
* offset of 0, as far as the kernel packet filter is
* concerned, so subtract the length of the link-layer
* header.
*/
p->k -= SLL_HDR_LEN;
Generate code to check for LLC SAP values on Linux cooked captures. Set "off_linktype" to the correct value for the offset of the Ethernet type field in the fake header for Linux cooked captures, so that the correct code is generated for tests of that field.
2001-01-14 05:30:07 +00:00
} else if (p->k == 14) {
Add support for a new link layer type DLT_LINUX_SLL, for use when doing live captures with a "cooked" (SOCK_DGRAM) rather than a "raw" (SOCK_RAW) PF_PACKET socket; it includes a bunch of the fields from the "struct sockaddr_ll" you get in a "recvfrom()", including the Ethernet protocol field. This requires us to rewrite the BPF program if we're stuffing it into the kernel; as long as we're doing *ex post facto* rewriting, we might as well also do the "ret <snaplen>" -> "ret 65535" fixup there as well, rather than in the code generator.
2000-12-21 10:29:21 +00:00
/*
* It's the protocol field; map it to the special magic
* kernel offset for that field.
*/
p->k = SKF_AD_OFF + SKF_AD_PROTOCOL;
} else {
/*
* It's within the header, but it's not one of those
* fields; we can't do that in the kernel, so punt
* to userland.
*/
return -1;
}
return 0;
}
Patch, based on a patch from Pavel Kankovsky <kan@dcit.cz>, to flush all packets queued up on the socket when we set a kernel filter on the socket, so that if there are any queue-up packets that wouldn't have passed the new filter, we don't see them. (Some other packet capture mechanisms do this automatically; this prevents tcpdump, for example, from showing or saving, when run with a filter, some packets that wouldn't have passed the filter.) XXX - do we have to do this on any other platforms? Choose whether to compile in the code to modify filter programs for use in the kernel, and to flush queued-up packet and set a kernel filter, on whether SO_ATTACH_FILTER is defined (i.e., on whether we have kernel filter support in our build environment), rather than on whether HAVE_PF_PACKET_SOCKETS is defined (i.e., on whether we have PF_PACKET support in our build environment), as we choose whether to *use* that code based on whether SO_ATTACH_FILTER is defined.
2001-08-25 05:08:26 +00:00
static int
set_kernel_filter(pcap_t *handle, struct sock_fprog *fcode)
{
int total_filter_on = 0;
int save_mode;
int ret;
int save_errno;
/*
* The socket filter code doesn't discard all packets queued
* up on the socket when the filter is changed; this means
* that packets that don't match the new filter may show up
* after the new filter is put onto the socket, if those
* packets haven't yet been read.
*
* This means, for example, that if you do a tcpdump capture
* with a filter, the first few packets in the capture might
* be packets that wouldn't have passed the filter.
*
* We therefore discard all packets queued up on the socket
* when setting a kernel filter. (This isn't an issue for
* userland filters, as the userland filtering is done after
* packets are queued up.)
*
* To flush those packets, we put the socket in read-only mode,
* and read packets from the socket until there are no more to
* read.
*
* In order to keep that from being an infinite loop - i.e.,
* to keep more packets from arriving while we're draining
* the queue - we put the "total filter", which is a filter
* that rejects all packets, onto the socket before draining
* the queue.
*
* This code deliberately ignores any errors, so that you may
* get bogus packets if an error occurs, rather than having
* the filtering done in userland even if it could have been
* done in the kernel.
*/
whitespace cleanup
2002-06-11 17:04:44 +00:00
if (setsockopt(handle->fd, SOL_SOCKET, SO_ATTACH_FILTER,
Patch, based on a patch from Pavel Kankovsky <kan@dcit.cz>, to flush all packets queued up on the socket when we set a kernel filter on the socket, so that if there are any queue-up packets that wouldn't have passed the new filter, we don't see them. (Some other packet capture mechanisms do this automatically; this prevents tcpdump, for example, from showing or saving, when run with a filter, some packets that wouldn't have passed the filter.) XXX - do we have to do this on any other platforms? Choose whether to compile in the code to modify filter programs for use in the kernel, and to flush queued-up packet and set a kernel filter, on whether SO_ATTACH_FILTER is defined (i.e., on whether we have kernel filter support in our build environment), rather than on whether HAVE_PF_PACKET_SOCKETS is defined (i.e., on whether we have PF_PACKET support in our build environment), as we choose whether to *use* that code based on whether SO_ATTACH_FILTER is defined.
