mirror/freebsd
1
0
Fork 0
mirror of https://git.FreeBSD.org/src.git synced 2025-01-30 16:51:41 +00:00
Code Issues Releases Activity

Update sources to 1.2.1

Browse Source 
Submitted by:	wxs@
This commit is contained in:
George V. Neville-Neil 2012-01-31 17:22:07 +00:00
parent e89167f07a
commit 59f06eaa08
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/vendor/libpcap/dist/; revision=230828
61 changed files with 5139 additions and 2426 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

74
CHANGES
View File

@ -1,3 +1,77 @@
Friday December 9, 2011. guy@alum.mit.edu.
Summary for 1.2.1 libpcap release
Update README file.
Fix typoes in README.linux file.
Clean up some compiler warnings.
Fix Linux compile problems and tests for ethtool.h.
Treat Debian/kFreeBSD and GNU/Hurd as systems with GNU
toolchains.
Support 802.1 QinQ as a form of VLAN in filters.
Treat "carp" as equivalent to "vrrp" in filters.
Fix code generated for "ip6 protochain".
Add some new link-layer header types.
Support capturing NetFilter log messages on Linux.
Clean up some error messages.
Turn off monitor mode on exit for mac80211 interfaces on Linux.
Fix problems turning monitor mode on for non-mac80211 interfaces
on Linux.
Properly fail if /sys/class/net or /proc/net/dev exist but can't
be opened.
Fail if pcap_activate() is called on an already-activated
pcap_t, and add a test program for that.
Fix filtering in pcap-ng files.
Don't build for PowerPC on Mac OS X Lion.
Simplify handling of new DLT_/LINKTYPE_ values.
Expand pcap(3PCAP) man page.
Sunday July 24, 2011. mcr@sandelman.ca.
Summary for 1.2 libpcap release
All of the changes listed below for 1.1.1 and 1.1.2.
Changes to error handling for pcap_findalldevs().
Fix the calculation of the frame size in memory-mapped captures.
Add a link-layer header type for STANAG 5066 D_PDUs.
Add a link-layer type for a variant of 3GPP TS 27.010.
Noted real nature of LINKTYPE_ARCNET.
Add a link-layer type for DVB-CI.
Fix configure-script discovery of VLAN acceleration support.
see http://netoptimizer.blogspot.com/2010/09/tcpdump-vs-vlan-tags.html
Linux, HP-UX, AIX, NetBSD and OpenBSD compilation/conflict fixes.
Protect against including AIX 5.x's <net/bpf.h> having been included.
Add DLT_DBUS, for raw D-Bus messages.
Treat either EPERM or EACCES as "no soup for you".
Changes to permissions on DLPI systems.
Add DLT_IEEE802_15_4_NOFCS for 802.15.4 interfaces.
Fri. August 6, 2010. guy@alum.mit.edu.
Summary for 1.1.2 libpcap release
Return DLT_ values, not raw LINKTYPE_ values from
pcap_datalink() when reading pcap-ng files
Add support for "wlan ra" and "wlan ta", to check the RA and TA
of WLAN frames that have them
Don't crash if "wlan addr{1,2,3,4}" are used without 802.11
headers
Do filtering on USB and Bluetooth capturing
On FreeBSD/SPARC64, use -fPIC - it's apparently necessary
Check for valid port numbers (fit in a 16-bit unsigned field) in
"port" filters
Reject attempts to put savefiles into non-blocking mode
Check for "no such device" for the "get the media types" ioctl
in *BSD
Improve error messages from bpf_open(), and let it do the error
handling
Return more specific errors from pcap_can_set_rfmon(); fix
documentation
Update description fetching code for FreeBSD, fix code for
OpenBSD
Ignore /sys/net/dev files if we get ENODEV for them, not just
ENXIO; fixes handling of bonding devices on Linux
Fix check for a constant 0 argument to BPF_DIV
Use the right version of ar when cross-building
Free any filter set on a savefile when the savefile is closed
Include the CFLAGS setting when configure was run in the
compiler flags
Add support for 802.15.4 interfaces on Linux
Thu. April 1, 2010. guy@alum.mit.edu.
Summary for 1.1.1 libpcap release
Update CHANGES to reflect more of the changes in 1.1.0.

279
CREDITS
View File

@ -1,145 +1,154 @@
This file lists people who have contributed to libpcap:
The current maintainers:
Bill Fenner <fenner at research dot att dot com>
Fulvio Risso <risso at polito dot it>
Guy Harris <guy at alum dot mit dot edu>
Hannes Gredler <hannes at juniper dot net>
Michael Richardson <mcr at sandelman dot ottawa dot on dot ca>
Bill Fenner <fenner at research dot att dot com>
Fulvio Risso <risso at polito dot it>
Guy Harris <guy at alum dot mit dot edu>
Hannes Gredler <hannes at juniper dot net>
Michael Richardson <mcr at sandelman dot ottawa dot on dot ca>
Additional people who have contributed patches:
Alan Bawden <Alan at LCS dot MIT dot EDU>
Albert Chin <china at thewrittenword dot com>
Alexander 'Leo' Bergolth <Leo dot Bergolth at wu-wien dot ac dot at>
Alexey Kuznetsov <kuznet at ms2 dot inr dot ac dot ru>
Alon Bar-Lev <alonbl at sourceforge dot net>
Andrew Brown <atatat at atatdot dot net>
Antti Kantee <pooka at netbsd dot org>
Arien Vijn <arienvijn at sourceforge dot net>
Arkadiusz Miskiewicz <misiek at pld dot org dot pl>
Armando L. Caro Jr. <acaro at mail dot eecis dot udel dot edu>
Assar Westerlund <assar at sics dot se>
Brian Ginsbach <ginsbach at cray dot com>
Charles M. Hannum <mycroft at netbsd dot org>
Chris G. Demetriou <cgd at netbsd dot org>
Chris Lightfoot <cwrl at users dot sourceforge dot net>
Chris Maynard <Chris dot Maynard at gtech dot com>
Chris Pepper <pepper at mail dot reppep dot com>
Christian Bell <csbell at myri dot com>
Christian Peron <csjp at freebsd dot org>
Daniele Orlandi <daniele at orlandi dot com>
Darren Reed <darrenr at sun dot com>
David Kaelbling <drk at sgi dot com>
David Young <dyoung at ojctech dot com>
Dean Gaudet <dean at arctic dot org>
Don Ebright <Don dot Ebright at compuware dot com>
Dug Song <dugsong at monkey dot org>
Dustin Spicuzza <dustin at virtualroadside dot com>
Eric Anderson <anderse at hpl dot hp dot com>
Erik de Castro Lopo <erik dot de dot castro dot lopo at sensorynetworks dot com>
Felix Obenhuber <felix at obenhuber dot de>
Florent Drouin <Florent dot Drouin at alcatel-lucent dot fr>
Franz Schaefer <schaefer at mond dot at>
Fulko Hew <fulko dot hew at gmail dot com>
Fumiyuki Shimizu <fumifumi at abacustech dot jp>
Gianluca Varenni <varenni at netgroup-serv dot polito dot it>
Gilbert Hoyek <gil_hoyek at hotmail dot com>
Gisle Vanem <gvanem at broadpark dot no>
Graeme Hewson <ghewson at cix dot compulink dot co dot uk>
Greg Stark <gsstark at mit dot edu>
Greg Troxel <gdt at ir dot bbn dot com>
Gregor Maier <gregor at net dot in dot tum dot de>
Guillaume Pelat <endymion_ at users dot sourceforge dot net>
Hagen Paul Pfeifer <hagen at jauu dot net>
Hyung Sik Yoon <hsyn at kr dot ibm dot com>
Igor Khristophorov <igor at atdot dot org>
Jan-Philip Velders <jpv at veldersjes dot net>
Jason R. Thorpe <thorpej at netbsd dot org>
Javier Achirica <achirica at ttd dot net>
Jean Tourrilhes <jt at hpl dot hp dot com>
Jean-Louis Charton <Jean-Louis.CHARTON at oikialog dot com>
Jefferson Ogata <jogata at nodc dot noaa dot gov>
Jesper Peterson <jesper at endace dot com>
Joerg Mayer <jmayer at loplof dot de>
John Bankier <jbankier at rainfinity dot com>
Jon Lindgren <jonl at yubyub dot net>
Jon Smirl <jonsmirl at gmail dot com>
Juergen Schoenwaelder <schoenw at ibr dot cs dot tu-bs dot de>
Jung-uk Kim <jkim at FreeBSD dot org>
Kazushi Sugyo <sugyo at pb dot jp dot nec dot com>
Klaus Klein <kleink at netbsd dot org>
Koryn Grant <koryn at endace dot com>
Kris Katterjohn <katterjohn at gmail dot com>
Krzysztof Halasa <khc at pm dot waw dot pl>
Lorenzo Cavallaro <sullivan at sikurezza dot org>
Loris Degioanni <loris at netgroup-serv dot polito dot it>
Love Hörnquist-Åstrand <lha at stacken dot kth dot se>
Luis Martin Garcia <luis dot mgarc at gmail dot com>
Maciej W. Rozycki <macro at ds2 dot pg dot gda dot pl>
Marcus Felipe Pereira <marcus at task dot com dot br>
Mark C. Brown <mbrown at hp dot com>
Mark Pizzolato <List-tcpdump-workers at subscriptions dot pizzolato dot net>
Markus Mayer <markus_mayer at sourceforge dot net>
Martin Husemann <martin at netbsd dot org>
Márton Németh <nm127 at freemail dot hu>
Matthew Luckie <mjl at luckie dot org dot nz>
Max Laier <max at love2party dot net>
Mike Frysinger <vapier at gmail dot com>
Mike Kershaw <dragorn at kismetwireless dot net>
Mike Wiacek <mike at iroot dot net>
Monroe Williams <monroe at pobox dot com>
N. Leiten <nleiten at sourceforge dot net>
Nicolas Dade <ndade at nsd dot dyndns dot org>
Octavian Cerna <tavy at ylabs dot com>
Olaf Kirch <okir at caldera dot de>
Ollie Wild <aaw at users dot sourceforge dot net>
Onno van der Linden <onno at simplex dot nl>
Paolo Abeni <paolo dot abeni at email dot it>
Patrick Marie <mycroft at virgaria dot org>
Patrick McHardy <kaber at trash not net>
Paul Mundt <lethal at linux-sh dot org>
Pavel Kankovsky <kan at dcit dot cz>
Pawel Pokrywka <publicpp at gmail dot com>
Peter Fales <peter at fales-lorenz dot net>
Peter Jeremy <peter dot jeremy at alcatel dot com dot au>
Peter Volkov <pva at gentoo dot org>
Phil Wood <cpw at lanl dot gov>
Rafal Maszkowski <rzm at icm dot edu dot pl>
<rcb-isis at users dot sourceforge dot net>
Richard Stearn <richard at rns-stearn dot demon dot co dot uk>
Rick Jones <raj at cup dot hp dot com>
Robert Edmonds <stu-42 at sourceforge dot net>
Roberto Mariani <jelot-tcpdump at jelot dot it>
Romain Francoise <rfrancoise at debian dot org>
Sagun Shakya <sagun dot shakya at sun dot com>
Scott Barron <sb125499 at ohiou dot edu>
Scott Gifford <sgifford at tir dot com>
Sebastian Krahmer <krahmer at cs dot uni-potsdam dot de>
Sebastien Roy <Sebastien dot Roy at Sun dot COM>
Sepherosa Ziehau <sepherosa at gmail dot com>
Shaun Clowes <delius at progsoc dot uts dot edu dot au>
Solomon Peachy <pizza at shaftnet dot org>
Stefan Hudson <hudson at mbay dot net>
Stephen Donnelly <stephen at endace dot com>
Takashi Yamamoto <yamt at mwd dot biglobe dot ne dot jp>
Tanaka Shin-ya <zstanaka at archer dot livedoor dot com>
Tobias Poschwatta <posch at sourceforge dot net>
Tony Li <tli at procket dot com>
Torsten Landschoff <torsten at debian dot org>
Uns Lider <unslider at miranda dot org>
Uwe Girlich <Uwe dot Girlich at philosys dot de>
Wesley Shields <wxs at FreeBSD dot org>
Xianjie Zhang <xzhang at cup dot hp dot com>
Xin Li <delphij at FreeBSD dot org>
Yen Yen Lim
Yvan Vanhullebus <vanhu at sourceforge dot net>
Yoann Vandoorselaere <yoann at prelude-ids dot org>
Alan Bawden <Alan at LCS dot MIT dot EDU>
Albert Chin <china at thewrittenword dot com>
Alexander 'Leo' Bergolth <Leo dot Bergolth at wu-wien dot ac dot at>
Alexey Kuznetsov <kuznet at ms2 dot inr dot ac dot ru>
Alon Bar-Lev <alonbl at sourceforge dot net>
Andrew Brown <atatat at atatdot dot net>
<andy-1 at sourceforge dot net>
Antti Kantee <pooka at netbsd dot org>
Arien Vijn <arienvijn at sourceforge dot net>
Arkadiusz Miskiewicz <misiek at pld dot org dot pl>
Armando L. Caro Jr. <acaro at mail dot eecis dot udel dot edu>
Assar Westerlund <assar at sics dot se>
Brian Ginsbach <ginsbach at cray dot com>
Charles M. Hannum <mycroft at netbsd dot org>
Chris G. Demetriou <cgd at netbsd dot org>
Chris Lightfoot <cwrl at users dot sourceforge dot net>
Chris Maynard <Chris dot Maynard at gtech dot com>
Chris Pepper <pepper at mail dot reppep dot com>
Christian Bell <csbell at myri dot com>
Christian Peron <csjp at freebsd dot org>
Daniele Orlandi <daniele at orlandi dot com>
Darren Reed <darrenr at sun dot com>
David Kaelbling <drk at sgi dot com>
David Young <dyoung at ojctech dot com>
Dean Gaudet <dean at arctic dot org>
Don Ebright <Don dot Ebright at compuware dot com>
Dug Song <dugsong at monkey dot org>
Dustin Spicuzza <dustin at virtualroadside dot com>
Eric Anderson <anderse at hpl dot hp dot com>
Erik de Castro Lopo <erik dot de dot castro dot lopo at sensorynetworks dot com>
Felix Obenhuber <felix at obenhuber dot de>
Florent Drouin <Florent dot Drouin at alcatel-lucent dot fr>
Franz Schaefer <schaefer at mond dot at>
frederich <frederich at sourceforge dot net>
Fulko Hew <fulko dot hew at gmail dot com>
Fumiyuki Shimizu <fumifumi at abacustech dot jp>
Garrett Cooper <yaberauneya at sourceforge dot net>
Gianluca Varenni <gianluca dot varenni at gmail dot com>
Gilbert Hoyek <gil_hoyek at hotmail dot com>
Gisle Vanem <gvanem at broadpark dot no>
Graeme Hewson <ghewson at cix dot compulink dot co dot uk>
Greg Stark <gsstark at mit dot edu>
Greg Troxel <gdt at ir dot bbn dot com>
Gregor Maier <gregor at net dot in dot tum dot de>
Guillaume Pelat <endymion_ at users dot sourceforge dot net>
Hagen Paul Pfeifer <hagen at jauu dot net>
Henri Doreau <hdoreau at sourceforge dot net>
Hyung Sik Yoon <hsyn at kr dot ibm dot com>
Igor Khristophorov <igor at atdot dot org>
Jan-Philip Velders <jpv at veldersjes dot net>
Jason R. Thorpe <thorpej at netbsd dot org>
Javier Achirica <achirica at ttd dot net>
Jean Tourrilhes <jt at hpl dot hp dot com>
Jean-Louis Charton <Jean-Louis.CHARTON at oikialog dot com>
Jefferson Ogata <jogata at nodc dot noaa dot gov>
Jesper Dangaard Brouer <hawk at comx dot dk>
Jesper Peterson <jesper at endace dot com>
Joerg Mayer <jmayer at loplof dot de>
John Bankier <jbankier at rainfinity dot com>
Jon Lindgren <jonl at yubyub dot net>
Jon Smirl <jonsmirl at gmail dot com>
Juergen Schoenwaelder <schoenw at ibr dot cs dot tu-bs dot de>
Julien Moutinho <julm at savines dot alpes dot fr dot eu dot org>
Jung-uk Kim <jkim at FreeBSD dot org>
Kazushi Sugyo <sugyo at pb dot jp dot nec dot com>
Klaus Klein <kleink at netbsd dot org>
Koryn Grant <koryn at endace dot com>
Kris Katterjohn <katterjohn at gmail dot com>
Krzysztof Halasa <khc at pm dot waw dot pl>
Lorenzo Cavallaro <sullivan at sikurezza dot org>
Loris Degioanni <loris at netgroup-serv dot polito dot it>
Love Hörnquist-Åstrand <lha at stacken dot kth dot se>
Luis MartinGarcia <luis dot mgarc at gmail dot com>
Maciej W. Rozycki <macro at ds2 dot pg dot gda dot pl>
Marcus Felipe Pereira <marcus at task dot com dot br>
Mark C. Brown <mbrown at hp dot com>
Mark Pizzolato <List-tcpdump-workers at subscriptions dot pizzolato dot net>
Markus Mayer <markus_mayer at sourceforge dot net>
Martin Husemann <martin at netbsd dot org>
Márton Németh <nm127 at freemail dot hu>
Matthew Luckie <mjl at luckie dot org dot nz>
Max Laier <max at love2party dot net>
Mike Frysinger <vapier at gmail dot com>
Mike Kershaw <dragorn at kismetwireless dot net>
Mike Wiacek <mike at iroot dot net>
Miroslav Lichvar <mlichvar at redhat dot com>
Monroe Williams <monroe at pobox dot com>
<nvercamm at sourceforge dot net>
N. Leiten <nleiten at sourceforge dot net>
Nicolas Dade <ndade at nsd dot dyndns dot org>
Octavian Cerna <tavy at ylabs dot com>
Olaf Kirch <okir at caldera dot de>
Ollie Wild <aaw at users dot sourceforge dot net>
Onno van der Linden <onno at simplex dot nl>
Paolo Abeni <paolo dot abeni at email dot it>
Patrick Marie <mycroft at virgaria dot org>
Patrick McHardy <kaber at trash not net>
Paul Mundt <lethal at linux-sh dot org>
Pavel Kankovsky <kan at dcit dot cz>
Pawel Pokrywka <publicpp at gmail dot com>
Peter Fales <peter at fales-lorenz dot net>
Peter Jeremy <peter dot jeremy at alcatel dot com dot au>
Peter Volkov <pva at gentoo dot org>
Phil Wood <cpw at lanl dot gov>
Rafal Maszkowski <rzm at icm dot edu dot pl>
<rcb-isis at users dot sourceforge dot net>
Richard Stearn <richard at rns-stearn dot demon dot co dot uk>
Rick Jones <raj at cup dot hp dot com>
Robert Edmonds <stu-42 at sourceforge dot net>
Roberto Mariani <jelot-tcpdump at jelot dot it>
Romain Francoise <rfrancoise at debian dot org>
Sagun Shakya <sagun dot shakya at sun dot com>
Scott Barron <sb125499 at ohiou dot edu>
Scott Gifford <sgifford at tir dot com>
Scott Mcmillan <scott dot a dot mcmillan at intel dot com>
Sebastian Krahmer <krahmer at cs dot uni-potsdam dot de>
Sebastien Roy <Sebastien dot Roy at Sun dot COM>
Sepherosa Ziehau <sepherosa at gmail dot com>
Shaun Clowes <delius at progsoc dot uts dot edu dot au>
Solomon Peachy <pizza at shaftnet dot org>
Stefan Hudson <hudson at mbay dot net>
Stephen Donnelly <stephen at endace dot com>
Takashi Yamamoto <yamt at mwd dot biglobe dot ne dot jp>
Tanaka Shin-ya <zstanaka at archer dot livedoor dot com>
Tobias Poschwatta <posch at sourceforge dot net>
Tony Li <tli at procket dot com>
Torsten Landschoff <torsten at debian dot org>
Uns Lider <unslider at miranda dot org>
Uwe Girlich <Uwe dot Girlich at philosys dot de>
Wesley Shields <wxs at FreeBSD dot org>
Xianjie Zhang <xzhang at cup dot hp dot com>
Xin Li <delphij at FreeBSD dot org>
Yen Yen Lim
Yvan Vanhullebus <vanhu at sourceforge dot net>
Yoann Vandoorselaere <yoann at prelude-ids dot org>
The original LBL crew:
Steve McCanne
Craig Leres
Van Jacobson
Steve McCanne
Craig Leres
Van Jacobson
Past maintainers:
Jun-ichiro itojun Hagino <itojun at iijlab dot net>
Jun-ichiro itojun Hagino <itojun at iijlab dot net>

115
Makefile.in
View File

@ -46,19 +46,21 @@ VPATH = @srcdir@
LD = /usr/bin/ld
CC = @CC@
AR = @AR@
CCOPT = @V_CCOPT@
INCLS = -I. @V_INCLS@
DEFS = @DEFS@ @V_DEFS@
ADDLOBJS = @ADDLOBJS@
ADDLARCHIVEOBJS = @ADDLARCHIVEOBJS@
LIBS = @LIBS@
CFLAGS = @CFLAGS@
LDFLAGS = @LDFLAGS@
DYEXT = @DYEXT@
V_RPATH_OPT = @V_RPATH_OPT@
PROG=libpcap
# Standard CFLAGS
CFLAGS = $(CCOPT) $(INCLS) $(DEFS)
FULL_CFLAGS = $(CCOPT) $(INCLS) $(DEFS) $(CFLAGS)
INSTALL = @INSTALL@
INSTALL_PROGRAM = @INSTALL_PROGRAM@
@ -78,9 +80,9 @@ YACC = @V_YACC@
# problem if you don't own the file but can write to the directory.
.c.o:
@rm -f $@
$(CC) $(CFLAGS) -c $(srcdir)/$*.c
$(CC) $(FULL_CFLAGS) -c $(srcdir)/$*.c
PSRC = pcap-@V_PCAP@.c @USB_SRC@ @BT_SRC@ @CAN_SRC@
PSRC = pcap-@V_PCAP@.c @USB_SRC@ @BT_SRC@ @CAN_SRC@ @NETFILTER_SRC@
FSRC = fad-@V_FINDALLDEVS@.c
SSRC = @SSRC@
CSRC = pcap.c inet.c gencode.c optimize.c nametoaddr.c etherent.c \
@ -123,14 +125,29 @@ HDR = $(PUBHDR) \
sf-pcap-ng.h \
sunatmpos.h
TESTS = \
filtertest \
findalldevstest \
nonblocktest \
opentest \
selpolltest
TESTS_SRC = \
tests/filtertest.c \
tests/findalldevstest.c \
tests/nonblocktest.c \
tests/opentest.c \
tests/reactivatetest.c \
tests/selpolltest.c
GENHDR = \
scanner.h tokdefs.h version.h
TAGFILES = \
$(SRC) $(HDR)
CLEANFILES = $(OBJ) libpcap.* filtertest findalldevstest selpolltest \
opentest $(PROG)-`cat $(srcdir)/VERSION`.tar.gz $(GENSRC) $(GENHDR) \
CLEANFILES = $(OBJ) libpcap.* $(TESTS) \
$(PROG)-`cat $(srcdir)/VERSION`.tar.gz $(GENSRC) $(GENHDR) \
lex.yy.c pcap-config
MAN1 = pcap-config.1
@ -141,8 +158,10 @@ MAN3PCAP_EXPAND = \
pcap_datalink.3pcap.in \
pcap_dump_open.3pcap.in \
pcap_list_datalinks.3pcap.in \
pcap_list_tstamp_types.3pcap.in \
pcap_open_dead.3pcap.in \
pcap_open_offline.3pcap.in
pcap_open_offline.3pcap.in \
pcap_set_tstamp_type.3pcap.in
MAN3PCAP_NOEXPAND = \
pcap_activate.3pcap \
@ -160,9 +179,7 @@ MAN3PCAP_NOEXPAND = \
pcap_file.3pcap \
pcap_fileno.3pcap \
pcap_findalldevs.3pcap \
pcap_freealldevs.3pcap \
pcap_freecode.3pcap \
pcap_free_datalinks.3pcap \
pcap_get_selectable_fd.3pcap \
pcap_geterr.3pcap \
pcap_inject.3pcap \
@ -187,7 +204,9 @@ MAN3PCAP_NOEXPAND = \
pcap_snapshot.3pcap \
pcap_stats.3pcap \
pcap_statustostr.3pcap \
pcap_strerror.3pcap
pcap_strerror.3pcap \
pcap_tstamp_type_name_to_val.3pcap \
pcap_tstamp_type_val_to_name.3pcap
MAN3PCAP = $(MAN3PCAP_NOEXPAND) $(MAN3PCAP_EXPAND:.in=)
@ -196,9 +215,11 @@ MANFILE = \
MANMISC = \
pcap-filter.manmisc.in \
pcap-linktype.manmisc.in
pcap-linktype.manmisc.in \
pcap-tstamp.manmisc.in
EXTRA_DIST = \
$(TESTS_SRC) \
CHANGES \
ChmodBPF/ChmodBPF \
ChmodBPF/StartupParameters.plist \
@ -237,8 +258,6 @@ EXTRA_DIST = \
fad-null.c \
fad-sita.c \
fad-win32.c \
filtertest.c \
findalldevstest.c \
grammar.y \
install-sh \
lbl/os-aix4.h \
@ -263,7 +282,6 @@ EXTRA_DIST = \
msdos/pktdrvr.c \
msdos/pktdrvr.h \
msdos/readme.dos \
opentest.c \
org.tcpdump.chmod_bpf.plist \
packaging/pcap.spec.in \
pcap-bpf.c \
@ -282,6 +300,8 @@ EXTRA_DIST = \
pcap-libdlpi.c \
pcap-linux.c \
pcap-namedb.h \
pcap-netfilter-linux.c \
pcap-netfilter-linux.h \
pcap-nit.c \
pcap-null.c \
pcap-pf.c \
@ -299,7 +319,6 @@ EXTRA_DIST = \
pcap-win32.c \
runlex.sh \
scanner.l \
selpolltest.c \
Win32/Include/Gnuc.h \
Win32/Include/addrinfo.h \
Win32/Include/bittypes.h \
@ -328,7 +347,7 @@ all: libpcap.a shared pcap-config
libpcap.a: $(OBJ)
@rm -f $@
ar rc $@ $(OBJ) $(ADDLARCHIVEOBJS)
$(AR) rc $@ $(OBJ) $(ADDLARCHIVEOBJS)
$(RANLIB) $@
shared: libpcap.$(DYEXT)
@ -401,7 +420,7 @@ libpcap.sl: $(OBJ)
libpcap.shareda: $(OBJ)
@rm -f $@ shr.o
$(CC) @V_SHLIB_OPT@ -o shr.o $(OBJ) $(ADDLOBJS) $(LDFLAGS) $(LIBS)
ar rc $@ shr.o
$(AR) rc $@ shr.o
#
# For platforms that don't support shared libraries (or on which we
@ -414,7 +433,7 @@ scanner.c: $(srcdir)/scanner.l
$(srcdir)/runlex.sh $(LEX) -o$@ $<
scanner.o: scanner.c tokdefs.h
$(CC) $(CFLAGS) -c scanner.c
$(CC) $(FULL_CFLAGS) -c scanner.c
pcap.o: version.h
@ -427,13 +446,13 @@ grammar.c: $(srcdir)/grammar.y
grammar.o: grammar.c
@rm -f $@
$(CC) $(CFLAGS) -Dyylval=pcap_lval -c grammar.c
$(CC) $(FULL_CFLAGS) -Dyylval=pcap_lval -c grammar.c
version.o: version.c
$(CC) $(CFLAGS) -c version.c
$(CC) $(FULL_CFLAGS) -c version.c
snprintf.o: $(srcdir)/missing/snprintf.c
$(CC) $(CFLAGS) -o $@ -c $(srcdir)/missing/snprintf.c
$(CC) $(FULL_CFLAGS) -o $@ -c $(srcdir)/missing/snprintf.c
version.c: $(srcdir)/VERSION
@rm -f $@
@ -467,35 +486,47 @@ bpf_filter.c: $(srcdir)/bpf/net/bpf_filter.c
ln -s $(srcdir)/bpf/net/bpf_filter.c bpf_filter.c
bpf_filter.o: bpf_filter.c
$(CC) $(CFLAGS) -c bpf_filter.c
$(CC) $(FULL_CFLAGS) -c bpf_filter.c
#
# Generate the pcap-config script.
#
pcap-config: $(srcdir)/pcap-config.in
# Some Makes, e.g. AIX Make and Solaris Make, can't handle "--file=$@.tmp:$<";
# for example, the Solaris 9 make man page says
#
# Because make assigns $< and $* as it would for implicit rules
# (according to the suffixes list and the directory contents),
# they may be unreliable when used within explicit target entries.
#
# and this is an explicit target entry.
#
# Therefore, instead of using $<, we explicitly put in $(srcdir)/pcap-config.in.
#
pcap-config: $(srcdir)/pcap-config.in ./config.status
@rm -f $@ $@.tmp
sed -e 's|@includedir[@]|$(includedir)|g' \
-e 's|@libdir[@]|$(libdir)|g' \
-e 's|@LIBS[@]|$(LIBS)|g' \
-e 's|@V_RPATH_OPT[@]|$(V_RPATH_OPT)|g' \
$(srcdir)/pcap-config.in >$@.tmp
./config.status --file=$@.tmp:$(srcdir)/pcap-config.in
mv $@.tmp $@
chmod a+x $@
#
# Test programs - not built by default, and not installed.
#
filtertest: filtertest.c libpcap.a
$(CC) $(CFLAGS) -I. -L. -o filtertest $(srcdir)/filtertest.c libpcap.a $(LIBS)
tests: $(TESTS)
findalldevstest: findalldevstest.c libpcap.a
$(CC) $(CFLAGS) -I. -L. -o findalldevstest $(srcdir)/findalldevstest.c libpcap.a $(LIBS)
filtertest: tests/filtertest.c libpcap.a
$(CC) $(FULL_CFLAGS) -I. -L. -o filtertest $(srcdir)/tests/filtertest.c libpcap.a $(LIBS)
selpolltest: selpolltest.c libpcap.a
$(CC) $(CFLAGS) -I. -L. -o selpolltest $(srcdir)/selpolltest.c libpcap.a $(LIBS)
findalldevstest: tests/findalldevstest.c libpcap.a
$(CC) $(FULL_CFLAGS) -I. -L. -o findalldevstest $(srcdir)/tests/findalldevstest.c libpcap.a $(LIBS)
opentest: opentest.c libpcap.a
$(CC) $(CFLAGS) -I. -L. -o opentest $(srcdir)/opentest.c libpcap.a $(LIBS)
nonblocktest: tests/nonblocktest.c libpcap.a
$(CC) $(FULL_CFLAGS) -I. -L. -o nonblocktest $(srcdir)/tests/nonblocktest.c libpcap.a $(LIBS)
opentest: tests/opentest.c libpcap.a
$(CC) $(FULL_CFLAGS) -I. -L. -o opentest $(srcdir)/tests/opentest.c libpcap.a $(LIBS)
selpolltest: tests/selpolltest.c libpcap.a
$(CC) $(FULL_CFLAGS) -I. -L. -o selpolltest $(srcdir)/tests/selpolltest.c libpcap.a $(LIBS)
install: install-shared install-archive pcap-config
[ -d $(DESTDIR)$(libdir) ] || \
@ -533,12 +564,21 @@ install: install-shared install-archive pcap-config
rm -f $(DESTDIR)$(mandir)/man3/pcap_dump_fopen.3pcap
ln $(DESTDIR)$(mandir)/man3/pcap_dump_open.3pcap \
$(DESTDIR)$(mandir)/man3/pcap_dump_fopen.3pcap
rm -f $(DESTDIR)$(mandir)/man3/pcap_freealldevs.3pcap
ln $(DESTDIR)$(mandir)/man3/pcap_findalldevs.3pcap \
$(DESTDIR)$(mandir)/man3/pcap_freealldevs.3pcap
rm -f $(DESTDIR)$(mandir)/man3/pcap_perror.3pcap
ln $(DESTDIR)$(mandir)/man3/pcap_geterr.3pcap \
$(DESTDIR)$(mandir)/man3/pcap_perror.3pcap
rm -f $(DESTDIR)$(mandir)/man3/pcap_sendpacket.3pcap
ln $(DESTDIR)$(mandir)/man3/pcap_inject.3pcap \
$(DESTDIR)$(mandir)/man3/pcap_sendpacket.3pcap
rm -f $(DESTDIR)$(mandir)/man3/pcap_free_datalinks.3pcap
ln $(DESTDIR)$(mandir)/man3/pcap_list_datalinks.3pcap \
$(DESTDIR)$(mandir)/man3/pcap_free_datalinks.3pcap
rm -f $(DESTDIR)$(mandir)/man3/pcap_free_tstamp_types.3pcap
ln $(DESTDIR)$(mandir)/man3/pcap_list_tstamp_types.3pcap \
$(DESTDIR)$(mandir)/man3/pcap_free_tstamp_types.3pcap
rm -f $(DESTDIR)$(mandir)/man3/pcap_dispatch.3pcap
ln $(DESTDIR)$(mandir)/man3/pcap_loop.3pcap \
$(DESTDIR)$(mandir)/man3/pcap_dispatch.3pcap
@ -622,8 +662,11 @@ uninstall: uninstall-shared
rm -f $(DESTDIR)$(mandir)/man3/$$i; done
rm -f $(DESTDIR)$(mandir)/man3/pcap_datalink_val_to_description.3pcap
rm -f $(DESTDIR)$(mandir)/man3/pcap_dump_fopen.3pcap
rm -f $(DESTDIR)$(mandir)/man3/pcap_freealldevs.3pcap
rm -f $(DESTDIR)$(mandir)/man3/pcap_perror.3pcap
rm -f $(DESTDIR)$(mandir)/man3/pcap_sendpacket.3pcap
rm -f $(DESTDIR)$(mandir)/man3/pcap_free_datalinks.3pcap
rm -f $(DESTDIR)$(mandir)/man3/pcap_free_tstamp_types.3pcap
rm -f $(DESTDIR)$(mandir)/man3/pcap_dispatch.3pcap
rm -f $(DESTDIR)$(mandir)/man3/pcap_minor_version.3pcap
rm -f $(DESTDIR)$(mandir)/man3/pcap_next.3pcap
@ -660,7 +703,7 @@ clean:
distclean: clean
rm -f Makefile config.cache config.log config.status \
config.h gnuc.h os-proto.h bpf_filter.c pcap-config \
config.h gnuc.h net os-proto.h bpf_filter.c pcap-config \
stamp-h stamp-h.in
rm -f $(MAN3PCAP_EXPAND:.in=) $(MANFILE:.in=) $(MANMISC:.in=)
rm -rf autom4te.cache

13
README
View File

@ -63,13 +63,14 @@ added overhead (especially, for selective filters). Ideally, libpcap
would translate BPF filters into a filter program that is compatible
with the underlying kernel subsystem, but this is not yet implemented.
BPF is standard in 4.4BSD, BSD/OS, NetBSD, FreeBSD, and OpenBSD. DEC
OSF/1/Digital UNIX/Tru64 UNIX uses the packetfilter interface but has
been extended to accept BPF filters (which libpcap utilizes). Also, you
can add BPF filter support to Ultrix using the kernel source and/or
object patches available in:
BPF is standard in 4.4BSD, BSD/OS, NetBSD, FreeBSD, OpenBSD, DragonFly
BSD, and Mac OS X; an older, modified and undocumented version is
standard in AIX. {DEC OSF/1, Digital UNIX, Tru64 UNIX} uses the
packetfilter interface but has been extended to accept BPF filters
(which libpcap utilizes). Also, you can add BPF filter support to
Ultrix using the kernel source and/or object patches available in:
ftp://gatekeeper.dec.com/pub/DEC/net/bpfext42.tar.Z.
http://www.tcpdump.org/other/bpfext42.tar.Z
Linux, in the 2.2 kernel and later kernels, has a "Socket Filter"
mechanism that accepts BPF filters; see the README.linux file for

10
README.linux
View File

@ -97,12 +97,12 @@ reported by pcap_stats on Linux are as follows:
2.2.x
=====
ps_recv Number of packets that were accepted by the pcap filter
ps_drops Always 0, this statistic is not gatherd on this platform
ps_drop Always 0, this statistic is not gatherd on this platform
2.4.x
=====
ps_rec Number of packets that were accepted by the pcap filter
ps_drops Number of packets that had passed filtering but were not
ps_recv Number of packets that were accepted by the pcap filter
ps_drop Number of packets that had passed filtering but were not
passed on to pcap due to things like buffer shortage, etc.
This is useful because these are packets you are interested in
but won't be reported by, for example, tcpdump output.
This is useful because these are packets you are interested in
but won't be reported by, for example, tcpdump output.

