The Tcpdump Group git mirrors - libpcap/blob - pcap-win32.c

   1 /*
   2  * Copyright (c) 1999 - 2005 NetGroup, Politecnico di Torino (Italy)
   3  * Copyright (c) 2005 - 2008 CACE Technologies, Davis (California)
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  *
  10  * 1. Redistributions of source code must retain the above copyright
  11  * notice, this list of conditions and the following disclaimer.
  12  * 2. Redistributions in binary form must reproduce the above copyright
  13  * notice, this list of conditions and the following disclaimer in the
  14  * documentation and/or other materials provided with the distribution.
  15  * 3. Neither the name of the Politecnico di Torino, CACE Technologies
  16  * nor the names of its contributors may be used to endorse or promote
  17  * products derived from this software without specific prior written
  18  * permission.
  19  *
  20  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  21  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  22  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
  23  * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
  24  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  25  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  26  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  27  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  28  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  29  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  30  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  31  *
  32  */
  33
  34 #ifndef lint
  35 static const char rcsid[] _U_ =
  36     "@(#) $Header: /tcpdump/master/libpcap/pcap-win32.c,v 1.42 2008-05-21 22:15:25 gianluca Exp $ (LBL)";
  37 #endif
  38
  39 #include <pcap-int.h>
  40 #include <Packet32.h>
  41 #ifdef __MINGW32__
  42 #ifdef __MINGW64__
  43 #include <ntddndis.h>
  44 #else  /*__MINGW64__*/
  45 #include <ddk/ntddndis.h>
  46 #include <ddk/ndis.h>
  47 #endif /*__MINGW64__*/
  48 #else /*__MINGW32__*/
  49 #include <ntddndis.h>
  50 #endif /*__MINGW32__*/
  51 #ifdef HAVE_DAG_API
  52 #include <dagnew.h>
  53 #include <dagapi.h>
  54 #endif /* HAVE_DAG_API */
  55 #ifdef __MINGW32__
  56 int* _errno();
  57 #define errno (*_errno())
  58 #endif /* __MINGW32__ */
  59
  60 static int pcap_setfilter_win32_npf(pcap_t *, struct bpf_program *);
  61 static int pcap_setfilter_win32_dag(pcap_t *, struct bpf_program *);
  62 static int pcap_getnonblock_win32(pcap_t *, char *);
  63 static int pcap_setnonblock_win32(pcap_t *, int, char *);
  64
  65 /*dimension of the buffer in the pcap_t structure*/
  66 #define WIN32_DEFAULT_USER_BUFFER_SIZE 256000
  67
  68 /*dimension of the buffer in the kernel driver NPF */
  69 #define WIN32_DEFAULT_KERNEL_BUFFER_SIZE 1000000
  70
  71 /* Equivalent to ntohs(), but a lot faster under Windows */
  72 #define SWAPS(_X) ((_X & 0xff) << 8) | (_X >> 8)
  73
  74 /*
  75  * Private data for capturing on WinPcap devices.
  76  */
  77 struct pcap_win {
  78         int nonblock;
  79
  80 #ifdef HAVE_DAG_API
  81         int     dag_fcs_bits;   /* Number of checksum bits from link layer */
  82 #endif
  83 };
  84
  85 /*
  86  * Header that the WinPcap driver associates to the packets.