2001-08-25 05:08:26 +00:00
&total_fcode, sizeof(total_fcode)) == 0) {
char drain[1];
/*
Changes from Pavel Kankovsky to reset the kernel filter in "pcap_setfilter()" if we're not using a kernel filter, in case a previous call to "pcap_setfilter()" had succeeded in adding a kernel filter, as if we're doing userland filtering we need to get rid of all kernel filters that might discard packets that'd pass the userland filter.
2001-08-30 03:08:43 +00:00
* Note that we've put the total filter onto the socket.
Patch, based on a patch from Pavel Kankovsky <kan@dcit.cz>, to flush all packets queued up on the socket when we set a kernel filter on the socket, so that if there are any queue-up packets that wouldn't have passed the new filter, we don't see them. (Some other packet capture mechanisms do this automatically; this prevents tcpdump, for example, from showing or saving, when run with a filter, some packets that wouldn't have passed the filter.) XXX - do we have to do this on any other platforms? Choose whether to compile in the code to modify filter programs for use in the kernel, and to flush queued-up packet and set a kernel filter, on whether SO_ATTACH_FILTER is defined (i.e., on whether we have kernel filter support in our build environment), rather than on whether HAVE_PF_PACKET_SOCKETS is defined (i.e., on whether we have PF_PACKET support in our build environment), as we choose whether to *use* that code based on whether SO_ATTACH_FILTER is defined.
2001-08-25 05:08:26 +00:00
*/
total_filter_on = 1;
/*
* Save the socket's current mode, and put it in
* non-blocking mode; we drain it by reading packets
Bug fixes from Graeme Hewson <ghewson@cix.compulink.co.uk>: 1. During termination processing set up by atexit() under a 2.0.x kernel, if a socket had been previously closed and the handle freed due to an error, pcap_close_all() and pcap_close_linux() would nevertheless try to work with these structures and then crash. pcap_close_linux() is now called directly when necessary during error processing. 2. atexit() could get called more than once because the did_atexit flag wasn't being set. 3. If iface_get_arptype() returns an error because the ioctl() call failed (probably due to "no such device"), live_open_new() now returns a fatal error to pcap_open_live() and the call to live_open_old() is short-circuited. 4. Applications using libpcap would appear to listen on an interface that was down. a. iface_bind() and iface_bind_old() now check for pending errors after bind(). In turn, pcap_open_live() now returns an error status if there was a pending error after bind(). b. After draining the socket, set_kernel_filter() now checks to see if the error was the expected EAGAIN and returns a fatal error to pcap_setfilter() if not. In turn, pcap_setfilter() now returns an error status if there was a network error. 5. pcap_setfilter() was putting an error message into errbuf after a failed call to install_bpf_program(). This was unnecessary since install_bpf_program() puts its own error message into errbuf.
2002-02-22 09:20:11 +00:00
* until we get an error (which is normally a
Patch, based on a patch from Pavel Kankovsky <kan@dcit.cz>, to flush all packets queued up on the socket when we set a kernel filter on the socket, so that if there are any queue-up packets that wouldn't have passed the new filter, we don't see them. (Some other packet capture mechanisms do this automatically; this prevents tcpdump, for example, from showing or saving, when run with a filter, some packets that wouldn't have passed the filter.) XXX - do we have to do this on any other platforms? Choose whether to compile in the code to modify filter programs for use in the kernel, and to flush queued-up packet and set a kernel filter, on whether SO_ATTACH_FILTER is defined (i.e., on whether we have kernel filter support in our build environment), rather than on whether HAVE_PF_PACKET_SOCKETS is defined (i.e., on whether we have PF_PACKET support in our build environment), as we choose whether to *use* that code based on whether SO_ATTACH_FILTER is defined.
