2 * Copyright (c) 1993, 1994, 1995, 1996, 1997, 1998
3 * The Regents of the University of California. All rights reserved.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 * 3. All advertising materials mentioning features or use of this software
14 * must display the following acknowledgement:
15 * This product includes software developed by the Computer Systems
16 * Engineering Group at Lawrence Berkeley Laboratory.
17 * 4. Neither the name of the University nor of the Laboratory may be used
18 * to endorse or promote products derived from this software without
19 * specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
35 static const char rcsid
[] =
36 "@(#) $Header: /tcpdump/master/libpcap/pcap.c,v 1.61 2003-07-25 05:32:05 guy Exp $ (LBL)";
44 #include <pcap-stdinc.h>
46 #include <sys/types.h>
58 #ifdef HAVE_OS_PROTO_H
65 pcap_dispatch(pcap_t
*p
, int cnt
, pcap_handler callback
, u_char
*user
)
68 return p
->read_op(p
, cnt
, callback
, user
);
72 * XXX - is this necessary?
75 pcap_read(pcap_t
*p
, int cnt
, pcap_handler callback
, u_char
*user
)
78 return p
->read_op(p
, cnt
, callback
, user
);
82 pcap_loop(pcap_t
*p
, int cnt
, pcap_handler callback
, u_char
*user
)
87 if (p
->sf
.rfile
!= NULL
) {
89 * 0 means EOF, so don't loop if we get 0.
91 n
= pcap_offline_read(p
, cnt
, callback
, user
);
94 * XXX keep reading until we get something
95 * (or an error occurs)
98 n
= p
->read_op(p
, cnt
, callback
, user
);
112 struct pcap_pkthdr
*hdr
;
118 pcap_oneshot(u_char
*userData
, const struct pcap_pkthdr
*h
, const u_char
*pkt
)
120 struct singleton
*sp
= (struct singleton
*)userData
;
126 pcap_next(pcap_t
*p
, struct pcap_pkthdr
*h
)
131 if (pcap_dispatch(p
, 1, pcap_oneshot
, (u_char
*)&s
) <= 0)
136 struct pkt_for_fakecallback
{
137 struct pcap_pkthdr
*hdr
;
142 pcap_fakecallback(u_char
*userData
, const struct pcap_pkthdr
*h
,
145 struct pkt_for_fakecallback
*sp
= (struct pkt_for_fakecallback
*)userData
;
152 pcap_next_ex(pcap_t
*p
, struct pcap_pkthdr
**pkt_header
,
153 const u_char
**pkt_data
)
155 struct pkt_for_fakecallback s
;
157 s
.hdr
= &p
->pcap_header
;
160 /* Saves a pointer to the packet headers */
161 *pkt_header
= &p
->pcap_header
;
163 if (p
->sf
.rfile
!= NULL
) {
166 /* We are on an offline capture */
167 status
= pcap_offline_read(p
, 1, pcap_fakecallback
,
171 * Return codes for pcap_offline_read() are:
175 * The first one ('0') conflicts with the return code of
176 * 0 from pcap_read() meaning "no packets arrived before
177 * the timeout expired", so we map it to -2 so you can
178 * distinguish between an EOF from a savefile and a
179 * "no packets arrived before the timeout expired, try
180 * again" from a live capture.
189 * Return codes for pcap_read() are:
193 * The first one ('0') conflicts with the return code of 0 from
194 * pcap_offline_read() meaning "end of file".
196 return (p
->read_op(p
, 1, pcap_fakecallback
, (u_char
*)&s
));
200 pcap_datalink(pcap_t
*p
)
202 return (p
->linktype
);
206 pcap_list_datalinks(pcap_t
*p
, int **dlt_buffer
)
208 if (p
->dlt_count
== 0) {
210 * We couldn't fetch the list of DLTs, which means
211 * this platform doesn't support changing the
212 * DLT for an interface. Return a list of DLTs
213 * containing only the DLT this device supports.
215 *dlt_buffer
= (int*)malloc(sizeof(**dlt_buffer
));
216 if (*dlt_buffer
== NULL
) {
217 (void)snprintf(p
->errbuf
, sizeof(p
->errbuf
),
218 "malloc: %s", pcap_strerror(errno
));
221 **dlt_buffer
= p
->linktype
;
224 *dlt_buffer
= (int*)malloc(sizeof(**dlt_buffer
) * p
->dlt_count
);
225 if (*dlt_buffer
== NULL
) {
226 (void)snprintf(p
->errbuf
, sizeof(p
->errbuf
),
227 "malloc: %s", pcap_strerror(errno
));
230 (void)memcpy(*dlt_buffer
, p
->dlt_list
,
231 sizeof(**dlt_buffer
) * p
->dlt_count
);
232 return (p
->dlt_count
);
237 pcap_set_datalink(pcap_t
*p
, int dlt
)
240 const char *dlt_name
;
242 if (p
->dlt_count
== 0 || p
->set_datalink_op
== NULL
) {
244 * We couldn't fetch the list of DLTs, or we don't
245 * have a "set datalink" operation, which means
246 * this platform doesn't support changing the
247 * DLT for an interface. Check whether the new
248 * DLT is the one this interface supports.
