2 * Copyright (c) 1993, 1994, 1995, 1996, 1997, 1998
3 * The Regents of the University of California. All rights reserved.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 * 3. All advertising materials mentioning features or use of this software
14 * must display the following acknowledgement:
15 * This product includes software developed by the Computer Systems
16 * Engineering Group at Lawrence Berkeley Laboratory.
17 * 4. Neither the name of the University nor of the Laboratory may be used
18 * to endorse or promote products derived from this software without
19 * specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
35 static const char rcsid
[] =
36 "@(#) $Header: /tcpdump/master/libpcap/pcap.c,v 1.60 2003-07-25 05:07:04 guy Exp $ (LBL)";
44 #include <pcap-stdinc.h>
46 #include <sys/types.h>
58 #ifdef HAVE_OS_PROTO_H
65 pcap_dispatch(pcap_t
*p
, int cnt
, pcap_handler callback
, u_char
*user
)
68 if (p
->sf
.rfile
!= NULL
)
69 return (pcap_offline_read(p
, cnt
, callback
, user
));
70 return (pcap_read(p
, cnt
, callback
, user
));
74 pcap_loop(pcap_t
*p
, int cnt
, pcap_handler callback
, u_char
*user
)
79 if (p
->sf
.rfile
!= NULL
)
80 n
= pcap_offline_read(p
, cnt
, callback
, user
);
83 * XXX keep reading until we get something
84 * (or an error occurs)
87 n
= pcap_read(p
, cnt
, callback
, user
);
101 struct pcap_pkthdr
*hdr
;
107 pcap_oneshot(u_char
*userData
, const struct pcap_pkthdr
*h
, const u_char
*pkt
)
109 struct singleton
*sp
= (struct singleton
*)userData
;
115 pcap_next(pcap_t
*p
, struct pcap_pkthdr
*h
)
120 if (pcap_dispatch(p
, 1, pcap_oneshot
, (u_char
*)&s
) <= 0)
125 struct pkt_for_fakecallback
{
126 struct pcap_pkthdr
*hdr
;
131 pcap_fakecallback(u_char
*userData
, const struct pcap_pkthdr
*h
,
134 struct pkt_for_fakecallback
*sp
= (struct pkt_for_fakecallback
*)userData
;
141 pcap_next_ex(pcap_t
*p
, struct pcap_pkthdr
**pkt_header
,
142 const u_char
**pkt_data
)
144 struct pkt_for_fakecallback s
;
146 s
.hdr
= &p
->pcap_header
;
149 /* Saves a pointer to the packet headers */
150 *pkt_header
= &p
->pcap_header
;
152 if (p
->sf
.rfile
!= NULL
) {
155 /* We are on an offline capture */
156 status
= pcap_offline_read(p
, 1, pcap_fakecallback
,
160 * Return codes for pcap_offline_read() are:
164 * The first one ('0') conflicts with the return code of
165 * 0 from pcap_read() meaning "no packets arrived before
166 * the timeout expired", so we map it to -2 so you can
167 * distinguish between an EOF from a savefile and a
168 * "no packets arrived before the timeout expired, try
169 * again" from a live capture.
178 * Return codes for pcap_read() are:
182 * The first one ('0') conflicts with the return code of 0 from
183 * pcap_offline_read() meaning "end of file".
185 return (pcap_read(p
, 1, pcap_fakecallback
, (u_char
*)&s
));
189 pcap_datalink(pcap_t
*p
)
191 return (p
->linktype
);
195 pcap_list_datalinks(pcap_t
*p
, int **dlt_buffer
)
197 if (p
->dlt_count
== 0) {
199 * We couldn't fetch the list of DLTs, which means
200 * this platform doesn't support changing the
201 * DLT for an interface. Return a list of DLTs
202 * containing only the DLT this device supports.
204 *dlt_buffer
= (int*)malloc(sizeof(**dlt_buffer
));
205 if (*dlt_buffer
== NULL
) {
206 (void)snprintf(p
->errbuf
, sizeof(p
->errbuf
),
207 "malloc: %s", pcap_strerror(errno
));
210 **dlt_buffer
= p
->linktype
;
213 *dlt_buffer
= (int*)malloc(sizeof(**dlt_buffer
) * p
->dlt_count
);
214 if (*dlt_buffer
== NULL
) {
215 (void)snprintf(p
->errbuf
, sizeof(p
->errbuf
),
216 "malloc: %s", pcap_strerror(errno
));
219 (void)memcpy(*dlt_buffer
, p
->dlt_list
,
220 sizeof(**dlt_buffer
) * p
->dlt_count
);
221 return (p
->dlt_count
);
226 pcap_set_datalink(pcap_t
*p
, int dlt
)
229 const char *dlt_name
;
231 if (p
->dlt_count
== 0 || p
->set_datalink_op
== NULL
) {
233 * We couldn't fetch the list of DLTs, or we don't
234 * have a "set datalink" operation, which means
235 * this platform doesn't support changing the
236 * DLT for an interface. Check whether the new
237 * DLT is the one this interface supports.