2001-08-25 05:08:26 +00:00
* "nothing more to be read" error).
*/
save_mode = fcntl(handle->fd, F_GETFL, 0);
if (save_mode != -1 &&
fcntl(handle->fd, F_SETFL, save_mode | O_NONBLOCK) >= 0) {
while (recv(handle->fd, &drain, sizeof drain,
MSG_TRUNC) >= 0)
;
Bug fixes from Graeme Hewson <ghewson@cix.compulink.co.uk>: 1. During termination processing set up by atexit() under a 2.0.x kernel, if a socket had been previously closed and the handle freed due to an error, pcap_close_all() and pcap_close_linux() would nevertheless try to work with these structures and then crash. pcap_close_linux() is now called directly when necessary during error processing. 2. atexit() could get called more than once because the did_atexit flag wasn't being set. 3. If iface_get_arptype() returns an error because the ioctl() call failed (probably due to "no such device"), live_open_new() now returns a fatal error to pcap_open_live() and the call to live_open_old() is short-circuited. 4. Applications using libpcap would appear to listen on an interface that was down. a. iface_bind() and iface_bind_old() now check for pending errors after bind(). In turn, pcap_open_live() now returns an error status if there was a pending error after bind(). b. After draining the socket, set_kernel_filter() now checks to see if the error was the expected EAGAIN and returns a fatal error to pcap_setfilter() if not. In turn, pcap_setfilter() now returns an error status if there was a network error. 5. pcap_setfilter() was putting an error message into errbuf after a failed call to install_bpf_program(). This was unnecessary since install_bpf_program() puts its own error message into errbuf.
2002-02-22 09:20:11 +00:00
save_errno = errno;
Patch, based on a patch from Pavel Kankovsky <kan@dcit.cz>, to flush all packets queued up on the socket when we set a kernel filter on the socket, so that if there are any queue-up packets that wouldn't have passed the new filter, we don't see them. (Some other packet capture mechanisms do this automatically; this prevents tcpdump, for example, from showing or saving, when run with a filter, some packets that wouldn't have passed the filter.) XXX - do we have to do this on any other platforms? Choose whether to compile in the code to modify filter programs for use in the kernel, and to flush queued-up packet and set a kernel filter, on whether SO_ATTACH_FILTER is defined (i.e., on whether we have kernel filter support in our build environment), rather than on whether HAVE_PF_PACKET_SOCKETS is defined (i.e., on whether we have PF_PACKET support in our build environment), as we choose whether to *use* that code based on whether SO_ATTACH_FILTER is defined.
2001-08-25 05:08:26 +00:00
fcntl(handle->fd, F_SETFL, save_mode);
Bug fixes from Graeme Hewson <ghewson@cix.compulink.co.uk>: 1. During termination processing set up by atexit() under a 2.0.x kernel, if a socket had been previously closed and the handle freed due to an error, pcap_close_all() and pcap_close_linux() would nevertheless try to work with these structures and then crash. pcap_close_linux() is now called directly when necessary during error processing. 2. atexit() could get called more than once because the did_atexit flag wasn't being set. 3. If iface_get_arptype() returns an error because the ioctl() call failed (probably due to "no such device"), live_open_new() now returns a fatal error to pcap_open_live() and the call to live_open_old() is short-circuited. 4. Applications using libpcap would appear to listen on an interface that was down. a. iface_bind() and iface_bind_old() now check for pending errors after bind(). In turn, pcap_open_live() now returns an error status if there was a pending error after bind(). b. After draining the socket, set_kernel_filter() now checks to see if the error was the expected EAGAIN and returns a fatal error to pcap_setfilter() if not. In turn, pcap_setfilter() now returns an error status if there was a network error. 5. pcap_setfilter() was putting an error message into errbuf after a failed call to install_bpf_program(). This was unnecessary since install_bpf_program() puts its own error message into errbuf.