250 if (p
->linktype
!= dlt
)
254 * It is, so there's nothing we need to do here.
258 for (i
= 0; i
< p
->dlt_count
; i
++)
259 if (p
->dlt_list
[i
] == dlt
)
261 if (i
>= p
->dlt_count
)
263 if (p
->set_datalink_op(p
, dlt
) == -1)
269 dlt_name
= pcap_datalink_val_to_name(dlt
);
270 if (dlt_name
!= NULL
) {
271 (void) snprintf(p
->errbuf
, sizeof(p
->errbuf
),
272 "%s is not one of the DLTs supported by this device",
275 (void) snprintf(p
->errbuf
, sizeof(p
->errbuf
),
276 "DLT %d is not one of the DLTs supported by this device",
287 #define DLT_CHOICE(code) { #code, code }
288 #define DLT_CHOICE_SENTINEL { NULL, 0 }
290 static struct dlt_choice dlt_choices
[] = {
291 DLT_CHOICE(DLT_ARCNET
),
292 DLT_CHOICE(DLT_ARCNET_LINUX
),
293 DLT_CHOICE(DLT_EN10MB
),
294 DLT_CHOICE(DLT_SLIP
),
295 DLT_CHOICE(DLT_SLIP_BSDOS
),
296 DLT_CHOICE(DLT_NULL
),
297 DLT_CHOICE(DLT_LOOP
),
299 DLT_CHOICE(DLT_C_HDLC
),
300 DLT_CHOICE(DLT_PPP_SERIAL
),
301 DLT_CHOICE(DLT_PPP_ETHER
),
302 DLT_CHOICE(DLT_PPP_BSDOS
),
303 DLT_CHOICE(DLT_FDDI
),
304 DLT_CHOICE(DLT_IEEE802
),
305 DLT_CHOICE(DLT_IEEE802_11
),
306 DLT_CHOICE(DLT_PRISM_HEADER
),
307 DLT_CHOICE(DLT_IEEE802_11_RADIO
),
308 DLT_CHOICE(DLT_ATM_RFC1483
),
309 DLT_CHOICE(DLT_ATM_CLIP
),
310 DLT_CHOICE(DLT_SUNATM
),
312 DLT_CHOICE(DLT_LINUX_SLL
),
313 DLT_CHOICE(DLT_LTALK
),
314 DLT_CHOICE(DLT_IP_OVER_FC
),
315 DLT_CHOICE(DLT_FRELAY
),
320 * This array is designed for mapping upper and lower case letter
321 * together for a case independent comparison. The mappings are
322 * based upon ascii character sequences.
324 static const u_char charmap
[] = {
325 (u_char
)'\000', (u_char
)'\001', (u_char
)'\002', (u_char
)'\003',
326 (u_char
)'\004', (u_char
)'\005', (u_char
)'\006', (u_char
)'\007',
327 (u_char
)'\010', (u_char
)'\011', (u_char
)'\012', (u_char
)'\013',
328 (u_char
)'\014', (u_char
)'\015', (u_char
)'\016', (u_char
)'\017',
329 (u_char
)'\020', (u_char
)'\021', (u_char
)'\022', (u_char
)'\023',
330 (u_char
)'\024', (u_char
)'\025', (u_char
)'\026', (u_char
)'\027',
331 (u_char
)'\030', (u_char
)'\031', (u_char
)'\032', (u_char
)'\033',
332 (u_char
)'\034', (u_char
)'\035', (u_char
)'\036', (u_char
)'\037',
333 (u_char
)'\040', (u_char
)'\041', (u_char
)'\042', (u_char
)'\043',
334 (u_char
)'\044', (u_char
)'\045', (u_char
)'\046', (u_char
)'\047',
335 (u_char
)'\050', (u_char
)'\051', (u_char
)'\052', (u_char
)'\053',
336 (u_char
)'\054', (u_char
)'\055', (u_char
)'\056', (u_char
)'\057',
337 (u_char
)'\060', (u_char
)'\061', (u_char
)'\062', (u_char
)'\063',
338 (u_char
)'\064', (u_char
)'\065', (u_char
)'\066', (u_char
)'\067',
339 (u_char
)'\070', (u_char
)'\071', (u_char
)'\072', (u_char
)'\073',
340 (u_char
)'\074', (u_char
)'\075', (u_char
)'\076', (u_char
)'\077',
341 (u_char
)'\100', (u_char
)'\141', (u_char
)'\142', (u_char
)'\143',
342 (u_char
)'\144', (u_char
)'\145', (u_char
)'\146', (u_char
)'\147',
343 (u_char
)'\150', (u_char
)'\151', (u_char
)'\152', (u_char
)'\153',
344 (u_char
)'\154', (u_char
)'\155', (u_char