  87  * Once was in bpf.h
  88  */
  89 struct bpf_hdr {
  90         struct timeval  bh_tstamp;      /* time stamp */
  91         bpf_u_int32     bh_caplen;      /* length of captured portion */
  92         bpf_u_int32     bh_datalen;     /* original length of packet */
  93         u_short         bh_hdrlen;      /* length of bpf header (this struct
  94                                            plus alignment padding) */
  95 };
  96
  97 CRITICAL_SECTION g_PcapCompileCriticalSection;
  98
  99 BOOL WINAPI DllMain(
 100   HANDLE hinstDLL,
 101   DWORD dwReason,
 102   LPVOID lpvReserved
 103 )
 104 {
 105         if (dwReason == DLL_PROCESS_ATTACH)
 106         {
 107                 InitializeCriticalSection(&g_PcapCompileCriticalSection);
 108         }
 109
 110         return TRUE;
 111 }
 112
 113 /* Start winsock */
 114 int
 115 wsockinit()
 116 {
 117         WORD wVersionRequested;
 118         WSADATA wsaData;
 119         int err;
 120         wVersionRequested = MAKEWORD( 1, 1);
 121         err = WSAStartup( wVersionRequested, &wsaData );
 122         if ( err != 0 )
 123         {
 124                 return -1;
 125         }
 126         return 0;
 127 }
 128
 129
 130 static int
 131 pcap_stats_win32(pcap_t *p, struct pcap_stat *ps)
 132 {
 133
 134         if(PacketGetStats(p->adapter, (struct bpf_stat*)ps) != TRUE){
 135                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "PacketGetStats error: %s", pcap_win32strerror());
 136                 return -1;
 137         }
 138
 139         return 0;
 140 }
 141
 142 /* Set the dimension of the kernel-level capture buffer */
 143 static int
 144 pcap_setbuff_win32(pcap_t *p, int dim)
 145 {
 146         if(PacketSetBuff(p->adapter,dim)==FALSE)
 147         {
 148                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "driver error: not enough memory to allocate the kernel buffer");
 149                 return -1;
 150         }
 151         return 0;
 152 }
 153
 154 /* Set the driver working mode */
 155 static int
 156 pcap_setmode_win32(pcap_t *p, int mode)
 157 {
 158         if(PacketSetMode(p->adapter,mode)==FALSE)
 159         {
 160                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "driver error: working mode not recognized");
 161                 return -1;
 162         }
 163
 164         return 0;
 165 }
 166
 167 /*set the minimum amount of data that will release a read call*/
 168 static int
 169 pcap_setmintocopy_win32(pcap_t *p, int size)
 170 {
 171         if(PacketSetMinToCopy(p->adapter, size)==FALSE)
 172         {
 173                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "driver error: unable to set the requested mintocopy size");
 174                 return -1;
 175         }
 176         return 0;
 177 }
 178
 179 static int
 180 pcap_read_win32_npf(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
 181 {
 182         int cc;
 183         int n = 0;
 184         register u_char *bp, *ep;
 185
 186         cc = p->cc;
 187         if (p->cc == 0) {
 188                 /*
 189                  * Has "pcap_breakloop()" been called?
 190                  */
 191                 if (p->break_loop) {
 192                         /*
 193                          * Yes - clear the flag that indicates that it
 194                          * has, and return -2 to indicate that we were
 195                          * told to break out of the loop.
 196                          */
 197                         p->break_loop = 0;
 198                         return (-2);
 199                 }
 200
 201             /* capture the packets */
 202                 if(PacketReceivePacket(p->adapter,p->Packet,TRUE)==FALSE){
 203                         snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "read error: PacketReceivePacket failed");
 204                         return (-1);
 205                 }
 206
 207                 cc = p->Packet->ulBytesReceived;
 208
 209                 bp = p->Packet->Buffer;
 210         }
 211         else
 212                 bp = p->bp;
 213
 214         /*
 215          * Loop through each packet.
 216          */
 217 #define bhp ((struct bpf_hdr *)bp)
 218         ep = bp + cc;
 219         while (1) {
 220                 register int caplen, hdrlen;
 221
 222                 /*
 223                  * Has "pcap_breakloop()" been called?
 224                  * If so, return immediately - if we haven't read any
 225                  * packets, clear the flag and return -2 to indicate
 226                  * that we were told to break out of the loop, otherwise
 227                  * leave the flag set, so that the *next* call will break
 228                  * out of the loop without having read any packets, and
 229                  * return the number of packets we've processed so far.
 230                  */
 231                 if (p->break_loop) {
 232                         if (n == 0) {
 233                                 p->break_loop = 0;
 234                                 return (-2);
 235                         } else {
 236                                 p->bp = bp;
 237                                 p->cc = ep - bp;
 238                                 return (n);
 239                         }
 240                 }
 241                 if (bp >= ep)
 242                         break;
 243
 244                 caplen = bhp->bh_caplen;
 245                 hdrlen = bhp->bh_hdrlen;
 246
 247                 /*
 248                  * XXX A bpf_hdr matches a pcap_pkthdr.