2002-02-22 09:20:11 +00:00
if (save_errno != EAGAIN) {
/* Fatal error */
reset_kernel_filter(handle);
From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_t handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
2008-04-04 19:37:44 +00:00
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
Bug fixes from Graeme Hewson <ghewson@cix.compulink.co.uk>: 1. During termination processing set up by atexit() under a 2.0.x kernel, if a socket had been previously closed and the handle freed due to an error, pcap_close_all() and pcap_close_linux() would nevertheless try to work with these structures and then crash. pcap_close_linux() is now called directly when necessary during error processing. 2. atexit() could get called more than once because the did_atexit flag wasn't being set. 3. If iface_get_arptype() returns an error because the ioctl() call failed (probably due to "no such device"), live_open_new() now returns a fatal error to pcap_open_live() and the call to live_open_old() is short-circuited. 4. Applications using libpcap would appear to listen on an interface that was down. a. iface_bind() and iface_bind_old() now check for pending errors after bind(). In turn, pcap_open_live() now returns an error status if there was a pending error after bind(). b. After draining the socket, set_kernel_filter() now checks to see if the error was the expected EAGAIN and returns a fatal error to pcap_setfilter() if not. In turn, pcap_setfilter() now returns an error status if there was a network error. 5. pcap_setfilter() was putting an error message into errbuf after a failed call to install_bpf_program(). This was unnecessary since install_bpf_program() puts its own error message into errbuf.
2002-02-22 09:20:11 +00:00
"recv: %s", pcap_strerror(save_errno));
return -2;
}
Patch, based on a patch from Pavel Kankovsky <kan@dcit.cz>, to flush all packets queued up on the socket when we set a kernel filter on the socket, so that if there are any queue-up packets that wouldn't have passed the new filter, we don't see them. (Some other packet capture mechanisms do this automatically; this prevents tcpdump, for example, from showing or saving, when run with a filter, some packets that wouldn't have passed the filter.) XXX - do we have to do this on any other platforms? Choose whether to compile in the code to modify filter programs for use in the kernel, and to flush queued-up packet and set a kernel filter, on whether SO_ATTACH_FILTER is defined (i.e., on whether we have kernel filter support in our build environment), rather than on whether HAVE_PF_PACKET_SOCKETS is defined (i.e., on whether we have PF_PACKET support in our build environment), as we choose whether to *use* that code based on whether SO_ATTACH_FILTER is defined.
2001-08-25 05:08:26 +00:00
}
}
/*
* Now attach the new filter.
*/
whitespace cleanup
2002-06-11 17:04:44 +00:00
ret = setsockopt(handle->fd, SOL_SOCKET, SO_ATTACH_FILTER,
Patch, based on a patch from Pavel Kankovsky <kan@dcit.cz>, to flush all packets queued up on the socket when we set a kernel filter on the socket, so that if there are any queue-up packets that wouldn't have passed the new filter, we don't see them. (Some other packet capture mechanisms do this automatically; this prevents tcpdump, for example, from showing or saving, when run with a filter, some packets that wouldn't have passed the filter.) XXX - do we have to do this on any other platforms? Choose whether to compile in the code to modify filter programs for use in the kernel, and to flush queued-up packet and set a kernel filter, on whether SO_ATTACH_FILTER is defined (i.e., on whether we have kernel filter support in our build environment), rather than on whether HAVE_PF_PACKET_SOCKETS is defined (i.e., on whether we have PF_PACKET support in our build environment), as we choose whether to *use* that code based on whether SO_ATTACH_FILTER is defined.
2001-08-25 05:08:26 +00:00
fcode, sizeof(*fcode));
if (ret == -1 && total_filter_on) {
/*
* Well, we couldn't set that filter on the socket,
* but we could set the total filter on the socket.
*
* This could, for example, mean that the filter was
* too big to put into the kernel, so we'll have to
* filter in userland; in any case, we'll be doing
* filtering in userland, so we need to remove the
* total filter so we see packets.
*/
save_errno = errno;
/*
* XXX - if this fails, we're really screwed;
* we have the total filter on the socket,
* and it won't come off. What do we do then?