2
VERSION
View File

@ -1 +1 @@
1.1.1
1.2.1

60
Win32/Include/bittypes.h
View File

@ -30,78 +30,28 @@
#define _BITTYPES_H
#ifndef HAVE_U_INT8_T
#if SIZEOF_CHAR == 1
typedef unsigned char u_int8_t;
typedef signed char int8_t;
#elif SIZEOF_INT == 1
typedef unsigned int u_int8_t;
typedef signed int int8_t;
#else /* XXX */
#error "there's no appropriate type for u_int8_t"
#endif
#define HAVE_U_INT8_T 1
#define HAVE_INT8_T 1
#endif /* HAVE_U_INT8_T */
#ifndef HAVE_U_INT16_T
#if SIZEOF_SHORT == 2
typedef unsigned short u_int16_t;
typedef signed short int16_t;
#elif SIZEOF_INT == 2
typedef unsigned int u_int16_t;
typedef signed int int16_t;
#elif SIZEOF_CHAR == 2
typedef unsigned char u_int16_t;
typedef signed char int16_t;
#else /* XXX */
#error "there's no appropriate type for u_int16_t"
#endif
#define HAVE_U_INT16_T 1
#define HAVE_INT16_T 1
#endif /* HAVE_U_INT16_T */
#ifndef HAVE_U_INT32_T
#if SIZEOF_INT == 4
typedef unsigned int u_int32_t;
typedef signed int int32_t;
#elif SIZEOF_LONG == 4
typedef unsigned long u_int32_t;
typedef signed long int32_t;
#elif SIZEOF_SHORT == 4
typedef unsigned short u_int32_t;
typedef signed short int32_t;
#else /* XXX */
#error "there's no appropriate type for u_int32_t"
#endif
#define HAVE_U_INT32_T 1
#define HAVE_INT32_T 1
#endif /* HAVE_U_INT32_T */
#ifndef HAVE_U_INT64_T
#if SIZEOF_LONG_LONG == 8
typedef unsigned long long u_int64_t;
typedef long long int64_t;
#elif defined(_MSC_EXTENSIONS)
#ifdef _MSC_EXTENSIONS
typedef unsigned _int64 u_int64_t;
typedef _int64 int64_t;
#elif SIZEOF_INT == 8
typedef unsigned int u_int64_t;
#elif SIZEOF_LONG == 8
typedef unsigned long u_int64_t;
#elif SIZEOF_SHORT == 8
typedef unsigned short u_int64_t;
#else /* XXX */
#error "there's no appropriate type for u_int64_t"
#endif
#define HAVE_U_INT64_T 1
#define HAVE_INT64_T 1
#else /* _MSC_EXTENSIONS */
typedef unsigned long long u_int64_t;
typedef long long int64_t;
#endif /* _MSC_EXTENSIONS */
#endif /* HAVE_U_INT64_T */
#ifndef PRId64

4
Win32/Prj/libpcap.dsp
View File

@ -41,7 +41,7 @@ RSC=rc.exe
# PROP Intermediate_Dir "Release"
# PROP Target_Dir ""
# ADD BASE CPP /nologo /W3 /GX /O2 /D "WIN32" /D "NDEBUG" /D "_MBCS" /D "_LIB" /YX /FD /c
# ADD CPP /nologo /MT /W3 /GX /O2 /I "../../" /I "../../lbl/" /I "../../bpf/" /I "../include/" /I "../../../../common" /I "../../../../dag/include" /I "../../../../dag/drv/windows" /D "NDEBUG" /D "YY_NEVER_INTERACTIVE" /D yylval=pcap_lval /D "_USRDLL" /D "LIBPCAP_EXPORTS" /D "HAVE_STRERROR" /D "__STDC__" /D "INET6" /D "_WINDOWS" /D "_MBCS" /D SIZEOF_CHAR=1 /D SIZEOF_SHORT=2 /D SIZEOF_INT=4 /D "HAVE_ADDRINFO" /D "WIN32" /D _U_= /D "HAVE_SNPRINTF" /D "HAVE_VSNPRINTF" /YX /FD /c
# ADD CPP /nologo /MT /W3 /GX /O2 /I "../../" /I "../../lbl/" /I "../../bpf/" /I "../include/" /I "../../../../common" /I "../../../../dag/include" /I "../../../../dag/drv/windows" /D "NDEBUG" /D "YY_NEVER_INTERACTIVE" /D yylval=pcap_lval /D "_USRDLL" /D "LIBPCAP_EXPORTS" /D "HAVE_STRERROR" /D "__STDC__" /D "INET6" /D "_WINDOWS" /D "_MBCS" /D "HAVE_ADDRINFO" /D "WIN32" /D _U_= /D "HAVE_SNPRINTF" /D "HAVE_VSNPRINTF" /YX /FD /c
# ADD BASE RSC /l 0x409 /d "NDEBUG"
# ADD RSC /l 0x409 /d "NDEBUG"
BSC32=bscmake.exe
@ -64,7 +64,7 @@ LIB32=link.exe -lib
# PROP Intermediate_Dir "Debug"
# PROP Target_Dir ""
# ADD BASE CPP /nologo /W3 /Gm /GX /ZI /Od /D "WIN32" /D "_DEBUG" /D "_MBCS" /D "_LIB" /YX /FD /GZ /c
# ADD CPP /nologo /MTd /W3 /Gm /GX /ZI /Od /I "../../" /I "../../lbl/" /I "../../bpf/" /I "../include/" /I "../../../../common" /I "../../../../dag/include" /I "../../../../dag/drv/windows" /D "_DEBUG" /D "YY_NEVER_INTERACTIVE" /D yylval=pcap_lval /D "_USRDLL" /D "LIBPCAP_EXPORTS" /D "HAVE_STRERROR" /D "__STDC__" /D "INET6" /D "_WINDOWS" /D "_MBCS" /D SIZEOF_CHAR=1 /D SIZEOF_SHORT=2 /D SIZEOF_INT=4 /D "HAVE_ADDRINFO" /D "WIN32" /D _U_= /D "HAVE_SNPRINTF" /D "HAVE_VSNPRINTF" /YX /FD /GZ /c
# ADD CPP /nologo /MTd /W3 /Gm /GX /ZI /Od /I "../../" /I "../../lbl/" /I "../../bpf/" /I "../include/" /I "../../../../common" /I "../../../../dag/include" /I "../../../../dag/drv/windows" /D "_DEBUG" /D "YY_NEVER_INTERACTIVE" /D yylval=pcap_lval /D "_USRDLL" /D "LIBPCAP_EXPORTS" /D "HAVE_STRERROR" /D "__STDC__" /D "INET6" /D "_WINDOWS" /D "_MBCS" /D "HAVE_ADDRINFO" /D "WIN32" /D _U_= /D "HAVE_SNPRINTF" /D "HAVE_VSNPRINTF" /YX /FD /GZ /c
# ADD BASE RSC /l 0x409 /d "_DEBUG"
# ADD RSC /l 0x409 /d "_DEBUG"
BSC32=bscmake.exe

2
Win32/Src/gai_strerror.c
View File

@ -80,4 +80,4 @@ WSAAPI gai_strerrorA(int ecode)
return "Unknown error";
}
#endif /* gai_strerror */
#endif /* gai_strerror */

11
Win32/Src/getaddrinfo.c
View File

@ -45,6 +45,12 @@
* in ai_flags?
*/
/*
* Mingw64 has its own implementation of getaddrinfo, mingw32 no
*/
#ifndef __MINGW64__
#ifdef HAVE_CONFIG_H
#include <config.h>
#endif
@ -85,7 +91,7 @@ static const char rcsid[] _U_ =
#ifdef NEED_ADDRINFO_H
#include "addrinfo.h"
#ifdef WIN32
#include "IP6_misc.h"
#include "ip6_misc.h"
#endif
#endif
@ -1118,3 +1124,6 @@ find_afd(af)
}
return NULL;
}
#endif /*__MING64__*/

22
aclocal.m4 vendored
View File

@ -245,7 +245,24 @@ AC_DEFUN(AC_LBL_SHLIBS_INIT,
# or accepts command-line arguments like
# those the GNU linker accepts.
#
V_CCOPT="$V_CCOPT -fpic"
# Some instruction sets require -fPIC on some
# operating systems. Check for them. If you
# have a combination that requires it, add it
# here.
#
PIC_OPT=-fpic
case "$host_cpu" in
sparc64*)
case "$host_os" in
freebsd*)
PIC_OPT=-fPIC
;;
esac
;;
esac
V_CCOPT="$V_CCOPT $PIC_OPT"
V_SONAME_OPT="-Wl,-soname,"
V_RPATH_OPT="-Wl,-rpath,"
;;
@ -978,8 +995,9 @@ dnl code that would use that member, or we wouldn't compile in any case).
dnl
AC_DEFUN(AC_LBL_LINUX_TPACKET_AUXDATA_TP_VLAN_TCI,
[AC_MSG_CHECKING(if tpacket_auxdata struct has tp_vlan_tci member)
AC_CACHE_VAL(ac_cv_lbl_dl_hp_ppa_info_t_has_dl_module_id_1,
AC_CACHE_VAL(ac_cv_lbl_linux_tpacket_auxdata_tp_vlan_tci,
AC_TRY_COMPILE([
# include <sys/types.h>
# include <linux/if_packet.h>],
[u_int i = sizeof(((struct tpacket_auxdata *)0)->tp_vlan_tci)],
ac_cv_lbl_linux_tpacket_auxdata_tp_vlan_tci=yes,

13
bpf/net/bpf_filter.c
View File

@ -405,7 +405,18 @@ bpf_filter(pc, p, wirelen, buflen)
continue;
case BPF_JMP|BPF_JA:
#if defined(KERNEL) || defined(_KERNEL)
/*
* No backward jumps allowed.
*/
pc += pc->k;
#else
/*
* XXX - we currently implement "ip6 protochain"
* with backward jumps, so sign-extend pc->k.
*/
pc += (bpf_int32)pc->k;
#endif
continue;
case BPF_JMP|BPF_JGT|BPF_K:
@ -608,7 +619,7 @@ bpf_validate(f, len)
/*
* Check for constant division by 0.
*/
if (BPF_RVAL(p->code) == BPF_K && p->k == 0)
if (BPF_SRC(p->code) == BPF_K && p->k == 0)
return 0;
break;
default:

30
config.h.in
View File

@ -18,6 +18,9 @@
/* define if you have streams capable DAG API */
#undef HAVE_DAG_STREAMS_API
/* define if you have vdag_set_device_info() */
#undef HAVE_DAG_VDAG
/* Define to 1 if you have the declaration of `ether_hostton', and to 0 if you
don't. */
#undef HAVE_DECL_ETHER_HOSTTON
@ -52,12 +55,30 @@
/* if libnl exists */
#undef HAVE_LIBNL
/* if libnl exists and is version 2.x */
#undef HAVE_LIBNL_2_x
/* Define to 1 if you have the <limits.h> header file. */
#undef HAVE_LIMITS_H
/* Define to 1 if you have the <linux/compiler.h> header file. */
#undef HAVE_LINUX_COMPILER_H
/* Define to 1 if you have the <linux/ethtool.h> header file. */
#undef HAVE_LINUX_ETHTOOL_H
/* Define to 1 if you have the <linux/if_packet.h> header file. */
#undef HAVE_LINUX_IF_PACKET_H
/* Define to 1 if you have the <linux/net_tstamp.h> header file. */
#undef HAVE_LINUX_NET_TSTAMP_H
/* if tp_vlan_tci exists */
#undef HAVE_LINUX_TPACKET_AUXDATA_TP_VLAN_TCI
/* Define to 1 if you have the <linux/types.h> header file. */
#undef HAVE_LINUX_TYPES_H
/* Define to 1 if you have the <linux/usbdevice_fs.h> header file. */
#undef HAVE_LINUX_USBDEVICE_FS_H
@ -73,6 +94,12 @@
/* Define to 1 if you have the <netinet/if_ether.h> header file. */
#undef HAVE_NETINET_IF_ETHER_H
/* Define to 1 if you have the <netpacket/if_packet.h> header file. */
#undef HAVE_NETPACKET_IF_PACKET_H
/* Define to 1 if you have the <netpacket/packet.h> header file. */
#undef HAVE_NETPACKET_PACKET_H
/* Define to 1 if you have the <net/if_media.h> header file. */
#undef HAVE_NET_IF_MEDIA_H
@ -217,6 +244,9 @@
/* target host supports CAN sniffing */
#undef PCAP_SUPPORT_CAN
/* target host supports netfilter sniffing */
#undef PCAP_SUPPORT_NETFILTER
/* target host supports USB sniffing */
#undef PCAP_SUPPORT_USB

1383
configure vendored
View File

File diff suppressed because it is too large Load Diff

399
configure.in
View File

@ -103,6 +103,8 @@ dnl and set "HAVE_SYS_IOCCOM_H" if we have it, otherwise
dnl "AC_LBL_FIXINCLUDES" wouldn't work on some platforms such as Solaris.
dnl
AC_CHECK_HEADERS(sys/ioccom.h sys/sockio.h limits.h paths.h)
AC_CHECK_HEADERS(linux/types.h)
AC_CHECK_HEADERS(linux/if_packet.h netpacket/packet.h netpacket/if_packet.h)
AC_CHECK_HEADERS(net/pfvar.h, , , [#include <sys/types.h>
#include <sys/socket.h>
#include <net/if.h>])
@ -152,7 +154,7 @@ needsnprintf=no
AC_CHECK_FUNCS(vsnprintf snprintf,,
[needsnprintf=yes])
if test $needsnprintf = yes; then
AC_LIBOBJ(snprintf)
AC_LIBOBJ([snprintf])
fi
#
@ -410,23 +412,6 @@ dlpi)
;;
linux)
AC_MSG_CHECKING(Linux kernel version)
if test "$cross_compiling" = yes; then
AC_CACHE_VAL(ac_cv_linux_vers,
ac_cv_linux_vers=unknown)
else
AC_CACHE_VAL(ac_cv_linux_vers,
ac_cv_linux_vers=`uname -r 2>&1 | \
sed -n -e '$s/.* //' -e '$s/\..*//p'`)
fi
AC_MSG_RESULT($ac_cv_linux_vers)
if test $ac_cv_linux_vers = unknown ; then
AC_MSG_ERROR(cannot determine linux version when cross-compiling)
fi
if test $ac_cv_linux_vers -lt 2 ; then
AC_MSG_ERROR(version 2 or higher required; see the INSTALL doc for more info)
fi
#
# Do we have the wireless extensions?
#
@ -445,15 +430,46 @@ linux)
with_libnl=$withval,,)
if test x$with_libnl != xno ; then
AC_CHECK_LIB(nl, nl_handle_alloc,
LIBS="-lnl $LIBS"
AC_DEFINE(HAVE_LIBNL,1,[if libnl exists]),
if test x$with_libnl = xyes ; then
AC_MSG_ERROR([libnl support requested but libnl not found])
fi
)
#
# Try libnl 2.x first.
#
AC_CHECK_LIB(nl, nl_socket_alloc,
[
#
# Yes, we have libnl 2.x.
#
LIBS="-lnl-genl -lnl $LIBS"
AC_DEFINE(HAVE_LIBNL,1,[if libnl exists])
AC_DEFINE(HAVE_LIBNL_2_x,1,[if libnl exists and is version 2.x])
],
[
#
# No, we don't; do we have libnl 1.x?
#
AC_CHECK_LIB(nl, nl_handle_alloc,
[
#
# Yes.
#
LIBS="-lnl $LIBS"
AC_DEFINE(HAVE_LIBNL,1,[if libnl exists])
],
[
#
# No, we don't have libnl at all.
#
if test x$with_libnl = xyes ; then
AC_MSG_ERROR([libnl support requested but libnl not found])
fi
])
])
fi
AC_CHECK_HEADERS(linux/ethtool.h,,,
[
AC_INCLUDES_DEFAULT
#include <linux/types.h>
])
AC_LBL_TPACKET_STATS
AC_LBL_LINUX_TPACKET_AUXDATA_TP_VLAN_TCI
;;
@ -727,7 +743,7 @@ if test "$want_dag" != no; then
if test -z "$dag_tools_dir"; then
dag_tools_dir="$dag_root/tools"
fi
fi
if test -r $dag_include_dir/dagapi.h; then
ac_cv_lbl_dag_api=yes
@ -735,131 +751,9 @@ if test "$want_dag" != no; then
AC_MSG_RESULT([$ac_cv_lbl_dag_api ($dag_include_dir)])
fi
if test $ac_cv_lbl_dag_api = yes; then
AC_MSG_CHECKING([dagapi.o])
dagapi_obj=no
if test -r $dag_tools_dir/dagapi.o; then
# 2.4.x.
dagapi_obj=$dag_tools_dir/dagapi.o
elif test -r $dag_lib_dir/dagapi.o; then
# 2.5.x.
dagapi_obj=$dag_lib_dir/dagapi.o
elif test -r $dag_lib_dir/libdag.a; then
# 2.5.x.
ar x $dag_lib_dir/libdag.a dagapi.o 2>/dev/null
if test -r ./dagapi.o; then
dagapi_obj=./dagapi.o
else
ar x $dag_lib_dir/libdag.a libdag_la-dagapi.o 2>/dev/null
if test -r ./libdag_la-dagapi.o; then
dagapi_obj=./libdag_la-dagapi.o
fi
fi
fi
if test $dagapi_obj = no; then
AC_MSG_RESULT([no (checked $dag_lib_dir $dag_tools_dir $dag_lib_dir/libdag.a)])
ac_cv_lbl_dag_api=no
else
AC_MSG_RESULT([yes ($dagapi_obj)])
fi
fi
if test $ac_cv_lbl_dag_api = yes; then
AC_MSG_CHECKING([dagopts.o])
dagopts_obj=no
if test -r $dag_tools_dir/dagopts.o; then
# 2.4.x.
dagopts_obj=$dag_tools_dir/dagopts.o
elif test -r $dag_lib_dir/dagopts.o; then
# 2.5.x.
dagopts_obj=$dag_lib_dir/dagopts.o
elif test -r $dag_lib_dir/libdag.a; then
# 2.5.x.
ar x $dag_lib_dir/libdag.a dagopts.o 2>/dev/null
if test -r ./dagopts.o; then
dagopts_obj=./dagopts.o
else
ar x $dag_lib_dir/libdag.a libdag_la-dagopts.o 2>/dev/null
if test -r ./libdag_la-dagopts.o; then
dagopts_obj=./libdag_la-dagopts.o
fi
fi
fi
if test $dagopts_obj = no; then
AC_MSG_RESULT([no (checked $dag_lib_dir $dag_tools_dir $dag_lib_dir/libdag.a)])
ac_cv_lbl_dag_api=no
else
AC_MSG_RESULT([yes ($dagopts_obj)])
fi
fi
if test $ac_cv_lbl_dag_api = yes; then
# Under 2.5.x only we need to add dagreg.o.
if test -r $dag_include_dir/dagreg.h; then
AC_MSG_CHECKING([dagreg.o])
dagreg_obj=no
if test -r $dag_lib_dir/dagreg.o; then
# Object file is ready and waiting.
dagreg_obj=$dag_lib_dir/dagreg.o
elif test -r $dag_lib_dir/libdag.a; then
# Extract from libdag.a.
ar x $dag_lib_dir/libdag.a dagreg.o 2>/dev/null
if test -r ./dagreg.o; then
dagreg_obj=./dagreg.o
else
ar x $dag_lib_dir/libdag.a libdag_la-dagreg.o 2>/dev/null
if test -r ./libdag_la-dagreg.o; then
dagreg_obj=./libdag_la-dagreg.o
fi
fi
fi
if test $dagreg_obj = no; then
AC_MSG_RESULT([no (checked $dag_lib_dir $dag_lib_dir/libdag.a)])
ac_cv_lbl_dag_api=no
else
AC_MSG_RESULT([yes ($dagreg_obj)])
fi
fi
fi
if test $ac_cv_lbl_dag_api = yes; then
# Under 2.5.x only we need to add dagutil.o.
if test -r $dag_include_dir/dagutil.h; then
AC_MSG_CHECKING([dagutil.o])
dagutil_obj=no
if test -r $dag_lib_dir/dagutil.o; then
# Object file is ready and waiting.
dagutil_obj=$dag_lib_dir/dagutil.o
elif test -r $dag_lib_dir/libdag.a; then
# Extract from libdag.a.
ar x $dag_lib_dir/libdag.a dagutil.o 2>/dev/null
if test -r ./dagutil.o; then
dagutil_obj=./dagutil.o
else
ar x $dag_lib_dir/libdag.a libdag_la-dagutil.o 2>/dev/null
if test -r ./libdag_la-dagutil.o; then
dagutil_obj=./libdag_la-dagutil.o
fi
fi
fi
if test $dagutil_obj = no; then
AC_MSG_RESULT([no (checked $dag_lib_dir $dag_lib_dir/libdag.a)])
ac_cv_lbl_dag_api=no
else
AC_MSG_RESULT([yes ($dagutil_obj)])
fi
fi
fi
if test $ac_cv_lbl_dag_api = yes; then
V_INCLS="$V_INCLS -I$dag_include_dir"
ADDLARCHIVEOBJS="$ADDLARCHIVEOBJS $dagapi_obj $dagopts_obj $dagreg_obj $dagutil_obj"
if test $V_PCAP != dag ; then
SSRC="pcap-dag.c"
fi
@ -874,11 +768,19 @@ if test $ac_cv_lbl_dag_api = yes; then
AC_DEFINE(HAVE_DAG_GET_ERF_TYPES, 1, [define if you have dag_get_erf_types()])])
AC_CHECK_LIB([dag],[dag_get_stream_erf_types], [
AC_DEFINE(HAVE_DAG_GET_STREAM_ERF_TYPES, 1, [define if you have dag_get_stream_erf_types()])])
LDFLAGS=$saved_ldflags
if test "$dag_streams" = 1; then
AC_DEFINE(HAVE_DAG_STREAMS_API, 1, [define if you have streams capable DAG API])
LIBS="$LIBS -ldag"
LDFLAGS="$LDFLAGS -L$dag_lib_dir"
AC_CHECK_LIB([vdag],[vdag_set_device_info], [ac_dag_have_vdag="1"], [ac_dag_have_vdag="0"])
if test "$ac_dag_have_vdag" = 1; then
AC_DEFINE(HAVE_DAG_VDAG, 1, [define if you have vdag_set_device_info()])
LIBS="$LIBS -lpthread"
fi
fi
AC_DEFINE(HAVE_DAG_API, 1, [define if you have the DAG API])
@ -1169,6 +1071,46 @@ aix*)
darwin*)
DYEXT="dylib"
V_CCOPT="$V_CCOPT -fno-common"
AC_ARG_ENABLE(universal,
AC_HELP_STRING([--disable-universal],[don't build universal on OS X]))
if test "$enable_universal" != "no"; then
case "$host_os" in
darwin9.*)
#
# Leopard. Build for 32-bit PowerPC, 64-bit
# PowerPC, x86, and x86-64, with 32-bit PowerPC
# first. (That's what Apple does.)
#
V_CCOPT="$V_CCOPT -arch ppc -arch ppc64 -arch i386 -arch x86_64"
LDFLAGS="$LDFLAGS -arch ppc -arch ppc64 -arch i386 -arch x86_64"
;;
darwin10.*)
#
# Snow Leopard. Build for x86-64, x86, and
# 32-bit PowerPC, with x86-64 first. (That's
# what Apple does, even though Snow Leopard
# doesn't run on PPC, so PPC libpcap runs under
# Rosetta, and Rosetta doesn't support BPF
# ioctls, so PPC programs can't do live
# captures.)
#
V_CCOPT="$V_CCOPT -arch x86_64 -arch i386 -arch ppc"
LDFLAGS="$LDFLAGS -arch x86_64 -arch i386 -arch ppc"
;;
darwin11.*)
#
# Lion. Build for x86-64 and x86, with x86-64
# first. (That's probably what Apple does,
# given that Rosetta is gone.)
#
V_CCOPT="$V_CCOPT -arch x86_64 -arch i386"
LDFLAGS="$LDFLAGS -arch x86_64 -arch i386"
;;
esac
fi
;;
hpux9*)
@ -1234,7 +1176,7 @@ irix*)
MAN_MISC_INFO=5
;;
linux*|freebsd*|netbsd*|openbsd*|dragonfly*)
linux*|freebsd*|netbsd*|openbsd*|dragonfly*|kfreebsd*|gnu*)
DYEXT="so"
#
@ -1283,6 +1225,7 @@ solaris*)
esac
AC_PROG_RANLIB
AC_CHECK_TOOL([AR], [ar])
AC_LBL_DEVEL(V_CCOPT)
@ -1325,48 +1268,103 @@ dnl check for USB sniffing support
AC_MSG_CHECKING(for USB sniffing support)
case "$host_os" in
linux*)
AC_DEFINE(PCAP_SUPPORT_USB, 1, [target host supports USB sniffing])
USB_SRC=pcap-usb-linux.c
AC_MSG_RESULT(yes)
ac_usb_dev_name=`udevinfo -q name -p /sys/class/usb_device/usbmon 2>/dev/null`
if test $? -ne 0 ; then
ac_usb_dev_name="usbmon"
fi
AC_DEFINE_UNQUOTED(LINUX_USB_MON_DEV, "/dev/$ac_usb_dev_name", [path for device for USB sniffing])
AC_MSG_NOTICE(Device for USB sniffing is /dev/$ac_usb_dev_name)
AC_CHECK_HEADERS(linux/usbdevice_fs.h)
if test "$ac_cv_header_linux_usbdevice_fs_h" = yes; then
#
# OK, does it define bRequestType? Older versions of the kernel
# define fields with names like "requesttype, "request", and
# "value", rather than "bRequestType", "bRequest", and
# "wValue".
#
AC_MSG_CHECKING(if usbdevfs_ctrltransfer struct has bRequestType member)
AC_CACHE_VAL(ac_cv_usbdevfs_ctrltransfer_has_bRequestType,
AC_TRY_COMPILE([
AC_DEFINE(PCAP_SUPPORT_USB, 1, [target host supports USB sniffing])
USB_SRC=pcap-usb-linux.c
AC_MSG_RESULT(yes)
ac_usb_dev_name=`udevinfo -q name -p /sys/class/usb_device/usbmon 2>/dev/null`
if test $? -ne 0 ; then
ac_usb_dev_name="usbmon"
fi
AC_DEFINE_UNQUOTED(LINUX_USB_MON_DEV, "/dev/$ac_usb_dev_name", [path for device for USB sniffing])
AC_MSG_NOTICE(Device for USB sniffing is /dev/$ac_usb_dev_name)
#
# Do we have a version of <linux/compiler.h> available?
# If so, we might need it for <linux/usbdevice_fs.h>.
#
AC_CHECK_HEADERS(linux/compiler.h)
if test "$ac_cv_header_linux_compiler_h" = yes; then
#
# Yes - include it when testing for <linux/usbdevice_fs.h>.
#
AC_CHECK_HEADERS(linux/usbdevice_fs.h,,,[#include <linux/compiler.h>])
else
AC_CHECK_HEADERS(linux/usbdevice_fs.h)
fi
if test "$ac_cv_header_linux_usbdevice_fs_h" = yes; then
#
# OK, does it define bRequestType? Older versions of the kernel
# define fields with names like "requesttype, "request", and
# "value", rather than "bRequestType", "bRequest", and
# "wValue".
#
AC_MSG_CHECKING(if usbdevfs_ctrltransfer struct has bRequestType member)
AC_CACHE_VAL(ac_cv_usbdevfs_ctrltransfer_has_bRequestType,
AC_TRY_COMPILE([
AC_INCLUDES_DEFAULT
#ifdef HAVE_SYS_BITYPES_H
#include <sys/bitypes.h>
#endif
# include <linux/usbdevice_fs.h>],
[u_int i = sizeof(((struct usbdevfs_ctrltransfer *)0)->bRequestType)],
ac_cv_usbdevfs_ctrltransfer_has_bRequestType=yes,
ac_cv_usbdevfs_ctrltransfer_has_bRequestType=no))
AC_MSG_RESULT($ac_cv_usbdevfs_ctrltransfer_has_bRequestType)
if test $ac_cv_usbdevfs_ctrltransfer_has_bRequestType = yes ; then
AC_DEFINE(HAVE_USBDEVFS_CTRLTRANSFER_BREQUESTTYPE,1,
[if struct usbdevfs_ctrltransfer has bRequestType])
fi
fi
;;
#ifdef HAVE_LINUX_COMPILER_H
#include <linux/compiler.h>
#endif
#include <linux/usbdevice_fs.h>],
[u_int i = sizeof(((struct usbdevfs_ctrltransfer *)0)->bRequestType)],
ac_cv_usbdevfs_ctrltransfer_has_bRequestType=yes,
ac_cv_usbdevfs_ctrltransfer_has_bRequestType=no))
AC_MSG_RESULT($ac_cv_usbdevfs_ctrltransfer_has_bRequestType)
if test $ac_cv_usbdevfs_ctrltransfer_has_bRequestType = yes ; then
AC_DEFINE(HAVE_USBDEVFS_CTRLTRANSFER_BREQUESTTYPE,1,
[if struct usbdevfs_ctrltransfer has bRequestType])
fi
fi
;;
*)
AC_MSG_RESULT(no)
;;
AC_MSG_RESULT(no)
;;
esac
AC_SUBST(PCAP_SUPPORT_USB)
AC_SUBST(USB_SRC)
dnl check for netfilter sniffing support
AC_MSG_CHECKING(whether the platform could support netfilter sniffing)
case "$host_os" in
linux*)
AC_MSG_RESULT(yes)
#
# Life's too short to deal with trying to get this to compile
# if you don't get the right types defined with
# __KERNEL_STRICT_NAMES getting defined by some other include.
#
# Check whether the includes Just Work. If not, don't turn on
# netfilter support.
#
AC_MSG_CHECKING(whether we can compile the netfilter support)
AC_CACHE_VAL(ac_cv_netfilter_can_compile,
AC_TRY_COMPILE([
AC_INCLUDES_DEFAULT
#include <sys/socket.h>
#include <linux/types.h>
#include <linux/netlink.h>
#include <linux/netfilter/nfnetlink.h>
#include <linux/netfilter/nfnetlink_log.h>],
[],
ac_cv_netfilter_can_compile=yes,
ac_cv_netfilter_can_compile=no))
AC_MSG_RESULT($ac_cv_netfilter_can_compile)
if test $ac_cv_netfilter_can_compile = yes ; then
AC_DEFINE(PCAP_SUPPORT_NETFILTER, 1,
[target host supports netfilter sniffing])
NETFILTER_SRC=pcap-netfilter-linux.c
fi
;;
*)
AC_MSG_RESULT(no)
;;
esac
AC_SUBST(PCAP_SUPPORT_NETFILTER)
AC_SUBST(NETFILTER_SRC)
AC_ARG_ENABLE([bluetooth],
[AC_HELP_STRING([--enable-bluetooth],[enable Bluetooth support @<:@default=yes, if support available@:>@])],
,enable_bluetooth=yes)
@ -1375,18 +1373,18 @@ if test "x$enable_bluetooth" != "xno" ; then
dnl check for Bluetooth sniffing support
case "$host_os" in
linux*)
AC_CHECK_HEADER(bluetooth/bluetooth.h,
[
AC_CHECK_HEADER(bluetooth/bluetooth.h,
[
AC_DEFINE(PCAP_SUPPORT_BT, 1, [target host supports Bluetooth sniffing])
BT_SRC=pcap-bt-linux.c
AC_MSG_NOTICE(Bluetooth sniffing is supported)
BT_SRC=pcap-bt-linux.c
AC_MSG_NOTICE(Bluetooth sniffing is supported)
],
AC_MSG_NOTICE(Bluetooth sniffing is not supported; install bluez-lib devel to enable it)
)
;;
)
;;
*)
AC_MSG_NOTICE(no Bluetooth sniffing support implemented for $host_os)
;;
AC_MSG_NOTICE(no Bluetooth sniffing support implemented for $host_os)
;;
esac
AC_SUBST(PCAP_SUPPORT_BT)
AC_SUBST(BT_SRC)
@ -1416,15 +1414,26 @@ if test "x$enable_can" != "xno" ; then
AC_SUBST(CAN_SRC)
fi
dnl check for hardware timestamp support
case "$host_os" in
linux*)
AC_CHECK_HEADERS([linux/net_tstamp.h])
;;
*)
AC_MSG_NOTICE(no hardware timestamp support implemented for $host_os)
;;
esac
AC_PROG_INSTALL
AC_CONFIG_HEADER(config.h)
AC_OUTPUT(Makefile pcap-filter.manmisc pcap-linktype.manmisc
pcap-savefile.manfile pcap.3pcap pcap_compile.3pcap
pcap_datalink.3pcap pcap_dump_open.3pcap
pcap_list_datalinks.3pcap pcap_open_dead.3pcap
pcap_open_offline.3pcap)
pcap-tstamp.manmisc pcap-savefile.manfile pcap.3pcap
pcap_compile.3pcap pcap_datalink.3pcap pcap_dump_open.3pcap
pcap_list_datalinks.3pcap pcap_list_tstamp_types.3pcap
pcap_open_dead.3pcap pcap_open_offline.3pcap
pcap_set_tstamp_type.3pcap)
if test -f .devel ; then
make depend

3
ethertype.h
View File

@ -117,3 +117,6 @@
#ifndef ETHERTYPE_LOOPBACK
#define ETHERTYPE_LOOPBACK 0x9000
#endif
#ifndef ETHERTYPE_8021QINQ
#define ETHERTYPE_8021QINQ 0x9100
#endif

12
fad-getad.c
View File

@ -61,15 +61,21 @@ static const char rcsid[] _U_ =
#endif
#ifdef AF_PACKET
# ifdef HAVE_NETPACKET_PACKET_H
/* Solaris 11 and later, Linux distributions with newer glibc */
# include <netpacket/packet.h>
# else /* HAVE_NETPACKET_PACKET_H */
/* LynxOS, Linux distributions with older glibc */
# ifdef __Lynx__
/* LynxOS */
# include <netpacket/if_packet.h>
# else
# else /* __Lynx__ */
/* Linux */
# include <linux/types.h>
# include <linux/if_packet.h>
# endif
#endif
# endif /* __Lynx__ */
# endif /* HAVE_NETPACKET_PACKET_H */
#endif /* AF_PACKET */
/*
* This is fun.