)'\156', (u_char
)'\157',
345 (u_char
)'\160', (u_char
)'\161', (u_char
)'\162', (u_char
)'\163',
346 (u_char
)'\164', (u_char
)'\165', (u_char
)'\166', (u_char
)'\167',
347 (u_char
)'\170', (u_char
)'\171', (u_char
)'\172', (u_char
)'\133',
348 (u_char
)'\134', (u_char
)'\135', (u_char
)'\136', (u_char
)'\137',
349 (u_char
)'\140', (u_char
)'\141', (u_char
)'\142', (u_char
)'\143',
350 (u_char
)'\144', (u_char
)'\145', (u_char
)'\146', (u_char
)'\147',
351 (u_char
)'\150', (u_char
)'\151', (u_char
)'\152', (u_char
)'\153',
352 (u_char
)'\154', (u_char
)'\155', (u_char
)'\156', (u_char
)'\157',
353 (u_char
)'\160', (u_char
)'\161', (u_char
)'\162', (u_char
)'\163',
354 (u_char
)'\164', (u_char
)'\165', (u_char
)'\166', (u_char
)'\167',
355 (u_char
)'\170', (u_char
)'\171', (u_char
)'\172', (u_char
)'\173',
356 (u_char
)'\174', (u_char
)'\175', (u_char
)'\176', (u_char
)'\177',
357 (u_char
)'\200', (u_char
)'\201', (u_char
)'\202', (u_char
)'\203',
358 (u_char
)'\204', (u_char
)'\205', (u_char
)'\206', (u_char
)'\207',
359 (u_char
)'\210', (u_char
)'\211', (u_char
)'\212', (u_char
)'\213',
360 (u_char
)'\214', (u_char
)'\215', (u_char
)'\216', (u_char
)'\217',
361 (u_char
)'\220', (u_char
)'\221', (u_char
)'\222', (u_char
)'\223',
362 (u_char
)'\224', (u_char
)'\225', (u_char
)'\226', (u_char
)'\227',
363 (u_char
)'\230', (u_char
)'\231', (u_char
)'\232', (u_char
)'\233',
364 (u_char
)'\234', (u_char
)'\235', (u_char
)'\236', (u_char
)'\237',
365 (u_char
)'\240', (u_char
)'\241', (u_char
)'\242', (u_char
)'\243',
366 (u_char
)'\244', (u_char
)'\245', (u_char
)'\246', (u_char
)'\247',
367 (u_char
)'\250', (u_char
)'\251', (u_char
)'\252', (u_char
)'\253',
368 (u_char
)'\254', (u_char
)'\255', (u_char
)'\256', (u_char
)'\257',
369 (u_char
)'\260', (u_char
)'\261', (u_char
)'\262', (u_char
)'\263',
370 (u_char
)'\264', (u_char
)'\265', (u_char
)'\266', (u_char
)'\267',
371 (u_char
)'\270', (u_char
)'\271', (u_char
)'\272', (u_char
)'\273',
372 (u_char
)'\274', (u_char
)'\275', (u_char
)'\276', (u_char
)'\277',
373 (u_char
)'\300', (u_char
)'\341', (u_char
)'\342', (u_char
)'\343',
374 (u_char
)'\344', (u_char
)'\345', (u_char
)'\346', (u_char
)'\347',
375 (u_char
)'\350', (u_char
)'\351', (u_char
)'\352', (u_char
)'\353',
376 (u_char
)'\354', (u_char
)'\355', (u_char
)'\356', (u_char
)'\357',
377 (u_char
)'\360', (u_char
)'\361', (u_char
)'\362', (u_char
)'\363',
378 (u_char
)'\364', (u_char
)'\365', (u_char
)'\366', (u_char
)'\367',
379 (u_char
)'\370', (u_char
)'\371', (u_char
)'\372', (u_char
)'\333',
380 (u_char
)'\334', (u_char
)'\335', (u_char
)'\336', (u_char
)'\337',
381 (u_char
)'\340', (u_char
)'\341', (u_char
)'\342', (u_char
)'\343',
382 (u_char
)'\344', (u_char
)'\345', (u_char
)'\346', (u_char
)'\347',
383 (u_char
)'\350', (u_char
)'\351', (u_char
)'\352', (u_char
)'\353',
384 (u_char
)'\354', (u_char
)'\355', (u_char
)'\356', (u_char
)'\357',
385 (u_char
)'\360', (u_char
)'\361', (u_char
)'\362', (u_char
)'\363',
386 (u_char
)'\364', (u_char
)'\365', (u_char
