X-Git-Url: https://git.tcpdump.org/libpcap/blobdiff_plain/084bcf12eae044b2d7f426bf12d64ec26433c874..09b51d326c38ea8e10ce4da09c09d50e08c5aeb8:/pcap-pf.c diff --git a/pcap-pf.c b/pcap-pf.c index f73beaac..bd27933e 100644 --- a/pcap-pf.c +++ b/pcap-pf.c @@ -22,13 +22,8 @@ * Extraction/creation by Jeffrey Mogul, DECWRL */ -#ifndef lint -static const char rcsid[] _U_ = - "@(#) $Header: /tcpdump/master/libpcap/pcap-pf.c,v 1.94 2006-10-04 18:09:22 guy Exp $ (LBL)"; -#endif - #ifdef HAVE_CONFIG_H -#include "config.h" +#include #endif #include @@ -53,7 +48,6 @@ struct rtentry; #include #include -#include #include #include #include @@ -74,6 +68,24 @@ struct rtentry; #include "os-proto.h" #endif +/* + * FDDI packets are padded to make everything line up on a nice boundary. + */ +#define PCAP_FDDIPAD 3 + +/* + * Private data for capturing on Ultrix and DEC OSF/1^WDigital UNIX^W^W + * Tru64 UNIX packetfilter devices. + */ +struct pcap_pf { + int filtering_in_kernel; /* using kernel filter */ + u_long TotPkts; /* can't oflow for 79 hrs on ether */ + u_long TotAccepted; /* count accepted by filter */ + u_long TotDrops; /* count of dropped packets */ + long TotMissed; /* missed by i/f during this run */ + long OrigMissed; /* missed by i/f before this run */ +}; + static int pcap_setfilter_pf(pcap_t *, struct bpf_program *); /* @@ -87,18 +99,13 @@ static int pcap_setfilter_pf(pcap_t *, struct bpf_program *); static int pcap_read_pf(pcap_t *pc, int cnt, pcap_handler callback, u_char *user) { + struct pcap_pf *pf = pc->priv; register u_char *p, *bp; - struct bpf_insn *fcode; register int cc, n, buflen, inc; register struct enstamp *sp; -#ifdef LBL_ALIGN struct enstamp stamp; -#endif -#ifdef PCAP_FDDIPAD - register int pad; -#endif + register u_int pad; - fcode = pc->md.use_bpf ? NULL : pc->fcode.bf_insns; again: cc = pc->cc; if (cc == 0) { @@ -117,20 +124,21 @@ pcap_read_pf(pcap_t *pc, int cnt, pcap_handler callback, u_char *user) (void)lseek(pc->fd, 0L, SEEK_SET); goto again; } - snprintf(pc->errbuf, sizeof(pc->errbuf), "pf read: %s", - pcap_strerror(errno)); + pcap_fmt_errmsg_for_errno(pc->errbuf, + sizeof(pc->errbuf), errno, "pf read"); return (-1); } - bp = pc->buffer + pc->offset; + bp = (u_char *)pc->buffer + pc->offset; } else bp = pc->bp; /* * Loop through each packet. + * + * This assumes that a single buffer of packets will have + * <= INT_MAX packets, so the packet count doesn't overflow. */ n = 0; -#ifdef PCAP_FDDIPAD pad = pc->fddipad; -#endif while (cc > 0) { /* * Has "pcap_breakloop()" been called? @@ -156,12 +164,10 @@ pcap_read_pf(pcap_t *pc, int cnt, pcap_handler callback, u_char *user) "pf short read (%d)", cc); return (-1); } -#ifdef LBL_ALIGN if ((long)bp & 3) { sp = &stamp; memcpy((char *)sp, (char *)bp, sizeof(*sp)); } else -#endif sp = (struct enstamp *)bp; if (sp->ens_stamplen != sizeof(*sp)) { snprintf(pc->errbuf, sizeof(pc->errbuf), @@ -179,41 +185,34 @@ pcap_read_pf(pcap_t *pc, int cnt, pcap_handler callback, u_char *user) inc = ENALIGN(buflen + sp->ens_stamplen); cc -= inc; bp += inc; - pc->md.TotPkts++; - pc->md.TotDrops += sp->ens_dropped; - pc->md.TotMissed = sp->ens_ifoverflows; - if (pc->md.OrigMissed < 0) - pc->md.OrigMissed = pc->md.TotMissed; + pf->TotPkts++; + pf->TotDrops += sp->ens_dropped; + pf->TotMissed = sp->ens_ifoverflows; + if (pf->OrigMissed < 0) + pf->OrigMissed = pf->TotMissed; /* * Short-circuit evaluation: if using BPF filter - * in kernel, no need to do it now. + * in kernel, no need to do it now - we already know + * the packet passed the filter. * -#ifdef PCAP_FDDIPAD * Note: the filter code was generated assuming * that pc->fddipad was the amount of padding * before the header, as that's what's required * in the kernel, so we run the filter before * skipping that padding. -#endif */ - if (fcode == NULL || - bpf_filter(fcode, p, sp->ens_count, buflen)) { + if (pf->filtering_in_kernel || + pcap_filter(pc->fcode.bf_insns, p, sp->ens_count, buflen)) { struct pcap_pkthdr h; - pc->md.TotAccepted++; + pf->TotAccepted++; h.ts = sp->ens_tstamp; -#ifdef PCAP_FDDIPAD h.len = sp->ens_count - pad; -#else - h.len = sp->ens_count; -#endif -#ifdef PCAP_FDDIPAD p += pad; buflen -= pad; -#endif h.caplen = buflen; (*callback)(user, &h, p); - if (++n >= cnt && cnt > 0) { + if (++n >= cnt && !PACKET_COUNT_IS_UNLIMITED(cnt)) { pc->cc = cc; pc->bp = bp; return (n); @@ -225,22 +224,23 @@ pcap_read_pf(pcap_t *pc, int cnt, pcap_handler callback, u_char *user) } static int -pcap_inject_pf(pcap_t *p, const void *buf, size_t size) +pcap_inject_pf(pcap_t *p, const void *buf, int size) { int ret; ret = write(p->fd, buf, size); if (ret == -1) { - snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "send: %s", - pcap_strerror(errno)); + pcap_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE, + errno, "send"); return (-1); } return (ret); -} +} static int pcap_stats_pf(pcap_t *p, struct pcap_stat *ps) { + struct pcap_pf *pf = p->priv; /* * If packet filtering is being done in the kernel: @@ -259,7 +259,7 @@ pcap_stats_pf(pcap_t *p, struct pcap_stat *ps) * full. * * "ps_ifdrop" counts packets dropped by the network - * inteface (regardless of whether they would have passed + * interface (regardless of whether they would have passed * the input filter, of course). * * If packet filtering is not being done in the kernel: @@ -271,16 +271,16 @@ pcap_stats_pf(pcap_t *p, struct pcap_stat *ps) * the userland filter. * * "ps_ifdrop" counts packets dropped by the network - * inteface (regardless of whether they would have passed + * interface (regardless of whether they would have passed * the input filter, of course). * * These statistics don't include packets not yet read from * the kernel by libpcap, but they may include packets not * yet read from libpcap by the application. */ - ps->ps_recv = p->md.TotAccepted; - ps->ps_drop = p->md.TotDrops; - ps->ps_ifdrop = p->md.TotMissed - p->md.OrigMissed; + ps->ps_recv = pf->TotAccepted; + ps->ps_drop = pf->TotDrops; + ps->ps_ifdrop = pf->TotMissed - pf->OrigMissed; return (0); } @@ -292,23 +292,16 @@ pcap_stats_pf(pcap_t *p, struct pcap_stat *ps) #define DLT_DOCSIS 143 #endif -pcap_t * -pcap_open_live(const char *device, int snaplen, int promisc, int to_ms, - char *ebuf) +static int +pcap_activate_pf(pcap_t *p) { - pcap_t *p; + struct pcap_pf *pf = p->priv; short enmode; int backlog = -1; /* request the most */ struct enfilter Filter; struct endevp devparams; + int err; - p = (pcap_t *)malloc(sizeof(*p)); - if (p == NULL) { - snprintf(ebuf, PCAP_ERRBUF_SIZE, - "pcap_open_live: %s", pcap_strerror(errno)); - return (0); - } - memset(p, 0, sizeof(*p)); /* * Initially try a read/write open (to allow the inject * method to work). If that fails due to permission @@ -327,23 +320,49 @@ pcap_open_live(const char *device, int snaplen, int promisc, int to_ms, * its argument, even though it takes a "char *" rather than a * "const char *" as its first argument. That appears to be * the case, at least on Digital UNIX 4.0. + * + * XXX - is there an error that means "no such device"? Is + * there one that means "that device doesn't support pf"? */ - p->fd = pfopen(device, O_RDWR); + p->fd = pfopen(p->opt.device, O_RDWR); if (p->fd == -1 && errno == EACCES) - p->fd = pfopen(device, O_RDONLY); + p->fd = pfopen(p->opt.device, O_RDONLY); if (p->fd < 0) { - snprintf(ebuf, PCAP_ERRBUF_SIZE, "pf open: %s: %s\n\ -your system may not be properly configured; see the packetfilter(4) man page\n", - device, pcap_strerror(errno)); + if (errno == EACCES) { + snprintf(p->errbuf, PCAP_ERRBUF_SIZE, + "pf open: %s: Permission denied\n" +"your system may not be properly configured; see the packetfilter(4) man page", + p->opt.device); + err = PCAP_ERROR_PERM_DENIED; + } else { + pcap_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE, + errno, "pf open: %s", p->opt.device); + err = PCAP_ERROR; + } goto bad; } - p->md.OrigMissed = -1; - enmode = ENTSTAMP|ENBATCH|ENNONEXCL; - if (promisc) + + /* + * Turn a negative snapshot value (invalid), a snapshot value of + * 0 (unspecified), or a value bigger than the normal maximum + * value, into the maximum allowed value. + * + * If some application really *needs* a bigger snapshot + * length, we should just increase MAXIMUM_SNAPLEN. + */ + if (p->snapshot <= 0 || p->snapshot > MAXIMUM_SNAPLEN) + p->snapshot = MAXIMUM_SNAPLEN; + + pf->OrigMissed = -1; + enmode = ENTSTAMP|ENNONEXCL; + if (!p->opt.immediate) + enmode |= ENBATCH; + if (p->opt.promisc) enmode |= ENPROMISC; if (ioctl(p->fd, EIOCMBIS, (caddr_t)&enmode) < 0) { - snprintf(ebuf, PCAP_ERRBUF_SIZE, "EIOCMBIS: %s", - pcap_strerror(errno)); + pcap_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE, + errno, "EIOCMBIS"); + err = PCAP_ERROR; goto bad; } #ifdef ENCOPYALL @@ -353,14 +372,16 @@ your system may not be properly configured; see the packetfilter(4) man page\n", #endif /* set the backlog */ if (ioctl(p->fd, EIOCSETW, (caddr_t)&backlog) < 0) { - snprintf(ebuf, PCAP_ERRBUF_SIZE, "EIOCSETW: %s", - pcap_strerror(errno)); + pcap_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE, + errno, "EIOCSETW"); + err = PCAP_ERROR; goto bad; } /* discover interface type */ if (ioctl(p->fd, EIOCDEVP, (caddr_t)&devparams) < 0) { - snprintf(ebuf, PCAP_ERRBUF_SIZE, "EIOCDEVP: %s", - pcap_strerror(errno)); + pcap_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE, + errno, "EIOCDEVP"); + err = PCAP_ERROR; goto bad; } /* HACK: to compile prior to Ultrix 4.2 */ @@ -441,51 +462,54 @@ your system may not be properly configured; see the packetfilter(4) man page\n", * framing", there's not much we can do, as that * doesn't specify a particular type of header. */ - snprintf(ebuf, PCAP_ERRBUF_SIZE, "unknown data-link type %u", - devparams.end_dev_type); + snprintf(p->errbuf, PCAP_ERRBUF_SIZE, + "unknown data-link type %u", devparams.end_dev_type); + err = PCAP_ERROR; goto bad; } /* set truncation */ -#ifdef PCAP_FDDIPAD if (p->linktype == DLT_FDDI) { p->fddipad = PCAP_FDDIPAD; /* packetfilter includes the padding in the snapshot */ - snaplen += PCAP_FDDIPAD; + p->snapshot += PCAP_FDDIPAD; } else p->fddipad = 0; -#endif - if (ioctl(p->fd, EIOCTRUNCATE, (caddr_t)&snaplen) < 0) { - snprintf(ebuf, PCAP_ERRBUF_SIZE, "EIOCTRUNCATE: %s", - pcap_strerror(errno)); + if (ioctl(p->fd, EIOCTRUNCATE, (caddr_t)&p->snapshot) < 0) { + pcap_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE, + errno, "EIOCTRUNCATE"); + err = PCAP_ERROR; goto bad; } - p->snapshot = snaplen; /* accept all packets */ memset(&Filter, 0, sizeof(Filter)); Filter.enf_Priority = 37; /* anything > 2 */ Filter.enf_FilterLen = 0; /* means "always true" */ if (ioctl(p->fd, EIOCSETF, (caddr_t)&Filter) < 0) { - snprintf(ebuf, PCAP_ERRBUF_SIZE, "EIOCSETF: %s", - pcap_strerror(errno)); + pcap_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE, + errno, "EIOCSETF"); + err = PCAP_ERROR; goto bad; } - if (to_ms != 0) { + if (p->opt.timeout != 0) { struct timeval timeout; - timeout.tv_sec = to_ms / 1000; - timeout.tv_usec = (to_ms * 1000) % 1000000; + timeout.tv_sec = p->opt.timeout / 1000; + timeout.tv_usec = (p->opt.timeout * 1000) % 1000000; if (ioctl(p->fd, EIOCSRTIMEOUT, (caddr_t)&timeout) < 0) { - snprintf(ebuf, PCAP_ERRBUF_SIZE, "EIOCSRTIMEOUT: %s", - pcap_strerror(errno)); + pcap_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE, + errno, "EIOCSRTIMEOUT"); + err = PCAP_ERROR; goto bad; } } p->bufsize = BUFSPACE; - p->buffer = (u_char*)malloc(p->bufsize + p->offset); + p->buffer = malloc(p->bufsize + p->offset); if (p->buffer == NULL) { - strlcpy(ebuf, pcap_strerror(errno), PCAP_ERRBUF_SIZE); + pcap_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE, + errno, "malloc"); + err = PCAP_ERROR; goto bad; } @@ -502,30 +526,68 @@ your system may not be properly configured; see the packetfilter(4) man page\n", p->getnonblock_op = pcap_getnonblock_fd; p->setnonblock_op = pcap_setnonblock_fd; p->stats_op = pcap_stats_pf; - p->close_op = pcap_close_common; - return (p); + return (0); bad: - if (p->fd >= 0) - close(p->fd); + pcap_cleanup_live_common(p); + return (err); +} + +pcap_t * +pcap_create_interface(const char *device _U_, char *ebuf) +{ + pcap_t *p; + + p = PCAP_CREATE_COMMON(ebuf, struct pcap_pf); + if (p == NULL) + return (NULL); + + p->activate_op = pcap_activate_pf; + return (p); +} + +/* + * XXX - is there an error from pfopen() that means "no such device"? + * Is there one that means "that device doesn't support pf"? + */ +static int +can_be_bound(const char *name _U_) +{ + return (1); +} + +static int +get_if_flags(const char *name _U_, bpf_u_int32 *flags _U_, char *errbuf _U_) +{ /* - * Get rid of any link-layer type list we allocated. + * Nothing we can do other than mark loopback devices as "the + * connected/disconnected status doesn't apply". + * + * XXX - is there a way to find out whether an adapter has + * something plugged into it? */ - if (p->dlt_list != NULL) - free(p->dlt_list); - free(p); - return (NULL); + if (*flags & PCAP_IF_LOOPBACK) { + /* + * Loopback devices aren't wireless, and "connected"/ + * "disconnected" doesn't apply to them. + */ + *flags |= PCAP_IF_CONNECTION_STATUS_NOT_APPLICABLE; + return (0); + } + return (0); } int -pcap_platform_finddevs(pcap_if_t **alldevsp, char *errbuf) +pcap_platform_finddevs(pcap_if_list_t *devlistp, char *errbuf) { - return (0); + return (pcap_findalldevs_interfaces(devlistp, errbuf, can_be_bound, + get_if_flags)); } static int pcap_setfilter_pf(pcap_t *p, struct bpf_program *fp) { + struct pcap_pf *pf = p->priv; struct bpf_version bv; /* @@ -548,8 +610,8 @@ pcap_setfilter_pf(pcap_t *p, struct bpf_program *fp) * Yes. Try to install the filter. */ if (ioctl(p->fd, BIOCSETF, (caddr_t)fp) < 0) { - snprintf(p->errbuf, sizeof(p->errbuf), - "BIOCSETF: %s", pcap_strerror(errno)); + pcap_fmt_errmsg_for_errno(p->errbuf, + sizeof(p->errbuf), errno, "BIOCSETF"); return (-1); } @@ -567,7 +629,7 @@ pcap_setfilter_pf(pcap_t *p, struct bpf_program *fp) * a window to annoy the user. */ fprintf(stderr, "tcpdump: Using kernel BPF filter\n"); - p->md.use_bpf = 1; + pf->filtering_in_kernel = 1; /* * Discard any previously-received packets, @@ -605,6 +667,15 @@ pcap_setfilter_pf(pcap_t *p, struct bpf_program *fp) * a warning of some sort. */ fprintf(stderr, "tcpdump: Filtering in user process\n"); - p->md.use_bpf = 0; + pf->filtering_in_kernel = 0; return (0); } + +/* + * Libpcap version string. + */ +const char * +pcap_lib_version(void) +{ + return (PCAP_VERSION_STRING); +}