529
gencode.c
View File

@ -47,7 +47,7 @@ static const char rcsid[] _U_ =
* XXX - why was this included even on UNIX?
*/
#ifdef __MINGW32__
#include "IP6_misc.h"
#include "ip6_misc.h"
#endif
#ifndef WIN32
@ -772,7 +772,8 @@ static int reg_off_ll;
* This is the offset of the beginning of the MAC-layer header from
* the beginning of the link-layer header.
* It's usually 0, except for ATM LANE, where it's the offset, relative
* to the beginning of the raw packet data, of the Ethernet header.
* to the beginning of the raw packet data, of the Ethernet header, and
* for Ethernet with various additional information.
*/
static u_int off_mac;
@ -1238,26 +1239,6 @@ init_linktype(p)
off_nl_nosnap = 0; /* no 802.2 LLC */
return;
case DLT_LINUX_IRDA:
/*
* Currently, only raw "link[N:M]" filtering is supported.
*/
off_linktype = -1;
off_macpl = -1;
off_nl = -1;
off_nl_nosnap = -1;
return;
case DLT_DOCSIS:
/*
* Currently, only raw "link[N:M]" filtering is supported.
*/
off_linktype = -1;
off_macpl = -1;
off_nl = -1;
off_nl_nosnap = -1;
return;
case DLT_SYMANTEC_FIREWALL:
off_linktype = 6;
off_macpl = 44;
@ -1366,6 +1347,16 @@ init_linktype(p)
off_nl_nosnap = -1;
return;
case DLT_JUNIPER_VS:
case DLT_JUNIPER_SRX_E2E:
case DLT_JUNIPER_FIBRECHANNEL:
case DLT_JUNIPER_ATM_CEMIC:
off_linktype = 8;
off_macpl = -1;
off_nl = -1;
off_nl_nosnap = -1;
return;
case DLT_MTP2:
off_li = 2;
off_sio = 3;
@ -1411,126 +1402,6 @@ init_linktype(p)
return;
#endif
case DLT_LINUX_LAPD:
/*
* Currently, only raw "link[N:M]" filtering is supported.
*/
off_linktype = -1;
off_macpl = -1;
off_nl = -1;
off_nl_nosnap = -1;
return;
case DLT_USB:
/*
* Currently, only raw "link[N:M]" filtering is supported.
*/
off_linktype = -1;
off_macpl = -1;
off_nl = -1;
off_nl_nosnap = -1;
return;
case DLT_BLUETOOTH_HCI_H4:
/*
* Currently, only raw "link[N:M]" filtering is supported.
*/
off_linktype = -1;
off_macpl = -1;
off_nl = -1;
off_nl_nosnap = -1;
return;
case DLT_USB_LINUX:
/*
* Currently, only raw "link[N:M]" filtering is supported.
*/
off_linktype = -1;
off_macpl = -1;
off_nl = -1;
off_nl_nosnap = -1;
return;
case DLT_CAN20B:
/*
* Currently, only raw "link[N:M]" filtering is supported.
*/
off_linktype = -1;
off_macpl = -1;
off_nl = -1;
off_nl_nosnap = -1;
return;
case DLT_IEEE802_15_4_LINUX:
/*
* Currently, only raw "link[N:M]" filtering is supported.
*/
off_linktype = -1;
off_macpl = -1;
off_nl = -1;
off_nl_nosnap = -1;
return;
case DLT_IEEE802_16_MAC_CPS_RADIO:
/*
* Currently, only raw "link[N:M]" filtering is supported.
*/
off_linktype = -1;
off_macpl = -1;
off_nl = -1;
off_nl_nosnap = -1;
return;
case DLT_IEEE802_15_4:
/*
* Currently, only raw "link[N:M]" filtering is supported.
*/
off_linktype = -1;
off_macpl = -1;
off_nl = -1;
off_nl_nosnap = -1;
return;
case DLT_SITA:
/*
* Currently, only raw "link[N:M]" filtering is supported.
*/
off_linktype = -1;
off_macpl = -1;
off_nl = -1;
off_nl_nosnap = -1;
return;
case DLT_RAIF1:
/*
* Currently, only raw "link[N:M]" filtering is supported.
*/
off_linktype = -1;
off_macpl = -1;
off_nl = -1;
off_nl_nosnap = -1;
return;
case DLT_IPMB:
/*
* Currently, only raw "link[N:M]" filtering is supported.
*/
off_linktype = -1;
off_macpl = -1;
off_nl = -1;
off_nl_nosnap = -1;
return;
case DLT_BLUETOOTH_HCI_H4_WITH_PHDR:
/*
* Currently, only raw "link[N:M]" filtering is supported.
*/
off_linktype = -1;
off_macpl = -1;
off_nl = -1;
off_nl_nosnap = -1;
return;
case DLT_AX25_KISS:
/*
* Currently, only raw "link[N:M]" filtering is supported.
@ -1542,52 +1413,43 @@ init_linktype(p)
off_mac = 1; /* step over the kiss length byte */
return;
case DLT_IEEE802_15_4_NONASK_PHY:
/*
* Currently, only raw "link[N:M]" filtering is supported.
*/
off_linktype = -1;
off_macpl = -1;
off_nl = -1;
off_nl_nosnap = -1;
return;
case DLT_MPLS:
/*
* Currently, only raw "link[N:M]" filtering is supported.
*/
off_linktype = -1;
off_macpl = -1;
off_nl = -1;
off_nl_nosnap = -1;
return;
case DLT_USB_LINUX_MMAPPED:
/*
* Currently, only raw "link[N:M]" filtering is supported.
*/
off_linktype = -1;
off_macpl = -1;
off_nl = -1;
off_nl_nosnap = -1;
return;
case DLT_CAN_SOCKETCAN:
/*
* Currently, only raw "link[N:M]" filtering is supported.
*/
off_linktype = -1;
off_macpl = -1;
off_nl = -1;
off_nl_nosnap = -1;
return;
case DLT_IPNET:
off_linktype = 1;
off_macpl = 24; /* ipnet header length */
off_nl = 0;
off_nl_nosnap = -1;
return;
case DLT_NETANALYZER:
off_mac = 4; /* MAC header is past 4-byte pseudo-header */
off_linktype = 16; /* includes 4-byte pseudo-header */
off_macpl = 18; /* pseudo-header+Ethernet header length */
off_nl = 0; /* Ethernet II */
off_nl_nosnap = 3; /* 802.3+802.2 */
return;
case DLT_NETANALYZER_TRANSPARENT:
off_mac = 12; /* MAC header is past 4-byte pseudo-header, preamble, and SFD */
off_linktype = 24; /* includes 4-byte pseudo-header+preamble+SFD */
off_macpl = 26; /* pseudo-header+preamble+SFD+Ethernet header length */
off_nl = 0; /* Ethernet II */
off_nl_nosnap = 3; /* 802.3+802.2 */
return;
default:
/*
* For values in the range in which we've assigned new
* DLT_ values, only raw "link[N:M]" filtering is supported.
*/
if (linktype >= DLT_MATCHING_MIN &&
linktype <= DLT_MATCHING_MAX) {
off_linktype = -1;
off_macpl = -1;
off_nl = -1;
off_nl_nosnap = -1;
return;
}
}
bpf_error("unknown data link type %d", linktype);
/* NOTREACHED */
@ -3059,6 +2921,8 @@ gen_linktype(proto)
switch (linktype) {
case DLT_EN10MB:
case DLT_NETANALYZER:
case DLT_NETANALYZER_TRANSPARENT:
return gen_ether_linktype(proto);
/*NOTREACHED*/
break;
@ -3462,6 +3326,11 @@ gen_linktype(proto)
case DLT_JUNIPER_VP:
case DLT_JUNIPER_ST:
case DLT_JUNIPER_ISM:
case DLT_JUNIPER_VS:
case DLT_JUNIPER_SRX_E2E:
case DLT_JUNIPER_FIBRECHANNEL:
case DLT_JUNIPER_ATM_CEMIC:
/* just lets verify the magic number for now -
* on ATM we may have up to 6 different encapsulations on the wire
* and need a lot of heuristics to figure out that the payload
@ -3511,6 +3380,7 @@ gen_linktype(proto)
case DLT_IEEE802_15_4:
case DLT_IEEE802_15_4_LINUX:
case DLT_IEEE802_15_4_NONASK_PHY:
case DLT_IEEE802_15_4_NOFCS:
bpf_error("IEEE 802.15.4 link-layer type filtering not implemented");
case DLT_IEEE802_16_MAC_CPS_RADIO:
@ -3785,6 +3655,30 @@ gen_ehostop(eaddr, dir)
b1 = gen_ehostop(eaddr, Q_DST);
gen_or(b0, b1);
return b1;
case Q_ADDR1:
bpf_error("'addr1' is only supported on 802.11 with 802.11 headers");
break;
case Q_ADDR2:
bpf_error("'addr2' is only supported on 802.11 with 802.11 headers");
break;
case Q_ADDR3:
bpf_error("'addr3' is only supported on 802.11 with 802.11 headers");
break;
case Q_ADDR4:
bpf_error("'addr4' is only supported on 802.11 with 802.11 headers");
break;
case Q_RA:
bpf_error("'ra' is only supported on 802.11 with 802.11 headers");
break;
case Q_TA:
bpf_error("'ta' is only supported on 802.11 with 802.11 headers");
break;
}
abort();
/* NOTREACHED */
@ -3827,6 +3721,30 @@ gen_fhostop(eaddr, dir)
b1 = gen_fhostop(eaddr, Q_DST);
gen_or(b0, b1);
return b1;
case Q_ADDR1:
bpf_error("'addr1' is only supported on 802.11");
break;
case Q_ADDR2:
bpf_error("'addr2' is only supported on 802.11");
break;
case Q_ADDR3:
bpf_error("'addr3' is only supported on 802.11");
break;
case Q_ADDR4:
bpf_error("'addr4' is only supported on 802.11");
break;
case Q_RA:
bpf_error("'ra' is only supported on 802.11");
break;
case Q_TA:
bpf_error("'ta' is only supported on 802.11");
break;
}
abort();
/* NOTREACHED */
@ -3861,6 +3779,30 @@ gen_thostop(eaddr, dir)
b1 = gen_thostop(eaddr, Q_DST);
gen_or(b0, b1);
return b1;
case Q_ADDR1:
bpf_error("'addr1' is only supported on 802.11");
break;
case Q_ADDR2:
bpf_error("'addr2' is only supported on 802.11");
break;
case Q_ADDR3:
bpf_error("'addr3' is only supported on 802.11");
break;
case Q_ADDR4:
bpf_error("'addr4' is only supported on 802.11");
break;
case Q_RA:
bpf_error("'ra' is only supported on 802.11");
break;
case Q_TA:
bpf_error("'ta' is only supported on 802.11");
break;
}
abort();
/* NOTREACHED */
@ -4154,8 +4096,79 @@ gen_wlanhostop(eaddr, dir)
gen_and(b1, b0);
return b0;
case Q_RA:
/*
* Not present in management frames; addr1 in other
* frames.
*/
/*
* If the high-order bit of the type value is 0, this
* is a management frame.
* I.e, check "(link[0] & 0x08)".
*/
s = gen_load_a(OR_LINK, 0, BPF_B);
b1 = new_block(JMP(BPF_JSET));
b1->s.k = 0x08;
b1->stmts = s;
/*
* Check addr1.
*/
b0 = gen_bcmp(OR_LINK, 4, 6, eaddr);
/*
* AND that with the check of addr1.
*/
gen_and(b1, b0);
return (b0);
case Q_TA:
/*
* Not present in management frames; addr2, if present,
* in other frames.
*/
/*
* Not present in CTS or ACK control frames.
*/
b0 = gen_mcmp(OR_LINK, 0, BPF_B, IEEE80211_FC0_TYPE_CTL,
IEEE80211_FC0_TYPE_MASK);
gen_not(b0);
b1 = gen_mcmp(OR_LINK, 0, BPF_B, IEEE80211_FC0_SUBTYPE_CTS,
IEEE80211_FC0_SUBTYPE_MASK);
gen_not(b1);
b2 = gen_mcmp(OR_LINK, 0, BPF_B, IEEE80211_FC0_SUBTYPE_ACK,
IEEE80211_FC0_SUBTYPE_MASK);
gen_not(b2);
gen_and(b1, b2);
gen_or(b0, b2);
/*
* If the high-order bit of the type value is 0, this
* is a management frame.
* I.e, check "(link[0] & 0x08)".
*/
s = gen_load_a(OR_LINK, 0, BPF_B);
b1 = new_block(JMP(BPF_JSET));
b1->s.k = 0x08;
b1->stmts = s;
/*
* AND that with the check for frames other than
* CTS and ACK frames.
*/
gen_and(b1, b2);
/*
* Check addr2.
*/
b1 = gen_bcmp(OR_LINK, 10, 6, eaddr);
gen_and(b2, b1);
return b1;
/*
* XXX - add RA, TA, and BSSID keywords?
* XXX - add BSSID keyword?
*/
case Q_ADDR1:
return (gen_bcmp(OR_LINK, 4, 6, eaddr));
@ -4251,6 +4264,30 @@ gen_ipfchostop(eaddr, dir)
b1 = gen_ipfchostop(eaddr, Q_DST);
gen_or(b0, b1);
return b1;
case Q_ADDR1:
bpf_error("'addr1' is only supported on 802.11");
break;
case Q_ADDR2:
bpf_error("'addr2' is only supported on 802.11");
break;
case Q_ADDR3:
bpf_error("'addr3' is only supported on 802.11");
break;
case Q_ADDR4:
bpf_error("'addr4' is only supported on 802.11");
break;
case Q_RA:
bpf_error("'ra' is only supported on 802.11");
break;
case Q_TA:
bpf_error("'ta' is only supported on 802.11");
break;
}
abort();
/* NOTREACHED */
@ -4444,6 +4481,9 @@ gen_host(addr, mask, proto, dir, type)
case Q_VRRP:
bpf_error("'vrrp' modifier applied to %s", typestr);
case Q_CARP:
bpf_error("'carp' modifier applied to %s", typestr);
case Q_ATALK:
bpf_error("ATALK host filtering not implemented");
@ -4563,6 +4603,9 @@ gen_host6(addr, mask, proto, dir, type)
case Q_VRRP:
bpf_error("'vrrp' modifier applied to %s", typestr);
case Q_CARP:
bpf_error("'carp' modifier applied to %s", typestr);
case Q_ATALK:
bpf_error("ATALK host filtering not implemented");
@ -4647,6 +4690,8 @@ gen_gateway(eaddr, alist, proto, dir)
case Q_RARP:
switch (linktype) {
case DLT_EN10MB:
case DLT_NETANALYZER:
case DLT_NETANALYZER_TRANSPARENT:
b0 = gen_ehostop(eaddr, Q_OR);
break;
case DLT_FDDI:
@ -4776,6 +4821,14 @@ gen_proto_abbrev(proto)
b1 = gen_proto(IPPROTO_VRRP, Q_IP, Q_DEFAULT);
break;
#ifndef IPPROTO_CARP
#define IPPROTO_CARP 112
#endif
case Q_CARP:
b1 = gen_proto(IPPROTO_CARP, Q_IP, Q_DEFAULT);
break;
case Q_IP:
b1 = gen_linktype(ETHERTYPE_IP);
break;
@ -4957,7 +5010,7 @@ gen_ipfrag()
struct slist *s;
struct block *b;
/* not ip frag */
/* not IPv4 frag other than the first frag */
s = gen_load_a(OR_NET, 6, BPF_H);
b = new_block(JMP(BPF_JSET));
b->s.k = 0x1fff;
@ -5000,7 +5053,7 @@ gen_portop(port, proto, dir)
{
struct block *b0, *b1, *tmp;
/* ip proto 'proto' */
/* ip proto 'proto' and not a fragment other than the first fragment */
tmp = gen_cmp(OR_NET, 9, BPF_B, (bpf_int32)proto);
b0 = gen_ipfrag();
gen_and(tmp, b0);
@ -5092,6 +5145,7 @@ gen_portop6(port, proto, dir)
struct block *b0, *b1, *tmp;
/* ip6 proto 'proto' */
/* XXX - catch the first fragment of a fragmented packet? */
b0 = gen_cmp(OR_NET, 6, BPF_B, (bpf_int32)proto);
switch (dir) {
@ -5193,7 +5247,7 @@ gen_portrangeop(port1, port2, proto, dir)
{
struct block *b0, *b1, *tmp;
/* ip proto 'proto' */
/* ip proto 'proto' and not a fragment other than the first fragment */
tmp = gen_cmp(OR_NET, 9, BPF_B, (bpf_int32)proto);
b0 = gen_ipfrag();
gen_and(tmp, b0);
@ -5297,6 +5351,7 @@ gen_portrangeop6(port1, port2, proto, dir)
struct block *b0, *b1, *tmp;
/* ip6 proto 'proto' */
/* XXX - catch the first fragment of a fragmented packet? */
b0 = gen_cmp(OR_NET, 6, BPF_B, (bpf_int32)proto);
switch (dir) {
@ -5574,12 +5629,9 @@ gen_protochain(v, proto, dir)
/*
* in short,
* A = P[X];
* X = X + (P[X + 1] + 1) * 8;
* A = P[X + packet head];
* X = X + (P[X + packet head + 1] + 1) * 8;
*/
/* A = X */
s[i] = new_stmt(BPF_MISC|BPF_TXA);
i++;
/* A = P[X + packet head] */
s[i] = new_stmt(BPF_LD|BPF_IND|BPF_B);
s[i]->s.k = off_macpl + off_nl;
@ -5588,19 +5640,9 @@ gen_protochain(v, proto, dir)
s[i] = new_stmt(BPF_ST);
s[i]->s.k = reg2;
i++;
/* A = X */
s[i] = new_stmt(BPF_MISC|BPF_TXA);
i++;
/* A += 1 */
s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K);
s[i]->s.k = 1;
i++;
/* X = A */
s[i] = new_stmt(BPF_MISC|BPF_TAX);
i++;
/* A = P[X + packet head]; */
/* A = P[X + packet head + 1]; */
s[i] = new_stmt(BPF_LD|BPF_IND|BPF_B);
s[i]->s.k = off_macpl + off_nl;
s[i]->s.k = off_macpl + off_nl + 1;
i++;
/* A += 1 */
s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_K);
@ -5610,6 +5652,10 @@ gen_protochain(v, proto, dir)
s[i] = new_stmt(BPF_ALU|BPF_MUL|BPF_K);
s[i]->s.k = 8;
i++;
/* A += X */
s[i] = new_stmt(BPF_ALU|BPF_ADD|BPF_X);
s[i]->s.k = 0;
i++;
/* X = A; */
s[i] = new_stmt(BPF_MISC|BPF_TAX);
i++;
@ -5933,6 +5979,10 @@ gen_proto(v, proto, dir)
bpf_error("'vrrp proto' is bogus");
/* NOTREACHED */
case Q_CARP:
bpf_error("'carp proto' is bogus");
/* NOTREACHED */
#ifdef INET6
case Q_IPV6:
b0 = gen_linktype(ETHERTYPE_IPV6);
@ -6016,6 +6066,8 @@ gen_scode(name, q)
switch (linktype) {
case DLT_EN10MB:
case DLT_NETANALYZER:
case DLT_NETANALYZER_TRANSPARENT:
eaddr = pcap_ether_hostton(name);
if (eaddr == NULL)
bpf_error(
@ -6197,6 +6249,10 @@ gen_scode(name, q)
/* override PROTO_UNDEF */
real_proto = IPPROTO_SCTP;
}
if (port < 0)
bpf_error("illegal port number %d < 0", port);
if (port > 65535)
bpf_error("illegal port number %d > 65535", port);
#ifndef INET6
return gen_port(port, real_proto, dir);
#else
@ -6238,6 +6294,15 @@ gen_scode(name, q)
/* override PROTO_UNDEF */
real_proto = IPPROTO_SCTP;
}
if (port1 < 0)
bpf_error("illegal port number %d < 0", port1);
if (port1 > 65535)
bpf_error("illegal port number %d > 65535", port1);
if (port2 < 0)
bpf_error("illegal port number %d < 0", port2);
if (port2 > 65535)
bpf_error("illegal port number %d > 65535", port2);
#ifndef INET6
return gen_portrange(port1, port2, real_proto, dir);
#else
@ -6389,6 +6454,9 @@ gen_ncode(s, v, q)
else
bpf_error("illegal qualifier of 'port'");
if (v > 65535)
bpf_error("illegal port number %u > 65535", v);
#ifndef INET6
return gen_port((int)v, proto, dir);
#else
@ -6412,6 +6480,9 @@ gen_ncode(s, v, q)
else
bpf_error("illegal qualifier of 'portrange'");
if (v > 65535)
bpf_error("illegal port number %u > 65535", v);
#ifndef INET6
return gen_portrange((int)v, (int)v, proto, dir);
#else
@ -6516,6 +6587,8 @@ gen_ecode(eaddr, q)
if ((q.addr == Q_HOST || q.addr == Q_DEFAULT) && q.proto == Q_LINK) {
switch (linktype) {
case DLT_EN10MB:
case DLT_NETANALYZER:
case DLT_NETANALYZER_TRANSPARENT:
return gen_ehostop(eaddr, (int)q.dir);
case DLT_FDDI:
return gen_fhostop(eaddr, (int)q.dir);
@ -6645,7 +6718,7 @@ gen_load(proto, inst, size)
/*
* Load into the X register the offset computed into the
* register specifed by "index".
* register specified by "index".
*/
s = xfer_to_x(inst);
@ -6677,7 +6750,7 @@ gen_load(proto, inst, size)
* the link-layer header. Add to it the offset computed
* into the register specified by "index", and move that
* into the X register. Otherwise, just load into the X
* register the offset computed into the register specifed
* register the offset computed into the register specified
* by "index".
*/
if (s != NULL) {
@ -6726,7 +6799,7 @@ gen_load(proto, inst, size)
* payload. Add to it the offset computed into the
* register specified by "index", and move that into
* the X register. Otherwise, just load into the X
* register the offset computed into the register specifed
* register the offset computed into the register specified
* by "index".
*/
if (s != NULL) {
@ -6771,6 +6844,7 @@ gen_load(proto, inst, size)
case Q_IGRP:
case Q_PIM:
case Q_VRRP:
case Q_CARP:
/*
* The offset is relative to the beginning of
* the transport-layer header.
@ -7119,6 +7193,8 @@ gen_broadcast(proto)
case DLT_ARCNET_LINUX:
return gen_ahostop(abroadcast, Q_DST);
case DLT_EN10MB:
case DLT_NETANALYZER:
case DLT_NETANALYZER_TRANSPARENT:
return gen_ehostop(ebroadcast, Q_DST);
case DLT_FDDI:
return gen_fhostop(ebroadcast, Q_DST);
@ -7214,6 +7290,8 @@ gen_multicast(proto)
/* all ARCnet multicasts use the same address */
return gen_ahostop(abroadcast, Q_DST);
case DLT_EN10MB:
case DLT_NETANALYZER:
case DLT_NETANALYZER_TRANSPARENT:
/* ether[0] & 1 != 0 */
return gen_mac_multicast(0);
case DLT_FDDI:
@ -7477,6 +7555,11 @@ gen_inbound(dir)
case DLT_JUNIPER_VP:
case DLT_JUNIPER_ST:
case DLT_JUNIPER_ISM:
case DLT_JUNIPER_VS:
case DLT_JUNIPER_SRX_E2E:
case DLT_JUNIPER_FIBRECHANNEL:
case DLT_JUNIPER_ATM_CEMIC:
/* juniper flags (including direction) are stored
* the byte after the 3-byte magic number */
if (dir) {
@ -7757,6 +7840,30 @@ gen_ahostop(eaddr, dir)
b1 = gen_ahostop(eaddr, Q_DST);
gen_or(b0, b1);
return b1;
case Q_ADDR1:
bpf_error("'addr1' is only supported on 802.11");
break;
case Q_ADDR2:
bpf_error("'addr2' is only supported on 802.11");
break;
case Q_ADDR3:
bpf_error("'addr3' is only supported on 802.11");
break;
case Q_ADDR4:
bpf_error("'addr4' is only supported on 802.11");
break;
case Q_RA:
bpf_error("'ra' is only supported on 802.11");
break;
case Q_TA:
bpf_error("'ta' is only supported on 802.11");
break;
}
abort();
/* NOTREACHED */
@ -7811,9 +7918,15 @@ gen_vlan(vlan_num)
switch (linktype) {
case DLT_EN10MB:
/* check for VLAN */
case DLT_NETANALYZER:
case DLT_NETANALYZER_TRANSPARENT:
/* check for VLAN, including QinQ */
b0 = gen_cmp(OR_LINK, off_linktype, BPF_H,
(bpf_int32)ETHERTYPE_8021Q);
b1 = gen_cmp(OR_LINK, off_linktype, BPF_H,
(bpf_int32)ETHERTYPE_8021QINQ);
gen_or(b0,b1);
b0 = b1;
/* If a specific VLAN is requested, check VLAN id */
if (vlan_num >= 0) {
@ -7874,6 +7987,8 @@ gen_mpls(label_num)
case DLT_C_HDLC: /* fall through */
case DLT_EN10MB:
case DLT_NETANALYZER:
case DLT_NETANALYZER_TRANSPARENT:
b0 = gen_linktype(ETHERTYPE_MPLS);
break;

4
gencode.h
View File

@ -126,6 +126,8 @@
#define Q_RADIO 40
#define Q_CARP 41
/* Directional qualifiers. */
#define Q_SRC 1
@ -136,6 +138,8 @@
#define Q_ADDR2 6
#define Q_ADDR3 7
#define Q_ADDR4 8
#define Q_RA 9
#define Q_TA 10
#define Q_DEFAULT 0
#define Q_UNDEF 255

7
grammar.y
View File

@ -272,12 +272,12 @@ pfaction_to_num(const char *action)
%token DST SRC HOST GATEWAY
%token NET NETMASK PORT PORTRANGE LESS GREATER PROTO PROTOCHAIN CBYTE
%token ARP RARP IP SCTP TCP UDP ICMP IGMP IGRP PIM VRRP
%token ARP RARP IP SCTP TCP UDP ICMP IGMP IGRP PIM VRRP CARP
%token ATALK AARP DECNET LAT SCA MOPRC MOPDL
%token TK_BROADCAST TK_MULTICAST
%token NUM INBOUND OUTBOUND
%token PF_IFNAME PF_RSET PF_RNR PF_SRNR PF_REASON PF_ACTION
%token TYPE SUBTYPE DIR ADDR1 ADDR2 ADDR3 ADDR4
%token TYPE SUBTYPE DIR ADDR1 ADDR2 ADDR3 ADDR4 RA TA
%token LINK
%token GEQ LEQ NEQ
%token ID EID HID HID6 AID
@ -442,6 +442,8 @@ dqual: SRC { $$ = Q_SRC; }
| ADDR2 { $$ = Q_ADDR2; }
| ADDR3 { $$ = Q_ADDR3; }
| ADDR4 { $$ = Q_ADDR4; }
| RA { $$ = Q_RA; }
| TA { $$ = Q_TA; }
;
/* address type qualifiers */
aqual: HOST { $$ = Q_HOST; }
@ -464,6 +466,7 @@ pname: LINK { $$ = Q_LINK; }
| IGRP { $$ = Q_IGRP; }
| PIM { $$ = Q_PIM; }
| VRRP { $$ = Q_VRRP; }
| CARP { $$ = Q_CARP; }
| ATALK { $$ = Q_ATALK; }
| AARP { $$ = Q_AARP; }
| DECNET { $$ = Q_DECNET; }

60
inet.c
View File

@ -133,6 +133,7 @@ add_or_find_if(pcap_if_t **curdev_ret, pcap_if_t **alldevs, const char *name,
pcap_t *p;
pcap_if_t *curdev, *prevdev, *nextdev;
int this_instance;
char open_errbuf[PCAP_ERRBUF_SIZE];
/*
* Is there already an entry in the list for this interface?
@ -192,11 +193,11 @@ add_or_find_if(pcap_if_t **curdev_ret, pcap_if_t **alldevs, const char *name,
}
strcpy(en_name, "en");
strcat(en_name, name + 3);
p = pcap_open_live(en_name, 68, 0, 0, errbuf);
p = pcap_open_live(en_name, 68, 0, 0, open_errbuf);
free(en_name);
} else
#endif /* __APPLE */
p = pcap_open_live(name, 68, 0, 0, errbuf);
p = pcap_open_live(name, 68, 0, 0, open_errbuf);
if (p == NULL) {
/*
* No. Don't bother including it.
@ -431,26 +432,53 @@ add_addr_to_iflist(pcap_if_t **alldevs, const char *name, u_int flags,
strlcpy(ifrdesc.ifr_name, name, sizeof ifrdesc.ifr_name);
s = socket(AF_INET, SOCK_DGRAM, 0);
if (s >= 0) {
#ifdef __FreeBSD__
/*
* On FreeBSD, if the buffer isn't big enough for the
* description, the ioctl succeeds, but the description
* isn't copied, ifr_buffer.length is set to the description
* length, and ifr_buffer.buffer is set to NULL.
*/
for (;;) {
free(description);
if ((description = malloc(descrlen)) != NULL) {
#ifdef __FreeBSD__
ifrdesc.ifr_buffer.buffer = description;
ifrdesc.ifr_buffer.length = descrlen;
#else /* __FreeBSD__ */
ifrdesc.ifr_data = (caddr_t)description;
#endif /* __FreeBSD__ */
if (ioctl(s, SIOCGIFDESCR, &ifrdesc) == 0)
break;
#ifdef __FreeBSD__
else if (errno == ENAMETOOLONG)
descrlen = ifrdesc.ifr_buffer.length;
#endif /* __FreeBSD__ */
else
if (ioctl(s, SIOCGIFDESCR, &ifrdesc) == 0) {
if (ifrdesc.ifr_buffer.buffer ==
description)
break;
else
descrlen = ifrdesc.ifr_buffer.length;
} else {
/*
* Failed to get interface description.
*/
free(description);
description = NULL;
break;
}
} else
break;
}
#else /* __FreeBSD__ */
/*
* The only other OS that currently supports
* SIOCGIFDESCR is OpenBSD, and it has no way
* to get the description length - it's clamped
* to a maximum of IFDESCRSIZE.
*/
if ((description = malloc(descrlen)) != NULL) {
ifrdesc.ifr_data = (caddr_t)description;
if (ioctl(s, SIOCGIFDESCR, &ifrdesc) != 0) {
/*
* Failed to get interface description.
*/
free(description);
description = NULL;
}
}
#endif /* __FreeBSD__ */
close(s);
if (description != NULL && strlen(description) == 0) {
free(description);
@ -850,8 +878,10 @@ pcap_lookupdev(errbuf)
*/
while(NAdapts--)
{
strcpy((char*)tUstr, tAstr);
(char*)tUstr += strlen(tAstr) + 1;;
char* tmp = (char*)tUstr;
strcpy(tmp, tAstr);
tmp += strlen(tAstr) + 1;
tUstr = (WCHAR*)tmp;
tAstr += strlen(tAstr) + 1;
}

83
packaging/pcap.spec.in
View File

@ -1,58 +1,75 @@
%define prefix /usr
%define version @VERSION@
Summary: packet capture library
Summary: A system-independent interface for user-level packet capture
Name: libpcap
Version: %version
Release: 1
Group: Development/Libraries
Copyright: BSD
License: BSD with advertising
Source: @NAME@.tar.gz
BuildRoot: /tmp/%{name}-buildroot
URL: http://www.tcpdump.org
Source: http://www.tcpdump.org/release/%{name}-%{version}.tar.gz
%description
Packet-capture library LIBPCAP @VERSION@
Now maintained by "The Tcpdump Group"
See http://www.tcpdump.org
Please send inquiries/comments/reports to tcpdump-workers@lists.tcpdump.org
Libpcap provides a portable framework for low-level network
monitoring. Libpcap can provide network statistics collection,
security monitoring and network debugging. Since almost every system
vendor provides a different interface for packet capture, the libpcap
authors created this system-independent API to ease in porting and to
alleviate the need for several system-dependent packet capture modules
in each application.
Install libpcap if you need to do low-level network traffic monitoring
on your network.
%package devel
Summary: Libraries and header files for the libpcap library
Group: Development/Libraries
%description devel
Libpcap provides a portable framework for low-level network
monitoring. Libpcap can provide network statistics collection,
security monitoring and network debugging. Since almost every system
vendor provides a different interface for packet capture, the libpcap
authors created this system-independent API to ease in porting and to
alleviate the need for several system-dependent packet capture modules
in each application.
This package provides the libraries, include files, and other
resources needed for developing libpcap applications.
%prep
%setup
%post
ldconfig
%setup -q
%build
CFLAGS="$RPM_OPT_FLAGS" ./configure --prefix=%prefix
make
export CFLAGS="$RPM_OPT_FLAGS -fno-strict-aliasing"
%configure
make %{?_smp_mflags}
%install
rm -rf $RPM_BUILD_ROOT
make install DESTDIR=$RPM_BUILD_ROOT mandir=/usr/share/man
cd $RPM_BUILD_ROOT/usr/lib
V1=`echo @VERSION@ | sed 's/\\.[^\.]*$//g'`
V2=`echo @VERSION@ | sed 's/\\.[^\.]*\.[^\.]*$//g'`
ln -sf libpcap.so.@VERSION@ libpcap.so.$V1
if test "$V2" -ne "$V1"; then
ln -sf libpcap.so.$V1 libpcap.so.$V2
ln -sf libpcap.so.$V2 libpcap.so
else
ln -sf libpcap.so.$V1 libpcap.so
fi
make DESTDIR=$RPM_BUILD_ROOT install
%clean
rm -rf $RPM_BUILD_ROOT
%files
%defattr(-,root,root)
%doc LICENSE CHANGES INSTALL.txt README.linux TODO VERSION CREDITS packaging/pcap.spec
/usr/lib/libpcap.a
/usr/share/man/man3/*
/usr/share/man/man5/*
/usr/share/man/man7/*
/usr/include/pcap.h
/usr/include/pcap/*.h
/usr/include/pcap-bpf.h
/usr/include/pcap-namedb.h
/usr/lib/libpcap.so*
%doc LICENSE README CHANGES INSTALL.txt README.linux TODO VERSION CREDITS packaging/pcap.spec
%{_libdir}/libpcap.so.*
%{_mandir}/man7/pcap*.7*
%files devel
%defattr(-,root,root)
%{_bindir}/pcap-config
%{_includedir}/pcap*.h
%{_includedir}/pcap.h
%{_libdir}/libpcap.so
%{_libdir}/libpcap.a
%{_mandir}/man1/pcap-config.1*
%{_mandir}/man3/pcap*.3*
%{_mandir}/man5/pcap*.5*