*/
Changes from Pavel Kankovsky to reset the kernel filter in "pcap_setfilter()" if we're not using a kernel filter, in case a previous call to "pcap_setfilter()" had succeeded in adding a kernel filter, as if we're doing userland filtering we need to get rid of all kernel filters that might discard packets that'd pass the userland filter.
2001-08-30 03:08:43 +00:00
reset_kernel_filter(handle);
Patch, based on a patch from Pavel Kankovsky <kan@dcit.cz>, to flush all packets queued up on the socket when we set a kernel filter on the socket, so that if there are any queue-up packets that wouldn't have passed the new filter, we don't see them. (Some other packet capture mechanisms do this automatically; this prevents tcpdump, for example, from showing or saving, when run with a filter, some packets that wouldn't have passed the filter.) XXX - do we have to do this on any other platforms? Choose whether to compile in the code to modify filter programs for use in the kernel, and to flush queued-up packet and set a kernel filter, on whether SO_ATTACH_FILTER is defined (i.e., on whether we have kernel filter support in our build environment), rather than on whether HAVE_PF_PACKET_SOCKETS is defined (i.e., on whether we have PF_PACKET support in our build environment), as we choose whether to *use* that code based on whether SO_ATTACH_FILTER is defined.
2001-08-25 05:08:26 +00:00
errno = save_errno;
}
whitespace cleanup
2002-06-11 17:04:44 +00:00
return ret;
Patch, based on a patch from Pavel Kankovsky <kan@dcit.cz>, to flush all packets queued up on the socket when we set a kernel filter on the socket, so that if there are any queue-up packets that wouldn't have passed the new filter, we don't see them. (Some other packet capture mechanisms do this automatically; this prevents tcpdump, for example, from showing or saving, when run with a filter, some packets that wouldn't have passed the filter.) XXX - do we have to do this on any other platforms? Choose whether to compile in the code to modify filter programs for use in the kernel, and to flush queued-up packet and set a kernel filter, on whether SO_ATTACH_FILTER is defined (i.e., on whether we have kernel filter support in our build environment), rather than on whether HAVE_PF_PACKET_SOCKETS is defined (i.e., on whether we have PF_PACKET support in our build environment), as we choose whether to *use* that code based on whether SO_ATTACH_FILTER is defined.
2001-08-25 05:08:26 +00:00
}
Changes from Pavel Kankovsky to reset the kernel filter in "pcap_setfilter()" if we're not using a kernel filter, in case a previous call to "pcap_setfilter()" had succeeded in adding a kernel filter, as if we're doing userland filtering we need to get rid of all kernel filters that might discard packets that'd pass the userland filter.
2001-08-30 03:08:43 +00:00
static int
reset_kernel_filter(pcap_t *handle)
{
Squelch another valgrind complaint.
2006-10-12 17:26:06 +00:00
/*
* setsockopt() barfs unless it get a dummy parameter.
* valgrind whines unless the value is initialized,
* as it has no idea that setsockopt() ignores its
* parameter.
*/
int dummy = 0;
Changes from Pavel Kankovsky to reset the kernel filter in "pcap_setfilter()" if we're not using a kernel filter, in case a previous call to "pcap_setfilter()" had succeeded in adding a kernel filter, as if we're doing userland filtering we need to get rid of all kernel filters that might discard packets that'd pass the userland filter.
2001-08-30 03:08:43 +00:00
return setsockopt(handle->fd, SOL_SOCKET, SO_DETACH_FILTER,
&dummy, sizeof(dummy));
}
Add support for a new link layer type DLT_LINUX_SLL, for use when doing live captures with a "cooked" (SOCK_DGRAM) rather than a "raw" (SOCK_RAW) PF_PACKET socket; it includes a bunch of the fields from the "struct sockaddr_ll" you get in a "recvfrom()", including the Ethernet protocol field. This requires us to rewrite the BPF program if we're stuffing it into the kernel; as long as we're doing *ex post facto* rewriting, we might as well also do the "ret <snaplen>" -> "ret 65535" fixup there as well, rather than in the code generator.
2000-12-21 10:29:21 +00:00
#endif