* IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
*/
+
#ifndef lint
-static const char rcsid[] =
- "@(#) $Header: /tcpdump/master/libpcap/pcap-linux.c,v 1.84 2002-07-12 07:51:15 guy Exp $ (LBL)";
+static const char rcsid[] _U_ =
+ "@(#) $Header: /tcpdump/master/libpcap/pcap-linux.c,v 1.110 2004-10-19 07:06:12 guy Exp $ (LBL)";
#endif
/*
#include "pcap-int.h"
#include "sll.h"
+#ifdef HAVE_DAG_API
+#include "pcap-dag.h"
+#endif /* HAVE_DAG_API */
+
#include <errno.h>
#include <stdlib.h>
#include <unistd.h>
* Prototypes for internal functions
*/
static void map_arphrd_to_dlt(pcap_t *, int, int);
-static int live_open_old(pcap_t *, char *, int, int, char *);
-static int live_open_new(pcap_t *, char *, int, int, char *);
+static int live_open_old(pcap_t *, const char *, int, int, char *);
+static int live_open_new(pcap_t *, const char *, int, int, char *);
+static int pcap_read_linux(pcap_t *, int, pcap_handler, u_char *);
static int pcap_read_packet(pcap_t *, pcap_handler, u_char *);
+static int pcap_inject_linux(pcap_t *, const void *, size_t);
+static int pcap_stats_linux(pcap_t *, struct pcap_stat *);
+static int pcap_setfilter_linux(pcap_t *, struct bpf_program *);
+static void pcap_close_linux(pcap_t *);
/*
* Wrap some ioctl calls
* See also pcap(3).
*/
pcap_t *
-pcap_open_live(char *device, int snaplen, int promisc, int to_ms, char *ebuf)
+pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
+ char *ebuf)
{
pcap_t *handle;
int mtu;
int live_open_ok = 0;
struct utsname utsname;
+#ifdef HAVE_DAG_API
+ if (strstr(device, "dag")) {
+ return dag_open_live(device, snaplen, promisc, to_ms, ebuf);
+ }
+#endif /* HAVE_DAG_API */
+
/* Allocate a handle for this session. */
handle = malloc(sizeof(*handle));
*/
mtu = iface_get_mtu(handle->fd, device, ebuf);
if (mtu == -1) {
- if (handle->md.clear_promisc)
- /* 2.0.x kernel */
- pcap_close_linux(handle);
- close(handle->fd);
- if (handle->md.device != NULL)
- free(handle->md.device);
+ pcap_close_linux(handle);
free(handle);
return NULL;
}
if (!handle->buffer) {
snprintf(ebuf, PCAP_ERRBUF_SIZE,
"malloc: %s", pcap_strerror(errno));
- if (handle->md.clear_promisc)
- /* 2.0.x kernel */
- pcap_close_linux(handle);
- close(handle->fd);
- if (handle->md.device != NULL)
- free(handle->md.device);
+ pcap_close_linux(handle);
free(handle);
return NULL;
}
+ /*
+ * "handle->fd" is a socket, so "select()" and "poll()"
+ * should work on it.
+ */
+ handle->selectable_fd = handle->fd;
+
+ handle->read_op = pcap_read_linux;
+ handle->inject_op = pcap_inject_linux;
+ handle->setfilter_op = pcap_setfilter_linux;
+ handle->set_datalink_op = NULL; /* can't change data link type */
+ handle->getnonblock_op = pcap_getnonblock_fd;
+ handle->setnonblock_op = pcap_setnonblock_fd;
+ handle->stats_op = pcap_stats_linux;
+ handle->close_op = pcap_close_linux;
+
return handle;
}
* for each of them. Returns the number of packets handled or -1 if an
* error occured.
*/
-int
-pcap_read(pcap_t *handle, int max_packets, pcap_handler callback, u_char *user)
+static int
+pcap_read_linux(pcap_t *handle, int max_packets, pcap_handler callback, u_char *user)
{
/*
* Currently, on Linux only one packet is delivered per read,
bp = handle->buffer + handle->offset;
do {
+ /*
+ * Has "pcap_breakloop()" been called?
+ */
+ if (handle->break_loop) {
+ /*
+ * Yes - clear the flag that indicates that it
+ * has, and return -2 as an indication that we
+ * were told to break out of the loop.
+ */
+ handle->break_loop = 0;
+ return -2;
+ }
fromlen = sizeof(from);
packet_len = recvfrom(
handle->fd, bp + offset,
return 1;
}
+static int
+pcap_inject_linux(pcap_t *handle, const void *buf, size_t size)
+{
+ int ret;
+
+#ifdef HAVE_PF_PACKET_SOCKETS
+ if (!handle->md.sock_packet) {
+ /* PF_PACKET socket */
+ if (handle->md.ifindex == -1) {
+ /*
+ * We don't support sending on the "any" device.