290
pcap-bpf.c
View File

@ -31,8 +31,8 @@ static const char rcsid[] _U_ =
#ifdef HAVE_ZEROCOPY_BPF
#include <sys/mman.h>
#endif
#include <sys/time.h>
#include <sys/socket.h>
#include <time.h>
/*
* <net/bpf.h> defines ioctls, but doesn't include <sys/ioccom.h>.
*
@ -186,77 +186,67 @@ static int pcap_setfilter_bpf(pcap_t *p, struct bpf_program *fp);
static int pcap_setdirection_bpf(pcap_t *, pcap_direction_t);
static int pcap_set_datalink_bpf(pcap_t *p, int dlt);
#ifdef HAVE_ZEROCOPY_BPF
/*
* For zerocopy bpf, we need to override the setnonblock/getnonblock routines
* so we don't call select(2) if the pcap handle is in non-blocking mode. We
* preserve the timeout supplied by pcap_open functions to make sure it
* does not get clobbered if the pcap handle moves between blocking and non-
* blocking mode.
* For zerocopy bpf, the setnonblock/getnonblock routines need to modify
* p->md.timeout so we don't call select(2) if the pcap handle is in non-
* blocking mode. We preserve the timeout supplied by pcap_open functions
* to make sure it does not get clobbered if the pcap handle moves between
* blocking and non-blocking mode.
*/
static int
pcap_getnonblock_zbuf(pcap_t *p, char *errbuf)
pcap_getnonblock_bpf(pcap_t *p, char *errbuf)
{
/*
* Use a negative value for the timeout to represent that the
* pcap handle is in non-blocking mode.
*/
return (p->md.timeout < 0);
#ifdef HAVE_ZEROCOPY_BPF
if (p->md.zerocopy) {
/*
* Use a negative value for the timeout to represent that the
* pcap handle is in non-blocking mode.
*/
return (p->md.timeout < 0);
}
#endif
return (pcap_getnonblock_fd(p, errbuf));
}
static int
pcap_setnonblock_zbuf(pcap_t *p, int nonblock, char *errbuf)
pcap_setnonblock_bpf(pcap_t *p, int nonblock, char *errbuf)
{
/*
* Map each value to the corresponding 2's complement, to
* preserve the timeout value provided with pcap_set_timeout.
* (from pcap-linux.c).
*/
if (nonblock) {
if (p->md.timeout >= 0) {
/*
* Timeout is non-negative, so we're not already
* in non-blocking mode; set it to the 2's
* complement, to make it negative, as an
* indication that we're in non-blocking mode.
*/
p->md.timeout = p->md.timeout * -1 - 1;
}
} else {
if (p->md.timeout < 0) {
/*
* Timeout is negative, so we're not already
* in blocking mode; reverse the previous
* operation, to make the timeout non-negative
* again.
*/
p->md.timeout = (p->md.timeout + 1) * -1;
#ifdef HAVE_ZEROCOPY_BPF
if (p->md.zerocopy) {
/*
* Map each value to the corresponding 2's complement, to
* preserve the timeout value provided with pcap_set_timeout.
* (from pcap-linux.c).
*/
if (nonblock) {
if (p->md.timeout >= 0) {
/*
* Timeout is non-negative, so we're not
* currently in non-blocking mode; set it
* to the 2's complement, to make it
* negative, as an indication that we're
* in non-blocking mode.
*/
p->md.timeout = p->md.timeout * -1 - 1;
}
} else {
if (p->md.timeout < 0) {
/*
* Timeout is negative, so we're currently
* in blocking mode; reverse the previous
* operation, to make the timeout non-negative
* again.
*/
p->md.timeout = (p->md.timeout + 1) * -1;
}
}
return (0);
}
return (0);
}
/*
* Zero-copy specific close method. Un-map the shared buffers then call
* pcap_cleanup_live_common.
*/
static void
pcap_cleanup_zbuf(pcap_t *p)
{
/*
* Delete the mappings. Note that p->buffer gets initialized to one
* of the mmapped regions in this case, so do not try and free it
* directly; null it out so that pcap_cleanup_live_common() doesn't
* try to free it.
*/
if (p->md.zbuf1 != MAP_FAILED && p->md.zbuf1 != NULL)
(void) munmap(p->md.zbuf1, p->md.zbufsize);
if (p->md.zbuf2 != MAP_FAILED && p->md.zbuf2 != NULL)
(void) munmap(p->md.zbuf2, p->md.zbufsize);
p->buffer = NULL;
pcap_cleanup_live_common(p);
#endif
return (pcap_setnonblock_fd(p, nonblock, errbuf));
}
#ifdef HAVE_ZEROCOPY_BPF
/*
* Zero-copy BPF buffer routines to check for and acknowledge BPF data in
* shared memory buffers.
@ -410,7 +400,7 @@ pcap_ack_zbuf(pcap_t *p)
p->buffer = NULL;
return (0);
}
#endif
#endif /* HAVE_ZEROCOPY_BPF */
pcap_t *
pcap_create(const char *device, char *ebuf)
@ -435,6 +425,10 @@ pcap_create(const char *device, char *ebuf)
return (p);
}
/*
* On success, returns a file descriptor for a BPF device.
* On failure, returns a PCAP_ERROR_ value, and sets p->errbuf.
*/
static int
bpf_open(pcap_t *p)
{
@ -495,12 +489,52 @@ bpf_open(pcap_t *p)
* XXX better message for all minors used
*/
if (fd < 0) {
if (errno == EACCES)
fd = PCAP_ERROR_PERM_DENIED;
else
switch (errno) {
case ENOENT:
fd = PCAP_ERROR;
snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "(no devices found) %s: %s",
device, pcap_strerror(errno));
if (n == 1) {
/*
* /dev/bpf0 doesn't exist, which
* means we probably have no BPF
* devices.
*/
snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
"(there are no BPF devices)");
} else {
/*
* We got EBUSY on at least one
* BPF device, so we have BPF
* devices, but all the ones
* that exist are busy.
*/
snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
"(all BPF devices are busy)");
}
break;
case EACCES:
/*
* Got EACCES on the last device we tried,
* and EBUSY on all devices before that,
* if any.
*/
fd = PCAP_ERROR_PERM_DENIED;
snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
"(cannot open BPF device) %s: %s", device,
pcap_strerror(errno));
break;
default:
/*
* Some other problem.
*/
fd = PCAP_ERROR;
snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
"(cannot open BPF device) %s: %s", device,
pcap_strerror(errno));
break;
}
}
#endif
@ -673,14 +707,23 @@ pcap_can_set_rfmon_bpf(pcap_t *p)
*/
fd = bpf_open(p);
if (fd < 0)
return (fd);
return (fd); /* fd is the appropriate error code */
/*
* Now bind to the device.
*/
(void)strncpy(ifr.ifr_name, p->opt.source, sizeof(ifr.ifr_name));
if (ioctl(fd, BIOCSETIF, (caddr_t)&ifr) < 0) {
if (errno == ENETDOWN) {
switch (errno) {
case ENXIO:
/*
* There's no such device.
*/
close(fd);
return (PCAP_ERROR_NO_SUCH_DEVICE);
case ENETDOWN:
/*
* Return a "network down" indication, so that
* the application can report that rather than
@ -690,7 +733,8 @@ pcap_can_set_rfmon_bpf(pcap_t *p)
*/
close(fd);
return (PCAP_ERROR_IFACE_NOT_UP);
} else {
default:
snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
"BIOCSETIF: %s: %s",
p->opt.source, pcap_strerror(errno));
@ -911,14 +955,28 @@ pcap_read_bpf(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
* processed so far.
*/
if (p->break_loop) {
p->bp = bp;
p->cc = ep - bp;
/*
* ep is set based on the return value of read(),
* but read() from a BPF device doesn't necessarily
* return a value that's a multiple of the alignment
* value for BPF_WORDALIGN(). However, whenever we
* increment bp, we round up the increment value by
* a value rounded up by BPF_WORDALIGN(), so we
* could increment bp past ep after processing the
* last packet in the buffer.
*
* We treat ep < bp as an indication that this
* happened, and just set p->cc to 0.
*/
if (p->cc < 0)
p->cc = 0;
if (n == 0) {
p->break_loop = 0;
return (PCAP_ERROR_BREAK);
} else {
p->bp = bp;
p->cc = ep - bp;
} else
return (n);
}
}
caplen = bhp->bh_caplen;
@ -970,6 +1028,11 @@ pcap_read_bpf(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
if (++n >= cnt && cnt > 0) {
p->bp = bp;
p->cc = ep - bp;
/*
* See comment above about p->cc < 0.
*/
if (p->cc < 0)
p->cc = 0;
return (n);
}
} else {
@ -1270,15 +1333,19 @@ pcap_cleanup_bpf(pcap_t *p)
}
#ifdef HAVE_ZEROCOPY_BPF
/*
* In zero-copy mode, p->buffer is just a pointer into one of the two
* memory-mapped buffers, so no need to free it.
*/
if (p->md.zerocopy) {
/*
* Delete the mappings. Note that p->buffer gets
* initialized to one of the mmapped regions in
* this case, so do not try and free it directly;
* null it out so that pcap_cleanup_live_common()
* doesn't try to free it.
*/
if (p->md.zbuf1 != MAP_FAILED && p->md.zbuf1 != NULL)
munmap(p->md.zbuf1, p->md.zbufsize);
(void) munmap(p->md.zbuf1, p->md.zbufsize);
if (p->md.zbuf2 != MAP_FAILED && p->md.zbuf2 != NULL)
munmap(p->md.zbuf2, p->md.zbufsize);
(void) munmap(p->md.zbuf2, p->md.zbufsize);
p->buffer = NULL;
}
#endif
if (p->md.device != NULL) {
@ -1392,7 +1459,15 @@ pcap_activate_bpf(pcap_t *p)
{
int status = 0;
int fd;
#ifdef LIFNAMSIZ
struct lifreq ifr;
char *ifrname = ifr.lifr_name;
const size_t ifnamsiz = sizeof(ifr.lifr_name);
#else
struct ifreq ifr;
char *ifrname = ifr.ifr_name;
const size_t ifnamsiz = sizeof(ifr.ifr_name);
#endif
struct bpf_version bv;
#ifdef __APPLE__
int sockfd;
@ -1484,9 +1559,8 @@ pcap_activate_bpf(pcap_t *p)
*/
sockfd = socket(AF_INET, SOCK_DGRAM, 0);
if (sockfd != -1) {
strlcpy(ifr.ifr_name,
p->opt.source,
sizeof(ifr.ifr_name));
strlcpy(ifrname,
p->opt.source, ifnamsiz);
if (ioctl(sockfd, SIOCGIFFLAGS,
(char *)&ifr) < 0) {
/*
@ -1551,14 +1625,6 @@ pcap_activate_bpf(pcap_t *p)
*/
p->md.zerocopy = 1;
/*
* Set the cleanup and set/get nonblocking mode ops
* as appropriate for zero-copy mode.
*/
p->cleanup_op = pcap_cleanup_zbuf;
p->setnonblock_op = pcap_setnonblock_zbuf;
p->getnonblock_op = pcap_getnonblock_zbuf;
/*
* How to pick a buffer size: first, query the maximum buffer
* size supported by zero-copy. This also lets us quickly
@ -1608,7 +1674,7 @@ pcap_activate_bpf(pcap_t *p)
pcap_strerror(errno));
goto bad;
}
(void)strncpy(ifr.ifr_name, p->opt.source, sizeof(ifr.ifr_name));
(void)strncpy(ifrname, p->opt.source, ifnamsiz);
if (ioctl(fd, BIOCSETIF, (caddr_t)&ifr) < 0) {
snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "BIOCSETIF: %s: %s",
p->opt.source, pcap_strerror(errno));
@ -1638,9 +1704,13 @@ pcap_activate_bpf(pcap_t *p)
/*
* Now bind to the device.
*/
(void)strncpy(ifr.ifr_name, p->opt.source,
sizeof(ifr.ifr_name));
if (ioctl(fd, BIOCSETIF, (caddr_t)&ifr) < 0) {
(void)strncpy(ifrname, p->opt.source, ifnamsiz);
#ifdef BIOCSETLIF
if (ioctl(fd, BIOCSETLIF, (caddr_t)&ifr) < 0)
#else
if (ioctl(fd, BIOCSETIF, (caddr_t)&ifr) < 0)
#endif
{
status = check_setif_failure(p, errno);
goto bad;
}
@ -1667,9 +1737,12 @@ pcap_activate_bpf(pcap_t *p)
*/
(void) ioctl(fd, BIOCSBLEN, (caddr_t)&v);
(void)strncpy(ifr.ifr_name, p->opt.source,
sizeof(ifr.ifr_name));
(void)strncpy(ifrname, p->opt.source, ifnamsiz);
#ifdef BIOCSETLIF
if (ioctl(fd, BIOCSETLIF, (caddr_t)&ifr) >= 0)
#else
if (ioctl(fd, BIOCSETIF, (caddr_t)&ifr) >= 0)
#endif
break; /* that size worked; we're done */
if (errno != ENOBUFS) {
@ -2160,8 +2233,8 @@ pcap_activate_bpf(pcap_t *p)
p->setfilter_op = pcap_setfilter_bpf;
p->setdirection_op = pcap_setdirection_bpf;
p->set_datalink_op = pcap_set_datalink_bpf;
p->getnonblock_op = pcap_getnonblock_fd;
p->setnonblock_op = pcap_setnonblock_fd;
p->getnonblock_op = pcap_getnonblock_bpf;
p->setnonblock_op = pcap_setnonblock_bpf;
p->stats_op = pcap_stats_bpf;
p->cleanup_op = pcap_cleanup_bpf;
@ -2214,17 +2287,28 @@ monitor_mode(pcap_t *p, int set)
/*
* Can't get the media types.
*/
if (errno == EINVAL) {
switch (errno) {
case ENXIO:
/*
* There's no such device.
*/
close(sock);
return (PCAP_ERROR_NO_SUCH_DEVICE);
case EINVAL:
/*
* Interface doesn't support SIOC{G,S}IFMEDIA.
*/
close(sock);
return (PCAP_ERROR_RFMON_NOTSUP);
default:
snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
"SIOCGIFMEDIA 1: %s", pcap_strerror(errno));
close(sock);
return (PCAP_ERROR);
}
snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "SIOCGIFMEDIA 1: %s",
pcap_strerror(errno));
close(sock);
return (PCAP_ERROR);
}
if (req.ifm_count == 0) {
/*

76
pcap-bt-linux.c
View File

@ -67,7 +67,6 @@ static const char rcsid[] _U_ =
static int bt_activate(pcap_t *);
static int bt_read_linux(pcap_t *, int , pcap_handler , u_char *);
static int bt_inject_linux(pcap_t *, const void *, size_t);
static int bt_setfilter_linux(pcap_t *, struct bpf_program *);
static int bt_setdirection_linux(pcap_t *, pcap_direction_t);
static int bt_stats_linux(pcap_t *, struct pcap_stat *);
@ -86,8 +85,8 @@ bt_platform_finddevs(pcap_if_t **alldevsp, char *err_str)
/* if bluetooth is not supported this this is not fatal*/
if (errno == EAFNOSUPPORT)
return 0;
snprintf(err_str, PCAP_ERRBUF_SIZE, "Can't open raw Bluetooth socket %d:%s",
errno, strerror(errno));
snprintf(err_str, PCAP_ERRBUF_SIZE,
"Can't open raw Bluetooth socket: %s", strerror(errno));
return -1;
}
@ -104,8 +103,9 @@ bt_platform_finddevs(pcap_if_t **alldevsp, char *err_str)
if (ioctl(sock, HCIGETDEVLIST, (void *) dev_list) < 0)
{
snprintf(err_str, PCAP_ERRBUF_SIZE, "Can't get Bluetooth device list via ioctl %d:%s",
errno, strerror(errno));
snprintf(err_str, PCAP_ERRBUF_SIZE,
"Can't get Bluetooth device list via ioctl: %s",
strerror(errno));
ret = -1;
goto free;
}
@ -172,7 +172,7 @@ bt_activate(pcap_t* handle)
handle->read_op = bt_read_linux;
handle->inject_op = bt_inject_linux;
handle->setfilter_op = bt_setfilter_linux;
handle->setfilter_op = install_bpf_program; /* no kernel filtering */
handle->setdirection_op = bt_setdirection_linux;
handle->set_datalink_op = NULL; /* can't change data link type */
handle->getnonblock_op = pcap_getnonblock_fd;
@ -183,8 +183,8 @@ bt_activate(pcap_t* handle)
/* Create HCI socket */
handle->fd = socket(AF_BLUETOOTH, SOCK_RAW, BTPROTO_HCI);
if (handle->fd < 0) {
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "Can't create raw socket %d:%s",
errno, strerror(errno));
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
"Can't create raw socket: %s", strerror(errno));
return PCAP_ERROR;
}
@ -197,15 +197,15 @@ bt_activate(pcap_t* handle)
opt = 1;
if (setsockopt(handle->fd, SOL_HCI, HCI_DATA_DIR, &opt, sizeof(opt)) < 0) {
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "Can't enable data direction info %d:%s",
errno, strerror(errno));
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
"Can't enable data direction info: %s", strerror(errno));
goto close_fail;
}
opt = 1;
if (setsockopt(handle->fd, SOL_HCI, HCI_TIME_STAMP, &opt, sizeof(opt)) < 0) {
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "Can't enable time stamp %d:%s",
errno, strerror(errno));
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
"Can't enable time stamp: %s", strerror(errno));
goto close_fail;
}
@ -215,8 +215,8 @@ bt_activate(pcap_t* handle)
memset((void *) &flt.type_mask, 0xff, sizeof(flt.type_mask));
memset((void *) &flt.event_mask, 0xff, sizeof(flt.event_mask));
if (setsockopt(handle->fd, SOL_HCI, HCI_FILTER, &flt, sizeof(flt)) < 0) {
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "Can't set filter %d:%s",
errno, strerror(errno));
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
"Can't set filter: %s", strerror(errno));
goto close_fail;
}
@ -225,8 +225,9 @@ bt_activate(pcap_t* handle)
addr.hci_family = AF_BLUETOOTH;
addr.hci_dev = handle->md.ifindex;
if (bind(handle->fd, (struct sockaddr *) &addr, sizeof(addr)) < 0) {
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "Can't attach to device %d %d:%s",
handle->md.ifindex, errno, strerror(errno));
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
"Can't attach to device %d: %s", handle->md.ifindex,
strerror(errno));
goto close_fail;
}
@ -238,7 +239,7 @@ bt_activate(pcap_t* handle)
goto close_fail;
}
if (handle->opt.buffer_size == 0) {
if (handle->opt.buffer_size != 0) {
/*
* Set the socket buffer size to the specified value.
*/
@ -265,6 +266,7 @@ bt_read_linux(pcap_t *handle, int max_packets, pcap_handler callback, u_char *us
struct cmsghdr *cmsg;
struct msghdr msg;
struct iovec iv;
ssize_t ret;
struct pcap_pkthdr pkth;
pcap_bluetooth_h4_header* bthdr;
@ -280,31 +282,33 @@ bt_read_linux(pcap_t *handle, int max_packets, pcap_handler callback, u_char *us
/* ignore interrupt system call error */
do {
pkth.caplen = recvmsg(handle->fd, &msg, 0);
ret = recvmsg(handle->fd, &msg, 0);
if (handle->break_loop)
{
handle->break_loop = 0;
return -2;
}
} while ((pkth.caplen == -1) && (errno == EINTR));
} while ((ret == -1) && (errno == EINTR));
if (pkth.caplen < 0) {
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "Can't receive packet %d:%s",
errno, strerror(errno));
if (ret < 0) {
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
"Can't receive packet: %s", strerror(errno));
return -1;
}
pkth.caplen = ret;
/* get direction and timestamp*/
cmsg = CMSG_FIRSTHDR(&msg);
int in=0;
while (cmsg) {
switch (cmsg->cmsg_type) {
case HCI_CMSG_DIR:
in = *((int *) CMSG_DATA(cmsg));
memcpy(&in, CMSG_DATA(cmsg), sizeof in);
break;
case HCI_CMSG_TSTAMP:
pkth.ts = *((struct timeval *) CMSG_DATA(cmsg));
memcpy(&pkth.ts, CMSG_DATA(cmsg),
sizeof pkth.ts);
break;
}
cmsg = CMSG_NXTHDR(&msg, cmsg);
@ -316,8 +320,13 @@ bt_read_linux(pcap_t *handle, int max_packets, pcap_handler callback, u_char *us
bthdr->direction = htonl(in != 0);
pkth.caplen+=sizeof(pcap_bluetooth_h4_header);
pkth.len = pkth.caplen;
callback(user, &pkth, &handle->buffer[handle->offset]);
return 1;
if (handle->fcode.bf_insns == NULL ||
bpf_filter(handle->fcode.bf_insns, &handle->buffer[handle->offset],
pkth.len, pkth.caplen)) {
callback(user, &pkth, &handle->buffer[handle->offset]);
return 1;
}
return 0; /* didn't pass filter */
}
static int
@ -337,14 +346,14 @@ bt_stats_linux(pcap_t *handle, struct pcap_stat *stats)
struct hci_dev_stats * s = &dev_info.stat;
dev_info.dev_id = handle->md.ifindex;
/* ingnore eintr */
/* ignore eintr */
do {
ret = ioctl(handle->fd, HCIGETDEVINFO, (void *)&dev_info);
} while ((ret == -1) && (errno == EINTR));
if (ret < 0) {
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "can get stats"
" via ioctl %d:%s", errno, strerror(errno));
snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
"Can't get stats via ioctl: %s", strerror(errno));
return (-1);
}
@ -357,13 +366,6 @@ bt_stats_linux(pcap_t *handle, struct pcap_stat *stats)
return 0;
}
static int
bt_setfilter_linux(pcap_t *p, struct bpf_program *fp)
{
return 0;
}
static int
bt_setdirection_linux(pcap_t *p, pcap_direction_t d)
{