239 if (p
->linktype
!= dlt
)
243 * It is, so there's nothing we need to do here.
247 for (i
= 0; i
< p
->dlt_count
; i
++)
248 if (p
->dlt_list
[i
] == dlt
)
250 if (i
>= p
->dlt_count
)
252 if (p
->set_datalink_op(p
, dlt
) == -1)
258 dlt_name
= pcap_datalink_val_to_name(dlt
);
259 if (dlt_name
!= NULL
) {
260 (void) snprintf(p
->errbuf
, sizeof(p
->errbuf
),
261 "%s is not one of the DLTs supported by this device",
264 (void) snprintf(p
->errbuf
, sizeof(p
->errbuf
),
265 "DLT %d is not one of the DLTs supported by this device",
276 #define DLT_CHOICE(code) { #code, code }
277 #define DLT_CHOICE_SENTINEL { NULL, 0 }
279 static struct dlt_choice dlt_choices
[] = {
280 DLT_CHOICE(DLT_ARCNET
),
281 DLT_CHOICE(DLT_ARCNET_LINUX
),
282 DLT_CHOICE(DLT_EN10MB
),
283 DLT_CHOICE(DLT_SLIP
),
284 DLT_CHOICE(DLT_SLIP_BSDOS
),
285 DLT_CHOICE(DLT_NULL
),
286 DLT_CHOICE(DLT_LOOP
),
288 DLT_CHOICE(DLT_C_HDLC
),
289 DLT_CHOICE(DLT_PPP_SERIAL
),
290 DLT_CHOICE(DLT_PPP_ETHER
),
291 DLT_CHOICE(DLT_PPP_BSDOS
),
292 DLT_CHOICE(DLT_FDDI
),
293 DLT_CHOICE(DLT_IEEE802
),
294 DLT_CHOICE(DLT_IEEE802_11
),
295 DLT_CHOICE(DLT_PRISM_HEADER
),
296 DLT_CHOICE(DLT_IEEE802_11_RADIO
),
297 DLT_CHOICE(DLT_ATM_RFC1483
),
298 DLT_CHOICE(DLT_ATM_CLIP
),
299 DLT_CHOICE(DLT_SUNATM
),
301 DLT_CHOICE(DLT_LINUX_SLL
),
302 DLT_CHOICE(DLT_LTALK
),
303 DLT_CHOICE(DLT_IP_OVER_FC
),
304 DLT_CHOICE(DLT_FRELAY
),
309 * This array is designed for mapping upper and lower case letter
310 * together for a case independent comparison. The mappings are
311 * based upon ascii character sequences.
313 static const u_char charmap
[] = {
314 (u_char
)'\000', (u_char
)'\001', (u_char
)'\002', (u_char
)'\003',
315 (u_char
)'\004', (u_char
)'\005', (u_char
)'\006', (u_char
)'\007',
316 (u_char
)'\010', (u_char
)'\011', (u_char
)'\012', (u_char
)'\013',
317 (u_char
)'\014', (u_char
)'\015', (u_char
)'\016', (u_char
)'\017',
318 (u_char
)'\020', (u_char
)'\021', (u_char
)'\022', (u_char
)'\023',
319 (u_char
)'\024', (u_char
)'\025', (u_char
)'\026', (u_char
)'\027',
320 (u_char
)'\030', (u_char
)'\031', (u_char
)'\032', (u_char
)'\033',
321 (u_char
)'\034', (u_char
)'\035', (u_char
)'\036', (u_char
)'\037',
322 (u_char
)'\040', (u_char
)'\041', (u_char
)'\042', (u_char
)'\043',
323 (u_char
)'\044', (u_char
)'\045', (u_char
)'\046', (u_char
)'\047',
324 (u_char
)'\050', (u_char
)'\051', (u_char
)'\052', (u_char
)'\053',
325 (u_char
)'\054', (u_char
)'\055', (u_char
)'\056', (u_char
)'\057',
326 (u_char
)'\060', (u_char
)'\061', (u_char
)'\062', (u_char
)'\063',
327 (u_char
)'\064', (u_char
)'\065', (u_char
)'\066', (u_char
)'\067',
328 (u_char
)'\070', (u_char
)'\071', (u_char
)'\072', (u_char
)'\073',
329 (u_char
)'\074', (u_char
)'\075', (u_char
)'\076', (u_char
)'\077',
330 (u_char
)'\100', (u_char
)'\141', (u_char
)'\142', (u_char
)'\143',
331 (u_char
)'\144', (u_char
)'\145', (u_char
)'\146', (u_char
)'\147',
332 (u_char
)'\150', (u_char
)'\151', (u_char
)'\152', (u_char
)'\153',
333 (u_char
)'\154', (u_char
)'\155', (u_char