 249                  */
 250                 (*callback)(user, (struct pcap_pkthdr*)bp, bp + hdrlen);
 251                 bp += Packet_WORDALIGN(caplen + hdrlen);
 252                 if (++n >= cnt && cnt > 0) {
 253                         p->bp = bp;
 254                         p->cc = ep - bp;
 255                         return (n);
 256                 }
 257         }
 258 #undef bhp
 259         p->cc = 0;
 260         return (n);
 261 }
 262
 263 #ifdef HAVE_DAG_API
 264 static int
 265 pcap_read_win32_dag(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
 266 {
 267         struct pcap_win *pw = p->private;
 268         u_char *dp = NULL;
 269         int     packet_len = 0, caplen = 0;
 270         struct pcap_pkthdr      pcap_header;
 271         u_char *endofbuf;
 272         int n = 0;
 273         dag_record_t *header;
 274         unsigned erf_record_len;
 275         ULONGLONG ts;
 276         int cc;
 277         unsigned swt;
 278         unsigned dfp = p->adapter->DagFastProcess;
 279
 280         cc = p->cc;
 281         if (cc == 0) /* Get new packets only if we have processed all the ones of the previous read */
 282         {
 283             /* Get new packets from the network */
 284                 if(PacketReceivePacket(p->adapter, p->Packet, TRUE)==FALSE){
 285                         snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "read error: PacketReceivePacket failed");
 286                         return (-1);
 287                 }
 288
 289                 cc = p->Packet->ulBytesReceived;
 290                 if(cc == 0)
 291                         /* The timeout has expired but we no packets arrived */
 292                         return 0;
 293                 header = (dag_record_t*)p->adapter->DagBuffer;
 294         }
 295         else
 296                 header = (dag_record_t*)p->bp;
 297
 298         endofbuf = (char*)header + cc;
 299
 300         /*
 301          * Cycle through the packets
 302          */
 303         do
 304         {
 305                 erf_record_len = SWAPS(header->rlen);
 306                 if((char*)header + erf_record_len > endofbuf)
 307                         break;
 308
 309                 /* Increase the number of captured packets */
 310                 pw->stat.ps_recv++;
 311
 312                 /* Find the beginning of the packet */
 313                 dp = ((u_char *)header) + dag_record_size;
 314
 315                 /* Determine actual packet len */
 316                 switch(header->type)
 317                 {
 318                 case TYPE_ATM:
 319                         packet_len = ATM_SNAPLEN;
 320                         caplen = ATM_SNAPLEN;
 321                         dp += 4;
 322
 323                         break;
 324
 325                 case TYPE_ETH:
 326                         swt = SWAPS(header->wlen);
 327                         packet_len = swt - (pw->dag_fcs_bits);
 328                         caplen = erf_record_len - dag_record_size - 2;
 329                         if (caplen > packet_len)
 330                         {
 331                                 caplen = packet_len;
 332                         }
 333                         dp += 2;
 334
 335                         break;
 336
 337                 case TYPE_HDLC_POS:
 338                         swt = SWAPS(header->wlen);
 339                         packet_len = swt - (pw->dag_fcs_bits);
 340                         caplen = erf_record_len - dag_record_size;
 341                         if (caplen > packet_len)
 342                         {
 343                                 caplen = packet_len;
 344                         }
 345
 346                         break;
 347                 }
 348
 349                 if(caplen > p->snapshot)
 350                         caplen = p->snapshot;
 351
 352                 /*
 353                  * Has "pcap_breakloop()" been called?
 354                  * If so, return immediately - if we haven't read any
 355                  * packets, clear the flag and return -2 to indicate
 356                  * that we were told to break out of the loop, otherwise
 357                  * leave the flag set, so that the *next* call will break
 358                  * out of the loop without having read any packets, and
 359                  * return the number of packets we've processed so far.