595
pcap-common.c
View File

@ -18,21 +18,9 @@
* WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
*
* savefile.c - supports offline use of tcpdump
* Extraction/creation by Jeffrey Mogul, DECWRL
* Modified by Steve McCanne, LBL.
*
* Used to save the received packet headers, after filtering, to
* a file, and then read them later.
* The first record in the file contains saved values for the machine
* dependent values so we can print the dump file on any architecture.
* pcap-common.c - common code for pcap and pcap-ng files
*/
#ifndef lint
static const char rcsid[] _U_ =
"@(#) $Header: /tcpdump/master/libpcap/savefile.c,v 1.183 2008-12-23 20:13:29 guy Exp $ (LBL)";
#endif
#ifdef HAVE_CONFIG_H
#include "config.h"
#endif
@ -106,6 +94,23 @@ static const char rcsid[] _U_ =
* file, and new values after that one might have been assigned. Also,
* do *NOT* use any values below 100 - those might already have been
* taken by one (or more!) organizations.
*
* Any platform that defines additional DLT_* codes should:
*
* request a LINKTYPE_* code and value from tcpdump.org,
* as per the above;
*
* add, in their version of libpcap, an entry to map
* those DLT_* codes to the corresponding LINKTYPE_*
* code;
*
* redefine, in their "net/bpf.h", any DLT_* values
* that collide with the values used by their additional
* DLT_* codes, to remove those collisions (but without
* making them collide with any of the LINKTYPE_*
* values equal to 50 or above; they should also avoid
* defining DLT_* values that collide with those
* LINKTYPE_* values, either).
*/
#define LINKTYPE_NULL DLT_NULL
#define LINKTYPE_ETHERNET DLT_EN10MB /* also for 100Mb and up */
@ -114,7 +119,7 @@ static const char rcsid[] _U_ =
#define LINKTYPE_PRONET DLT_PRONET
#define LINKTYPE_CHAOS DLT_CHAOS
#define LINKTYPE_TOKEN_RING DLT_IEEE802 /* DLT_IEEE802 is used for Token Ring */
#define LINKTYPE_ARCNET DLT_ARCNET /* BSD-style headers */
#define LINKTYPE_ARCNET_BSD DLT_ARCNET /* BSD-style headers */
#define LINKTYPE_SLIP DLT_SLIP
#define LINKTYPE_PPP DLT_PPP
#define LINKTYPE_FDDI DLT_FDDI
@ -140,10 +145,29 @@ static const char rcsid[] _U_ =
#define LINKTYPE_SYMANTEC_FIREWALL 99 /* Symantec Enterprise Firewall */
/*
* These correspond to DLT_s that have different values on different
* platforms; we map between these values in capture files and
* the DLT_ values as returned by pcap_datalink() and passed to
* pcap_open_dead().
*/
#define LINKTYPE_ATM_RFC1483 100 /* LLC/SNAP-encapsulated ATM */
#define LINKTYPE_RAW 101 /* raw IP */
#define LINKTYPE_SLIP_BSDOS 102 /* BSD/OS SLIP BPF header */
#define LINKTYPE_PPP_BSDOS 103 /* BSD/OS PPP BPF header */
/*
* Values starting with 104 are used for newly-assigned link-layer
* header type values; for those link-layer header types, the DLT_
* value returned by pcap_datalink() and passed to pcap_open_dead(),
* and the LINKTYPE_ value that appears in capture files, are the
* same.
*
* LINKTYPE_MATCHING_MIN is the lowest such value; LINKTYPE_MATCHING_MAX
* is the highest such value.
*/
#define LINKTYPE_MATCHING_MIN 104 /* lowest value in the "matching" range */
#define LINKTYPE_C_HDLC 104 /* Cisco HDLC */
#define LINKTYPE_IEEE802_11 105 /* IEEE 802.11 (wireless) */
#define LINKTYPE_ATM_CLIP 106 /* Linux Classical IP over ATM */
@ -544,39 +568,39 @@ static const char rcsid[] _U_ =
* IPMB with a Linux-specific pseudo-header; as requested by Alexey Neyman
* <avn@pigeonpoint.com>.
*/
#define LINKTYPE_IPMB_LINUX 209
#define LINKTYPE_IPMB_LINUX 209
/*
* FlexRay automotive bus - http://www.flexray.com/ - as requested
* by Hannes Kaelber <hannes.kaelber@x2e.de>.
*/
#define LINKTYPE_FLEXRAY 210
#define LINKTYPE_FLEXRAY 210
/*
* Media Oriented Systems Transport (MOST) bus for multimedia
* transport - http://www.mostcooperation.com/ - as requested
* by Hannes Kaelber <hannes.kaelber@x2e.de>.
*/
#define LINKTYPE_MOST 211
#define LINKTYPE_MOST 211
/*
* Local Interconnect Network (LIN) bus for vehicle networks -
* http://www.lin-subbus.org/ - as requested by Hannes Kaelber
* <hannes.kaelber@x2e.de>.
*/
#define LINKTYPE_LIN 212
#define LINKTYPE_LIN 212
/*
* X2E-private data link type used for serial line capture,
* as requested by Hannes Kaelber <hannes.kaelber@x2e.de>.
*/
#define LINKTYPE_X2E_SERIAL 213
#define LINKTYPE_X2E_SERIAL 213
/*
* X2E-private data link type used for the Xoraya data logger
* family, as requested by Hannes Kaelber <hannes.kaelber@x2e.de>.
*/
#define LINKTYPE_X2E_XORAYA 214
#define LINKTYPE_X2E_XORAYA 214
/*
* IEEE 802.15.4, exactly as it appears in the spec (no padding, no
@ -595,22 +619,22 @@ static const char rcsid[] _U_ =
* is used to communicate keystrokes and mouse movements from the
* Linux kernel to display systems, such as Xorg.
*/
#define LINKTYPE_LINUX_EVDEV 216
#define LINKTYPE_LINUX_EVDEV 216
/*
* GSM Um and Abis interfaces, preceded by a "gsmtap" header.
*
* Requested by Harald Welte <laforge@gnumonks.org>.
*/
#define LINKTYPE_GSMTAP_UM 217
#define LINKTYPE_GSMTAP_ABIS 218
#define LINKTYPE_GSMTAP_UM 217
#define LINKTYPE_GSMTAP_ABIS 218
/*
* MPLS, with an MPLS label as the link-layer header.
* Requested by Michele Marchetto <michele@openbsd.org> on behalf
* of OpenBSD.
*/
#define LINKTYPE_MPLS 219
#define LINKTYPE_MPLS 219
/*
* USB packets, beginning with a Linux USB header, with the USB header
@ -622,7 +646,7 @@ static const char rcsid[] _U_ =
* DECT packets, with a pseudo-header; requested by
* Matthias Wenzel <tcpdump@mazzoo.de>.
*/
#define LINKTYPE_DECT 221
#define LINKTYPE_DECT 221
/*
* From: "Lidwa, Eric (GSFC-582.0)[SGT INC]" <eric.lidwa-1@nasa.gov>
@ -633,7 +657,7 @@ static const char rcsid[] _U_ =
* legal before I can submit a patch.
*
*/
#define LINKTYPE_AOS 222
#define LINKTYPE_AOS 222
/*
* Wireless HART (Highway Addressable Remote Transducer)
@ -642,13 +666,13 @@ static const char rcsid[] _U_ =
*
* Requested by Sam Roberts <vieuxtech@gmail.com>.
*/
#define LINKTYPE_WIHART 223
#define LINKTYPE_WIHART 223
/*
* Fibre Channel FC-2 frames, beginning with a Frame_Header.
* Requested by Kahou Lei <kahou82@gmail.com>.
*/
#define LINKTYPE_FC_2 224
#define LINKTYPE_FC_2 224
/*
* Fibre Channel FC-2 frames, beginning with an encoding of the
@ -710,7 +734,7 @@ static const char rcsid[] _U_ =
* An IPv4 or IPv6 datagram follows the pseudo-header; dli_family indicates
* which of those it is.
*/
#define LINKTYPE_IPNET 226
#define LINKTYPE_IPNET 226
/*
* CAN (Controller Area Network) frames, with a pseudo-header as supplied
@ -719,15 +743,114 @@ static const char rcsid[] _U_ =
*
* Requested by Felix Obenhuber <felix@obenhuber.de>.
*/
#define LINKTYPE_CAN_SOCKETCAN 227
#define LINKTYPE_CAN_SOCKETCAN 227
/*
* Raw IPv4/IPv6; different from DLT_RAW in that the DLT_ value specifies
* whether it's v4 or v6. Requested by Darren Reed <Darren.Reed@Sun.COM>.
*/
#define LINKTYPE_IPV4 228
#define LINKTYPE_IPV6 229
#define LINKTYPE_IPV4 228
#define LINKTYPE_IPV6 229
/*
* IEEE 802.15.4, exactly as it appears in the spec (no padding, no
* nothing), and with no FCS at the end of the frame; requested by
* Jon Smirl <jonsmirl@gmail.com>.
*/
#define LINKTYPE_IEEE802_15_4_NOFCS 230
/*
* Raw D-Bus:
*
* http://www.freedesktop.org/wiki/Software/dbus
*
* messages:
*
* http://dbus.freedesktop.org/doc/dbus-specification.html#message-protocol-messages
*
* starting with the endianness flag, followed by the message type, etc.,
* but without the authentication handshake before the message sequence:
*
* http://dbus.freedesktop.org/doc/dbus-specification.html#auth-protocol
*
* Requested by Martin Vidner <martin@vidner.net>.
*/
#define LINKTYPE_DBUS 231
/*
* Juniper-private data link type, as per request from
* Hannes Gredler <hannes@juniper.net>.
*/
#define LINKTYPE_JUNIPER_VS 232
#define LINKTYPE_JUNIPER_SRX_E2E 233
#define LINKTYPE_JUNIPER_FIBRECHANNEL 234
/*
* DVB-CI (DVB Common Interface for communication between a PC Card
* module and a DVB receiver). See
*
* http://www.kaiser.cx/pcap-dvbci.html
*
* for the specification.
*
* Requested by Martin Kaiser <martin@kaiser.cx>.
*/
#define LINKTYPE_DVB_CI 235
/*
* Variant of 3GPP TS 27.010 multiplexing protocol. Requested
* by Hans-Christoph Schemmel <hans-christoph.schemmel@cinterion.com>.
*/
#define LINKTYPE_MUX27010 236
/*
* STANAG 5066 D_PDUs. Requested by M. Baris Demiray
* <barisdemiray@gmail.com>.
*/
#define LINKTYPE_STANAG_5066_D_PDU 237
/*
* Juniper-private data link type, as per request from
* Hannes Gredler <hannes@juniper.net>.
*/
#define LINKTYPE_JUNIPER_ATM_CEMIC 238
/*
* NetFilter LOG messages
* (payload of netlink NFNL_SUBSYS_ULOG/NFULNL_MSG_PACKET packets)
*
* Requested by Jakub Zawadzki <darkjames-ws@darkjames.pl>
*/
#define LINKTYPE_NFLOG 239
/*
* Hilscher Gesellschaft fuer Systemautomation mbH link-layer type
* for Ethernet packets with a 4-byte pseudo-header and always
* with the payload including the FCS, as supplied by their
* netANALYZER hardware and software.
*
* Requested by Holger P. Frommer <HPfrommer@hilscher.com>
*/
#define LINKTYPE_NETANALYZER 240
/*
* Hilscher Gesellschaft fuer Systemautomation mbH link-layer type
* for Ethernet packets with a 4-byte pseudo-header and FCS and
* 1 byte of SFD, as supplied by their netANALYZER hardware and
* software.
*
* Requested by Holger P. Frommer <HPfrommer@hilscher.com>
*/
#define LINKTYPE_NETANALYZER_TRANSPARENT 241
/*
* IP-over-Infiniband, as specified by RFC 4391.
*
* Requested by Petr Sumbera <petr.sumbera@oracle.com>.
*/
#define LINKTYPE_IPOIB 242
#define LINKTYPE_MATCHING_MAX 242 /* highest value in the "matching" range */
static struct linktype_map {
int dlt;
@ -744,7 +867,7 @@ static struct linktype_map {
{ DLT_PRONET, LINKTYPE_PRONET },
{ DLT_CHAOS, LINKTYPE_CHAOS },
{ DLT_IEEE802, LINKTYPE_TOKEN_RING },
{ DLT_ARCNET, LINKTYPE_ARCNET },
{ DLT_ARCNET, LINKTYPE_ARCNET_BSD },
{ DLT_SLIP, LINKTYPE_SLIP },
{ DLT_PPP, LINKTYPE_PPP },
{ DLT_FDDI, LINKTYPE_FDDI },
@ -785,295 +908,12 @@ static struct linktype_map {
/* NetBSD PPP over Ethernet */
{ DLT_PPP_ETHER, LINKTYPE_PPP_ETHER },
/* IEEE 802.11 wireless */
{ DLT_IEEE802_11, LINKTYPE_IEEE802_11 },
/* Frame Relay */
{ DLT_FRELAY, LINKTYPE_FRELAY },
/* OpenBSD loopback */
{ DLT_LOOP, LINKTYPE_LOOP },
/* OpenBSD IPSEC enc */
{ DLT_ENC, LINKTYPE_ENC },
/* Linux cooked socket capture */
{ DLT_LINUX_SLL, LINKTYPE_LINUX_SLL },
/* Apple LocalTalk hardware */
{ DLT_LTALK, LINKTYPE_LTALK },
/* Acorn Econet */
{ DLT_ECONET, LINKTYPE_ECONET },
/* OpenBSD DLT_PFLOG */
{ DLT_PFLOG, LINKTYPE_PFLOG },
/* For Cisco-internal use */
{ DLT_CISCO_IOS, LINKTYPE_CISCO_IOS },
/* Prism II monitor-mode header plus 802.11 header */
{ DLT_PRISM_HEADER, LINKTYPE_PRISM_HEADER },
/* FreeBSD Aironet driver stuff */
{ DLT_AIRONET_HEADER, LINKTYPE_AIRONET_HEADER },
/* Siemens HiPath HDLC */
{ DLT_HHDLC, LINKTYPE_HHDLC },
/* RFC 2625 IP-over-Fibre Channel */
{ DLT_IP_OVER_FC, LINKTYPE_IP_OVER_FC },
/* Solaris+SunATM */
{ DLT_SUNATM, LINKTYPE_SUNATM },
/* RapidIO */
{ DLT_RIO, LINKTYPE_RIO },
/* PCI Express */
{ DLT_PCI_EXP, LINKTYPE_PCI_EXP },
/* Xilinx Aurora link layer */
{ DLT_AURORA, LINKTYPE_AURORA },
/* 802.11 plus BSD radio header */
{ DLT_IEEE802_11_RADIO, LINKTYPE_IEEE802_11_RADIO },
/* Tazmen Sniffer Protocol */
{ DLT_TZSP, LINKTYPE_TZSP },
/* Arcnet with Linux-style link-layer headers */
{ DLT_ARCNET_LINUX, LINKTYPE_ARCNET_LINUX },
/* Juniper-internal chassis encapsulation */
{ DLT_JUNIPER_MLPPP, LINKTYPE_JUNIPER_MLPPP },
{ DLT_JUNIPER_MLFR, LINKTYPE_JUNIPER_MLFR },
{ DLT_JUNIPER_ES, LINKTYPE_JUNIPER_ES },
{ DLT_JUNIPER_GGSN, LINKTYPE_JUNIPER_GGSN },
{ DLT_JUNIPER_MFR, LINKTYPE_JUNIPER_MFR },
{ DLT_JUNIPER_ATM2, LINKTYPE_JUNIPER_ATM2 },
{ DLT_JUNIPER_SERVICES, LINKTYPE_JUNIPER_SERVICES },
{ DLT_JUNIPER_ATM1, LINKTYPE_JUNIPER_ATM1 },
/* Apple IP-over-IEEE 1394 cooked header */
{ DLT_APPLE_IP_OVER_IEEE1394, LINKTYPE_APPLE_IP_OVER_IEEE1394 },
/* SS7 */
{ DLT_MTP2_WITH_PHDR, LINKTYPE_MTP2_WITH_PHDR },
{ DLT_MTP2, LINKTYPE_MTP2 },
{ DLT_MTP3, LINKTYPE_MTP3 },
{ DLT_SCCP, LINKTYPE_SCCP },
/* DOCSIS MAC frames */
{ DLT_DOCSIS, LINKTYPE_DOCSIS },
/* IrDA IrLAP packets + Linux-cooked header */
{ DLT_LINUX_IRDA, LINKTYPE_LINUX_IRDA },
/* IBM SP and Next Federation switches */
{ DLT_IBM_SP, LINKTYPE_IBM_SP },
{ DLT_IBM_SN, LINKTYPE_IBM_SN },
/* 802.11 plus AVS radio header */
{ DLT_IEEE802_11_RADIO_AVS, LINKTYPE_IEEE802_11_RADIO_AVS },
/*
* Any platform that defines additional DLT_* codes should:
*
* request a LINKTYPE_* code and value from tcpdump.org,
* as per the above;
*
* add, in their version of libpcap, an entry to map
* those DLT_* codes to the corresponding LINKTYPE_*
* code;
*
* redefine, in their "net/bpf.h", any DLT_* values
* that collide with the values used by their additional
* DLT_* codes, to remove those collisions (but without
* making them collide with any of the LINKTYPE_*
* values equal to 50 or above; they should also avoid
* defining DLT_* values that collide with those
* LINKTYPE_* values, either).
* All LINKTYPE_ values between LINKTYPE_MATCHING_MIN
* and LINKTYPE_MATCHING_MAX are mapped to identical
* DLT_ values.
*/
/* Juniper-internal chassis encapsulation */
{ DLT_JUNIPER_MONITOR, LINKTYPE_JUNIPER_MONITOR },
/* BACnet MS/TP */
{ DLT_BACNET_MS_TP, LINKTYPE_BACNET_MS_TP },
/* PPP for pppd, with direction flag in the PPP header */
{ DLT_PPP_PPPD, LINKTYPE_PPP_PPPD},
/* Juniper-internal chassis encapsulation */
{ DLT_JUNIPER_PPPOE, LINKTYPE_JUNIPER_PPPOE },
{ DLT_JUNIPER_PPPOE_ATM,LINKTYPE_JUNIPER_PPPOE_ATM },
/* GPRS LLC */
{ DLT_GPRS_LLC, LINKTYPE_GPRS_LLC },
/* Transparent Generic Framing Procedure (ITU-T G.7041/Y.1303) */
{ DLT_GPF_T, LINKTYPE_GPF_T },
/* Framed Generic Framing Procedure (ITU-T G.7041/Y.1303) */
{ DLT_GPF_F, LINKTYPE_GPF_F },
{ DLT_GCOM_T1E1, LINKTYPE_GCOM_T1E1 },
{ DLT_GCOM_SERIAL, LINKTYPE_GCOM_SERIAL },
/* Juniper-internal chassis encapsulation */
{ DLT_JUNIPER_PIC_PEER, LINKTYPE_JUNIPER_PIC_PEER },
/* Endace types */
{ DLT_ERF_ETH, LINKTYPE_ERF_ETH },
{ DLT_ERF_POS, LINKTYPE_ERF_POS },
/* viSDN LAPD */
{ DLT_LINUX_LAPD, LINKTYPE_LINUX_LAPD },
/* Juniper meta-information before Ether, PPP, Frame Relay, C-HDLC Frames */
{ DLT_JUNIPER_ETHER, LINKTYPE_JUNIPER_ETHER },
{ DLT_JUNIPER_PPP, LINKTYPE_JUNIPER_PPP },
{ DLT_JUNIPER_FRELAY, LINKTYPE_JUNIPER_FRELAY },
{ DLT_JUNIPER_CHDLC, LINKTYPE_JUNIPER_CHDLC },
/* Multi Link Frame Relay (FRF.16) */
{ DLT_MFR, LINKTYPE_MFR },
/* Juniper Voice PIC */
{ DLT_JUNIPER_VP, LINKTYPE_JUNIPER_VP },
/* Controller Area Network (CAN) v2.0B */
{ DLT_A429, LINKTYPE_A429 },
/* Arinc 653 Interpartition Communication messages */
{ DLT_A653_ICM, LINKTYPE_A653_ICM },
/* USB */
{ DLT_USB, LINKTYPE_USB },
/* Bluetooth HCI UART transport layer */
{ DLT_BLUETOOTH_HCI_H4, LINKTYPE_BLUETOOTH_HCI_H4 },
/* IEEE 802.16 MAC Common Part Sublayer */
{ DLT_IEEE802_16_MAC_CPS, LINKTYPE_IEEE802_16_MAC_CPS },
/* USB with Linux header */
{ DLT_USB_LINUX, LINKTYPE_USB_LINUX },
/* Controller Area Network (CAN) v2.0B */
{ DLT_CAN20B, LINKTYPE_CAN20B },
/* IEEE 802.15.4 with address fields padded */
{ DLT_IEEE802_15_4_LINUX, LINKTYPE_IEEE802_15_4_LINUX },
/* Per Packet Information encapsulated packets */
{ DLT_PPI, LINKTYPE_PPI },
/* IEEE 802.16 MAC Common Part Sublayer plus radiotap header */
{ DLT_IEEE802_16_MAC_CPS_RADIO, LINKTYPE_IEEE802_16_MAC_CPS_RADIO },
/* Juniper Voice ISM */
{ DLT_JUNIPER_ISM, LINKTYPE_JUNIPER_ISM },
/* IEEE 802.15.4 exactly as it appears in the spec */
{ DLT_IEEE802_15_4, LINKTYPE_IEEE802_15_4 },
/* Various link-layer types for SITA */
{ DLT_SITA, LINKTYPE_SITA },
/* Various link-layer types for Endace */
{ DLT_ERF, LINKTYPE_ERF },
/* Special header for u10 Networks boards */
{ DLT_RAIF1, LINKTYPE_RAIF1 },
/* IPMB */
{ DLT_IPMB, LINKTYPE_IPMB },
/* Juniper Secure Tunnel */
{ DLT_JUNIPER_ST, LINKTYPE_JUNIPER_ST },
/* Bluetooth HCI UART transport layer, with pseudo-header */
{ DLT_BLUETOOTH_HCI_H4_WITH_PHDR, LINKTYPE_BLUETOOTH_HCI_H4_WITH_PHDR },
/* AX.25 with KISS header */
{ DLT_AX25_KISS, LINKTYPE_AX25_KISS },
/* Raw LAPD, with no pseudo-header */
{ DLT_LAPD, LINKTYPE_LAPD },
/* PPP with one-byte pseudo-header giving direction */
{ DLT_PPP_WITH_DIR, LINKTYPE_PPP_WITH_DIR },
/* Cisco HDLC with one-byte pseudo-header giving direction */
{ DLT_C_HDLC_WITH_DIR, LINKTYPE_C_HDLC_WITH_DIR },
/* Frame Relay with one-byte pseudo-header giving direction */
{ DLT_FRELAY_WITH_DIR, LINKTYPE_FRELAY_WITH_DIR },
/* LAPB with one-byte pseudo-header giving direction */
{ DLT_LAPB_WITH_DIR, LINKTYPE_LAPB_WITH_DIR },
/* IPMB with Linux pseudo-header */
{ DLT_IPMB_LINUX, LINKTYPE_IPMB_LINUX },
/* FlexRay */
{ DLT_FLEXRAY, LINKTYPE_FLEXRAY },
/* MOST */
{ DLT_MOST, LINKTYPE_MOST },
/* LIN */
{ DLT_LIN, LINKTYPE_LIN },
/* X2E-private serial line capture */
{ DLT_X2E_SERIAL, LINKTYPE_X2E_SERIAL },
/* X2E-private for Xoraya data logger family */
{ DLT_X2E_XORAYA, LINKTYPE_X2E_XORAYA },
/* IEEE 802.15.4 with PHY data for non-ASK PHYs */
{ DLT_IEEE802_15_4_NONASK_PHY, LINKTYPE_IEEE802_15_4_NONASK_PHY },
/* Input device events from Linux /dev/input/eventN devices */
{ DLT_LINUX_EVDEV, LINKTYPE_LINUX_EVDEV },
/* GSM types */
{ DLT_GSMTAP_UM, LINKTYPE_GSMTAP_UM },
{ DLT_GSMTAP_ABIS, LINKTYPE_GSMTAP_ABIS },
/* MPLS, with an MPLS label as the link-layer header */
{ DLT_MPLS, LINKTYPE_MPLS },
/* USB with padded Linux header */
{ DLT_USB_LINUX_MMAPPED, LINKTYPE_USB_LINUX_MMAPPED },
/* DECT packets with a pseudo-header */
{ DLT_DECT, LINKTYPE_DECT },
/* AOS Space Data Link Protocol */
{ DLT_AOS, LINKTYPE_AOS },
/* Wireless HART */
{ DLT_WIHART, LINKTYPE_WIHART },
/* Fibre Channel FC-2 frames without SOF or EOF */
{ DLT_FC_2, LINKTYPE_FC_2 },
/* Fibre Channel FC-2 frames with SOF and EOF */
{ DLT_FC_2_WITH_FRAME_DELIMS, LINKTYPE_FC_2_WITH_FRAME_DELIMS },
/* Solaris IPNET */
{ DLT_IPNET, LINKTYPE_IPNET },
/* CAN frames with SocketCAN headers */
{ DLT_CAN_SOCKETCAN, LINKTYPE_CAN_SOCKETCAN },
/* Raw IPv4/IPv6 */
{ DLT_IPV4, LINKTYPE_IPV4 },
{ DLT_IPV6, LINKTYPE_IPV6 },
{ -1, -1 }
};
@ -1082,6 +922,15 @@ dlt_to_linktype(int dlt)
{
int i;
/*
* Map the values in the matching range.
*/
if (dlt >= DLT_MATCHING_MIN && dlt <= DLT_MATCHING_MAX)
return (dlt);
/*
* Map the values outside that range.
*/
for (i = 0; map[i].dlt != -1; i++) {
if (map[i].dlt == dlt)
return (map[i].linktype);
@ -1089,8 +938,8 @@ dlt_to_linktype(int dlt)
/*
* If we don't have a mapping for this DLT_ code, return an
* error; that means that the table above needs to have an
* entry added.
* error; that means that this is a value with no corresponding
* LINKTYPE_ code, and we need to assign one.
*/
return (-1);
}
@ -1100,6 +949,16 @@ linktype_to_dlt(int linktype)
{
int i;
/*
* Map the values in the matching range.
*/
if (linktype >= LINKTYPE_MATCHING_MIN &&
linktype <= LINKTYPE_MATCHING_MAX)
return (linktype);
/*
* Map the values outside that range.
*/
for (i = 0; map[i].linktype != -1; i++) {
if (map[i].linktype == linktype)
return (map[i].dlt);
@ -1127,33 +986,72 @@ swap_linux_usb_header(const struct pcap_pkthdr *hdr, u_char *buf,
int header_len_64_bytes)
{
pcap_usb_header_mmapped *uhdr = (pcap_usb_header_mmapped *)buf;
bpf_u_int32 offset = 0;
usb_isodesc *pisodesc;
int32_t numdesc, i;
/*
* "offset" is the offset *past* the field we're swapping;
* we skip the field *before* checking to make sure
* the captured data length includes the entire field.
*/
/*
* The URB id is a totally opaque value; do we really need to
* convert it to the reading host's byte order???
*/
if (hdr->caplen < 8)
offset += 8; /* skip past id */
if (hdr->caplen < offset)
return;
uhdr->id = SWAPLL(uhdr->id);
if (hdr->caplen < 14)
offset += 4; /* skip past various 1-byte fields */
offset += 2; /* skip past bus_id */
if (hdr->caplen < offset)
return;
uhdr->bus_id = SWAPSHORT(uhdr->bus_id);
if (hdr->caplen < 24)
offset += 2; /* skip past various 1-byte fields */
offset += 8; /* skip past ts_sec */
if (hdr->caplen < offset)
return;
uhdr->ts_sec = SWAPLL(uhdr->ts_sec);
if (hdr->caplen < 28)
offset += 4; /* skip past ts_usec */
if (hdr->caplen < offset)
return;
uhdr->ts_usec = SWAPLONG(uhdr->ts_usec);
if (hdr->caplen < 32)
offset += 4; /* skip past status */
if (hdr->caplen < offset)
return;
uhdr->status = SWAPLONG(uhdr->status);
if (hdr->caplen < 36)
offset += 4; /* skip past urb_len */
if (hdr->caplen < offset)
return;
uhdr->urb_len = SWAPLONG(uhdr->urb_len);
if (hdr->caplen < 40)
offset += 4; /* skip past data_len */
if (hdr->caplen < offset)
return;
uhdr->data_len = SWAPLONG(uhdr->data_len);
if (uhdr->transfer_type == URB_ISOCHRONOUS) {
offset += 4; /* skip past s.iso.error_count */
if (hdr->caplen < offset)
return;
uhdr->s.iso.error_count = SWAPLONG(uhdr->s.iso.error_count);
offset += 4; /* skip past s.iso.numdesc */
if (hdr->caplen < offset)
return;
uhdr->s.iso.numdesc = SWAPLONG(uhdr->s.iso.numdesc);
} else
offset += 8; /* skip USB setup header */
if (header_len_64_bytes) {
/*
* This is either the "version 1" header, with
@ -1163,17 +1061,50 @@ swap_linux_usb_header(const struct pcap_pkthdr *hdr, u_char *buf,
* at the end. Byte swap them as if this were
* a "version 1" header.
*/
if (hdr->caplen < 52)
offset += 4; /* skip past interval */
if (hdr->caplen < offset)
return;
uhdr->interval = SWAPLONG(uhdr->interval);
if (hdr->caplen < 56)
offset += 4; /* skip past start_frame */
if (hdr->caplen < offset)
return;
uhdr->start_frame = SWAPLONG(uhdr->start_frame);
if (hdr->caplen < 60)
offset += 4; /* skip past xfer_flags */
if (hdr->caplen < offset)
return;
uhdr->xfer_flags = SWAPLONG(uhdr->xfer_flags);
if (hdr->caplen < 64)
offset += 4; /* skip past ndesc */
if (hdr->caplen < offset)
return;
uhdr->ndesc = SWAPLONG(uhdr->ndesc);
}
if (uhdr->transfer_type == URB_ISOCHRONOUS) {
/* swap the values in struct linux_usb_isodesc */
pisodesc = (usb_isodesc *)(void *)(buf+offset);
numdesc = uhdr->s.iso.numdesc;
for (i = 0; i < numdesc; i++) {
offset += 4; /* skip past status */
if (hdr->caplen < offset)
return;
pisodesc->status = SWAPLONG(pisodesc->status);
offset += 4; /* skip past offset */
if (hdr->caplen < offset)
return;
pisodesc->offset = SWAPLONG(pisodesc->offset);
offset += 4; /* skip past len */
if (hdr->caplen < offset)
return;
pisodesc->len = SWAPLONG(pisodesc->len);
offset += 4; /* skip past padding */
pisodesc++;
}
}
}

31
pcap-config.in
View File

@ -4,6 +4,13 @@
# Script to give the appropriate compiler flags and linker flags
# to use when building code that uses libpcap.
#
prefix="@prefix@"
exec_prefix="@exec_prefix@"
includedir="@includedir@"
libdir="@libdir@"
V_RPATH_OPT="@V_RPATH_OPT@"
LIBS="@LIBS@"
static=0
show_cflags=0
show_libs=0
@ -29,14 +36,14 @@ do
esac
shift
done
if [ "@V_RPATH_OPT@" != "" ]
if [ "$V_RPATH_OPT" != "" ]
then
#
# If libdir isn't /usr/lib, add it to the run-time linker path.
#
if [ "@libdir@" != "/usr/lib" ]
if [ "$libdir" != "/usr/lib" ]
then
RPATH=@V_RPATH_OPT@@libdir@
RPATH=$V_RPATH_OPT$libdir
fi
fi
if [ "$static" = 1 ]
@ -47,19 +54,19 @@ then
#
if [ "$show_cflags" = 1 -a "$show_libs" = 1 ]
then
echo "-I@includedir@ -L@libdir@ -lpcap @LIBS@"
echo "-I$includedir -L$libdir -lpcap $LIBS"
elif [ "$show_cflags" = 1 -a "$show_additional_libs" = 1 ]
then
echo "-I@includedir@ -L@libdir@ @LIBS@"
echo "-I$includedir -L$libdir $LIBS"
elif [ "$show_cflags" = 1 ]
then
echo "-I@includedir@"
echo "-I$includedir"
elif [ "$show_libs" = 1 ]
then
echo "-L@libdir@ -lpcap @LIBS@"
echo "-L$libdir -lpcap $LIBS"
elif [ "$show_additional_libs" = 1 ]
then
echo "@LIBS@"
echo "$LIBS"
fi
else
#
@ -68,15 +75,15 @@ else
#
if [ "$show_cflags" = 1 -a "$show_libs" = 1 ]
then
echo "-I@includedir@ -L@libdir@ $RPATH -lpcap"
echo "-I$includedir -L$libdir $RPATH -lpcap"
elif [ "$show_cflags" = 1 -a "$show_additional_libs" = 1 ]
then
echo "-I@includedir@"
echo "-I$includedir"
elif [ "$show_cflags" = 1 ]
then
echo "-I@includedir@"
echo "-I$includedir"
elif [ "$show_libs" = 1 ]
then
echo "-L@libdir@ $RPATH -lpcap"
echo "-L$libdir $RPATH -lpcap"
fi
fi

11
pcap-dag.c
View File

@ -879,8 +879,8 @@ dag_platform_finddevs(pcap_if_t **devlistp, char *errbuf)
int dagstream;
int dagfd;
/* Try all the DAGs 0-9 */
for (c = 0; c < 9; c++) {
/* Try all the DAGs 0-31 */
for (c = 0; c < 32; c++) {
snprintf(name, 12, "dag%d", c);
if (-1 == dag_parse_name(name, dagname, DAGNAME_BUFSIZE, &dagstream))
{
@ -897,7 +897,7 @@ dag_platform_finddevs(pcap_if_t **devlistp, char *errbuf)
{
int stream, rxstreams;
rxstreams = dag_rx_get_stream_count(dagfd);
for(stream=0;stream<16;stream+=2) {
for(stream=0;stream<DAG_STREAM_MAX;stream+=2) {
if (0 == dag_attach_stream(dagfd, stream, 0, 0)) {
dag_detach_stream(dagfd, stream);
@ -908,6 +908,11 @@ dag_platform_finddevs(pcap_if_t **devlistp, char *errbuf)
*/
ret = -1;
}
rxstreams--;
if(rxstreams <= 0) {
break;
}
}
}
}

103
pcap-dlpi.c
View File

@ -143,10 +143,9 @@ static int dl_doattach(int, int, char *);
#ifdef DL_HP_RAWDLS
static int dl_dohpuxbind(int, char *);
#endif
static int dlattachreq(int, bpf_u_int32, char *);
static int dlpromiscon(pcap_t *, bpf_u_int32);
static int dlbindreq(int, bpf_u_int32, char *);
static int dlbindack(int, char *, char *, int *);
static int dlpromisconreq(int, bpf_u_int32, char *);
static int dlokack(int, const char *, char *, char *);
static int dlinforeq(int, char *);
static int dlinfoack(int, char *, char *);
@ -450,7 +449,7 @@ pcap_activate_dlpi(pcap_t *p)
/* Try device without unit number */
if ((p->fd = open(dname, O_RDWR)) < 0) {
if (errno != ENOENT) {
if (errno == EACCES)
if (errno == EPERM || errno == EACCES)
status = PCAP_ERROR_PERM_DENIED;
snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "%s: %s", dname,
pcap_strerror(errno));
@ -486,7 +485,7 @@ pcap_activate_dlpi(pcap_t *p)
snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
"%s: No DLPI device found", p->opt.source);
} else {
if (errno == EACCES)
if (errno == EPERM || errno == EACCES)
status = PCAP_ERROR_PERM_DENIED;
snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "%s: %s",
dname2, pcap_strerror(errno));
@ -610,9 +609,12 @@ pcap_activate_dlpi(pcap_t *p)
/*
** Enable promiscuous (not necessary on send FD)
*/
if (dlpromisconreq(p->fd, DL_PROMISC_PHYS, p->errbuf) < 0 ||
dlokack(p->fd, "promisc_phys", (char *)buf, p->errbuf) < 0)
status = dlpromiscon(p, DL_PROMISC_PHYS);
if (status < 0) {
if (status == PCAP_ERROR_PERM_DENIED)
status = PCAP_ERROR_PROMISC_PERM_DENIED;
goto bad;
}
/*
** Try to enable multicast (you would have thought
@ -620,8 +622,8 @@ pcap_activate_dlpi(pcap_t *p)
** HP-UX or SINIX) (Not necessary on send FD)
*/
#if !defined(__hpux) && !defined(sinix)
if (dlpromisconreq(p->fd, DL_PROMISC_MULTI, p->errbuf) < 0 ||
dlokack(p->fd, "promisc_multi", (char *)buf, p->errbuf) < 0)
status = dlpromiscon(p, DL_PROMISC_MULTI);
if (status < 0)
status = PCAP_WARNING;
#endif
}
@ -631,20 +633,27 @@ pcap_activate_dlpi(pcap_t *p)
** under SINIX) (Not necessary on send FD)
*/
#ifndef sinix
if (
#ifdef __hpux
!p->opt.promisc &&
#if defined(__hpux)
/* HP-UX - only do this when not in promiscuous mode */
if (!p->opt.promisc) {
#elif defined(HAVE_SOLARIS)
/* Solaris - don't do this on SunATM devices */
if (!isatm) {
#else
/* Everything else (except for SINIX) - always do this */
{
#endif
#ifdef HAVE_SOLARIS
!isatm &&
#endif
(dlpromisconreq(p->fd, DL_PROMISC_SAP, p->errbuf) < 0 ||
dlokack(p->fd, "promisc_sap", (char *)buf, p->errbuf) < 0)) {
/* Not fatal if promisc since the DL_PROMISC_PHYS worked */
if (p->opt.promisc)
status = PCAP_WARNING;
else
goto bad;
status = dlpromiscon(p, DL_PROMISC_SAP);
if (status < 0) {
/*
* Not fatal, since the DL_PROMISC_PHYS mode worked.
* Report it as a warning, however.
*/
if (p->opt.promisc)
status = PCAP_WARNING;
else
goto bad;
}
}
#endif /* sinix */
@ -815,11 +824,15 @@ split_dname(char *device, int *unitp, char *ebuf)
static int
dl_doattach(int fd, int ppa, char *ebuf)
{
dl_attach_req_t req;
bpf_u_int32 buf[MAXDLBUF];
int err;
if (dlattachreq(fd, ppa, ebuf) < 0)
req.dl_primitive = DL_ATTACH_REQ;
req.dl_ppa = ppa;
if (send_request(fd, (char *)&req, sizeof(req), "attach", ebuf) < 0)
return (PCAP_ERROR);
err = dlokack(fd, "attach", (char *)buf, ebuf);
if (err < 0)
return (err);
@ -877,6 +890,27 @@ dl_dohpuxbind(int fd, char *ebuf)
}
#endif
#define STRINGIFY(n) #n
static int
dlpromiscon(pcap_t *p, bpf_u_int32 level)
{
dl_promiscon_req_t req;
bpf_u_int32 buf[MAXDLBUF];
int err;
req.dl_primitive = DL_PROMISCON_REQ;
req.dl_level = level;
if (send_request(p->fd, (char *)&req, sizeof(req), "promiscon",
p->errbuf) < 0)
return (PCAP_ERROR);
err = dlokack(p->fd, "promiscon" STRINGIFY(level), (char *)buf,
p->errbuf);
if (err < 0)
return (err);
return (0);
}
int
pcap_platform_finddevs(pcap_if_t **alldevsp, char *errbuf)
{
@ -986,7 +1020,8 @@ recv_ack(int fd, int size, const char *what, char *bufp, char *ebuf, int *uerror
snprintf(ebuf, PCAP_ERRBUF_SIZE,
"recv_ack: %s: UNIX error - %s",
what, pcap_strerror(dlp->error_ack.dl_unix_errno));
if (dlp->error_ack.dl_unix_errno == EACCES)
if (dlp->error_ack.dl_unix_errno == EPERM ||
dlp->error_ack.dl_unix_errno == EACCES)
return (PCAP_ERROR_PERM_DENIED);
break;
@ -1221,17 +1256,6 @@ dlprim(bpf_u_int32 prim)
}
}
static int
dlattachreq(int fd, bpf_u_int32 ppa, char *ebuf)
{
dl_attach_req_t req;
req.dl_primitive = DL_ATTACH_REQ;
req.dl_ppa = ppa;
return (send_request(fd, (char *)&req, sizeof(req), "attach", ebuf));
}
static int
dlbindreq(int fd, bpf_u_int32 sap, char *ebuf)
{
@ -1259,17 +1283,6 @@ dlbindack(int fd, char *bufp, char *ebuf, int *uerror)
return (recv_ack(fd, DL_BIND_ACK_SIZE, "bind", bufp, ebuf, uerror));
}
static int
dlpromisconreq(int fd, bpf_u_int32 level, char *ebuf)
{
dl_promiscon_req_t req;
req.dl_primitive = DL_PROMISCON_REQ;
req.dl_level = level;
return (send_request(fd, (char *)&req, sizeof(req), "promiscon", ebuf));
}
static int
dlokack(int fd, const char *what, char *bufp, char *ebuf)
{

15
pcap-filter.manmisc.in
View File

@ -65,6 +65,8 @@ Possible directions are
.BR dst ,
.BR "src or dst" ,
.BR "src and dst" ,
.BR ra ,
.BR ta ,
.BR addr1 ,
.BR addr2 ,
.BR addr3 ,
@ -76,6 +78,8 @@ there is no dir qualifier,
.B "src or dst"
is assumed.
The
.BR ra ,
.BR ta ,
.BR addr1 ,
.BR addr2 ,
.BR addr3 ,
@ -472,6 +476,15 @@ and
.B scrub
(applies only to packets logged by OpenBSD's or FreeBSD's
.BR pf (4)).
.IP "\fBwlan ra \fIehost\fR"
True if the IEEE 802.11 RA is
.IR ehost .
The RA field is used in all frames except for management frames.
.IP "\fBwlan ta \fIehost\fR"
True if the IEEE 802.11 TA is
.IR ehost .
The TA field is used in all frames except for management frames and
CTS (Clear To Send) and ACK (Acknowledgment) control frames.
.IP "\fBwlan addr1 \fIehost\fR"
True if the first IEEE 802.11 address is
.IR ehost .
@ -490,7 +503,7 @@ True if the fourth IEEE 802.11 address, if present, is
.IR ehost .
The fourth address field is only used for
WDS (Wireless Distribution System) frames.
.IP "\fBip\fR, \fBip6\fR, \fBarp\fR, \fBrarp\fR, \fBatalk\fR, \fBaarp\fR, \fBdecnet\fR, \fBiso\fR, \fBstp\fR, \fBipx\fR, \fInetbeui\fP"
.IP "\fBip\fR, \fBip6\fR, \fBarp\fR, \fBrarp\fR, \fBatalk\fR, \fBaarp\fR, \fBdecnet\fR, \fBiso\fR, \fBstp\fR, \fBipx\fR, \fBnetbeui\fP"
Abbreviations for:
.in +.5i
.nf

3
pcap-int.h
View File

@ -209,6 +209,7 @@ struct pcap_opt {
char *source;
int promisc;
int rfmon;
int tstamp_type;
};
/*
@ -331,6 +332,8 @@ struct pcap {
char errbuf[PCAP_ERRBUF_SIZE + 1];
int dlt_count;
u_int *dlt_list;
int tstamp_type_count;
u_int *tstamp_type_list;
struct pcap_pkthdr pcap_header; /* This is needed for the pcap_next_ex() to work */
};

72
pcap-libdlpi.c
View File

@ -49,6 +49,7 @@ static const char rcsid[] _U_ =
#include "dlpisubs.h"
/* Forwards. */
static int dlpromiscon(pcap_t *, bpf_u_int32);
static int pcap_read_libdlpi(pcap_t *, int, pcap_handler, u_char *);
static int pcap_inject_libdlpi(pcap_t *, const void *, size_t);
static void pcap_close_libdlpi(pcap_t *);
@ -114,7 +115,8 @@ pcap_activate_libdlpi(pcap_t *p)
if (retv != DLPI_SUCCESS) {
if (retv == DLPI_ELINKNAMEINVAL || retv == DLPI_ENOLINK)
err = PCAP_ERROR_NO_SUCH_DEVICE;
else if (retv == DL_SYSERR && errno == EACCES)
else if (retv == DL_SYSERR &&
(errno == EPERM || errno == EACCES))
err = PCAP_ERROR_PERM_DENIED;
pcap_libdlpi_err(p->opt.source, "dlpi_open", retv,
p->errbuf);
@ -139,34 +141,43 @@ pcap_activate_libdlpi(pcap_t *p)
/* Enable promiscuous mode. */
if (p->opt.promisc) {
retv = dlpi_promiscon(p->dlpi_hd, DL_PROMISC_PHYS);
if (retv != DLPI_SUCCESS) {
pcap_libdlpi_err(p->opt.source,
"dlpi_promisc(PHYSICAL)", retv, p->errbuf);
err = dlpromiscon(p, DL_PROMISC_PHYS);
if (err < 0) {
/*
* "You don't have permission to capture on
* this device" and "you don't have permission
* to capture in promiscuous mode on this
* device" are different; let the user know,
* so if they can't get permission to
* capture in promiscuous mode, they can at
* least try to capture in non-promiscuous
* mode.
*
* XXX - you might have to capture in
* promiscuous mode to see outgoing packets.
*/
if (err == PCAP_ERROR_PERM_DENIED)
err = PCAP_ERROR_PROMISC_PERM_DENIED;
goto bad;
}
} else {
/* Try to enable multicast. */
retv = dlpi_promiscon(p->dlpi_hd, DL_PROMISC_MULTI);
if (retv != DLPI_SUCCESS) {
pcap_libdlpi_err(p->opt.source, "dlpi_promisc(MULTI)",
retv, p->errbuf);
err = dlpromiscon(p, DL_PROMISC_MULTI);
if (err < 0)
goto bad;
}
}
/* Try to enable SAP promiscuity. */
retv = dlpi_promiscon(p->dlpi_hd, DL_PROMISC_SAP);
if (retv != DLPI_SUCCESS) {
if (p->opt.promisc) {
pcap_libdlpi_err(p->opt.source, "dlpi_promisc(SAP)",
retv, p->errbuf);
err = dlpromiscon(p, DL_PROMISC_SAP);
if (err < 0) {
/*
* Not fatal, since the DL_PROMISC_PHYS mode worked.
* Report it as a warning, however.
*/
if (p->opt.promisc)
err = PCAP_WARNING;
else
goto bad;
}
/* Not fatal, since the DL_PROMISC_PHYS mode worked. */
fprintf(stderr, "WARNING: dlpi_promisc(SAP) failed on"
" %s:(%s)\n", p->opt.source, dlpi_strerror(retv));
}
/* Determine link type. */
@ -219,6 +230,27 @@ pcap_activate_libdlpi(pcap_t *p)
return (err);
}
#define STRINGIFY(n) #n
static int
dlpromiscon(pcap_t *p, bpf_u_int32 level)
{
int err;
retv = dlpi_promiscon(p->hd, level);
if (retv != DLPI_SUCCESS) {
if (retv == DL_SYSERR &&
(errno == EPERM || errno == EACCES))
err = PCAP_ERROR_PERM_DENIED;
else
err = PCAP_ERROR;
pcap_libdlpi_err(p->opt.source, "dlpi_promiscon" STRINGIFY(level),
retv, p->errbuf);
return (err);
}
return (0);
}
/*
* In Solaris, the "standard" mechanism" i.e SIOCGLIFCONF will only find
* network links that are plumbed and are up. dlpi_walk(3DLPI) will find