+ */
+ strlcpy(handle->errbuf,
+ "Sending packets isn't supported on the \"any\" device",
+ PCAP_ERRBUF_SIZE);
+ return (-1);
+ }
+
+ if (handle->md.cooked) {
+ /*
+ * We don't support sending on the "any" device.
+ *
+ * XXX - how do you send on a bound cooked-mode
+ * socket?
+ * Is a "sendto()" required there?
+ */
+ strlcpy(handle->errbuf,
+ "Sending packets isn't supported in cooked mode",
+ PCAP_ERRBUF_SIZE);
+ return (-1);
+ }
+ }
+#endif
+
+ ret = send(handle->fd, buf, size, 0);
+ if (ret == -1) {
+ snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "send: %s",
+ pcap_strerror(errno));
+ return (-1);
+ }
+ return (ret);
+}
+
/*
* Get the statistics for the given packet capture handle.
* Reports the number of dropped packets iff the kernel supports
* patches); otherwise, that information isn't available, and we lie
* and report 0 as the count of dropped packets.
*/
-int
-pcap_stats(pcap_t *handle, struct pcap_stat *stats)
+static int
+pcap_stats_linux(pcap_t *handle, struct pcap_stat *stats)
{
#ifdef HAVE_TPACKET_STATS
struct tpacket_stats kstats;
socklen_t len = sizeof (struct tpacket_stats);
+#endif
+#ifdef HAVE_TPACKET_STATS
/*
* Try to get the packet counts from the kernel.
*/
* platforms, but the best approximation is to return
* "tp_packets" as the count of packets and "tp_drops"
* as the count of drops.
+ *
+ * Keep a running total because each call to
+ * getsockopt(handle->fd, SOL_PACKET, PACKET_STATISTICS, ....
+ * resets the counters to zero.
*/
- handle->md.stat.ps_recv = kstats.tp_packets;
- handle->md.stat.ps_drop = kstats.tp_drops;
+ handle->md.stat.ps_recv += kstats.tp_packets;
+ handle->md.stat.ps_drop += kstats.tp_drops;
}
else
{
if (pcap_add_if(alldevsp, "any", 0, any_descr, errbuf) < 0)
return (-1);
+#ifdef HAVE_DAG_API
+ if (dag_platform_finddevs(alldevsp, errbuf) < 0)
+ return (-1);
+#endif /* HAVE_DAG_API */
+
return (0);
}
/*
* Attach the given BPF code to the packet capture device.
*/
-int
-pcap_setfilter(pcap_t *handle, struct bpf_program *filter)
+static int
+pcap_setfilter_linux(pcap_t *handle, struct bpf_program *filter)
{
#ifdef SO_ATTACH_FILTER
struct sock_fprog fcode;
*/
handle->md.use_bpf = 0;
- /*
- * If we're reading from a savefile, don't try to install
- * a kernel filter.
- */
- if (handle->sf.rfile != NULL)
- return 0;
-
/* Install kernel level filter if possible */
#ifdef SO_ATTACH_FILTER
switch (arptype) {
case ARPHRD_ETHER:
+ /*
+ * This is (presumably) a real Ethernet capture; give it a
+ * link-layer-type list with DLT_EN10MB and DLT_DOCSIS, so
+ * that an application can let you choose it, in case you're
+ * capturing DOCSIS traffic that a Cisco Cable Modem
+ * Termination System is putting out onto an Ethernet (it
+ * doesn't put an Ethernet header onto the wire, it puts raw
+ * DOCSIS frames out on the wire inside the low-level
+ * Ethernet framing).
+ *
+ * XXX - are there any sorts of "fake Ethernet" that have
+ * ARPHRD_ETHER but that *shouldn't offer DLT_DOCSIS as
+ * a Cisco CMTS won't put traffic onto it or get traffic
+ * bridged onto it? ISDN is handled in "live_open_new()",
+ * as we fall back on cooked mode there; are there any
+ * others?
+ */
+ handle->dlt_list = (u_int *) malloc(sizeof(u_int) * 2);
+ /*
+ * If that fails, just leave the list empty.