)'\156', (u_char
)'\157',
334 (u_char
)'\160', (u_char
)'\161', (u_char
)'\162', (u_char
)'\163',
335 (u_char
)'\164', (u_char
)'\165', (u_char
)'\166', (u_char
)'\167',
336 (u_char
)'\170', (u_char
)'\171', (u_char
)'\172', (u_char
)'\133',
337 (u_char
)'\134', (u_char
)'\135', (u_char
)'\136', (u_char
)'\137',
338 (u_char
)'\140', (u_char
)'\141', (u_char
)'\142', (u_char
)'\143',
339 (u_char
)'\144', (u_char
)'\145', (u_char
)'\146', (u_char
)'\147',
340 (u_char
)'\150', (u_char
)'\151', (u_char
)'\152', (u_char
)'\153',
341 (u_char
)'\154', (u_char
)'\155', (u_char
)'\156', (u_char
)'\157',
342 (u_char
)'\160', (u_char
)'\161', (u_char
)'\162', (u_char
)'\163',
343 (u_char
)'\164', (u_char
)'\165', (u_char
)'\166', (u_char
)'\167',
344 (u_char
)'\170', (u_char
)'\171', (u_char
)'\172', (u_char
)'\173',
345 (u_char
)'\174', (u_char
)'\175', (u_char
)'\176', (u_char
)'\177',
346 (u_char
)'\200', (u_char
)'\201', (u_char
)'\202', (u_char
)'\203',
347 (u_char
)'\204', (u_char
)'\205', (u_char
)'\206', (u_char
)'\207',
348 (u_char
)'\210', (u_char
)'\211', (u_char
)'\212', (u_char
)'\213',
349 (u_char
)'\214', (u_char
)'\215', (u_char
)'\216', (u_char
)'\217',
350 (u_char
)'\220', (u_char
)'\221', (u_char
)'\222', (u_char
)'\223',
351 (u_char
)'\224', (u_char
)'\225', (u_char
)'\226', (u_char
)'\227',
352 (u_char
)'\230', (u_char
)'\231', (u_char
)'\232', (u_char
)'\233',
353 (u_char
)'\234', (u_char
)'\235', (u_char
)'\236', (u_char
)'\237',
354 (u_char
)'\240', (u_char
)'\241', (u_char
)'\242', (u_char
)'\243',
355 (u_char
)'\244', (u_char
)'\245', (u_char
)'\246', (u_char
)'\247',
356 (u_char
)'\250', (u_char
)'\251', (u_char
)'\252', (u_char
)'\253',
357 (u_char
)'\254', (u_char
)'\255', (u_char
)'\256', (u_char
)'\257',
358 (u_char
)'\260', (u_char
)'\261', (u_char
)'\262', (u_char
)'\263',
359 (u_char
)'\264', (u_char
)'\265', (u_char
)'\266', (u_char
)'\267',
360 (u_char
)'\270', (u_char
)'\271', (u_char
)'\272', (u_char
)'\273',
361 (u_char
)'\274', (u_char
)'\275', (u_char
)'\276', (u_char
)'\277',
362 (u_char
)'\300', (u_char
)'\341', (u_char
)'\342', (u_char
)'\343',
363 (u_char
)'\344', (u_char
)'\345', (u_char
)'\346', (u_char
)'\347',
364 (u_char
)'\350', (u_char
)'\351', (u_char
)'\352', (u_char
)'\353',
365 (u_char
)'\354', (u_char
)'\355', (u_char
)'\356', (u_char
)'\357',
366 (u_char
)'\360', (u_char
)'\361', (u_char
)'\362', (u_char
)'\363',
367 (u_char
)'\364', (u_char
)'\365', (u_char
)'\366', (u_char
)'\367',
368 (u_char
)'\370', (u_char
)'\371', (u_char
)'\372', (u_char
)'\333',
369 (u_char
)'\334', (u_char
)'\335', (u_char
)'\336', (u_char
)'\337',
370 (u_char
)'\340', (u_char
)'\341', (u_char
)'\342', (u_char
)'\343',
371 (u_char
)'\344', (u_char
)'\345', (u_char
)'\346', (u_char
)'\347',
372 (u_char
)'\350', (u_char
)'\351', (u_char
)'\352', (u_char
)'\353',
373 (u_char
)'\354', (u_char
)'\355', (u_char
)'\356', (u_char
)'\357',
374 (u_char
)'\360', (u_char
)'\361', (u_char
)'\362', (u_char
)'\363',
375 (u_char
)'\364', (u_char
)'\365', (u_char