238
pcap-linktype.manmisc.in
View File

@ -44,241 +44,7 @@ by
The names for those values begin with
.BR LINKTYPE_ .
.PP
The link-layer header types supported by libpcap are listed here. The
value corresponding to
.B LINKTYPE_
names are given; the value corresponding to
.B DLT_
values are, in some cases, platform dependent, and are not given;
applications should check for particular
.B DLT_
values by name.
.RS 5
.TP 5
.BR DLT_NULL "; " LINKTYPE_NULL = 0
BSD loopback encapsulation; the link-layer header is a 4-byte field, in
.I host
byte order, containing a PF_ value from
.B socket.h
for the network-layer protocol of the packet.
.IP
Note that ``host byte order'' is the byte order of the machine on which
the packets are captured, and the PF_ values are for the OS of the
machine on which the packets are captured; if a live capture is being
done, ``host byte order'' is the byte order of the machine capturing the
packets, and the PF_ values are those of the OS of the machine capturing
the packets, but if a ``savefile'' is being read, the byte order and PF_
values are
.I not
necessarily those of the machine reading the capture file.
.TP 5
.BR DLT_EN10MB "; " LINKTYPE_ETHERNET = 1
Ethernet (10Mb, 100Mb, 1000Mb, and up); the
.B 10MB
in the
.B DLT_
name is historical.
.TP 5
.BR DLT_IEEE802 "; " LINKTYPE_TOKEN_RING = 6
IEEE 802.5 Token Ring; the
.B IEEE802
in the
.B DLT_
name is historical.
.TP 5
.BR DLT_ARCNET "; " LINKTYPE_ARCNET = 7
ARCNET
.TP 5
.BR DLT_SLIP "; " LINKTYPE_SLIP = 8
SLIP; the link-layer header contains, in order:
.RS 10
.LP
a 1-byte flag, which is 0 for packets received by the machine and 1 for
packets sent by the machine;
.LP
a 1-byte field, the upper 4 bits of which indicate the type of packet,
as per RFC 1144:
.RS 5
.TP 5
0x40
an unmodified IP datagram (TYPE_IP);
.TP 5
0x70
an uncompressed-TCP IP datagram (UNCOMPRESSED_TCP), with that byte being
the first byte of the raw IP header on the wire, containing the
connection number in the protocol field;
.TP 5
0x80
a compressed-TCP IP datagram (COMPRESSED_TCP), with that byte being the
first byte of the compressed TCP/IP datagram header;
.RE
.LP
for UNCOMPRESSED_TCP, the rest of the modified IP header, and for
COMPRESSED_TCP, the compressed TCP/IP datagram header;
.RE
.RS 5
.LP
for a total of 16 bytes; the uncompressed IP datagram follows the header.
.RE
.TP 5
.BR DLT_PPP "; " LINKTYPE_PPP = 9
PPP; if the first 2 bytes are 0xff and 0x03, it's PPP in HDLC-like
framing, with the PPP header following those two bytes, otherwise it's
PPP without framing, and the packet begins with the PPP header.
.TP 5
.BR DLT_FDDI "; " LINKTYPE_FDDI = 10
FDDI
.TP 5
.BR DLT_ATM_RFC1483 "; " LINKTYPE_ATM_RFC1483 = 100
RFC 1483 LLC/SNAP-encapsulated ATM; the packet begins with an IEEE 802.2
LLC header.
.TP 5
.BR DLT_RAW "; " LINKTYPE_RAW = 101
raw IP; the packet begins with an IP header.
.TP 5
.BR DLT_PPP_SERIAL "; " LINKTYPE_PPP_HDLC = 50
PPP in HDLC-like framing, as per RFC 1662, or Cisco PPP with HDLC
framing, as per section 4.3.1 of RFC 1547; the first byte will be 0xFF
for PPP in HDLC-like framing, and will be 0x0F or 0x8F for Cisco PPP
with HDLC framing.
.TP 5
.BR DLT_PPP_ETHER "; " LINKTYPE_PPP_ETHER = 51
PPPoE; the packet begins with a PPPoE header, as per RFC 2516.
.TP 5
.BR DLT_C_HDLC "; " LINKTYPE_C_HDLC = 104
Cisco PPP with HDLC framing, as per section 4.3.1 of RFC 1547.
.TP 5
.BR DLT_IEEE802_11 "; " LINKTYPE_IEEE802_11 = 105
IEEE 802.11 wireless LAN
.TP 5
.BR DLT_FRELAY "; " LINKTYPE_FRELAY = 107
Frame Relay
.TP 5
.BR DLT_LOOP "; " LINKTYPE_LOOP = 108
OpenBSD loopback encapsulation; the link-layer header is a 4-byte field, in
.I network
byte order, containing a PF_ value from OpenBSD's
.B socket.h
for the network-layer protocol of the packet.
.IP
Note that, if a ``savefile'' is being read, those PF_ values are
.I not
necessarily those of the machine reading the capture file.
.TP 5
.BR DLT_LINUX_SLL "; " LINKTYPE_LINUX_SLL = 113
Linux "cooked" capture encapsulation; the link-layer header contains, in
order:
.RS 10
.LP
a 2-byte "packet type", in network byte order, which is one of:
.RS 5
.TP 5
0
packet was sent to us by somebody else
.TP 5
1
packet was broadcast by somebody else
.TP 5
2
packet was multicast, but not broadcast, by somebody else
.TP 5
3
packet was sent by somebody else to somebody else
.TP 5
4
packet was sent by us
.RE
.LP
a 2-byte field, in network byte order, containing a Linux ARPHRD_ value
for the link-layer device type;
.LP
a 2-byte field, in network byte order, containing the length of the
link-layer address of the sender of the packet (which could be 0);
.LP
an 8-byte field containing that number of bytes of the link-layer
address of the sender (if there are more than 8 bytes, only the first
8 are present, and if there are fewer than 8 bytes, there are padding
bytes after the address to pad the field to 8 bytes);
.LP
a 2-byte field containing an Ethernet protocol type, in network byte
order, or containing 1 for Novell 802.3 frames without an 802.2 LLC
header or 4 for frames beginning with an 802.2 LLC header.
.RE
.TP 5
.BR DLT_LTALK "; " LINKTYPE_LTALK = 104
Apple LocalTalk; the packet begins with an AppleTalk LLAP header.
.TP 5
.BR DLT_PFLOG "; " LINKTYPE_PFLOG = 117
OpenBSD pflog; the link-layer header contains a
.B "struct pfloghdr"
structure, as defined by the host on which the file was saved. (This
differs from operating system to operating system and release to
release; there is nothing in the file to indicate what the layout of
that structure is.)
.TP 5
.BR DLT_PRISM_HEADER "; " LINKTYPE_PRISM_HEADER = 119
Prism monitor mode information followed by an 802.11 header.
.TP 5
.BR DLT_IP_OVER_FC "; " LINKTYPE_IP_OVER_FC = 122
RFC 2625 IP-over-Fibre Channel, with the link-layer header being the
Network_Header as described in that RFC.
.TP 5
.BR DLT_SUNATM "; " LINKTYPE_SUNATM = 123
SunATM devices; the link-layer header contains, in order:
.RS 10
.LP
a 1-byte flag field, containing a direction flag in the uppermost bit,
which is set for packets transmitted by the machine and clear for
packets received by the machine, and a 4-byte traffic type in the
low-order 4 bits, which is one of:
.RS 5
.TP 5
0
raw traffic
.TP 5
1
LANE traffic
.TP 5
2
LLC-encapsulated traffic
.TP 5
3
MARS traffic
.TP 5
4
IFMP traffic
.TP 5
5
ILMI traffic
.TP 5
6
Q.2931 traffic
.RE
.LP
a 1-byte VPI value;
.LP
a 2-byte VCI field, in network byte order.
.RE
.TP 5
.BR DLT_IEEE802_11_RADIO "; " LINKTYPE_IEEE802_11_RADIO = 127
link-layer information followed by an 802.11 header - see
http://www.shaftnet.org/~pizza/software/capturefrm.txt for a description
of the link-layer information.
.TP 5
.BR DLT_ARCNET_LINUX "; " LINKTYPE_ARCNET_LINUX = 129
ARCNET, with no exception frames, reassembled packets rather than raw
frames, and an extra 16-bit offset field between the destination host
and type bytes.
.TP 5
.BR DLT_LINUX_IRDA "; " LINKTYPE_LINUX_IRDA = 144
Linux-IrDA packets, with a
.B DLT_LINUX_SLL
header followed by the IrLAP header.
.TP 5
.BR DLT_LINUX_LAPD "; " LINKTYPE_LINUX_LAPD = 177
LAPD (Q.921) frames, with a
.B DLT_LINUX_SLL
header captured via vISDN.
.RE
The link-layer header types supported by libpcap are described at
http://www.tcpdump.org/linktypes.html.
.SH SEE ALSO
pcap_datalink(3PCAP)

1368
pcap-linux.c
View File

File diff suppressed because it is too large Load Diff

7
pcap-stdinc.h
View File

@ -33,13 +33,6 @@
#ifndef pcap_stdinc_h
#define pcap_stdinc_h
#define SIZEOF_CHAR 1
#define SIZEOF_SHORT 2
#define SIZEOF_INT 4
#ifndef _MSC_EXTENSIONS
#define SIZEOF_LONG_LONG 8
#endif
/*
* Avoids a compiler warning in case this was already defined
* (someone defined _WINSOCKAPI_ when including 'windows.h', in order

51
pcap-usb-linux.c
View File

@ -61,8 +61,15 @@ static const char rcsid[] _U_ =
#include <sys/ioctl.h>
#include <sys/mman.h>
#ifdef HAVE_LINUX_USBDEVICE_FS_H
/*
* We might need <linux/compiler.h> to define __user for
* <linux/usbdevice_fs.h>.
*/
#ifdef HAVE_LINUX_COMPILER_H
#include <linux/compiler.h>
#endif /* HAVE_LINUX_COMPILER_H */
#include <linux/usbdevice_fs.h>
#endif
#endif /* HAVE_LINUX_USBDEVICE_FS_H */
#define USB_IFACE "usbmon"
#define USB_TEXT_DIR_OLD "/sys/kernel/debug/usbmon"
@ -122,7 +129,6 @@ static int usb_read_linux(pcap_t *, int , pcap_handler , u_char *);
static int usb_read_linux_bin(pcap_t *, int , pcap_handler , u_char *);
static int usb_read_linux_mmap(pcap_t *, int , pcap_handler , u_char *);
static int usb_inject_linux(pcap_t *, const void *, size_t);
static int usb_setfilter_linux(pcap_t *, struct bpf_program *);
static int usb_setdirection_linux(pcap_t *, pcap_direction_t);
static void usb_cleanup_linux_mmap(pcap_t *);
@ -301,7 +307,7 @@ usb_activate(pcap_t* handle)
handle->linktype = DLT_USB_LINUX;
handle->inject_op = usb_inject_linux;
handle->setfilter_op = usb_setfilter_linux;
handle->setfilter_op = install_bpf_program; /* no kernel filtering */
handle->setdirection_op = usb_setdirection_linux;
handle->set_datalink_op = NULL; /* can't change data link type */
handle->getnonblock_op = pcap_getnonblock_fd;
@ -597,12 +603,17 @@ usb_read_linux(pcap_t *handle, int max_packets, pcap_handler callback, u_char *u
got:
uhdr->data_len = data_len;
handle->md.packets_read++;
if (pkth.caplen > handle->snapshot)
pkth.caplen = handle->snapshot;
callback(user, &pkth, handle->buffer);
return 1;
if (handle->fcode.bf_insns == NULL ||
bpf_filter(handle->fcode.bf_insns, handle->buffer,
pkth.len, pkth.caplen)) {
handle->md.packets_read++;
callback(user, &pkth, handle->buffer);
return 1;
}
return 0; /* didn't pass filter */
}
static int
@ -688,12 +699,6 @@ usb_stats_linux(pcap_t *handle, struct pcap_stat *stats)
return 0;
}
static int
usb_setfilter_linux(pcap_t *p, struct bpf_program *fp)
{
return 0;
}
static int
usb_setdirection_linux(pcap_t *p, pcap_direction_t d)
{
@ -767,9 +772,15 @@ usb_read_linux_bin(pcap_t *handle, int max_packets, pcap_handler callback, u_cha
pkth.ts.tv_sec = info.hdr->ts_sec;
pkth.ts.tv_usec = info.hdr->ts_usec;
handle->md.packets_read++;
callback(user, &pkth, handle->buffer);
return 1;
if (handle->fcode.bf_insns == NULL ||
bpf_filter(handle->fcode.bf_insns, handle->buffer,
pkth.len, pkth.caplen)) {
handle->md.packets_read++;
callback(user, &pkth, handle->buffer);
return 1;
}
return 0; /* didn't pass filter */
}
/*
@ -841,9 +852,13 @@ usb_read_linux_mmap(pcap_t *handle, int max_packets, pcap_handler callback, u_ch
pkth.ts.tv_sec = hdr->ts_sec;
pkth.ts.tv_usec = hdr->ts_usec;
handle->md.packets_read++;
callback(user, &pkth, (u_char*) hdr);
packets++;
if (handle->fcode.bf_insns == NULL ||
bpf_filter(handle->fcode.bf_insns, (u_char*) hdr,
pkth.len, pkth.caplen)) {
handle->md.packets_read++;
callback(user, &pkth, (u_char*) hdr);
packets++;
}
}
/* with max_packets <= 0 we stop afer the first chunk*/

7
pcap-win32.c
View File

@ -39,7 +39,12 @@ static const char rcsid[] _U_ =
#include <pcap-int.h>
#include <Packet32.h>
#ifdef __MINGW32__
#ifdef __MINGW64__
#include <ntddndis.h>
#else /*__MINGW64__*/
#include <ddk/ntddndis.h>
#include <ddk/ndis.h>
#endif /*__MINGW64__*/
#else /*__MINGW32__*/
#include <ntddndis.h>
#endif /*__MINGW32__*/
@ -232,7 +237,7 @@ pcap_read_win32_npf(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
* XXX A bpf_hdr matches a pcap_pkthdr.
*/
(*callback)(user, (struct pcap_pkthdr*)bp, bp + hdrlen);
bp += BPF_WORDALIGN(caplen + hdrlen);
bp += Packet_WORDALIGN(caplen + hdrlen);
if (++n >= cnt && cnt > 0) {
p->bp = bp;
p->cc = ep - bp;

569
pcap.3pcap.in
View File

@ -37,22 +37,51 @@ on the network, even those destined for other hosts, are accessible
through this mechanism.
It also supports saving captured packets to a ``savefile'', and reading
packets from a ``savefile''.
.PP
To open a handle for a live capture, call
.BR pcap_create() ,
.SS Opening a capture handle for reading
To open a handle for a live capture, given the name of the network or
other interface on which the capture should be done, call
.BR pcap_create (),
set the appropriate options on the handle, and then activate it with
.BR pcap_activate() .
To open a handle for a ``savefile'' with captured packets, call
.BR pcap_open_offline() .
Both
.B pcap_create()
.BR pcap_activate ().
.PP
To obtain a list of devices that can be opened for a live capture, call
.BR pcap_findalldevs ();
to free the list returned by
.BR pcap_findalldevs (),
call
.BR pcap_freealldevs ().
.BR pcap_lookupdev ()
will return the first device on that list that is not a ``loopback``
network interface.
.PP
To open a handle for a ``savefile'' from which to read packets, given the
pathname of the ``savefile'', call
.BR pcap_open_offline ();
to set up a handle for a ``savefile'', given a
.B "FILE\ *"
referring to a file already opened for reading, call
.BR pcap_fopen_offline ().
.PP
In order to get a ``fake''
.B pcap_t
for use in routines that require a
.B pcap_t
as an argument, such as routines to open a ``savefile'' for writing and
to compile a filter expression, call
.BR pcap_open_dead ().
.PP
.BR pcap_create (),
.BR pcap_open_offline (),
.BR pcap_fopen_offline (),
and
.B pcap_open_offline()
.BR pcap_open_dead ()
return a pointer to a
.BR pcap_t ,
which is the handle used for reading packets from the capture stream or
the ``savefile'', and for finding out information about the capture
stream or ``savefile''.
To close a handle, use
.BR pcap_close ().
.PP
The options that can be set on a capture handle include
.IP "snapshot length"
@ -75,7 +104,7 @@ A snapshot length of 65535 should be sufficient, on most if not all
networks, to capture all the data available from the packet.
.IP
The snapshot length is set with
.BR pcap_set_snaplen() .
.BR pcap_set_snaplen ().
.IP "promiscuous mode"
On broadcast LANs such as Ethernet, if the network isn't switched, or if
the adapter is connected to a "mirror port" on a switch to which all
@ -97,7 +126,7 @@ For now, this doesn't work on the "any" device; if an argument of "any"
or NULL is supplied, the setting of promiscuous mode is ignored.
.IP
Promiscuous mode is set with
.BR pcap_set_promisc() .
.BR pcap_set_promisc ().
.IP "monitor mode"
On IEEE 802.11 wireless LANs, even if an adapter is in promiscuous mode,
it will supply to the host only frames for the network with which it's
@ -118,9 +147,9 @@ if you are capturing in monitor mode and are not connected to another
network with another adapter.
.IP
Monitor mode is set with
.BR pcap_set_rfmon() ,
.BR pcap_set_rfmon (),
and
.B pcap_can_set_rfmon()
.BR pcap_can_set_rfmon ()
can be used to determine whether an adapter can be put into monitor
mode.
.IP "read timeout"
@ -162,7 +191,7 @@ guarantee that a call reading packets will return after the timeout
expires even if no packets have arrived.
.IP
The read timeout is set with
.BR pcap_set_timeout() .
.BR pcap_set_timeout ().
.IP "buffer size"
Packets that arrive for a capture are stored in a buffer, so that they
do not have to be read by the application as soon as they arrive. On
@ -175,7 +204,17 @@ non-pageable operating system memory than is necessary to prevent
packets from being dropped.
.IP
The buffer size is set with
.BR pcap_set_buffer_size() .
.BR pcap_set_buffer_size ().
.IP "timestamp type"
On some platforms, the time stamp given to packets on live captures can
come from different sources that can have different resolutions or that
can have different relationships to the time values for the current time
supplied by routines on the native operating system. See
.BR pcap-tstamp (@MAN_MISC_INFO@)
for a list of time stamp types.
.IP
The time stamp type is set with
.BR pcap_set_tstamp_type ().
.PP
Reading packets from a network interface may require that you have
special privileges:
@ -260,26 +299,193 @@ have to find some other way to make that happen at boot time.
.PP
Reading a saved packet file doesn't require special privileges.
.PP
To open a ``savefile`` to which to write packets, call
.BR pcap_dump_open() .
It returns a pointer to a
.BR pcap_dumper_t ,
which is the handle used for writing packets to the ``savefile''.
The packets read from the handle may include a ``pseudo-header''
containing various forms of packet meta-data, and probably includes a
link-layer header whose contents can differ for different network
interfaces. To determine the format of the packets supplied by the
handle, call
.BR pcap_datalink ();
.I http://www.tcpdump.org/linktypes.html
lists the values it returns and describes the packet formats that
correspond to those values.
.PP
To obtain the
.B "FILE\ *"
corresponding to a
.B pcap_t
opened for a ``savefile'', call
.BR pcap_file ().
.TP
.B Routines
.RS
.TP
.BR pcap_create (3PCAP)
get a
.B pcap_t
for live capture
.TP
.BR pcap_activate (3PCAP)
activate a
.B pcap_t
for live capture
.TP
.BR pcap_findalldevs (3PCAP)
get a list of devices that can be opened for a live capture
.TP
.BR pcap_freealldevs (3PCAP)
free list of devices
.TP
.BR pcap_lookupdev (3PCAP)
get first non-loopback device on that list
.TP
.BR pcap_open_offline (3PCAP)
open a
.B pcap_t
for a ``savefile'', given a pathname
.TP
.BR pcap_fopen_offline (3PCAP)
open a
.B pcap_t
for a ``savefile'', given a
.B "FILE\ *"
.TP
.BR pcap_open_dead (3PCAP)
create a ``fake''
.B pcap_t
.TP
.BR pcap_close (3PCAP)
close a
.B pcap_t
.TP
.BR pcap_set_snaplen (3PCAP)
set the snapshot length for a not-yet-activated
.B pcap_t
for live capture
.TP
.BR pcap_snapshot (3PCAP)
get the snapshot length for a
.B pcap_t
.TP
.BR pcap_set_promisc (3PCAP)
set promiscuous mode for a not-yet-activated
.B pcap_t
for live capture
.TP
.BR pcap_set_rfmon (3PCAP)
set monitor mode for a not-yet-activated
.B pcap_t
for live capture
.TP
.BR pcap_can_set_rfmon (3PCAP)
determine whether monitor mode can be set for a
.B pcap_t
for live capture
.TP
.BR pcap_set_timeout (3PCAP)
set read timeout for a not-yet-activated
.B pcap_t
for live capture
.TP
.BR pcap_set_buffer_size (3PCAP)
set buffer size for a not-yet-activated
.B pcap_t
for live capture
.TP
.BR pcap_set_tstamp_type (3PCAP)
set time stamp type for a not-yet-activated
.B pcap_t
for live capture
.TP
.BR pcap_list_tstamp_types (3PCAP)
get list of available time stamp types for a not-yet-activated
.B pcap_t
for live capture
.TP
.BR pcap_free_tstamp_types (3PCAP)
free list of available time stamp types
.TP
.BR pcap_tstamp_type_val_to_name (3PCAP)
get name for a time stamp type
.TP
.BR pcap_tstamp_type_val_to_description (3PCAP)
get description for a time stamp type
.TP
.BR pcap_tstamp_name_to_val (3PCAP)
get time stamp type corresponding to a name
.TP
.BR pcap_datalink (3PCAP)
get link-layer header type for a
.B pcap_t
.TP
.BR pcap_file (3PCAP)
get the
.B "FILE\ *"
for a
.B pcap_t
opened for a ``savefile''
.TP
.BR pcap_is_swapped (3PCAP)
determine whether a ``savefile'' being read came from a machine with the
opposite byte order
.TP
.BR pcap_major_version (3PCAP)
.PD 0
.TP
.BR pcap_minor_version (3PCAP)
get the major and minor version of the file format version for a
``savefile''
.PD
.RE
.SS Selecting a link-layer header type for a live capture
Some devices may provide more than one link-layer header type. To
obtain a list of all link-layer header types provided by a device, call
.BR pcap_list_datalinks ()
on an activated
.B pcap_t
for the device.
To free a list of link-layer header types, call
.BR pcap_free_datalinks ().
To set the link-layer header type for a device, call
.BR pcap_set_datalink ().
This should be done after the device has been activated but before any
packets are read and before any filters are compiled or installed.
.TP
.B Routines
.RS
.TP
.BR pcap_list_datalinks (3PCAP)
get a list of link-layer header types for a device
.TP
.BR pcap_free_datalinks (3PCAP)
free list of link-layer header types
.TP
.BR pcap_set_datalink (3PCAP)
set link-layer header type for a device
.TP
.BR pcap_datalink_val_to_name (3PCAP)
get name for a link-layer header type
.TP
.BR pcap_datalink_val_to_description (3PCAP)
get description for a link-layer header type
.TP
.BR pcap_datalink_name_to_val (3PCAP)
get link-layer header type corresponding to a name
.RE
.SS Reading packets
Packets are read with
.B pcap_dispatch()
.BR pcap_dispatch ()
or
.BR pcap_loop() ,
.BR pcap_loop (),
which process one or more packets, calling a callback routine for each
packet, or with
.B pcap_next()
.BR pcap_next ()
or
.BR pcap_next_ex() ,
.BR pcap_next_ex (),
which return the next packet.
The callback for
.B pcap_dispatch()
.BR pcap_dispatch ()
and
.BR pcap_loop()
.BR pcap_loop ()
is supplied a pointer to a
.IR "struct pcap_pkthdr" ,
which includes the following members:
@ -304,9 +510,9 @@ number of bytes available from the capture, if the length of the packet
is larger than the maximum number of bytes to capture).
.RE
.PP
.B pcap_next_ex()
.BR pcap_next_ex ()
supplies that pointer through a pointer argument.
.B pcap_next()
.BR pcap_next ()
is passed an argument that points to a
.I struct pcap_pkthdr
structure, and fills it in.
@ -323,15 +529,306 @@ packet; to capture the entire packet, you will have to provide a value
for
.I snaplen
in your call to
.B pcap_open_live()
.BR pcap_set_snaplen ()
that is sufficiently large to get all of the packet's data - a value of
65535 should be sufficient on most if not all networks). When reading
from a ``savefile'', the snapshot length specified when the capture was
performed will limit the amount of packet data available.
.B pcap_next()
.BR pcap_next ()
returns that pointer;
.B pcap_next_ex()
.BR pcap_next_ex ()
supplies that pointer through a pointer argument.
.PP
To force the loop in
.BR pcap_dispatch ()
or
.BR pcap_loop ()
to terminate, call
.BR pcap_breakloop ().
.PP
By default, when reading packets from an interface opened for a live
capture,
.BR pcap_dispatch (),
.BR pcap_next (),
and
.BR pcap_next_ex ()
will, if no packets are currently available to be read, block waiting
for packets to become available. On some, but
.I not
all, platforms, if a read timeout was specified, the wait will terminate
after the read timeout expires; applications should be prepared for
this, as it happens on some platforms, but should not rely on it, as it
does not happen on other platforms.
.PP
A handle can be put into ``non-blocking mode'', so that those routines
will, rather than blocking, return an indication that no packets are
available to read. Call
.BR pcap_setnonblock ()
to put a handle into non-blocking mode or to take it out of non-blocking
mode; call
.BR pcap_getnonblock ()
to determine whether a handle is in non-blocking mode. Note that
non-blocking mode does not work correctly in Mac OS X 10.6.
.PP
Non-blocking mode is often combined with routines such as
.BR select (2)
or
.BR poll (2)
or other routines a platform offers to wait for the availability of data
on any of a set of descriptors. To obtain, for a handle, a descriptor
that can be used in those routines, call
.BR pcap_get_selectable_fd ().
Not all handles have such a descriptor available;
.BR pcap_get_selectable_fd ()
will return \-1 if no such descriptor exists. In addition, for various
reasons, one or more of those routines will not work properly with the
descriptor; the documentation for
.BR pcap_get_selectable_fd ()
gives details.
.TP
.B Routines
.RS
.TP
.BR pcap_dispatch (3PCAP)
read a bufferful of packets from a
.B pcap_t
open for a live capture or the full set of packets from a
.B pcap_t
open for a ``savefile''
.TP
.BR pcap_loop (3PCAP)
read packets from a
.B pcap_t
until an interrupt or error occurs
.TP
.BR pcap_next (3PCAP)
read the next packet from a
.B pcap_t
without an indication whether an error occurred
.TP
.BR pcap_next_ex (3PCAP)
read the next packet from a
.B pcap_t
with an error indication on an error
.TP
.BR pcap_breakloop (3PCAP)
prematurely terminate the loop in
.BR pcap_dispatch ()
or
.BR pcap_loop ()
.TP
.BR pcap_setnonblock (3PCAP)
set or clear non-blocking mode on a
.B pcap_t
.TP
.BR pcap_getnonblock (3PCAP)
get the state of non-blocking mode for a
.B pcap_t
.TP
.BR pcap_get_selectable_fd (3PCAP)
attempt to get a descriptor for a
.B pcap_t
that can be used in calls such as
.BR select (2)
and
.BR poll (2)
.RE
.SS Filters
In order to cause only certain packets to be returned when reading
packets, a filter can be set on a handle. For a live capture, the
filtering will be performed in kernel mode, if possible, to avoid
copying ``uninteresting'' packets from the kernel to user mode.
.PP
A filter can be specified as a text string; the syntax and semantics of
the string are as described by
.BR pcap-filter (@MAN_MISC_INFO@).
A filter string is compiled into a program in a pseudo-machine-language
by
.BR pcap_compile ()
and the resulting program can be made a filter for a handle with
.BR pcap_setfilter ().
The result of
.BR pcap_compile ()
can be freed with a call to
.BR pcap_freecode ().
.BR pcap_compile ()
may require a network mask for certain expressions in the filter string;
.BR pcap_lookupnet ()
can be used to find the network address and network mask for a given
capture device.
.PP
A compiled filter can also be applied directly to a packet that has been
read using
.BR pcap_offline_filter ().
.TP
.B Routines
.RS
.TP
.BR pcap_compile (3PCAP)
compile filter expression to a pseudo-machine-language code program
.TP
.BR pcap_freecode (3PCAP)
free a filter program
.TP
.BR pcap_setfilter (3PCAP)
set filter for a
.B pcap_t
.TP
.BR pcap_lookupnet (3PCAP)
get network address and network mask for a capture device
.TP
.BR pcap_offline_filter (3PCAP)
apply a filter program to a packet
.RE
.SS Incoming and outgoing packets
By default, libpcap will attempt to capture both packets sent by the
machine and packets received by the machine. To limit it to capturing
only packets received by the machine or, if possible, only packets sent
by the machine, call
.BR pcap_setdirection ().
.TP
.BR Routines
.RS
.TP
.BR pcap_setdirection (3PCAP)
specify whether to capture incoming packets, outgoing packets, or both
.RE
.SS Capture statistics
To get statistics about packets received and dropped in a live capture,
call
.BR pcap_stats ().
.TP
.B Routines
.RS
.TP
.BR pcap_stats (3PCAP)
get capture statistics
.RE
.SS Opening a handle for writing captured packets
To open a ``savefile`` to which to write packets, given the pathname the
``savefile'' should have, call
.BR pcap_dump_open ().
To open a ``savefile`` to which to write packets, given the pathname the
``savefile'' should have, call
.BR pcap_dump_open ();
to set up a handle for a ``savefile'', given a
.B "FILE\ *"
referring to a file already opened for writing, call
.BR pcap_dump_fopen ().
They each return pointers to a
.BR pcap_dumper_t ,
which is the handle used for writing packets to the ``savefile''. If it
succeeds, it will have created the file if it doesn't exist and
truncated the file if it does exist.
To close a
.BR pcap_dumper_t ,
call
.BR pcap_dump_close ().
.TP
.B Routines
.RS
.TP
.BR pcap_dump_open (3PCAP)
open a
.B pcap_dumper_t
for a ``savefile``, given a pathname
.TP
.BR pcap_dump_fopen (3PCAP)
open a
.B pcap_dumper_t
for a ``savefile``, given a
.B "FILE\ *"
.TP
.BR pcap_dump_close (3PCAP)
close a
.B pcap_dumper_t
.TP
.BR pcap_dump_file (3PCAP)
get the
.B "FILE\ *"
for a
.B pcap_dumper_t
opened for a ``savefile''
.RE
.SS Writing packets
To write a packet to a
.BR pcap_dumper_t ,
call
.BR pcap_dump ().
Packets written with
.BR pcap_dump ()
may be buffered, rather than being immediately written to the
``savefile''. Closing the
.B pcap_dumper_t
will cause all buffered-but-not-yet-written packets to be written to the
``savefile''.
To force all packets written to the
.BR pcap_dumper_t ,
and not yet written to the ``savefile'' because they're buffered by the
.BR pcap_dumper_t ,
to be written to the ``savefile'', without closing the
.BR pcap_dumper_t ,
call
.BR pcap_dump_flush ().
.TP
.B Routines
.RS
.TP
.BR pcap_dump (3PCAP)
write packet to a
.B pcap_dumper_t
.TP
.BR pcap_dump_flush (3PCAP)
flush buffered packets written to a
.B pcap_dumper_t
to the ``savefile''
.TP
.BR pcap_dump_ftell (3PCAP)
get current file position for a
.B pcap_dumper_t
.RE
.SS Injecting packets
If you have the required privileges, you can inject packets onto a
network with a
.B pcap_t
for a live capture, using
.BR pcap_inject ()
or
.BR pcap_sendpacket ().
(The two routines exist for compatibility with both OpenBSD and WinPcap;
they perform the same function, but have different return values.)
.TP
.B Routines
.RS
.TP
.BR pcap_inject (3PCAP)
.PD 0
.TP
.BR pcap_sendpacket (3PCAP)
transmit a packet
.PD
.RE
.SS Reporting errors
Some routines return error or warning status codes; to convert them to a
string, use
.BR pcap_statustostr ().
.TP
.B Routines
.RS
.TP
.BR pcap_statustostr (3PCAP)
get a string for an error or warning status code
.RE
.SS Getting library version information
To get a string giving version information about libpcap, call
.BR pcap_library_version ().
.TP
.B Routines
.RS
.TP
.BR pcap_library_version (3PCAP)
get library version string
.RE
.SH BACKWARDS COMPATIBILITY
.PP
In versions of libpcap prior to 1.0, the
@ -346,18 +843,18 @@ which will include
for you, rather than including
.BR <pcap/pcap.h> .
.PP
.B pcap_create()
.BR pcap_create ()
and
.B pcap_activate()
.BR pcap_activate ()
were not available in versions of libpcap prior to 1.0; if you are
writing an application that must work on versions of libpcap prior to
1.0, either use
.B pcap_open_live()
.BR pcap_open_live ()
to get a handle for a live capture or, if you want to be able to use the
additional capabilities offered by using
.B pcap_create()
.BR pcap_create ()
and
.BR pcap_activate() ,
.BR pcap_activate (),
use an
.BR autoconf (1)
script or some other configuration script to check whether the libpcap

