The Tcpdump Group git mirrors - libpcap/blob - pcap-bpf.c

   1 /*
   2  * Copyright (c) 1993, 1994, 1995, 1996, 1998
   3  *      The Regents of the University of California.  All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that: (1) source code distributions
   7  * retain the above copyright notice and this paragraph in its entirety, (2)
   8  * distributions including binary code include the above copyright notice and
   9  * this paragraph in its entirety in the documentation or other materials
  10  * provided with the distribution, and (3) all advertising materials mentioning
  11  * features or use of this software display the following acknowledgement:
  12  * ``This product includes software developed by the University of California,
  13  * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
  14  * the University nor the names of its contributors may be used to endorse
  15  * or promote products derived from this software without specific prior
  16  * written permission.
  17  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
  18  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
  19  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  20  */
  21 #ifndef lint
  22 static const char rcsid[] =
  23     "@(#) $Header: /tcpdump/master/libpcap/pcap-bpf.c,v 1.35 2000-07-11 00:37:05 assar Exp $ (LBL)";
  24 #endif
  25
  26 #ifdef HAVE_CONFIG_H
  27 #include "config.h"
  28 #endif
  29
  30 #include <sys/param.h>                  /* optionally get BSD define */
  31 #include <sys/time.h>
  32 #include <sys/timeb.h>
  33 #include <sys/socket.h>
  34 #include <sys/file.h>
  35 #include <sys/ioctl.h>
  36
  37 #include <net/if.h>
  38
  39 #include <ctype.h>
  40 #include <errno.h>
  41 #include <netdb.h>
  42 #include <stdio.h>
  43 #include <stdlib.h>
  44 #include <string.h>
  45 #include <unistd.h>
  46
  47 #include "pcap-int.h"
  48
  49 #ifdef HAVE_OS_PROTO_H
  50 #include "os-proto.h"
  51 #endif
  52
  53 #include "gencode.h"
  54
  55 int
  56 pcap_stats(pcap_t *p, struct pcap_stat *ps)
  57 {
  58         struct bpf_stat s;
  59
  60         if (ioctl(p->fd, BIOCGSTATS, (caddr_t)&s) < 0) {
  61                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "BIOCGSTATS: %s",
  62                     pcap_strerror(errno));
  63                 return (-1);
  64         }
  65
  66         ps->ps_recv = s.bs_recv;
  67         ps->ps_drop = s.bs_drop;
  68         return (0);
  69 }
  70
  71 int
  72 pcap_read(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
  73 {
  74         int cc;
  75         int n = 0;
  76         register u_char *bp, *ep;
  77
  78  again:
  79         cc = p->cc;
  80         if (p->cc == 0) {
  81                 cc = read(p->fd, (char *)p->buffer, p->bufsize);
  82                 if (cc < 0) {
  83                         /* Don't choke when we get ptraced */
  84                         switch (errno) {
  85
  86                         case EINTR:
  87                                 goto again;
  88
  89                         case EWOULDBLOCK:
  90                                 return (0);
  91 #if defined(sun) && !defined(BSD)
  92                         /*
  93                          * Due to a SunOS bug, after 2^31 bytes, the kernel
  94                          * file offset overflows and read fails with EINVAL.
  95                          * The lseek() to 0 will fix things.
  96                          */
  97                         case EINVAL:
  98                                 if (lseek(p->fd, 0L, SEEK_CUR) +
  99                                     p->bufsize < 0) {
 100                                         (void)lseek(p->fd, 0L, SEEK_SET);
 101                                         goto again;
 102                                 }
 103                                 /* fall through */
 104 #endif
 105                         }
 106                         snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "read: %s",
 107                             pcap_strerror(errno));
 108                         return (-1);
 109                 }
 110                 bp = p->buffer;
 111         } else
 112                 bp = p->bp;
 113
 114         /*
 115          * Loop through each packet.