 360                  */
 361                 if (p->break_loop)
 362                 {
 363                         if (n == 0)
 364                         {
 365                                 p->break_loop = 0;
 366                                 return (-2);
 367                         }
 368                         else
 369                         {
 370                                 p->bp = (char*)header;
 371                                 p->cc = endofbuf - (char*)header;
 372                                 return (n);
 373                         }
 374                 }
 375
 376                 if(!dfp)
 377                 {
 378                         /* convert between timestamp formats */
 379                         ts = header->ts;
 380                         pcap_header.ts.tv_sec = (int)(ts >> 32);
 381                         ts = (ts & 0xffffffffi64) * 1000000;
 382                         ts += 0x80000000; /* rounding */
 383                         pcap_header.ts.tv_usec = (int)(ts >> 32);
 384                         if (pcap_header.ts.tv_usec >= 1000000) {
 385                                 pcap_header.ts.tv_usec -= 1000000;
 386                                 pcap_header.ts.tv_sec++;
 387                         }
 388                 }
 389
 390                 /* No underlaying filtering system. We need to filter on our own */
 391                 if (p->fcode.bf_insns)
 392                 {
 393                         if (bpf_filter(p->fcode.bf_insns, dp, packet_len, caplen) == 0)
 394                         {
 395                                 /* Move to next packet */
 396                                 header = (dag_record_t*)((char*)header + erf_record_len);
 397                                 continue;
 398                         }
 399                 }
 400
 401                 /* Fill the header for the user suppplied callback function */
 402                 pcap_header.caplen = caplen;
 403                 pcap_header.len = packet_len;
 404
 405                 /* Call the callback function */
 406                 (*callback)(user, &pcap_header, dp);
 407
 408                 /* Move to next packet */
 409                 header = (dag_record_t*)((char*)header + erf_record_len);
 410
 411                 /* Stop if the number of packets requested by user has been reached*/
 412                 if (++n >= cnt && cnt > 0)
 413                 {
 414                         p->bp = (char*)header;
 415                         p->cc = endofbuf - (char*)header;
 416                         return (n);
 417                 }
 418         }
 419         while((u_char*)header < endofbuf);
 420
 421   return 1;
 422 }
 423 #endif /* HAVE_DAG_API */
 424
 425 /* Send a packet to the network */
 426 static int
 427 pcap_inject_win32(pcap_t *p, const void *buf, size_t size){
 428         LPPACKET PacketToSend;
 429
 430         PacketToSend=PacketAllocatePacket();
 431
 432         if (PacketToSend == NULL)
 433         {
 434                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "send error: PacketAllocatePacket failed");
 435                 return -1;
 436         }
 437
 438         PacketInitPacket(PacketToSend,(PVOID)buf,size);
 439         if(PacketSendPacket(p->adapter,PacketToSend,TRUE) == FALSE){
 440                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "send error: PacketSendPacket failed");
 441                 PacketFreePacket(PacketToSend);
 442                 return -1;
 443         }
 444
 445         PacketFreePacket(PacketToSend);
 446
 447         /*
 448          * We assume it all got sent if "PacketSendPacket()" succeeded.
 449          * "pcap_inject()" is expected to return the number of bytes
 450          * sent.
 451          */
 452         return size;
 453 }
 454
 455 static void
 456 pcap_cleanup_win32(pcap_t *p)
 457 {
 458         if (p->adapter != NULL) {
 459                 PacketCloseAdapter(p->adapter);
 460                 p->adapter = NULL;
 461         }
 462         if (p->Packet) {
 463                 PacketFreePacket(p->Packet);
 464                 p->Packet = NULL;
 465         }
 466         pcap_cleanup_live_common(p);
 467 }
 468
 469 static int
 470 pcap_activate_win32(pcap_t *p)
 471 {
 472         struct pcap_win *pw = p->private;
 473         NetType type;
 474
 475         if (p->opt.rfmon) {
 476                 /*
 477                  * No monitor mode on Windows.  It could be done on
 478                  * Vista with drivers that support the native 802.11
 479                  * mechanism and monitor mode.
 480                  */
 481                 return (PCAP_ERROR_RFMON_NOTSUP);
 482         }
 483
 484         /* Init WinSock */
 485         wsockinit();
 486
 487         p->adapter = PacketOpenAdapter(p->opt.source);
 488
 489         if (p->adapter == NULL)
 490         {
 491                 /* Adapter detected but we are not able to open it. Return failure. */
 492                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "Error opening adapter: %s", pcap_win32strerror());
 493                 return PCAP_ERROR;
 494         }
 495
 496         /*get network type*/
 497         if(PacketGetNetType (p->adapter,&type) == FALSE)
 498         {
 499                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "Cannot determine the network type: %s", pcap_win32strerror());
 500                 goto bad;
 501         }
 502
 503         /*Set the linktype*/
 504         switch (type.LinkType)
 505         {
 506         case NdisMediumWan:
 507                 p->linktype = DLT_EN10MB;
 508                 break;
 509
 510         case NdisMedium802_3:
 511                 p->linktype = DLT_EN10MB;
 512                 /*
 513                  * This is (presumably) a real Ethernet capture; give it a
 514                  * link-layer-type list with DLT_EN10MB and DLT_DOCSIS, so
 515                  * that an application can let you choose it, in case you're
 516                  * capturing DOCSIS traffic that a Cisco Cable Modem
 517                  * Termination System is putting out onto an Ethernet (it
 518                  * doesn't put an Ethernet header onto the wire, it puts raw
 519                  * DOCSIS frames out on the wire inside the low-level
 520                  * Ethernet framing).