)'\366', (u_char
)'\367',
376 (u_char
)'\370', (u_char
)'\371', (u_char
)'\372', (u_char
)'\373',
377 (u_char
)'\374', (u_char
)'\375', (u_char
)'\376', (u_char
)'\377',
381 pcap_strcasecmp(const char *s1
, const char *s2
)
383 register const u_char
*cm
= charmap
,
387 while (cm
[*us1
] == cm
[*us2
++])
390 return (cm
[*us1
] - cm
[*--us2
]);
394 pcap_datalink_name_to_val(const char *name
)
398 for (i
= 0; dlt_choices
[i
].name
!= NULL
; i
++) {
399 if (pcap_strcasecmp(dlt_choices
[i
].name
+ sizeof("DLT_") - 1,
401 return (dlt_choices
[i
].dlt
);
407 pcap_datalink_val_to_name(int dlt
)
411 for (i
= 0; dlt_choices
[i
].name
!= NULL
; i
++) {
412 if (dlt_choices
[i
].dlt
== dlt
)
413 return (dlt_choices
[i
].name
+ sizeof("DLT_") - 1);
419 pcap_snapshot(pcap_t
*p
)
421 return (p
->snapshot
);
425 pcap_is_swapped(pcap_t
*p
)
427 return (p
->sf
.swapped
);
431 pcap_major_version(pcap_t
*p
)
433 return (p
->sf
.version_major
);
437 pcap_minor_version(pcap_t
*p
)
439 return (p
->sf
.version_minor
);
445 return (p
->sf
.rfile
);
449 pcap_fileno(pcap_t
*p
)
454 if (p
->adapter
!= NULL
)
455 return ((int)(DWORD
)p
->adapter
->hFile
);
462 pcap_perror(pcap_t
*p
, char *prefix
)
464 fprintf(stderr
, "%s: %s\n", prefix
, p
->errbuf
);
468 pcap_geterr(pcap_t
*p
)
474 * NOTE: in the future, these may need to call platform-dependent routines,
475 * e.g. on platforms with memory-mapped packet-capture mechanisms where
476 * "pcap_read()" uses "select()" or "poll()" to wait for packets to arrive.
479 pcap_getnonblock(pcap_t
*p
, char *errbuf
)
485 if (p
->sf
.rfile
!= NULL
) {
487 * This is a savefile, not a live capture file, so
488 * never say it's in non-blocking mode.
493 fdflags
= fcntl(p
->fd
, F_GETFL
, 0);
495 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
, "F_GETFL: %s",
496 pcap_strerror(errno
));
499 if (fdflags
& O_NONBLOCK
)
504 return (p
->nonblock
);
509 pcap_setnonblock(pcap_t
*p
, int nonblock
, char *errbuf
)
517 if (p
->sf
.rfile
!= NULL
) {
519 * This is a savefile, not a live capture file, so
520 * ignore requests to put it in non-blocking mode.
525 fdflags
= fcntl(p
->fd
, F_GETFL
, 0);
527 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
, "F_GETFL: %s",
528 pcap_strerror(errno
));
532 fdflags
|= O_NONBLOCK
;
534 fdflags
&= ~O_NONBLOCK
;
535 if (fcntl(p
->fd
, F_SETFL
, fdflags
) == -1) {
536 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
, "F_SETFL: %s",
537 pcap_strerror(errno
));
543 * Set the read timeout to -1 for non-blocking mode.
548 * Restore the timeout set when the device was opened.
549 * (Note that this may be -1, in which case we're not
550 * really leaving non-blocking mode.)
552 newtimeout
= p
->timeout
;
554 if (!PacketSetReadTimeout(p
->adapter
, newtimeout
)) {
555 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
,
556 "PacketSetReadTimeout: %s", pcap_win32strerror());
559 p
->nonblock
= (newtimeout
== -1);
566 * Generate a string for the last Win32-specific error (i.e. an error generated when
567 * calling a Win32 API).