 116          */
 117 #define bhp ((struct bpf_hdr *)bp)
 118         ep = bp + cc;
 119         while (bp < ep) {
 120                 register int caplen, hdrlen;
 121                 caplen = bhp->bh_caplen;
 122                 hdrlen = bhp->bh_hdrlen;
 123                 /*
 124                  * XXX A bpf_hdr matches a pcap_pkthdr.
 125                  */
 126                 (*callback)(user, (struct pcap_pkthdr*)bp, bp + hdrlen);
 127                 bp += BPF_WORDALIGN(caplen + hdrlen);
 128                 if (++n >= cnt && cnt > 0) {
 129                         p->bp = bp;
 130                         p->cc = ep - bp;
 131                         return (n);
 132                 }
 133         }
 134 #undef bhp
 135         p->cc = 0;
 136         return (n);
 137 }
 138
 139 static inline int
 140 bpf_open(pcap_t *p, char *errbuf)
 141 {
 142         int fd;
 143         int n = 0;
 144         char device[sizeof "/dev/bpf0000000000"];
 145
 146         /*
 147          * Go through all the minors and find one that isn't in use.
 148          */
 149         do {
 150                 (void)snprintf(device, sizeof(device), "/dev/bpf%d", n++);
 151                 fd = open(device, O_RDONLY);
 152         } while (fd < 0 && errno == EBUSY);
 153
 154         /*
 155          * XXX better message for all minors used
 156          */
 157         if (fd < 0)
 158                 snprintf(errbuf, PCAP_ERRBUF_SIZE, "(no devices found) %s: %s",
 159                     device, pcap_strerror(errno));
 160
 161         return (fd);
 162 }
 163
 164 pcap_t *
 165 pcap_open_live(char *device, int snaplen, int promisc, int to_ms, char *ebuf)
 166 {
 167         int fd;
 168         struct ifreq ifr;
 169         struct bpf_version bv;
 170         u_int v;
 171         pcap_t *p;
 172
 173         p = (pcap_t *)malloc(sizeof(*p));
 174         if (p == NULL) {
 175                 snprintf(ebuf, PCAP_ERRBUF_SIZE, "malloc: %s",
 176                     pcap_strerror(errno));
 177                 return (NULL);
 178         }
 179         bzero(p, sizeof(*p));
 180         fd = bpf_open(p, ebuf);
 181         if (fd < 0)
 182                 goto bad;
 183
 184         p->fd = fd;
 185         p->snapshot = snaplen;
 186
 187         if (ioctl(fd, BIOCVERSION, (caddr_t)&bv) < 0) {
 188                 snprintf(ebuf, PCAP_ERRBUF_SIZE, "BIOCVERSION: %s",
 189                     pcap_strerror(errno));
 190                 goto bad;
 191         }
 192         if (bv.bv_major != BPF_MAJOR_VERSION ||
 193             bv.bv_minor < BPF_MINOR_VERSION) {
 194                 snprintf(ebuf, PCAP_ERRBUF_SIZE,
 195                     "kernel bpf filter out of date");
 196                 goto bad;
 197         }
 198         v = 32768;      /* XXX this should be a user-accessible hook */
 199         /* try finding a good size for the buffer */
 200         do {
 201                 (void) ioctl(fd, BIOCSBLEN, (caddr_t)&v);
 202
 203                 (void)strncpy(ifr.ifr_name, device, sizeof(ifr.ifr_name));
 204                 if ((ioctl(fd, BIOCSETIF, (caddr_t)&ifr) < 0) &&
 205                     (errno != ENOBUFS)) {
 206                         snprintf(ebuf, PCAP_ERRBUF_SIZE, "BIOCSETIF: %s: %s",
 207                             errno, device, pcap_strerror(errno));
 208                         goto bad;
 209                 }
 210                 v >>= 2;
 211         } while (fd < 0 && errno == ENOBUFS);
 212
 213         (void) ioctl(fd, BIOCSBLEN, (caddr_t)&v);
 214
 215         (void)strncpy(ifr.ifr_name, device, sizeof(ifr.ifr_name));