 521                  */
 522                 p->dlt_list = (u_int *) malloc(sizeof(u_int) * 2);
 523                 /*
 524                  * If that fails, just leave the list empty.
 525                  */
 526                 if (p->dlt_list != NULL) {
 527                         p->dlt_list[0] = DLT_EN10MB;
 528                         p->dlt_list[1] = DLT_DOCSIS;
 529                         p->dlt_count = 2;
 530                 }
 531                 break;
 532
 533         case NdisMediumFddi:
 534                 p->linktype = DLT_FDDI;
 535                 break;
 536
 537         case NdisMedium802_5:
 538                 p->linktype = DLT_IEEE802;
 539                 break;
 540
 541         case NdisMediumArcnetRaw:
 542                 p->linktype = DLT_ARCNET;
 543                 break;
 544
 545         case NdisMediumArcnet878_2:
 546                 p->linktype = DLT_ARCNET;
 547                 break;
 548
 549         case NdisMediumAtm:
 550                 p->linktype = DLT_ATM_RFC1483;
 551                 break;
 552
 553         case NdisMediumCHDLC:
 554                 p->linktype = DLT_CHDLC;
 555                 break;
 556
 557         case NdisMediumPPPSerial:
 558                 p->linktype = DLT_PPP_SERIAL;
 559                 break;
 560
 561         case NdisMediumNull:
 562                 p->linktype = DLT_NULL;
 563                 break;
 564
 565         case NdisMediumBare80211:
 566                 p->linktype = DLT_IEEE802_11;
 567                 break;
 568
 569         case NdisMediumRadio80211:
 570                 p->linktype = DLT_IEEE802_11_RADIO;
 571                 break;
 572
 573         case NdisMediumPpi:
 574                 p->linktype = DLT_PPI;
 575                 break;
 576
 577         default:
 578                 p->linktype = DLT_EN10MB;                       /*an unknown adapter is assumed to be ethernet*/
 579                 break;
 580         }
 581
 582         /* Set promiscuous mode */
 583         if (p->opt.promisc)
 584         {
 585
 586                 if (PacketSetHwFilter(p->adapter,NDIS_PACKET_TYPE_PROMISCUOUS) == FALSE)
 587                 {
 588                         snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "failed to set hardware filter to promiscuous mode");
 589                         goto bad;
 590                 }
 591         }
 592         else
 593         {
 594                 if (PacketSetHwFilter(p->adapter,NDIS_PACKET_TYPE_ALL_LOCAL) == FALSE)
 595                 {
 596                         snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "failed to set hardware filter to non-promiscuous mode");
 597                         goto bad;
 598                 }
 599         }
 600
 601         /* Set the buffer size */
 602         p->bufsize = WIN32_DEFAULT_USER_BUFFER_SIZE;
 603
 604         /* allocate Packet structure used during the capture */
 605         if((p->Packet = PacketAllocatePacket())==NULL)
 606         {
 607                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "failed to allocate the PACKET structure");
 608                 goto bad;
 609         }
 610
 611         if(!(p->adapter->Flags & INFO_FLAG_DAG_CARD))
 612         {
 613         /*
 614          * Traditional Adapter
 615          */
 616                 /*
 617                  * If the buffer size wasn't explicitly set, default to
 618                  * WIN32_DEFAULT_USER_BUFFER_SIZE.