568 * For errors occurred during standard C calls, we still use pcap_strerror()
571 pcap_win32strerror(void)
574 static char errbuf
[PCAP_ERRBUF_SIZE
+1];
577 error
= GetLastError();
578 FormatMessage(FORMAT_MESSAGE_FROM_SYSTEM
, NULL
, error
, 0, errbuf
,
579 PCAP_ERRBUF_SIZE
, NULL
);
582 * "FormatMessage()" "helpfully" sticks CR/LF at the end of the
583 * message. Get rid of it.
585 errlen
= strlen(errbuf
);
587 errbuf
[errlen
- 1] = '\0';
588 errbuf
[errlen
- 2] = '\0';
595 * Not all systems have strerror().
598 pcap_strerror(int errnum
)
601 return (strerror(errnum
));
604 extern const char *const sys_errlist
[];
605 static char ebuf
[20];
607 if ((unsigned int)errnum
< sys_nerr
)
608 return ((char *)sys_errlist
[errnum
]);
609 (void)snprintf(ebuf
, sizeof ebuf
, "Unknown error: %d", errnum
);
615 pcap_setfilter(pcap_t
*p
, struct bpf_program
*fp
)
617 return p
->setfilter_op(p
, fp
);
621 pcap_stats(pcap_t
*p
, struct pcap_stat
*ps
)
623 return p
->stats_op(p
, ps
);
627 pcap_stats_dead(pcap_t
*p
, struct pcap_stat
*ps
)
629 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
,
630 "Statistics aren't available from a pcap_open_dead pcap_t");
635 pcap_close_dead(pcap_t
*p
)
641 pcap_open_dead(int linktype
, int snaplen
)
645 p
= malloc(sizeof(*p
));
648 memset (p
, 0, sizeof(*p
));
649 p
->snapshot
= snaplen
;
650 p
->linktype
= linktype
;
651 p
->stats_op
= pcap_stats_dead
;
652 p
->close_op
= pcap_close_dead
;
657 pcap_close(pcap_t
*p
)
660 if (p
->dlt_list
!= NULL
)
662 pcap_freecode(&p
->fcode
);
667 * We make the version string static, and return a pointer to it, rather
668 * than exporting the version string directly. On at least some UNIXes,
669 * if you import data from a shared library into an program, the data is
670 * bound into the program binary, so if the string in the version of the
671 * library with which the program was linked isn't the same as the
672 * string in the version of the library with which the program is being
673 * run, various undesirable things may happen (warnings, the string
674 * being the one from the version of the library with which the program
675 * was linked, or even weirder things, such as the string being the one
676 * from the library but being truncated).
680 * XXX - it'd be nice if we could somehow generate the WinPcap and libpcap
681 * version numbers when building WinPcap. (It'd be nice to do so for
682 * the packet.dll version number as well.)
684 static const char wpcap_version_string
[] = "3.0";
685 static const char pcap_version_string_fmt
[] =
686 "WinPcap version %s, based on libpcap version 0.8";
687 static const char pcap_version_string_packet_dll_fmt
[] =
688 "WinPcap version %s (packet.dll version %s), based on libpcap version 0.8";
689 static char *pcap_version_string
;
692 pcap_lib_version(void)
694 char *packet_version_string
;
695 size_t pcap_version_string_len
;
697 if (pcap_version_string
== NULL
) {
699 * Generate the version string.
701 packet_version_string
= PacketGetVersion();
702 if (strcmp(wpcap_version_string
, packet_version_string
) == 0) {
704 * WinPcap version string and packet.dll version
705 * string are the same; just report the WinPcap
708 pcap_version_string_len
=
709 (sizeof pcap_version_string_fmt
- 2) +
710 strlen(wpcap_version_string
);
711 pcap_version_string
= malloc(pcap_version_string_len
);
712 sprintf(pcap_version_string
, pcap_version_string_fmt
,
713 wpcap_version_string
);
716 * WinPcap version string and packet.dll version
717 * string are different; that shouldn't be the
718 * case (the two libraries should come from the
719 * same version of WinPcap), so we report both
722 pcap_version_string_len
=
723 (sizeof pcap_version_string_packet_dll_fmt
- 4) +
724 strlen(wpcap_version_string
) +
725 strlen(packet_version_string
);
726 pcap_version_string
= malloc(pcap_version_string_len
);
727 sprintf(pcap_version_string
,
728 pcap_version_string_packet_dll_fmt
,
729 wpcap_version_string
, packet_version_string
);
732 return (pcap_version_string
);
738 pcap_lib_version(void)
740 return (pcap_version_string
);