)'\366', (u_char
)'\367',
387 (u_char
)'\370', (u_char
)'\371', (u_char
)'\372', (u_char
)'\373',
388 (u_char
)'\374', (u_char
)'\375', (u_char
)'\376', (u_char
)'\377',
392 pcap_strcasecmp(const char *s1
, const char *s2
)
394 register const u_char
*cm
= charmap
,
398 while (cm
[*us1
] == cm
[*us2
++])
401 return (cm
[*us1
] - cm
[*--us2
]);
405 pcap_datalink_name_to_val(const char *name
)
409 for (i
= 0; dlt_choices
[i
].name
!= NULL
; i
++) {
410 if (pcap_strcasecmp(dlt_choices
[i
].name
+ sizeof("DLT_") - 1,
412 return (dlt_choices
[i
].dlt
);
418 pcap_datalink_val_to_name(int dlt
)
422 for (i
= 0; dlt_choices
[i
].name
!= NULL
; i
++) {
423 if (dlt_choices
[i
].dlt
== dlt
)
424 return (dlt_choices
[i
].name
+ sizeof("DLT_") - 1);
430 pcap_snapshot(pcap_t
*p
)
432 return (p
->snapshot
);
436 pcap_is_swapped(pcap_t
*p
)
438 return (p
->sf
.swapped
);
442 pcap_major_version(pcap_t
*p
)
444 return (p
->sf
.version_major
);
448 pcap_minor_version(pcap_t
*p
)
450 return (p
->sf
.version_minor
);
456 return (p
->sf
.rfile
);
460 pcap_fileno(pcap_t
*p
)
465 if (p
->adapter
!= NULL
)
466 return ((int)(DWORD
)p
->adapter
->hFile
);
473 pcap_perror(pcap_t
*p
, char *prefix
)
475 fprintf(stderr
, "%s: %s\n", prefix
, p
->errbuf
);
479 pcap_geterr(pcap_t
*p
)
485 * NOTE: in the future, these may need to call platform-dependent routines,
486 * e.g. on platforms with memory-mapped packet-capture mechanisms where
487 * "pcap_read()" uses "select()" or "poll()" to wait for packets to arrive.
490 pcap_getnonblock(pcap_t
*p
, char *errbuf
)
496 if (p
->sf
.rfile
!= NULL
) {
498 * This is a savefile, not a live capture file, so
499 * never say it's in non-blocking mode.
504 fdflags
= fcntl(p
->fd
, F_GETFL
, 0);
506 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
, "F_GETFL: %s",
507 pcap_strerror(errno
));
510 if (fdflags
& O_NONBLOCK
)
515 return (p
->nonblock
);
520 pcap_setnonblock(pcap_t
*p
, int nonblock
, char *errbuf
)
528 if (p
->sf
.rfile
!= NULL
) {
530 * This is a savefile, not a live capture file, so
531 * ignore requests to put it in non-blocking mode.
536 fdflags
= fcntl(p
->fd
, F_GETFL
, 0);
538 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
, "F_GETFL: %s",
539 pcap_strerror(errno
));
543 fdflags
|= O_NONBLOCK
;
545 fdflags
&= ~O_NONBLOCK
;
546 if (fcntl(p
->fd
, F_SETFL
, fdflags
) == -1) {
547 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
, "F_SETFL: %s",
548 pcap_strerror(errno
));
554 * Set the read timeout to -1 for non-blocking mode.
559 * Restore the timeout set when the device was opened.
560 * (Note that this may be -1, in which case we're not
561 * really leaving non-blocking mode.)
563 newtimeout
= p
->timeout
;
565 if (!PacketSetReadTimeout(p
->adapter
, newtimeout
)) {
566 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
,
567 "PacketSetReadTimeout: %s", pcap_win32strerror());
570 p
->nonblock
= (newtimeout
== -1);
577 * Generate a string for the last Win32-specific error (i.e. an error generated when
578 * calling a Win32 API).