 619                  */
 620                 if (p->opt.buffer_size == 0)
 621                         p->opt.buffer_size = WIN32_DEFAULT_KERNEL_BUFFER_SIZE;
 622
 623                 if(PacketSetBuff(p->adapter,p->opt.buffer_size)==FALSE)
 624                 {
 625                         snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "driver error: not enough memory to allocate the kernel buffer");
 626                         goto bad;
 627                 }
 628
 629                 p->buffer = (u_char *)malloc(p->bufsize);
 630                 if (p->buffer == NULL)
 631                 {
 632                         snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "malloc: %s", pcap_strerror(errno));
 633                         goto bad;
 634                 }
 635
 636                 PacketInitPacket(p->Packet,(BYTE*)p->buffer,p->bufsize);
 637
 638                 /* tell the driver to copy the buffer only if it contains at least 16K */
 639                 if(PacketSetMinToCopy(p->adapter,16000)==FALSE)
 640                 {
 641                         snprintf(p->errbuf, PCAP_ERRBUF_SIZE,"Error calling PacketSetMinToCopy: %s", pcap_win32strerror());
 642                         goto bad;
 643                 }
 644         }
 645         else
 646 #ifdef HAVE_DAG_API
 647         {
 648         /*
 649          * Dag Card
 650          */
 651                 LONG    status;
 652                 HKEY    dagkey;
 653                 DWORD   lptype;
 654                 DWORD   lpcbdata;
 655                 int             postype = 0;
 656                 char    keyname[512];
 657
 658                 snprintf(keyname, sizeof(keyname), "%s\\CardParams\\%s",
 659                         "SYSTEM\\CurrentControlSet\\Services\\DAG",
 660                         strstr(_strlwr(p->opt.source), "dag"));
 661                 do
 662                 {
 663                         status = RegOpenKeyEx(HKEY_LOCAL_MACHINE, keyname, 0, KEY_READ, &dagkey);
 664                         if(status != ERROR_SUCCESS)
 665                                 break;
 666
 667                         status = RegQueryValueEx(dagkey,
 668                                 "PosType",
 669                                 NULL,
 670                                 &lptype,
 671                                 (char*)&postype,
 672                                 &lpcbdata);
 673
 674                         if(status != ERROR_SUCCESS)
 675                         {
 676                                 postype = 0;
 677                         }
 678
 679                         RegCloseKey(dagkey);
 680                 }
 681                 while(FALSE);
 682
 683
 684                 p->snapshot = PacketSetSnapLen(p->adapter, snaplen);
 685
 686                 /* Set the length of the FCS associated to any packet. This value
 687                  * will be subtracted to the packet length */
 688                 pw->dag_fcs_bits = p->adapter->DagFcsLen;
 689         }
 690 #else
 691         goto bad;
 692 #endif /* HAVE_DAG_API */
 693
 694         PacketSetReadTimeout(p->adapter, p->opt.timeout);
 695
 696 #ifdef HAVE_DAG_API
 697         if(p->adapter->Flags & INFO_FLAG_DAG_CARD)
 698         {
 699                 /* install dag specific handlers for read and setfilter */
 700                 p->read_op = pcap_read_win32_dag;
 701                 p->setfilter_op = pcap_setfilter_win32_dag;
 702         }
 703         else
 704         {
 705 #endif /* HAVE_DAG_API */
 706                 /* install traditional npf handlers for read and setfilter */
 707                 p->read_op = pcap_read_win32_npf;
 708                 p->setfilter_op = pcap_setfilter_win32_npf;
 709 #ifdef HAVE_DAG_API
 710         }
 711 #endif /* HAVE_DAG_API */
 712         p->setdirection_op = NULL;      /* Not implemented. */
 713             /* XXX - can this be implemented on some versions of Windows? */
 714         p->inject_op = pcap_inject_win32;
 715         p->set_datalink_op = NULL;      /* can't change data link type */
 716         p->getnonblock_op = pcap_getnonblock_win32;
 717         p->setnonblock_op = pcap_setnonblock_win32;
 718         p->stats_op = pcap_stats_win32;
 719         p->setbuff_op = pcap_setbuff_win32;
 720         p->setmode_op = pcap_setmode_win32;
 721         p->setmintocopy_op = pcap_setmintocopy_win32;
 722         p->cleanup_op = pcap_cleanup_win32;
 723
 724         return (0);
 725 bad:
 726         pcap_cleanup_win32(p);
 727         return (PCAP_ERROR);
 728 }
 729
 730 pcap_t *
 731 pcap_create_interface(const char *device, char *ebuf)
 732 {
 733         pcap_t *p;
 734