440
pcap.c
View File

@ -57,7 +57,7 @@ static const char rcsid[] _U_ =
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#if !defined(_MSC_VER) && !defined(__BORLANDC__)
#if !defined(_MSC_VER) && !defined(__BORLANDC__) && !defined(__MINGW32__)
#include <unistd.h>
#endif
#include <fcntl.h>
@ -82,7 +82,7 @@ int
pcap_not_initialized(pcap_t *pcap)
{
/* this means 'not initialized' */
return PCAP_ERROR_NOT_ACTIVATED;
return (PCAP_ERROR_NOT_ACTIVATED);
}
/*
@ -104,6 +104,56 @@ pcap_cant_set_rfmon(pcap_t *p _U_)
return (0);
}
/*
* Sets *tstamp_typesp to point to an array 1 or more supported time stamp
* types; the return value is the number of supported time stamp types.
* The list should be freed by a call to pcap_free_tstamp_types() when
* you're done with it.
*
* A return value of 0 means "you don't get a choice of time stamp type",
* in which case *tstamp_typesp is set to null.
*
* PCAP_ERROR is returned on error.
*/
int
pcap_list_tstamp_types(pcap_t *p, int **tstamp_typesp)
{
if (p->tstamp_type_count == 0) {
/*
* We don't support multiple time stamp types.
*/
*tstamp_typesp = NULL;
} else {
*tstamp_typesp = (int*)calloc(sizeof(**tstamp_typesp),
p->tstamp_type_count);
if (*tstamp_typesp == NULL) {
(void)snprintf(p->errbuf, sizeof(p->errbuf),
"malloc: %s", pcap_strerror(errno));
return (PCAP_ERROR);
}
(void)memcpy(*tstamp_typesp, p->tstamp_type_list,
sizeof(**tstamp_typesp) * p->tstamp_type_count);
}
return (p->tstamp_type_count);
}
/*
* In Windows, you might have a library built with one version of the
* C runtime library and an application built with another version of
* the C runtime library, which means that the library might use one
* version of malloc() and free() and the application might use another
* version of malloc() and free(). If so, that means something
* allocated by the library cannot be freed by the application, so we
* need to have a pcap_free_tstamp_types() routine to free up the list
* allocated by pcap_list_tstamp_types(), even though it's just a wrapper
* around free().
*/
void
pcap_free_tstamp_types(int *tstamp_type_list)
{
free(tstamp_type_list);
}
/*
* Default one-shot callback; overridden for capture types where the
* packet data cannot be guaranteed to be available after the callback
@ -149,7 +199,8 @@ pcap_next_ex(pcap_t *p, struct pcap_pkthdr **pkt_header,
int status;
/* We are on an offline capture */
status = pcap_offline_read(p, 1, pcap_oneshot, (u_char *)&s);
status = pcap_offline_read(p, 1, p->oneshot_callback,
(u_char *)&s);
/*
* Return codes for pcap_offline_read() are:
@ -178,7 +229,7 @@ pcap_next_ex(pcap_t *p, struct pcap_pkthdr **pkt_header,
* The first one ('0') conflicts with the return code of 0 from
* pcap_offline_read() meaning "end of file".
*/
return (p->read_op(p, 1, pcap_oneshot, (u_char *)&s));
return (p->read_op(p, 1, p->oneshot_callback, (u_char *)&s));
}
static void
@ -258,6 +309,7 @@ pcap_create_common(const char *source, char *ebuf)
pcap_set_snaplen(p, 65535); /* max packet size */
p->opt.promisc = 0;
p->opt.buffer_size = 0;
p->opt.tstamp_type = -1; /* default to not setting time stamp type */
return (p);
}
@ -267,54 +319,89 @@ pcap_check_activated(pcap_t *p)
if (p->activated) {
snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "can't perform "
" operation on activated capture");
return -1;
return (-1);
}
return 0;
return (0);
}
int
pcap_set_snaplen(pcap_t *p, int snaplen)
{
if (pcap_check_activated(p))
return PCAP_ERROR_ACTIVATED;
return (PCAP_ERROR_ACTIVATED);
p->snapshot = snaplen;
return 0;
return (0);
}
int
pcap_set_promisc(pcap_t *p, int promisc)
{
if (pcap_check_activated(p))
return PCAP_ERROR_ACTIVATED;
return (PCAP_ERROR_ACTIVATED);
p->opt.promisc = promisc;
return 0;
return (0);
}
int
pcap_set_rfmon(pcap_t *p, int rfmon)
{
if (pcap_check_activated(p))
return PCAP_ERROR_ACTIVATED;
return (PCAP_ERROR_ACTIVATED);
p->opt.rfmon = rfmon;
return 0;
return (0);
}
int
pcap_set_timeout(pcap_t *p, int timeout_ms)
{
if (pcap_check_activated(p))
return PCAP_ERROR_ACTIVATED;
return (PCAP_ERROR_ACTIVATED);
p->md.timeout = timeout_ms;
return 0;
return (0);
}
int
pcap_set_tstamp_type(pcap_t *p, int tstamp_type)
{
int i;
if (pcap_check_activated(p))
return (PCAP_ERROR_ACTIVATED);
/*
* If p->tstamp_type_count is 0, we don't support setting
* the time stamp type at all.
*/
if (p->tstamp_type_count == 0)
return (PCAP_ERROR_CANTSET_TSTAMP_TYPE);
/*
* Check whether we claim to support this type of time stamp.
*/
for (i = 0; i < p->tstamp_type_count; i++) {
if (p->tstamp_type_list[i] == tstamp_type) {
/*
* Yes.
*/
p->opt.tstamp_type = tstamp_type;
return (0);
}
}
/*
* No. We support setting the time stamp type, but not to this
* particular value.
*/
return (PCAP_WARNING_TSTAMP_TYPE_NOTSUP);
}
int
pcap_set_buffer_size(pcap_t *p, int buffer_size)
{
if (pcap_check_activated(p))
return PCAP_ERROR_ACTIVATED;
return (PCAP_ERROR_ACTIVATED);
p->opt.buffer_size = buffer_size;
return 0;
return (0);
}
int
@ -322,6 +409,15 @@ pcap_activate(pcap_t *p)
{
int status;
/*
* Catch attempts to re-activate an already-activated
* pcap_t; this should, for example, catch code that
* calls pcap_open_live() followed by pcap_activate(),
* as some code that showed up in a Stack Exchange
* question did.
*/
if (pcap_check_activated(p))
return (PCAP_ERROR_ACTIVATED);
status = p->activate_op(p);
if (status >= 0)
p->activated = 1;
@ -384,7 +480,8 @@ pcap_open_live(const char *source, int snaplen, int promisc, int to_ms, char *er
snprintf(errbuf, PCAP_ERRBUF_SIZE, "%s: %s", source,
p->errbuf);
else if (status == PCAP_ERROR_NO_SUCH_DEVICE ||
status == PCAP_ERROR_PERM_DENIED)
status == PCAP_ERROR_PERM_DENIED ||
status == PCAP_ERROR_PROMISC_PERM_DENIED)
snprintf(errbuf, PCAP_ERRBUF_SIZE, "%s: %s (%s)", source,
pcap_statustostr(status), p->errbuf);
else
@ -397,7 +494,7 @@ pcap_open_live(const char *source, int snaplen, int promisc, int to_ms, char *er
int
pcap_dispatch(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
{
return p->read_op(p, cnt, callback, user);
return (p->read_op(p, cnt, callback, user));
}
/*
@ -407,7 +504,7 @@ int
pcap_read(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
{
return p->read_op(p, cnt, callback, user);
return (p->read_op(p, cnt, callback, user));
}
int
@ -571,111 +668,6 @@ pcap_set_datalink(pcap_t *p, int dlt)
return (-1);
}
struct dlt_choice {
const char *name;
const char *description;
int dlt;
};
#define DLT_CHOICE(code, description) { #code, description, code }
#define DLT_CHOICE_SENTINEL { NULL, NULL, 0 }
static struct dlt_choice dlt_choices[] = {
DLT_CHOICE(DLT_NULL, "BSD loopback"),
DLT_CHOICE(DLT_EN10MB, "Ethernet"),
DLT_CHOICE(DLT_IEEE802, "Token ring"),
DLT_CHOICE(DLT_ARCNET, "BSD ARCNET"),
DLT_CHOICE(DLT_SLIP, "SLIP"),
DLT_CHOICE(DLT_PPP, "PPP"),
DLT_CHOICE(DLT_FDDI, "FDDI"),
DLT_CHOICE(DLT_ATM_RFC1483, "RFC 1483 LLC-encapsulated ATM"),
DLT_CHOICE(DLT_RAW, "Raw IP"),
DLT_CHOICE(DLT_SLIP_BSDOS, "BSD/OS SLIP"),
DLT_CHOICE(DLT_PPP_BSDOS, "BSD/OS PPP"),
DLT_CHOICE(DLT_ATM_CLIP, "Linux Classical IP-over-ATM"),
DLT_CHOICE(DLT_PPP_SERIAL, "PPP over serial"),
DLT_CHOICE(DLT_PPP_ETHER, "PPPoE"),
DLT_CHOICE(DLT_SYMANTEC_FIREWALL, "Symantec Firewall"),
DLT_CHOICE(DLT_C_HDLC, "Cisco HDLC"),
DLT_CHOICE(DLT_IEEE802_11, "802.11"),
DLT_CHOICE(DLT_FRELAY, "Frame Relay"),
DLT_CHOICE(DLT_LOOP, "OpenBSD loopback"),
DLT_CHOICE(DLT_ENC, "OpenBSD encapsulated IP"),
DLT_CHOICE(DLT_LINUX_SLL, "Linux cooked"),
DLT_CHOICE(DLT_LTALK, "Localtalk"),
DLT_CHOICE(DLT_PFLOG, "OpenBSD pflog file"),
DLT_CHOICE(DLT_PRISM_HEADER, "802.11 plus Prism header"),
DLT_CHOICE(DLT_IP_OVER_FC, "RFC 2625 IP-over-Fibre Channel"),
DLT_CHOICE(DLT_SUNATM, "Sun raw ATM"),
DLT_CHOICE(DLT_IEEE802_11_RADIO, "802.11 plus radiotap header"),
DLT_CHOICE(DLT_ARCNET_LINUX, "Linux ARCNET"),
DLT_CHOICE(DLT_JUNIPER_MLPPP, "Juniper Multi-Link PPP"),
DLT_CHOICE(DLT_JUNIPER_MLFR, "Juniper Multi-Link Frame Relay"),
DLT_CHOICE(DLT_JUNIPER_ES, "Juniper Encryption Services PIC"),
DLT_CHOICE(DLT_JUNIPER_GGSN, "Juniper GGSN PIC"),
DLT_CHOICE(DLT_JUNIPER_MFR, "Juniper FRF.16 Frame Relay"),
DLT_CHOICE(DLT_JUNIPER_ATM2, "Juniper ATM2 PIC"),
DLT_CHOICE(DLT_JUNIPER_SERVICES, "Juniper Advanced Services PIC"),
DLT_CHOICE(DLT_JUNIPER_ATM1, "Juniper ATM1 PIC"),
DLT_CHOICE(DLT_APPLE_IP_OVER_IEEE1394, "Apple IP-over-IEEE 1394"),
DLT_CHOICE(DLT_MTP2_WITH_PHDR, "SS7 MTP2 with Pseudo-header"),
DLT_CHOICE(DLT_MTP2, "SS7 MTP2"),
DLT_CHOICE(DLT_MTP3, "SS7 MTP3"),
DLT_CHOICE(DLT_SCCP, "SS7 SCCP"),
DLT_CHOICE(DLT_DOCSIS, "DOCSIS"),
DLT_CHOICE(DLT_LINUX_IRDA, "Linux IrDA"),
DLT_CHOICE(DLT_IEEE802_11_RADIO_AVS, "802.11 plus AVS radio information header"),
DLT_CHOICE(DLT_JUNIPER_MONITOR, "Juniper Passive Monitor PIC"),
DLT_CHOICE(DLT_PPP_PPPD, "PPP for pppd, with direction flag"),
DLT_CHOICE(DLT_JUNIPER_PPPOE, "Juniper PPPoE"),
DLT_CHOICE(DLT_JUNIPER_PPPOE_ATM, "Juniper PPPoE/ATM"),
DLT_CHOICE(DLT_GPRS_LLC, "GPRS LLC"),
DLT_CHOICE(DLT_GPF_T, "GPF-T"),
DLT_CHOICE(DLT_GPF_F, "GPF-F"),
DLT_CHOICE(DLT_JUNIPER_PIC_PEER, "Juniper PIC Peer"),
DLT_CHOICE(DLT_ERF_ETH, "Ethernet with Endace ERF header"),
DLT_CHOICE(DLT_ERF_POS, "Packet-over-SONET with Endace ERF header"),
DLT_CHOICE(DLT_LINUX_LAPD, "Linux vISDN LAPD"),
DLT_CHOICE(DLT_JUNIPER_ETHER, "Juniper Ethernet"),
DLT_CHOICE(DLT_JUNIPER_PPP, "Juniper PPP"),
DLT_CHOICE(DLT_JUNIPER_FRELAY, "Juniper Frame Relay"),
DLT_CHOICE(DLT_JUNIPER_CHDLC, "Juniper C-HDLC"),
DLT_CHOICE(DLT_MFR, "FRF.16 Frame Relay"),
DLT_CHOICE(DLT_JUNIPER_VP, "Juniper Voice PIC"),
DLT_CHOICE(DLT_A429, "Arinc 429"),
DLT_CHOICE(DLT_A653_ICM, "Arinc 653 Interpartition Communication"),
DLT_CHOICE(DLT_USB, "USB"),
DLT_CHOICE(DLT_BLUETOOTH_HCI_H4, "Bluetooth HCI UART transport layer"),
DLT_CHOICE(DLT_IEEE802_16_MAC_CPS, "IEEE 802.16 MAC Common Part Sublayer"),
DLT_CHOICE(DLT_USB_LINUX, "USB with Linux header"),
DLT_CHOICE(DLT_CAN20B, "Controller Area Network (CAN) v. 2.0B"),
DLT_CHOICE(DLT_IEEE802_15_4_LINUX, "IEEE 802.15.4 with Linux padding"),
DLT_CHOICE(DLT_PPI, "Per-Packet Information"),
DLT_CHOICE(DLT_IEEE802_16_MAC_CPS_RADIO, "IEEE 802.16 MAC Common Part Sublayer plus radiotap header"),
DLT_CHOICE(DLT_JUNIPER_ISM, "Juniper Integrated Service Module"),
DLT_CHOICE(DLT_IEEE802_15_4, "IEEE 802.15.4"),
DLT_CHOICE(DLT_SITA, "SITA pseudo-header"),
DLT_CHOICE(DLT_ERF, "Endace ERF header"),
DLT_CHOICE(DLT_RAIF1, "Ethernet with u10 Networks pseudo-header"),
DLT_CHOICE(DLT_IPMB, "IPMB"),
DLT_CHOICE(DLT_JUNIPER_ST, "Juniper Secure Tunnel"),
DLT_CHOICE(DLT_BLUETOOTH_HCI_H4_WITH_PHDR, "Bluetooth HCI UART transport layer plus pseudo-header"),
DLT_CHOICE(DLT_AX25_KISS, "AX.25 with KISS header"),
DLT_CHOICE(DLT_IEEE802_15_4_NONASK_PHY, "IEEE 802.15.4 with non-ASK PHY data"),
DLT_CHOICE(DLT_MPLS, "MPLS with label as link-layer header"),
DLT_CHOICE(DLT_USB_LINUX_MMAPPED, "USB with padded Linux header"),
DLT_CHOICE(DLT_DECT, "DECT"),
DLT_CHOICE(DLT_AOS, "AOS Space Data Link protocol"),
DLT_CHOICE(DLT_WIHART, "Wireless HART"),
DLT_CHOICE(DLT_FC_2, "Fibre Channel FC-2"),
DLT_CHOICE(DLT_FC_2_WITH_FRAME_DELIMS, "Fibre Channel FC-2 with frame delimiters"),
DLT_CHOICE(DLT_IPNET, "Solaris ipnet"),
DLT_CHOICE(DLT_CAN_SOCKETCAN, "CAN-bus with SocketCAN headers"),
DLT_CHOICE(DLT_IPV4, "Raw IPv4"),
DLT_CHOICE(DLT_IPV6, "Raw IPv6"),
DLT_CHOICE_SENTINEL
};
/*
* This array is designed for mapping upper and lower case letter
* together for a case independent comparison. The mappings are
@ -761,6 +753,121 @@ pcap_strcasecmp(const char *s1, const char *s2)
return (cm[*us1] - cm[*--us2]);
}
struct dlt_choice {
const char *name;
const char *description;
int dlt;
};
#define DLT_CHOICE(code, description) { #code, description, code }
#define DLT_CHOICE_SENTINEL { NULL, NULL, 0 }
static struct dlt_choice dlt_choices[] = {
DLT_CHOICE(DLT_NULL, "BSD loopback"),
DLT_CHOICE(DLT_EN10MB, "Ethernet"),
DLT_CHOICE(DLT_IEEE802, "Token ring"),
DLT_CHOICE(DLT_ARCNET, "BSD ARCNET"),
DLT_CHOICE(DLT_SLIP, "SLIP"),
DLT_CHOICE(DLT_PPP, "PPP"),
DLT_CHOICE(DLT_FDDI, "FDDI"),
DLT_CHOICE(DLT_ATM_RFC1483, "RFC 1483 LLC-encapsulated ATM"),
DLT_CHOICE(DLT_RAW, "Raw IP"),
DLT_CHOICE(DLT_SLIP_BSDOS, "BSD/OS SLIP"),
DLT_CHOICE(DLT_PPP_BSDOS, "BSD/OS PPP"),
DLT_CHOICE(DLT_ATM_CLIP, "Linux Classical IP-over-ATM"),
DLT_CHOICE(DLT_PPP_SERIAL, "PPP over serial"),
DLT_CHOICE(DLT_PPP_ETHER, "PPPoE"),
DLT_CHOICE(DLT_SYMANTEC_FIREWALL, "Symantec Firewall"),
DLT_CHOICE(DLT_C_HDLC, "Cisco HDLC"),
DLT_CHOICE(DLT_IEEE802_11, "802.11"),
DLT_CHOICE(DLT_FRELAY, "Frame Relay"),
DLT_CHOICE(DLT_LOOP, "OpenBSD loopback"),
DLT_CHOICE(DLT_ENC, "OpenBSD encapsulated IP"),
DLT_CHOICE(DLT_LINUX_SLL, "Linux cooked"),
DLT_CHOICE(DLT_LTALK, "Localtalk"),
DLT_CHOICE(DLT_PFLOG, "OpenBSD pflog file"),
DLT_CHOICE(DLT_PRISM_HEADER, "802.11 plus Prism header"),
DLT_CHOICE(DLT_IP_OVER_FC, "RFC 2625 IP-over-Fibre Channel"),
DLT_CHOICE(DLT_SUNATM, "Sun raw ATM"),
DLT_CHOICE(DLT_IEEE802_11_RADIO, "802.11 plus radiotap header"),
DLT_CHOICE(DLT_ARCNET_LINUX, "Linux ARCNET"),
DLT_CHOICE(DLT_JUNIPER_MLPPP, "Juniper Multi-Link PPP"),
DLT_CHOICE(DLT_JUNIPER_MLFR, "Juniper Multi-Link Frame Relay"),
DLT_CHOICE(DLT_JUNIPER_ES, "Juniper Encryption Services PIC"),
DLT_CHOICE(DLT_JUNIPER_GGSN, "Juniper GGSN PIC"),
DLT_CHOICE(DLT_JUNIPER_MFR, "Juniper FRF.16 Frame Relay"),
DLT_CHOICE(DLT_JUNIPER_ATM2, "Juniper ATM2 PIC"),
DLT_CHOICE(DLT_JUNIPER_SERVICES, "Juniper Advanced Services PIC"),
DLT_CHOICE(DLT_JUNIPER_ATM1, "Juniper ATM1 PIC"),
DLT_CHOICE(DLT_APPLE_IP_OVER_IEEE1394, "Apple IP-over-IEEE 1394"),
DLT_CHOICE(DLT_MTP2_WITH_PHDR, "SS7 MTP2 with Pseudo-header"),
DLT_CHOICE(DLT_MTP2, "SS7 MTP2"),
DLT_CHOICE(DLT_MTP3, "SS7 MTP3"),
DLT_CHOICE(DLT_SCCP, "SS7 SCCP"),
DLT_CHOICE(DLT_DOCSIS, "DOCSIS"),
DLT_CHOICE(DLT_LINUX_IRDA, "Linux IrDA"),
DLT_CHOICE(DLT_IEEE802_11_RADIO_AVS, "802.11 plus AVS radio information header"),
DLT_CHOICE(DLT_JUNIPER_MONITOR, "Juniper Passive Monitor PIC"),
DLT_CHOICE(DLT_PPP_PPPD, "PPP for pppd, with direction flag"),
DLT_CHOICE(DLT_JUNIPER_PPPOE, "Juniper PPPoE"),
DLT_CHOICE(DLT_JUNIPER_PPPOE_ATM, "Juniper PPPoE/ATM"),
DLT_CHOICE(DLT_GPRS_LLC, "GPRS LLC"),
DLT_CHOICE(DLT_GPF_T, "GPF-T"),
DLT_CHOICE(DLT_GPF_F, "GPF-F"),
DLT_CHOICE(DLT_JUNIPER_PIC_PEER, "Juniper PIC Peer"),
DLT_CHOICE(DLT_ERF_ETH, "Ethernet with Endace ERF header"),
DLT_CHOICE(DLT_ERF_POS, "Packet-over-SONET with Endace ERF header"),
DLT_CHOICE(DLT_LINUX_LAPD, "Linux vISDN LAPD"),
DLT_CHOICE(DLT_JUNIPER_ETHER, "Juniper Ethernet"),
DLT_CHOICE(DLT_JUNIPER_PPP, "Juniper PPP"),
DLT_CHOICE(DLT_JUNIPER_FRELAY, "Juniper Frame Relay"),
DLT_CHOICE(DLT_JUNIPER_CHDLC, "Juniper C-HDLC"),
DLT_CHOICE(DLT_MFR, "FRF.16 Frame Relay"),
DLT_CHOICE(DLT_JUNIPER_VP, "Juniper Voice PIC"),
DLT_CHOICE(DLT_A429, "Arinc 429"),
DLT_CHOICE(DLT_A653_ICM, "Arinc 653 Interpartition Communication"),
DLT_CHOICE(DLT_USB, "USB"),
DLT_CHOICE(DLT_BLUETOOTH_HCI_H4, "Bluetooth HCI UART transport layer"),
DLT_CHOICE(DLT_IEEE802_16_MAC_CPS, "IEEE 802.16 MAC Common Part Sublayer"),
DLT_CHOICE(DLT_USB_LINUX, "USB with Linux header"),
DLT_CHOICE(DLT_CAN20B, "Controller Area Network (CAN) v. 2.0B"),
DLT_CHOICE(DLT_IEEE802_15_4_LINUX, "IEEE 802.15.4 with Linux padding"),
DLT_CHOICE(DLT_PPI, "Per-Packet Information"),
DLT_CHOICE(DLT_IEEE802_16_MAC_CPS_RADIO, "IEEE 802.16 MAC Common Part Sublayer plus radiotap header"),
DLT_CHOICE(DLT_JUNIPER_ISM, "Juniper Integrated Service Module"),
DLT_CHOICE(DLT_IEEE802_15_4, "IEEE 802.15.4 with FCS"),
DLT_CHOICE(DLT_SITA, "SITA pseudo-header"),
DLT_CHOICE(DLT_ERF, "Endace ERF header"),
DLT_CHOICE(DLT_RAIF1, "Ethernet with u10 Networks pseudo-header"),
DLT_CHOICE(DLT_IPMB, "IPMB"),
DLT_CHOICE(DLT_JUNIPER_ST, "Juniper Secure Tunnel"),
DLT_CHOICE(DLT_BLUETOOTH_HCI_H4_WITH_PHDR, "Bluetooth HCI UART transport layer plus pseudo-header"),
DLT_CHOICE(DLT_AX25_KISS, "AX.25 with KISS header"),
DLT_CHOICE(DLT_IEEE802_15_4_NONASK_PHY, "IEEE 802.15.4 with non-ASK PHY data"),
DLT_CHOICE(DLT_MPLS, "MPLS with label as link-layer header"),
DLT_CHOICE(DLT_USB_LINUX_MMAPPED, "USB with padded Linux header"),
DLT_CHOICE(DLT_DECT, "DECT"),
DLT_CHOICE(DLT_AOS, "AOS Space Data Link protocol"),
DLT_CHOICE(DLT_WIHART, "Wireless HART"),
DLT_CHOICE(DLT_FC_2, "Fibre Channel FC-2"),
DLT_CHOICE(DLT_FC_2_WITH_FRAME_DELIMS, "Fibre Channel FC-2 with frame delimiters"),
DLT_CHOICE(DLT_IPNET, "Solaris ipnet"),
DLT_CHOICE(DLT_CAN_SOCKETCAN, "CAN-bus with SocketCAN headers"),
DLT_CHOICE(DLT_IPV4, "Raw IPv4"),
DLT_CHOICE(DLT_IPV6, "Raw IPv6"),
DLT_CHOICE(DLT_IEEE802_15_4_NOFCS, "IEEE 802.15.4 without FCS"),
DLT_CHOICE(DLT_JUNIPER_VS, "Juniper Virtual Server"),
DLT_CHOICE(DLT_JUNIPER_SRX_E2E, "Juniper SRX E2E"),
DLT_CHOICE(DLT_JUNIPER_FIBRECHANNEL, "Juniper Fibre Channel"),
DLT_CHOICE(DLT_DVB_CI, "DVB-CI"),
DLT_CHOICE(DLT_JUNIPER_ATM_CEMIC, "Juniper ATM CEMIC"),
DLT_CHOICE(DLT_NFLOG, "Linux netfilter log messages"),
DLT_CHOICE(DLT_NETANALYZER, "Ethernet with Hilscher netANALYZER pseudo-header"),
DLT_CHOICE(DLT_NETANALYZER_TRANSPARENT, "Ethernet with Hilscher netANALYZER pseudo-header and with preamble and SFD"),
DLT_CHOICE(DLT_IPOIB, "RFC 4391 IP-over-Infiniband"),
DLT_CHOICE_SENTINEL
};
int
pcap_datalink_name_to_val(const char *name)
{
@ -798,6 +905,57 @@ pcap_datalink_val_to_description(int dlt)
return (NULL);
}
struct tstamp_type_choice {
const char *name;
const char *description;
int type;
};
static struct tstamp_type_choice tstamp_type_choices[] = {
{ "host", "Host", PCAP_TSTAMP_HOST },
{ "host_lowprec", "Host, low precision", PCAP_TSTAMP_HOST_LOWPREC },
{ "host_hiprec", "Host, high precision", PCAP_TSTAMP_HOST_HIPREC },
{ "adapter", "Adapter", PCAP_TSTAMP_ADAPTER },
{ "adapter_unsynced", "Adapter, not synced with system time", PCAP_TSTAMP_ADAPTER_UNSYNCED },
{ NULL, NULL, 0 }
};
int
pcap_tstamp_type_name_to_val(const char *name)
{
int i;
for (i = 0; tstamp_type_choices[i].name != NULL; i++) {
if (pcap_strcasecmp(tstamp_type_choices[i].name, name) == 0)
return (tstamp_type_choices[i].type);
}
return (PCAP_ERROR);
}
const char *
pcap_tstamp_type_val_to_name(int tstamp_type)
{
int i;
for (i = 0; tstamp_type_choices[i].name != NULL; i++) {
if (tstamp_type_choices[i].type == tstamp_type)
return (tstamp_type_choices[i].name);
}
return (NULL);
}
const char *
pcap_tstamp_type_val_to_description(int tstamp_type)
{
int i;
for (i = 0; tstamp_type_choices[i].name != NULL; i++) {
if (tstamp_type_choices[i].type == tstamp_type)
return (tstamp_type_choices[i].description);
}
return (NULL);
}
int
pcap_snapshot(pcap_t *p)
{
@ -864,7 +1022,7 @@ pcap_geterr(pcap_t *p)
int
pcap_getnonblock(pcap_t *p, char *errbuf)
{
return p->getnonblock_op(p, errbuf);
return (p->getnonblock_op(p, errbuf));
}
/*
@ -896,7 +1054,7 @@ pcap_getnonblock_fd(pcap_t *p, char *errbuf)
int
pcap_setnonblock(pcap_t *p, int nonblock, char *errbuf)
{
return p->setnonblock_op(p, nonblock, errbuf);
return (p->setnonblock_op(p, nonblock, errbuf));
}
#if !defined(WIN32) && !defined(MSDOS)
@ -976,6 +1134,9 @@ pcap_statustostr(int errnum)
case PCAP_WARNING:
return("Generic warning");
case PCAP_WARNING_TSTAMP_TYPE_NOTSUP:
return ("That type of time stamp is not supported by that device");
case PCAP_WARNING_PROMISC_NOTSUP:
return ("That device doesn't support promiscuous mode");
@ -1005,6 +1166,12 @@ pcap_statustostr(int errnum)
case PCAP_ERROR_IFACE_NOT_UP:
return ("That device is not up");
case PCAP_ERROR_CANTSET_TSTAMP_TYPE:
return ("That device doesn't support setting the time stamp type");
case PCAP_ERROR_PROMISC_PERM_DENIED:
return ("You don't have permission to capture in promiscuous mode on that device");
}
(void)snprintf(ebuf, sizeof ebuf, "Unknown error: %d", errnum);
return(ebuf);
@ -1033,7 +1200,7 @@ pcap_strerror(int errnum)
int
pcap_setfilter(pcap_t *p, struct bpf_program *fp)
{
return p->setfilter_op(p, fp);
return (p->setfilter_op(p, fp));
}
/*
@ -1048,15 +1215,15 @@ pcap_setdirection(pcap_t *p, pcap_direction_t d)
if (p->setdirection_op == NULL) {
snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
"Setting direction is not implemented on this platform");
return -1;
return (-1);
} else
return p->setdirection_op(p, d);
return (p->setdirection_op(p, d));
}
int
pcap_stats(pcap_t *p, struct pcap_stat *ps)
{
return p->stats_op(p, ps);
return (p->stats_op(p, ps));
}
static int
@ -1071,7 +1238,7 @@ pcap_stats_dead(pcap_t *p, struct pcap_stat *ps _U_)
int
pcap_setbuff(pcap_t *p, int dim)
{
return p->setbuff_op(p, dim);
return (p->setbuff_op(p, dim));
}
static int
@ -1085,7 +1252,7 @@ pcap_setbuff_dead(pcap_t *p, int dim)
int
pcap_setmode(pcap_t *p, int mode)
{
return p->setmode_op(p, mode);
return (p->setmode_op(p, mode));
}
static int
@ -1099,7 +1266,7 @@ pcap_setmode_dead(pcap_t *p, int mode)
int
pcap_setmintocopy(pcap_t *p, int size)
{
return p->setmintocopy_op(p, size);
return (p->setmintocopy_op(p, size));
}
static int
@ -1212,6 +1379,11 @@ pcap_cleanup_live_common(pcap_t *p)
p->dlt_list = NULL;
p->dlt_count = 0;
}
if (p->tstamp_type_list != NULL) {
free(p->tstamp_type_list);
p->tstamp_type_list = NULL;
p->tstamp_type_count = 0;
}
pcap_freecode(&p->fcode);
#if !defined(WIN32) && !defined(MSDOS)
if (p->fd >= 0) {
@ -1248,7 +1420,7 @@ pcap_open_dead(int linktype, int snaplen)
#endif
p->cleanup_op = pcap_cleanup_dead;
p->activated = 1;
return p;
return (p);
}
/*