579 * For errors occurred during standard C calls, we still use pcap_strerror()
582 pcap_win32strerror(void)
585 static char errbuf
[PCAP_ERRBUF_SIZE
+1];
588 error
= GetLastError();
589 FormatMessage(FORMAT_MESSAGE_FROM_SYSTEM
, NULL
, error
, 0, errbuf
,
590 PCAP_ERRBUF_SIZE
, NULL
);
593 * "FormatMessage()" "helpfully" sticks CR/LF at the end of the
594 * message. Get rid of it.
596 errlen
= strlen(errbuf
);
598 errbuf
[errlen
- 1] = '\0';
599 errbuf
[errlen
- 2] = '\0';
606 * Not all systems have strerror().
609 pcap_strerror(int errnum
)
612 return (strerror(errnum
));
615 extern const char *const sys_errlist
[];
616 static char ebuf
[20];
618 if ((unsigned int)errnum
< sys_nerr
)
619 return ((char *)sys_errlist
[errnum
]);
620 (void)snprintf(ebuf
, sizeof ebuf
, "Unknown error: %d", errnum
);
626 pcap_setfilter(pcap_t
*p
, struct bpf_program
*fp
)
628 return p
->setfilter_op(p
, fp
);
632 pcap_stats(pcap_t
*p
, struct pcap_stat
*ps
)
634 return p
->stats_op(p
, ps
);
638 pcap_stats_dead(pcap_t
*p
, struct pcap_stat
*ps
)
640 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
,
641 "Statistics aren't available from a pcap_open_dead pcap_t");
646 pcap_close_dead(pcap_t
*p
)
652 pcap_open_dead(int linktype
, int snaplen
)
656 p
= malloc(sizeof(*p
));
659 memset (p
, 0, sizeof(*p
));
660 p
->snapshot
= snaplen
;
661 p
->linktype
= linktype
;
662 p
->stats_op
= pcap_stats_dead
;
663 p
->close_op
= pcap_close_dead
;
668 pcap_close(pcap_t
*p
)
671 if (p
->dlt_list
!= NULL
)
673 pcap_freecode(&p
->fcode
);
678 * We make the version string static, and return a pointer to it, rather
679 * than exporting the version string directly. On at least some UNIXes,
680 * if you import data from a shared library into an program, the data is
681 * bound into the program binary, so if the string in the version of the
682 * library with which the program was linked isn't the same as the
683 * string in the version of the library with which the program is being
684 * run, various undesirable things may happen (warnings, the string
685 * being the one from the version of the library with which the program
686 * was linked, or even weirder things, such as the string being the one
687 * from the library but being truncated).
691 * XXX - it'd be nice if we could somehow generate the WinPcap and libpcap
692 * version numbers when building WinPcap. (It'd be nice to do so for
693 * the packet.dll version number as well.)
695 static const char wpcap_version_string
[] = "3.0";
696 static const char pcap_version_string_fmt
[] =
697 "WinPcap version %s, based on libpcap version 0.8";
698 static const char pcap_version_string_packet_dll_fmt
[] =
699 "WinPcap version %s (packet.dll version %s), based on libpcap version 0.8";
700 static char *pcap_version_string
;
703 pcap_lib_version(void)
705 char *packet_version_string
;
706 size_t pcap_version_string_len
;
708 if (pcap_version_string
== NULL
) {
710 * Generate the version string.
712 packet_version_string
= PacketGetVersion();
713 if (strcmp(wpcap_version_string
, packet_version_string
) == 0) {
715 * WinPcap version string and packet.dll version
716 * string are the same; just report the WinPcap
719 pcap_version_string_len
=
720 (sizeof pcap_version_string_fmt
- 2) +
721 strlen(wpcap_version_string
);
722 pcap_version_string
= malloc(pcap_version_string_len
);
723 sprintf(pcap_version_string
, pcap_version_string_fmt
,
724 wpcap_version_string
);
727 * WinPcap version string and packet.dll version
728 * string are different; that shouldn't be the
729 * case (the two libraries should come from the
730 * same version of WinPcap), so we report both
733 pcap_version_string_len
=
734 (sizeof pcap_version_string_packet_dll_fmt
- 4) +
735 strlen(wpcap_version_string
) +
736 strlen(packet_version_string
);
737 pcap_version_string
= malloc(pcap_version_string_len
);
738 sprintf(pcap_version_string
,
739 pcap_version_string_packet_dll_fmt
,
740 wpcap_version_string
, packet_version_string
);
743 return (pcap_version_string
);
749 pcap_lib_version(void)
751 return (pcap_version_string
);