+ */
+ if (handle->dlt_list != NULL) {
+ handle->dlt_list[0] = DLT_EN10MB;
+ handle->dlt_list[1] = DLT_DOCSIS;
+ handle->dlt_count = 2;
+ }
+ /* FALLTHROUGH */
+
case ARPHRD_METRICOM:
case ARPHRD_LOOPBACK:
handle->linktype = DLT_EN10MB;
break;
case ARPHRD_ARCNET:
- handle->linktype = DLT_ARCNET;
+ handle->linktype = DLT_ARCNET_LINUX;
break;
#ifndef ARPHRD_FDDI /* From Linux 2.2.13 */
}
break;
-#ifndef ARPHRD_HDLC
-#define ARPHRD_HDLC 513 /* From Linux 2.2.13 */
+#ifndef ARPHRD_CISCO
+#define ARPHRD_CISCO 513 /* previously ARPHRD_HDLC */
#endif
- case ARPHRD_HDLC:
+ case ARPHRD_CISCO:
handle->linktype = DLT_C_HDLC;
break;
#define ARPHRD_RAWHDLC 518
#endif
case ARPHRD_RAWHDLC:
+#ifndef ARPHRD_DLCI
+#define ARPHRD_DLCI 15
+#endif
+ case ARPHRD_DLCI:
/*
* XXX - should some of those be mapped to DLT_LINUX_SLL
* instead? Should we just map all of them to DLT_LINUX_SLL?
handle->linktype = DLT_RAW;
break;
+#ifndef ARPHRD_FRAD
+#define ARPHRD_FRAD 770
+#endif
+ case ARPHRD_FRAD:
+ handle->linktype = DLT_FRELAY;
+ break;
+
case ARPHRD_LOCALTLK:
handle->linktype = DLT_LTALK;
break;
+#ifndef ARPHRD_FCPP
+#define ARPHRD_FCPP 784
+#endif
+ case ARPHRD_FCPP:
+#ifndef ARPHRD_FCAL
+#define ARPHRD_FCAL 785
+#endif
+ case ARPHRD_FCAL:
+#ifndef ARPHRD_FCPL
+#define ARPHRD_FCPL 786
+#endif
+ case ARPHRD_FCPL:
+#ifndef ARPHRD_FCFABRIC
+#define ARPHRD_FCFABRIC 787
+#endif
+ case ARPHRD_FCFABRIC:
+ /*
+ * We assume that those all mean RFC 2625 IP-over-
+ * Fibre Channel, with the RFC 2625 header at
+ * the beginning of the packet.
+ */
+ handle->linktype = DLT_IP_OVER_FC;
+ break;
+
+#ifndef ARPHRD_IRDA
+#define ARPHRD_IRDA 783
+#endif
+ case ARPHRD_IRDA:
+ /* Don't expect IP packet out of this interfaces... */
+ handle->linktype = DLT_LINUX_IRDA;
+ /* We need to save packet direction for IrDA decoding,
+ * so let's use "Linux-cooked" mode. Jean II */
+ //handle->md.cooked = 1;
+ break;
+
default:
handle->linktype = -1;
break;
* FIXME: 0 uses to mean success (Sebastian)
*/
static int
-live_open_new(pcap_t *handle, char *device, int promisc,
+live_open_new(pcap_t *handle, const char *device, int promisc,
int to_ms, char *ebuf)
{
#ifdef HAVE_PF_PACKET_SOCKETS
- int sock_fd = -1, device_id, arptype;
+ int sock_fd = -1, arptype;
int err;
int fatal_err = 0;
struct packet_mreq mr;
map_arphrd_to_dlt(handle, arptype, 1);
if (handle->linktype == -1 ||
handle->linktype == DLT_LINUX_SLL ||
+ handle->linktype == DLT_LINUX_IRDA ||
(handle->linktype == DLT_EN10MB &&
(strncmp("isdn", device, 4) == 0 ||
strncmp("isdY", device, 4) == 0))) {
}
handle->md.cooked = 1;
+ /*
+ * Get rid of any link-layer type list
+ * we allocated - this only supports cooked
+ * capture.
+ */
+ if (handle->dlt_list != NULL) {
+ free(handle->dlt_list);
+ handle->dlt_list = NULL;
+ handle->dlt_count = 0;
+ }
+
if (handle->linktype == -1) {
/*
* Warn that we're falling back on
"socket",
arptype);
}
- handle->linktype = DLT_LINUX_SLL;
+ /* IrDA capture is not a real "cooked" capture,
+ * it's IrLAP frames, not IP packets. */
+ if (handle->linktype != DLT_LINUX_IRDA)
+ handle->linktype = DLT_LINUX_SLL;
}
- device_id = iface_get_id(sock_fd, device, ebuf);
- if (device_id == -1)
+ handle->md.ifindex = iface_get_id(sock_fd, device, ebuf);
+ if (handle->md.ifindex == -1)
break;
- if ((err = iface_bind(sock_fd, device_id, ebuf)) < 0) {
+ if ((err = iface_bind(sock_fd, handle->md.ifindex,
+ ebuf)) < 0) {
if (err == -2)
fatal_err = 1;
break;
handle->linktype = DLT_LINUX_SLL;
/*
- * XXX - squelch GCC complaints about
- * uninitialized variables; if we can't
- * select promiscuous mode on all interfaces,
- * we should move the code below into the
- * "if (device)" branch of the "if" and
- * get rid of the next statement.