189
pcap/bpf.h
View File

@ -48,10 +48,30 @@
* "pcap-bpf.c" will include the native OS version, as it deals with
* the OS's BPF implementation.
*
* XXX - should this all just be moved to "pcap.h"?
* At least two programs found by Google Code Search explicitly includes
* <pcap/bpf.h> (even though <pcap.h>/<pcap/pcap.h> includes it for you),
* so moving that stuff to <pcap/pcap.h> would break the build for some
* programs.
*/
#ifndef BPF_MAJOR_VERSION
/*
* If we've already included <net/bpf.h>, don't re-define this stuff.
* We assume BSD-style multiple-include protection in <net/bpf.h>,
* which is true of all but the oldest versions of FreeBSD and NetBSD,
* or Tru64 UNIX-style multiple-include protection (or, at least,
* Tru64 UNIX 5.x-style; I don't have earlier versions available to check),
* or AIX-style multiple-include protection (or, at least, AIX 5.x-style;
* I don't have earlier versions available to check).
*
* We do not check for BPF_MAJOR_VERSION, as that's defined by
* <linux/filter.h>, which is directly or indirectly included in some
* programs that also include pcap.h, and <linux/filter.h> doesn't
* define stuff we need.
*
* This also provides our own multiple-include protection.
*/
#if !defined(_NET_BPF_H_) && !defined(_BPF_H_) && !defined(_H_BPF) && !defined(lib_pcap_bpf_h)
#define lib_pcap_bpf_h
#ifdef __cplusplus
extern "C" {
@ -70,7 +90,9 @@ typedef u_int bpf_u_int32;
/*
* Alignment macros. BPF_WORDALIGN rounds up to the next
* even multiple of BPF_ALIGNMENT.
* even multiple of BPF_ALIGNMENT.
*
* Tcpdump's print-pflog.c uses this, so we define it here.
*/
#ifndef __NetBSD__
#define BPF_ALIGNMENT sizeof(bpf_int32)
@ -79,9 +101,6 @@ typedef u_int bpf_u_int32;
#endif
#define BPF_WORDALIGN(x) (((x)+(BPF_ALIGNMENT-1))&~(BPF_ALIGNMENT-1))
#define BPF_MAXBUFSIZE 0x8000
#define BPF_MINBUFSIZE 32
/*
* Structure for "pcap_compile()", "pcap_setfilter()", etc..
*/
@ -91,26 +110,7 @@ struct bpf_program {
};
/*
* Struct return by BIOCVERSION. This represents the version number of
* the filter language described by the instruction encodings below.
* bpf understands a program iff kernel_major == filter_major &&
* kernel_minor >= filter_minor, that is, if the value returned by the
* running kernel has the same major number and a minor number equal
* equal to or less than the filter being downloaded. Otherwise, the
* results are undefined, meaning an error may be returned or packets
* may be accepted haphazardly.
* It has nothing to do with the source code version.
*/
struct bpf_version {
u_short bv_major;
u_short bv_minor;
};
/* Current version number of filter architecture. */
#define BPF_MAJOR_VERSION 1
#define BPF_MINOR_VERSION 1
/*
* Data-link level type codes.
* Link-layer header type codes.
*
* Do *NOT* add new values to this list without asking
* "tcpdump-workers@lists.tcpdump.org" for a value. Otherwise, you run
@ -119,6 +119,12 @@ struct bpf_version {
* being able to handle captures with your new DLT_ value, with no hope
* that they will ever be changed to do so (as that would destroy their
* ability to read captures using that value for that other purpose).
*
* See
*
* http://www.tcpdump.org/linktypes.html
*
* for detailed descriptions of some of these link-layer header types.
*/
/*
@ -203,10 +209,23 @@ struct bpf_version {
/*
* Values between 100 and 103 are used in capture file headers as
* link-layer types corresponding to DLT_ types that differ
* between platforms; don't use those values for new DLT_ new types.
* link-layer header type LINKTYPE_ values corresponding to DLT_ types
* that differ between platforms; don't use those values for new DLT_
* new types.
*/
/*
* Values starting with 104 are used for newly-assigned link-layer
* header type values; for those link-layer header types, the DLT_
* value returned by pcap_datalink() and passed to pcap_open_dead(),
* and the LINKTYPE_ value that appears in capture files, are the
* same.
*
* DLT_MATCHING_MIN is the lowest such value; DLT_MATCHING_MAX is
* the highest such value.
*/
#define DLT_MATCHING_MIN 104
/*
* This value was defined by libpcap 0.5; platforms that have defined
* it with a different value should define it here with that value -
@ -697,6 +716,8 @@ struct bpf_version {
/*
* IEEE 802.15.4, exactly as it appears in the spec (no padding, no
* nothing); requested by Mikko Saarnivala <mikko.saarnivala@sensinode.com>.
* For this one, we expect the FCS to be present at the end of the frame;
* if the frame has no FCS, DLT_IEEE802_15_4_NOFCS should be used.
*/
#define DLT_IEEE802_15_4 195
@ -942,7 +963,7 @@ struct bpf_version {
* An IPv4 or IPv6 datagram follows the pseudo-header; dli_family indicates
* which of those it is.
*/
#define DLT_IPNET 226
#define DLT_IPNET 226
/*
* CAN (Controller Area Network) frames, with a pseudo-header as supplied
@ -951,14 +972,116 @@ struct bpf_version {
*
* Requested by Felix Obenhuber <felix@obenhuber.de>.
*/
#define DLT_CAN_SOCKETCAN 227
#define DLT_CAN_SOCKETCAN 227
/*
* Raw IPv4/IPv6; different from DLT_RAW in that the DLT_ value specifies
* whether it's v4 or v6. Requested by Darren Reed <Darren.Reed@Sun.COM>.
*/
#define DLT_IPV4 228
#define DLT_IPV6 229
#define DLT_IPV4 228
#define DLT_IPV6 229
/*
* IEEE 802.15.4, exactly as it appears in the spec (no padding, no
* nothing), and with no FCS at the end of the frame; requested by
* Jon Smirl <jonsmirl@gmail.com>.
*/
#define DLT_IEEE802_15_4_NOFCS 230
/*
* Raw D-Bus:
*
* http://www.freedesktop.org/wiki/Software/dbus
*
* messages:
*
* http://dbus.freedesktop.org/doc/dbus-specification.html#message-protocol-messages
*
* starting with the endianness flag, followed by the message type, etc.,
* but without the authentication handshake before the message sequence:
*
* http://dbus.freedesktop.org/doc/dbus-specification.html#auth-protocol
*
* Requested by Martin Vidner <martin@vidner.net>.
*/
#define DLT_DBUS 231
/*
* Juniper-private data link type, as per request from
* Hannes Gredler <hannes@juniper.net>.
*/
#define DLT_JUNIPER_VS 232
#define DLT_JUNIPER_SRX_E2E 233
#define DLT_JUNIPER_FIBRECHANNEL 234
/*
* DVB-CI (DVB Common Interface for communication between a PC Card
* module and a DVB receiver). See
*
* http://www.kaiser.cx/pcap-dvbci.html
*
* for the specification.
*
* Requested by Martin Kaiser <martin@kaiser.cx>.
*/
#define DLT_DVB_CI 235
/*
* Variant of 3GPP TS 27.010 multiplexing protocol (similar to, but
* *not* the same as, 27.010). Requested by Hans-Christoph Schemmel
* <hans-christoph.schemmel@cinterion.com>.
*/
#define DLT_MUX27010 236
/*
* STANAG 5066 D_PDUs. Requested by M. Baris Demiray
* <barisdemiray@gmail.com>.
*/
#define DLT_STANAG_5066_D_PDU 237
/*
* Juniper-private data link type, as per request from
* Hannes Gredler <hannes@juniper.net>.
*/
#define DLT_JUNIPER_ATM_CEMIC 238
/*
* NetFilter LOG messages
* (payload of netlink NFNL_SUBSYS_ULOG/NFULNL_MSG_PACKET packets)
*
* Requested by Jakub Zawadzki <darkjames-ws@darkjames.pl>
*/
#define DLT_NFLOG 239
/*
* Hilscher Gesellschaft fuer Systemautomation mbH link-layer type
* for Ethernet packets with a 4-byte pseudo-header and always
* with the payload including the FCS, as supplied by their
* netANALYZER hardware and software.
*
* Requested by Holger P. Frommer <HPfrommer@hilscher.com>
*/
#define DLT_NETANALYZER 240
/*
* Hilscher Gesellschaft fuer Systemautomation mbH link-layer type
* for Ethernet packets with a 4-byte pseudo-header and FCS and
* with the Ethernet header preceded by 7 bytes of preamble and
* 1 byte of SFD, as supplied by their netANALYZER hardware and
* software.
*
* Requested by Holger P. Frommer <HPfrommer@hilscher.com>
*/
#define DLT_NETANALYZER_TRANSPARENT 241
/*
* IP-over-Infiniband, as specified by RFC 4391.
*
* Requested by Petr Sumbera <petr.sumbera@oracle.com>.
*/
#define DLT_IPOIB 242
#define DLT_MATCHING_MAX 242 /* highest value in the "matching" range */
/*
* DLT and savefile link type values are split into a class and
@ -1069,4 +1192,4 @@ extern u_int bpf_filter();
}
#endif
#endif
#endif /* !defined(_NET_BPF_H_) && !defined(_BPF_H_) && !defined(_H_BPF) && !defined(lib_pcap_bpf_h) */

66
pcap/pcap.h
View File

@ -251,6 +251,8 @@ typedef void (*pcap_handler)(u_char *, const struct pcap_pkthdr *,
#define PCAP_ERROR_NOT_RFMON -7 /* operation supported only in monitor mode */
#define PCAP_ERROR_PERM_DENIED -8 /* no permission to open the device */
#define PCAP_ERROR_IFACE_NOT_UP -9 /* interface isn't up */
#define PCAP_ERROR_CANTSET_TSTAMP_TYPE -10 /* this device doesn't support setting the time stamp type */
#define PCAP_ERROR_PROMISC_PERM_DENIED -11 /* you don't have permission to capture in promiscuous mode */
/*
* Warning codes for the pcap API.
@ -259,6 +261,7 @@ typedef void (*pcap_handler)(u_char *, const struct pcap_pkthdr *,
*/
#define PCAP_WARNING 1 /* generic warning code */
#define PCAP_WARNING_PROMISC_NOTSUP 2 /* this device doesn't support promiscuous mode */
#define PCAP_WARNING_TSTAMP_TYPE_NOTSUP 3 /* the requested time stamp type is not supported */
/*
* Value to pass to pcap_compile() as the netmask if you don't know what
@ -275,9 +278,60 @@ int pcap_set_promisc(pcap_t *, int);
int pcap_can_set_rfmon(pcap_t *);
int pcap_set_rfmon(pcap_t *, int);
int pcap_set_timeout(pcap_t *, int);
int pcap_set_tstamp_type(pcap_t *, int);
int pcap_set_buffer_size(pcap_t *, int);
int pcap_activate(pcap_t *);
int pcap_list_tstamp_types(pcap_t *, int **);
void pcap_free_tstamp_types(int *);
int pcap_tstamp_type_name_to_val(const char *);
const char *pcap_tstamp_type_val_to_name(int);
const char *pcap_tstamp_type_val_to_description(int);
/*
* Time stamp types.
* Not all systems and interfaces will necessarily support all of these.
*
* A system that supports PCAP_TSTAMP_HOST is offering time stamps
* provided by the host machine, rather than by the capture device,
* but not committing to any characteristics of the time stamp;
* it will not offer any of the PCAP_TSTAMP_HOST_ subtypes.
*
* PCAP_TSTAMP_HOST_LOWPREC is a time stamp, provided by the host machine,
* that's low-precision but relatively cheap to fetch; it's normally done
* using the system clock, so it's normally synchronized with times you'd
* fetch from system calls.
*
* PCAP_TSTAMP_HOST_HIPREC is a time stamp, provided by the host machine,
* that's high-precision; it might be more expensive to fetch. It might
* or might not be synchronized with the system clock, and might have
* problems with time stamps for packets received on different CPUs,
* depending on the platform.
*
* PCAP_TSTAMP_ADAPTER is a high-precision time stamp supplied by the
* capture device; it's synchronized with the system clock.
*
* PCAP_TSTAMP_ADAPTER_UNSYNCED is a high-precision time stamp supplied by
* the capture device; it's not synchronized with the system clock.
*
* Note that time stamps synchronized with the system clock can go
* backwards, as the system clock can go backwards. If a clock is
* not in sync with the system clock, that could be because the
* system clock isn't keeping accurate time, because the other
* clock isn't keeping accurate time, or both.
*
* Note that host-provided time stamps generally correspond to the
* time when the time-stamping code sees the packet; this could
* be some unknown amount of time after the first or last bit of
* the packet is received by the network adapter, due to batching
* of interrupts for packet arrival, queueing delays, etc..
*/
#define PCAP_TSTAMP_HOST 0 /* host-provided, unknown characteristics */
#define PCAP_TSTAMP_HOST_LOWPREC 1 /* host-provided, low precision */
#define PCAP_TSTAMP_HOST_HIPREC 2 /* host-provided, high precision */
#define PCAP_TSTAMP_ADAPTER 3 /* device-provided, synced with the system clock */
#define PCAP_TSTAMP_ADAPTER_UNSYNCED 4 /* device-provided, not synced with the system clock */
pcap_t *pcap_open_live(const char *, int, int, int, char *);
pcap_t *pcap_open_dead(int, int);
pcap_t *pcap_open_offline(const char *, char *);
@ -348,8 +402,16 @@ void pcap_freealldevs(pcap_if_t *);
const char *pcap_lib_version(void);
/* XXX this guy lives in the bpf tree */
/*
* On at least some versions of NetBSD, we don't want to declare
* bpf_filter() here, as it's also be declared in <net/bpf.h>, with a
* different signature, but, on other BSD-flavored UN*Xes, it's not
* declared in <net/bpf.h>, so we *do* want to declare it here, so it's
* declared when we build pcap-bpf.c.
*/
#ifndef __NetBSD__
u_int bpf_filter(const struct bpf_insn *, const u_char *, u_int, u_int);
#endif
int bpf_validate(const struct bpf_insn *f, int len);
char *bpf_image(const struct bpf_insn *, int);
void bpf_dump(const struct bpf_program *, int);
@ -397,4 +459,4 @@ int pcap_get_selectable_fd(pcap_t *);
}
#endif
#endif
#endif /* lib_pcap_pcap_h */

8
pcap_activate.3pcap
View File

@ -43,6 +43,11 @@ returns 0 on success without warnings,
.B PCAP_WARNING_PROMISC_NOTSUP
on success on a device that doesn't support promiscuous mode if
promiscuous mode was requested,
.B PCAP_WARNING_TSTAMP_TYPE_NOTSUP
on success if the time stamp type specified in a previous
.B pcap_set_tstamp_type()
call isn't supported by the capture source (the time stamp type is
left as the default),
.B PCAP_WARNING
on success with any other warning,
.B PCAP_ERROR_ACTIVATED
@ -52,6 +57,9 @@ if the capture source specified when the handle was created doesn't
exist,
.B PCAP_ERROR_PERM_DENIED
if the process doesn't have permission to open the capture source,
.B PCAP_ERROR_PROMISC_PERM_DENIED
if the process has permission to open the capture source but doesn't
have permission to put it into promiscuous mode,
.B PCAP_ERROR_RFMON_NOTSUP
if monitor mode was specified but the capture source doesn't support
monitor mode,

10
pcap_can_set_rfmon.3pcap
View File

@ -19,7 +19,7 @@
.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
.\"
.TH PCAP_CAN_SET_RFMON 3PCAP "5 April 2008"
.TH PCAP_CAN_SET_RFMON 3PCAP "18 May 2010"
.SH NAME
pcap_can_set_rfmon \- check whether monitor mode can be set for a
not-yet-activated capture handle
@ -37,11 +37,15 @@ int pcap_can_set_rfmon(pcap_t *p);
checks whether monitor mode could be set on a capture handle when
the handle is activated.
.SH RETURN VALUE
.B pcap_set_rfmon()
.B pcap_can_set_rfmon()
returns 0 if monitor mode could not be set,
1 if monitor mode could be set,
.B PCAP_ERROR_NO_SUCH_DEVICE
if the device specified when the handle was created doesn't exist,
if the capture source specified when the handle was created doesn't
exist,
.B PCAP_ERROR_PERM_DENIED
if the process doesn't have permission to check whether monitor mode
could be supported,
.B PCAP_ERROR_ACTIVATED
if called on a capture handle that has been activated, or
.B PCAP_ERROR

2
pcap_compile.3pcap.in
View File

@ -55,7 +55,7 @@ the filter program. If the netmask of the network on which packets are
being captured isn't known to the program, or if packets are being
captured on the Linux "any" pseudo-interface that can capture on more
than one network, a value of PCAP_NETMASK_UNKNOWN can be supplied; tests
for IPv4 broadcast addreses will fail to compile, but all other tests in
for IPv4 broadcast addresses will fail to compile, but all other tests in
the filter program will be OK.
.SH RETURN VALUE
.B pcap_compile()

4
pcap_datalink.3pcap.in
View File

@ -19,7 +19,7 @@
.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
.\"
.TH PCAP_DATALINK 3PCAP "5 April 2008"
.TH PCAP_DATALINK 3PCAP "22 August 2010"
.SH NAME
pcap_datalink \- get the link-layer header type
.SH SYNOPSIS
@ -34,7 +34,7 @@ int pcap_datalink(pcap_t *p);
.fi
.SH DESCRIPTION
.B pcap_datalink()
returns the link layer type for the live capture or ``savefile''
returns the link-layer header type for the live capture or ``savefile''
specified by
.IR p .
.SH SEE ALSO

8
pcap_datalink_name_to_val.3pcap
View File

@ -19,7 +19,7 @@
.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
.\"
.TH PCAP_DATALINK_NAME_TO_VAL 3PCAP "5 April 2008"
.TH PCAP_DATALINK_NAME_TO_VAL 3PCAP "22 August 2010"
.SH NAME
pcap_datalink_name_to_val \- get the link-layer header type value
corresponding to a header type name
@ -35,12 +35,12 @@ int pcap_datalink_name_to_val(const char *name);
.fi
.SH DESCRIPTION
.B pcap_datalink_name_to_val()
translates a data link type name, which is a
translates a link-layer header type name, which is a
.B DLT_
name with the
.B DLT_
removed, to the corresponding data link type value. The translation
is case-insensitive.
removed, to the corresponding link-layer header type value. The
translation is case-insensitive.
.SH RETURN VALUE
.B pcap_datalink_name_to_val()
returns 0 on success and \-1 on failure.

10
pcap_datalink_val_to_name.3pcap
View File

@ -19,7 +19,7 @@
.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
.\"
.TH PCAP_DATALINK_VAL_TO_NAME 3PCAP "24 December 2008"
.TH PCAP_DATALINK_VAL_TO_NAME 3PCAP "22 August 2010"
.SH NAME
pcap_datalink_val_to_name, pcap_datalink_val_to_description \- get a
name or description for a link-layer header type value
@ -36,9 +36,9 @@ const char *pcap_datalink_val_to_description(int dlt);
.fi
.SH DESCRIPTION
.B pcap_datalink_val_to_name()
translates a data link type value to the corresponding data link type
name. NULL is returned on failure.
translates a link-layer header type value to the corresponding
link-layer header type name. NULL is returned on failure.
.PP
.B pcap_datalink_val_to_description()
translates a data link type value to a short description of that data
link type. NULL is returned on failure.
translates a link-layer header type value to a short description of that
link-layer header type. NULL is returned on failure.

2
pcap_fileno.3pcap
View File

@ -47,7 +47,7 @@ returns the file descriptor from which captured packets are read.
.LP
If
.I p
refers to a ``savefile'' that was opened using fuctions such as
refers to a ``savefile'' that was opened using functions such as
.BR pcap_open_offline()
or
.BR pcap_fopen_offline() ,

62
pcap_findalldevs.3pcap
View File

@ -19,9 +19,10 @@
.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
.\"
.TH PCAP_FINDALLDEVS 3PCAP "5 April 2008"
.TH PCAP_FINDALLDEVS 3PCAP "22 August 2010"
.SH NAME
pcap_findalldevs \- get a list of capture devices
pcap_findalldevs, pcap_freealldevs \- get a list of capture devices, and
free that list
.SH SYNOPSIS
.nf
.ft B
@ -35,6 +36,7 @@ char errbuf[PCAP_ERRBUF_SIZE];
.LP
.ft B
int pcap_findalldevs(pcap_if_t **alldevsp, char *errbuf);
void pcap_freealldevs(pcap_if_t *alldevs);
.ft
.fi
.SH DESCRIPTION
@ -48,12 +50,17 @@ or with
(Note that there may be network devices that cannot be opened by the
process calling
.BR pcap_findalldevs() ,
because, for example, that process might not have sufficient privileges
because, for example, that process does not have sufficient privileges
to open them for capturing; if so, those devices will not appear on the
list.)
If
.B pcap_findalldevs()
succeeds, the pointer pointed to by
.I alldevsp
is set to point to the first element of the list; each element of the
list is of type
is set to point to the first element of the list, or to
.B NULL
if no devices were found (this is considered success).
Each element of the list is of type
.BR pcap_if_t ,
and has the following members:
.RS
@ -75,14 +82,18 @@ if not
a pointer to a string giving a human-readable description of the device
.TP
.B addresses
a pointer to the first element of a list of addresses for the interface
a pointer to the first element of a list of network addresses for the
device,
or
.B NULL
if the device has no addresses
.TP
.B flags
interface flags:
device flags:
.RS
.TP
.B PCAP_IF_LOOPBACK
set if the interface is a loopback interface
set if the device is a loopback interface
.RE
.RE
.PP
@ -119,7 +130,7 @@ a pointer to a
that contains the broadcast address corresponding to the address pointed
to by
.BR addr ;
may be null if the interface doesn't support broadcasts
may be null if the device doesn't support broadcasts
.TP
.B dstaddr
if not
@ -129,21 +140,40 @@ a pointer to a
that contains the destination address corresponding to the address pointed
to by
.BR addr ;
may be null if the interface isn't a point-to-point interface
may be null if the device isn't a point-to-point interface
.RE
.PP
Note that not all the addresses in the list of addresses are
necessarily IPv4 or IPv6 addresses - you must check the
Note that the addresses in the list of addresses might be IPv4
addresses, IPv6 addresses, or some other type of addresses, so you must
check the
.B sa_family
member of the
.B "struct sockaddr"
before interpreting the contents of the address.
before interpreting the contents of the address; do not assume that the
addresses are all IPv4 addresses, or even all IPv4 or IPv6 addresses.
IPv4 addresses have the value
.BR AF_INET ,
IPv6 addresses have the value
.B AF_INET6
(which older operating systems that don't support IPv6 might not
define), and other addresses have other values. Whether other addresses
are returned, and what types they might have is platform-dependent.
For IPv4 addresses, the
.B "struct sockaddr"
pointer can be interpreted as if it pointed to a
.BR "struct sockaddr_in" ;
for IPv6 addresses, it can be interpreted as if it pointed to a
.BR "struct sockaddr_in6".
.PP
The list of devices must be freed with
.BR pcap_freealldevs() .
.BR pcap_freealldevs() ,
whch frees the list pointed to by
.IR alldevs .
.SH RETURN VALUE
.B pcap_findalldevs()
returns 0 on success and \-1 on failure.
returns 0 on success and \-1 on failure; as indicated, finding no
devices is considered success, rather than failure, so 0 will be
returned in that case.
If \-1 is returned,
.I errbuf
is filled in with an appropriate error message.
@ -153,4 +183,4 @@ is assumed to be able to hold at least
chars.
.SH SEE ALSO
pcap(3PCAP), pcap_create(3PCAP), pcap_activate(3PCAP),
pcap_open_live(3PCAP), pcap_freealldevs(3PCAP)
pcap_open_live(3PCAP)

41
pcap_free_datalinks.3pcap
View File

@ -1,41 +0,0 @@
.\" @(#) $Header: /tcpdump/master/libpcap/pcap_free_datalinks.3pcap,v 1.1 2008-05-26 19:58:06 guy Exp $
.\"
.\" Copyright (c) 1994, 1996, 1997
.\" The Regents of the University of California. All rights reserved.
.\"
.\" Redistribution and use in source and binary forms, with or without
.\" modification, are permitted provided that: (1) source code distributions
.\" retain the above copyright notice and this paragraph in its entirety, (2)
.\" distributions including binary code include the above copyright notice and
.\" this paragraph in its entirety in the documentation or other materials
.\" provided with the distribution, and (3) all advertising materials mentioning
.\" features or use of this software display the following acknowledgement:
.\" ``This product includes software developed by the University of California,
.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
.\" the University nor the names of its contributors may be used to endorse
.\" or promote products derived from this software without specific prior
.\" written permission.
.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
.\"
.TH PCAP_FREE_DATALINKS 3PCAP "26 May 2008"
.SH NAME
pcap_free_datalinks \- free a list of link-layer header types from
pcap_get_datalinks()
.SH SYNOPSIS
.nf
.ft B
#include <pcap/pcap.h>
.ft
.LP
.ft B
void pcap_free_datalinks(int *dlt_list);
.ft
.fi
.SH DESCRIPTION
.B pcap_free_datalinks()
is used to free a list of supported data link types returned by
.BR pcap_list_datalinks() .
.SH SEE ALSO
pcap(3PCAP), pcap_list_datalinks(3PCAP)

40
pcap_freealldevs.3pcap
View File

@ -1,40 +0,0 @@
.\" @(#) $Header: /tcpdump/master/libpcap/pcap_freealldevs.3pcap,v 1.3 2008-04-06 02:53:22 guy Exp $
.\"
.\" Copyright (c) 1994, 1996, 1997
.\" The Regents of the University of California. All rights reserved.
.\"
.\" Redistribution and use in source and binary forms, with or without
.\" modification, are permitted provided that: (1) source code distributions
.\" retain the above copyright notice and this paragraph in its entirety, (2)
.\" distributions including binary code include the above copyright notice and
.\" this paragraph in its entirety in the documentation or other materials
.\" provided with the distribution, and (3) all advertising materials mentioning
.\" features or use of this software display the following acknowledgement:
.\" ``This product includes software developed by the University of California,
.\" Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
.\" the University nor the names of its contributors may be used to endorse
.\" or promote products derived from this software without specific prior
.\" written permission.
.\" THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
.\"
.TH PCAP_FREEALLDEVS 3PCAP "5 April 2008"
.SH NAME
pcap_freealldevs \- free a list of capture devices
.SH SYNOPSIS
.nf
.ft B
#include <pcap/pcap.h>
.ft
.LP
.ft B
void pcap_freealldevs(pcap_if_t *alldevs);
.ft
.fi
.SH DESCRIPTION
.B pcap_freealldevs()
is used to free a list allocated by
.BR pcap_findalldevs() .
.SH SEE ALSO
pcap(3PCAP), pcap_findalldevs(3PCAP)

18
pcap_get_selectable_fd.3pcap
View File

@ -56,19 +56,29 @@ or
(for example, regular network devices on FreeBSD 4.3 and 4.4, and Endace
DAG devices), so \-1 is returned for those devices.
.PP
Note that on most versions of most BSDs (including Mac OS X)
Note that in:
.IP
FreeBSD prior to FreeBSD 4.6;
.IP
NetBSD prior to NetBSD 3.0;
.IP
OpenBSD prior to OpenBSD 2.4;
.IP
Mac OS X prior to Mac OS X 10.7;
.PP
.B select()
and
.B poll()
do not work correctly on BPF devices;
.B pcap_get_selectable_fd()
will return a file descriptor on most of those versions (the exceptions
being FreeBSD 4.3 and 4.4), a simple
being FreeBSD 4.3 and 4.4), but a simple
.B select()
or
.B poll()
will not return even after the read timeout expires. To work around
this, an application that uses
will not indicate that the descriptor is readable until a full buffer's
worth of packets is received, even if the read timeout expires before
then. To work around this, an application that uses
.B select()
or
.B poll()

26
pcap_list_datalinks.3pcap.in
View File

@ -19,10 +19,10 @@
.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
.\"
.TH PCAP_LIST_DATALINKS 3PCAP "5 April 2008"
.TH PCAP_LIST_DATALINKS 3PCAP "22 August 2010"
.SH NAME
pcap_list_datalinks \- get a list of link-layer header types supported
by a capture device
pcap_list_datalinks, pcap_free_datalinks \- get a list of link-layer header
types supported by a capture device, and free that list
.SH SYNOPSIS
.nf
.ft B
@ -31,21 +31,26 @@ by a capture device
.LP
.ft B
int pcap_list_datalinks(pcap_t *p, int **dlt_buf);
void pcap_free_datalinks(int *dlt_list);
.ft
.fi
.SH DESCRIPTION
.B pcap_list_datalinks()
is used to get a list of the supported data link types of the interface
associated with the pcap descriptor.
is used to get a list of the supported link-layer header types of the
interface associated with the pcap descriptor.
.B pcap_list_datalinks()
allocates an array to hold the list and sets
.IR *dlt_buf .
.IR *dlt_buf
to point to that array.
.LP
The caller is responsible for freeing the array with
.BR pcap_free_datalinks (3PCAP).
.BR pcap_free_datalinks() ,
which frees the list of link-layer header types pointed to by
.IR dlt_list .
.SH RETURN VALUE
.B pcap_list_datalinks()
returns the number of data link types in the array on success and \-1
on failure.
returns the number of link-layer header types in the array on success
and \-1 on failure.
If \-1 is returned,
.B pcap_geterr()
or
@ -54,5 +59,6 @@ may be called with
.I p
as an argument to fetch or display the error text.
.SH SEE ALSO
pcap(3PCAP), pcap_geterr(3PCAP), pcap_free_datalinks(3PCAP),
pcap(3PCAP), pcap_geterr(3PCAP),
pcap_datalink_val_to_name(3PCAP),
pcap-linktype(@MAN_MISC_INFO@)

7
pcap_loop.3pcap
View File

@ -109,7 +109,12 @@ pointer to the first
(as given in the
.I struct pcap_pkthdr
a pointer to which is passed to the callback routine)
bytes of data from the packet.
bytes of data from the packet. The
.I struct pcap_pkthdr
and the packet data are not to be freed by the callback routine, and are
not guaranteed to be valid after the callback routine returns; if the
code needs them to be valid after the callback, it must make a copy of
them.
.SH RETURN VALUE
.B pcap_loop()
returns 0 if

10
pcap_major_version.3pcap
View File

@ -36,12 +36,14 @@ int pcap_minor_version(pcap_t *p);
.SH DESCRIPTION
If
.I p
refers to a savefile,
refers to a ``savefile'',
.B pcap_major_version()
returns the major number of the file format of the savefile and
returns the major number of the file format of the ``savefile'' and
.B pcap_minor_version()
returns the minor number of the file format of the savefile. The
version number is stored in the header of the savefile.
returns the minor number of the file format of the ``savefile''. The
version number is stored in the ``savefile''; note that the meaning of
its values depends on the type of ``savefile'' (for example, pcap or
pcap-NG).
.PP
If
.I p

25
pcap_next_ex.3pcap
View File

@ -45,7 +45,16 @@ argument is set to point to the
struct for the packet, and the
pointer pointed to by the
.I pkt_data
argument is set to point to the data in the packet.
argument is set to point to the data in the packet. The
.I struct pcap_pkthdr
and the packet data are not to be freed by the caller, and are not
guaranteed to be valid after the next call to
.BR pcap_next_ex() ,
.BR pcap_next() ,
.BR pcap_loop() ,
or
.BR pcap_dispatch() ;
if the code needs them to remain valid, it must make a copy of them.
.PP
.B pcap_next()
reads the next packet (by calling
@ -54,7 +63,15 @@ with a
.I cnt
of 1) and returns a
.I u_char
pointer to the data in that packet.
pointer to the data in that packet. The
packet data is not to be freed by the caller, and is not
guaranteed to be valid after the next call to
.BR pcap_next_ex() ,
.BR pcap_next() ,
.BR pcap_loop() ,
or
.BR pcap_dispatch() ;
if the code needs it to remain valid, it must make a copy of it.
The
.I pcap_pkthdr
structure pointed to by
@ -78,13 +95,13 @@ as an argument to fetch or display the error text.
.B pcap_next()
returns a pointer to the packet data on success, and returns
.B NULL
if an error occured, or if no packets were read from a live
if an error occurred, or if no packets were read from a live
capture (if, for example, they were discarded because they didn't pass
the packet filter, or if, on platforms that support a read timeout that
starts before any packets arrive, the timeout expires before any packets
arrive, or if the file descriptor for the capture device is in
non-blocking mode and no packets were available to be read), or if no
more packets are available in a ``savefile.'' Unfortunately, there is
no way to determine whether an error occured or not.
no way to determine whether an error occurred or not.
.SH SEE ALSO
pcap(3PCAP), pcap_geterr(3PCAP), pcap_dispatch(3PCAP)

2
pcap_open_live.3pcap
View File

@ -74,7 +74,7 @@ is filled in with an appropriate error message.
.I errbuf
may also be set to warning text when
.B pcap_open_live()
succeds; to detect this case the caller should store a zero-length string in
succeeds; to detect this case the caller should store a zero-length string in
.I errbuf
before calling
.B pcap_open_live()

7
pcap_set_datalink.3pcap
View File

@ -19,7 +19,7 @@
.\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
.\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
.\"
.TH PCAP_SET_DATALINK 3PCAP "5 April 2008"
.TH PCAP_SET_DATALINK 3PCAP "22 August 2010"
.SH NAME
pcap_set_datalink \- set the link-layer header type to be used by a
capture device
@ -35,7 +35,7 @@ int pcap_set_datalink(pcap_t *p, int dlt);
.fi
.SH DESCRIPTION
.B pcap_set_datalink()
is used to set the current data link type of the pcap descriptor
is used to set the current link-layer header type of the pcap descriptor
to the type specified by
.IR dlt .
.SH RETURN VALUE
@ -49,4 +49,5 @@ may be called with
.I p
as an argument to fetch or display the error text.
.SH SEE ALSO
pcap(3PCAP), pcap_geterr(3PCAP)
pcap(3PCAP), pcap_geterr(3PCAP),
pcap_datalink_name_to_val(3PCAP)

15
savefile.c
View File

@ -94,10 +94,16 @@ static int
sf_setnonblock(pcap_t *p, int nonblock, char *errbuf)
{
/*
* This is a savefile, not a live capture file, so ignore
* requests to put it in non-blocking mode.
* This is a savefile, not a live capture file, so reject
* requests to put it in non-blocking mode. (If it's a
* pipe, it could be put in non-blocking mode, but that
* would significantly complicate the code to read packets,
* as it would have to handle reading partial packets and
* keeping the state of the read.)
*/
return (0);
snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
"Savefiles cannot be put into non-blocking mode");
return (-1);
}
static int
@ -161,6 +167,7 @@ sf_cleanup(pcap_t *p)
(void)fclose(p->sf.rfile);
if (p->buffer != NULL)
free(p->buffer);
pcap_freecode(&p->fcode);
}
pcap_t *
@ -376,7 +383,7 @@ pcap_offline_read(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
}
if ((fcode = p->fcode.bf_insns) == NULL ||
bpf_filter(fcode, p->buffer, h.len, h.caplen)) {
bpf_filter(fcode, data, h.len, h.caplen)) {
(*callback)(user, &h, data);
if (++n >= cnt && cnt > 0)
break;

6
scanner.l
View File

@ -54,7 +54,7 @@ static const char rcsid[] _U_ =
#include <pcap-stdinc.h>
#ifdef __MINGW32__
#include "IP6_misc.h"
#include "ip6_misc.h"
#endif
#else /* WIN32 */
#include <sys/socket.h> /* for "struct sockaddr" in "struct addrinfo" */
@ -77,6 +77,7 @@ static int stoi(char *);
static inline int xdtoi(int);
#ifdef FLEX_SCANNER
#define YY_NO_INPUT
#define YY_NO_UNPUT
static YY_BUFFER_STATE in_buffer;
#else
@ -202,6 +203,7 @@ igmp return IGMP;
igrp return IGRP;
pim return PIM;
vrrp return VRRP;
carp return CARP;
radio return RADIO;
ip6 {
@ -273,6 +275,8 @@ address1|addr1 return ADDR1;
address2|addr2 return ADDR2;
address3|addr3 return ADDR3;
address4|addr4 return ADDR4;
ra return RA;
ta return TA;
less return LESS;
greater return GREATER;

8
sf-pcap-ng.c
View File

@ -746,7 +746,7 @@ pcap_ng_check_header(pcap_t *p, bpf_u_int32 magic, FILE *fp, char *errbuf)
done:
p->tzoff = 0; /* XXX - not used in pcap */
p->snapshot = idbp->snaplen;
p->linktype = idbp->linktype;
p->linktype = linktype_to_dlt(idbp->linktype);
p->linktype_ext = 0;
p->sf.next_packet_op = pcap_ng_next_packet;
@ -772,7 +772,6 @@ pcap_ng_next_packet(pcap_t *p, struct pcap_pkthdr *hdr, u_char **data)
struct simple_packet_block *spbp;
struct packet_block *pbp;
bpf_u_int32 interface_id = 0xFFFFFFFF;
size_t pblock_len;
struct interface_description_block *idbp;
struct section_header_block *shbp;
FILE *fp = p->sf.rfile;
@ -823,7 +822,6 @@ pcap_ng_next_packet(pcap_t *p, struct pcap_pkthdr *hdr, u_char **data)
t = ((u_int64_t)epbp->timestamp_high) << 32 |
epbp->timestamp_low;
}
pblock_len = sizeof(*epbp);
goto found;
case BT_SPB:
@ -860,7 +858,6 @@ pcap_ng_next_packet(pcap_t *p, struct pcap_pkthdr *hdr, u_char **data)
if (hdr->caplen > p->snapshot)
hdr->caplen = p->snapshot;
t = 0; /* no time stamps */
pblock_len = sizeof(*spbp);
goto found;
case BT_PB:
@ -890,7 +887,6 @@ pcap_ng_next_packet(pcap_t *p, struct pcap_pkthdr *hdr, u_char **data)
t = ((u_int64_t)pbp->timestamp_high) << 32 |
pbp->timestamp_low;
}
pblock_len = sizeof(*pbp);
goto found;
case BT_IDB:
@ -1053,7 +1049,7 @@ pcap_ng_next_packet(pcap_t *p, struct pcap_pkthdr *hdr, u_char **data)
/*
* Is the interface ID an interface we know?
*/
if (interface_id > p->sf.ifcount) {
if (interface_id >= p->sf.ifcount) {
/*
* Yes. Fail.
*/

8
sf-pcap.c
View File

@ -271,8 +271,12 @@ pcap_check_header(pcap_t *p, bpf_u_int32 magic, FILE *fp, char *errbuf)
* Allocate a buffer for the packet data.
*/
p->bufsize = p->snapshot;
if (p->bufsize <= 0)
p->bufsize = BPF_MAXBUFSIZE;
if (p->bufsize <= 0) {
/*
* Bogus snapshot length; use 64KiB as a fallback.
*/
p->bufsize = 65536;
}
p->buffer = malloc(p->bufsize);
if (p->buffer == NULL) {
snprintf(errbuf, PCAP_ERRBUF_SIZE, "out of memory");