 216         if (ioctl(fd, BIOCSETIF, (caddr_t)&ifr) < 0) {
 217                 snprintf(ebuf, PCAP_ERRBUF_SIZE, "%s: %s",
 218                     device, pcap_strerror(errno));
 219                 goto bad;
 220         }
 221         /* Get the data link layer type. */
 222         if (ioctl(fd, BIOCGDLT, (caddr_t)&v) < 0) {
 223                 snprintf(ebuf, PCAP_ERRBUF_SIZE, "BIOCGDLT: %s",
 224                     pcap_strerror(errno));
 225                 goto bad;
 226         }
 227 #ifdef __OpenBSD__
 228         switch (v) {
 229         case DLT_LOOP:
 230                 v = DLT_NULL;
 231                 break;
 232         }
 233 #endif
 234 #if _BSDI_VERSION - 0 >= 199510
 235         /* The SLIP and PPP link layer header changed in BSD/OS 2.1 */
 236         switch (v) {
 237
 238         case DLT_SLIP:
 239                 v = DLT_SLIP_BSDOS;
 240                 break;
 241
 242         case DLT_PPP:
 243                 v = DLT_PPP_BSDOS;
 244                 break;
 245
 246         case 11:        /*DLT_FR*/
 247                 v = DLT_RAW;    /*XXX*/
 248                 break;
 249
 250         case 12:        /*DLT_C_HDLC*/
 251                 v = DLT_CHDLC;
 252                 break;
 253         }
 254 #endif
 255         p->linktype = v;
 256
 257         /* set timeout */
 258         if (to_ms != 0) {
 259                 struct timeval to;
 260                 to.tv_sec = to_ms / 1000;
 261                 to.tv_usec = (to_ms * 1000) % 1000000;
 262                 if (ioctl(p->fd, BIOCSRTIMEOUT, (caddr_t)&to) < 0) {
 263                         snprintf(ebuf, PCAP_ERRBUF_SIZE, "BIOCSRTIMEOUT: %s",
 264                             pcap_strerror(errno));
 265                         goto bad;
 266                 }
 267         }
 268
 269 #ifdef  BIOCIMMEDIATE
 270         v = 1;
 271         if (ioctl(p->fd, BIOCIMMEDIATE, &v) < 0) {
 272                 snprintf(ebuf, PCAP_ERRBUF_SIZE, "BIOCIMMEDIATE: %s",
 273                     pcap_strerror(errno));
 274                 goto bad;
 275         }
 276 #endif  /* BIOCIMMEDIATE */
 277
 278         if (promisc)
 279                 /* set promiscuous mode, okay if it fails */
 280                 (void)ioctl(p->fd, BIOCPROMISC, NULL);
 281
 282         if (ioctl(fd, BIOCGBLEN, (caddr_t)&v) < 0) {
 283                 snprintf(ebuf, PCAP_ERRBUF_SIZE, "BIOCGBLEN: %s",
 284                     pcap_strerror(errno));
 285                 goto bad;
 286         }
 287         p->bufsize = v;
 288         p->buffer = (u_char *)malloc(p->bufsize);
 289         if (p->buffer == NULL) {
 290                 snprintf(ebuf, PCAP_ERRBUF_SIZE, "malloc: %s",
 291                     pcap_strerror(errno));
 292                 goto bad;
 293         }
 294
 295         return (p);
 296  bad:
 297         (void)close(fd);
 298         free(p);
 299         return (NULL);
 300 }
 301
 302 int
 303 pcap_setfilter(pcap_t *p, struct bpf_program *fp)
 304 {
 305         /*
 306          * It looks that BPF code generated by gen_protochain() is not
 307          * compatible with some of kernel BPF code (for example BSD/OS 3.1).
 308          * Take a safer side for now.
 309          */
 310         if (no_optimize)
 311                 p->fcode = *fp;
 312         else if (p->sf.rfile != NULL)
 313                 p->fcode = *fp;
 314         else if (ioctl(p->fd, BIOCSETF, (caddr_t)fp) < 0) {
 315                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "BIOCSETF: %s",
 316                     pcap_strerror(errno));
 317                 return (-1);
 318         }
 319         return (0);
 320 }