+ * We're not bound to a device.
+ * XXX - true? Or true only if we're using
+ * the "any" device?
+ * For now, we're using this as an indication
+ * that we can't transmit; stop doing that only
+ * if we figure out how to transmit in cooked
+ * mode.
*/
- device_id = -1;
+ handle->md.ifindex = -1;
}
- /* Select promiscuous mode on/off */
+ /*
+ * Select promiscuous mode on if "promisc" is set.
+ *
+ * Do not turn allmulti mode on if we don't select
+ * promiscuous mode - on some devices (e.g., Orinoco
+ * wireless interfaces), allmulti mode isn't supported
+ * and the driver implements it by turning promiscuous
+ * mode on, and that screws up the operation of the
+ * card as a normal networking interface, and on no
+ * other platform I know of does starting a non-
+ * promiscuous capture affect which multicast packets
+ * are received by the interface.
+ */
/*
* Hmm, how can we set promiscuous mode on all interfaces?
* I am not sure if that is possible at all.
*/
- if (device) {
+ if (device && promisc) {
memset(&mr, 0, sizeof(mr));
- mr.mr_ifindex = device_id;
- mr.mr_type = promisc ?
- PACKET_MR_PROMISC : PACKET_MR_ALLMULTI;
+ mr.mr_ifindex = handle->md.ifindex;
+ mr.mr_type = PACKET_MR_PROMISC;
if (setsockopt(sock_fd, SOL_PACKET,
PACKET_ADD_MEMBERSHIP, &mr, sizeof(mr)) == -1)
{
if (sock_fd != -1)
close(sock_fd);
- if (fatal_err)
+ if (fatal_err) {
+ /*
+ * Get rid of any link-layer type list we allocated.
+ */
+ if (handle->dlt_list != NULL)
+ free(handle->dlt_list);
return -2;
- else
+ } else
return 0;
#else
strncpy(ebuf,
pcap_close(handle);
}
-void pcap_close_linux( pcap_t *handle )
+static void pcap_close_linux( pcap_t *handle )
{
struct pcap *p, *prevp;
struct ifreq ifr;
if (handle->md.device != NULL)
free(handle->md.device);
handle->md.device = NULL;
+ pcap_close_common(handle);
}
/*
* FIXME: 0 uses to mean success (Sebastian)
*/
static int
-live_open_old(pcap_t *handle, char *device, int promisc,
+live_open_old(pcap_t *handle, const char *device, int promisc,
int to_ms, char *ebuf)
{
- int sock_fd = -1, arptype;
+ int arptype;
struct ifreq ifr;
do {
/* Open the socket */
- sock_fd = socket(PF_INET, SOCK_PACKET, htons(ETH_P_ALL));
- if (sock_fd == -1) {
+ handle->fd = socket(PF_INET, SOCK_PACKET, htons(ETH_P_ALL));
+ if (handle->fd == -1) {
snprintf(ebuf, PCAP_ERRBUF_SIZE,
"socket: %s", pcap_strerror(errno));
break;
PCAP_ERRBUF_SIZE);
break;
}
- if (iface_bind_old(sock_fd, device, ebuf) == -1)
+ if (iface_bind_old(handle->fd, device, ebuf) == -1)
break;
/*
* Try to get the link-layer type.
*/
- arptype = iface_get_arptype(sock_fd, device, ebuf);
+ arptype = iface_get_arptype(handle->fd, device, ebuf);
if (arptype == -1)
break;
if (promisc) {
memset(&ifr, 0, sizeof(ifr));
strncpy(ifr.ifr_name, device, sizeof(ifr.ifr_name));
- if (ioctl(sock_fd, SIOCGIFFLAGS, &ifr) == -1) {
+ if (ioctl(handle->fd, SIOCGIFFLAGS, &ifr) == -1) {
snprintf(ebuf, PCAP_ERRBUF_SIZE,
"ioctl: %s", pcap_strerror(errno));
break;
}
ifr.ifr_flags |= IFF_PROMISC;
- if (ioctl(sock_fd, SIOCSIFFLAGS, &ifr) == -1) {
+ if (ioctl(handle->fd, SIOCSIFFLAGS, &ifr) == -1) {
snprintf(ebuf, PCAP_ERRBUF_SIZE,
"ioctl: %s",
pcap_strerror(errno));
}
}
- /* Save the socket FD in the pcap structure */
-
- handle->fd = sock_fd;
-
/*
* Default value for offset to align link-layer payload
* on a 4-byte boundary.
} while (0);
- if (handle->md.clear_promisc)
- pcap_close_linux(handle);
- if (sock_fd != -1)
- close(sock_fd);
+ pcap_close_linux(handle);
return 0;
}
projects / libpcap / blobdiff