 735         if (strlen(device) == 1)
 736         {
 737                 /*
 738                  * It's probably a unicode string
 739                  * Convert to ascii and pass it to pcap_create_common
 740                  *
 741                  * This wonderful hack is needed because pcap_lookupdev still returns
 742                  * unicode strings, and it's used by windump when no device is specified
 743                  * in the command line
 744                  */
 745                 size_t length;
 746                 char* deviceAscii;
 747
 748                 length = wcslen((wchar_t*)device);
 749
 750                 deviceAscii = (char*)malloc(length + 1);
 751
 752                 if (deviceAscii == NULL)
 753                 {
 754                         snprintf(ebuf, PCAP_ERRBUF_SIZE, "Malloc failed");
 755                         return NULL;
 756                 }
 757
 758                 snprintf(deviceAscii, length + 1, "%ws", (wchar_t*)device);
 759                 p = pcap_create_common(deviceAscii, ebuf, sizeof (struct pcap_win));
 760                 free(deviceAscii);
 761         }
 762         else
 763         {
 764                 p = pcap_create_common(device, ebuf, sizeof (struct pcap_win));
 765         }
 766
 767         if (p == NULL)
 768                 return (NULL);
 769
 770         p->activate_op = pcap_activate_win32;
 771         return (p);
 772 }
 773
 774 static int
 775 pcap_setfilter_win32_npf(pcap_t *p, struct bpf_program *fp)
 776 {
 777         if(PacketSetBpf(p->adapter,fp)==FALSE){
 778                 /*
 779                  * Kernel filter not installed.
 780                  * XXX - fall back on userland filtering, as is done
 781                  * on other platforms?
 782                  */
 783                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "Driver error: cannot set bpf filter: %s", pcap_win32strerror());
 784                 return (-1);
 785         }
 786
 787         /*
 788          * Discard any previously-received packets, as they might have
 789          * passed whatever filter was formerly in effect, but might
 790          * not pass this filter (BIOCSETF discards packets buffered
 791          * in the kernel, so you can lose packets in any case).
 792          */
 793         p->cc = 0;
 794         return (0);
 795 }
 796
 797 /*
 798  * We filter at user level, since the kernel driver does't process the packets
 799  */
 800 static int
 801 pcap_setfilter_win32_dag(pcap_t *p, struct bpf_program *fp) {
 802
 803         if(!fp)
 804         {
 805                 strncpy(p->errbuf, "setfilter: No filter specified", sizeof(p->errbuf));
 806                 return -1;
 807         }
 808
 809         /* Install a user level filter */
 810         if (install_bpf_program(p, fp) < 0)
 811         {
 812                 snprintf(p->errbuf, sizeof(p->errbuf),
 813                         "setfilter, unable to install the filter: %s", pcap_strerror(errno));
 814                 return -1;
 815         }
 816
 817         return (0);
 818 }
 819
 820 static int
 821 pcap_getnonblock_win32(pcap_t *p, char *errbuf)
 822 {
 823         struct pcap_win *pw = p->private;
 824
 825         /*
 826          * XXX - if there were a PacketGetReadTimeout() call, we
 827          * would use it, and return 1 if the timeout is -1
 828          * and 0 otherwise.
 829          */
 830         return (pw->nonblock);
 831 }
 832
 833 static int
 834 pcap_setnonblock_win32(pcap_t *p, int nonblock, char *errbuf)
 835 {
 836         struct pcap_win *pw = p->private;
 837         int newtimeout;
 838
 839         if (nonblock) {
 840                 /*
 841                  * Set the read timeout to -1 for non-blocking mode.
 842                  */
 843                 newtimeout = -1;
 844         } else {
 845                 /*
 846                  * Restore the timeout set when the device was opened.
 847                  * (Note that this may be -1, in which case we're not
 848                  * really leaving non-blocking mode.)
 849                  */
 850                 newtimeout = p->opt.timeout;
 851         }
 852         if (!PacketSetReadTimeout(p->adapter, newtimeout)) {
 853                 snprintf(errbuf, PCAP_ERRBUF_SIZE,
 854                     "PacketSetReadTimeout: %s", pcap_win32strerror());
 855                 return (-1);
 856         }
 857         pw->nonblock = (newtimeout == -1);
 858         return (0);
 859 }
 860
 861 /*platform-dependent routine to add devices other than NDIS interfaces*/
 862 int
 863 pcap_platform_finddevs(pcap_if_t **alldevsp, char *errbuf)
 864 {
 865         return (0);
 866 }