• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /*
2  * Copyright (c) 1993, 1994, 1995, 1996, 1997, 1998
3  *	The Regents of the University of California.  All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. All advertising materials mentioning features or use of this software
14  *    must display the following acknowledgement:
15  *	This product includes software developed by the Computer Systems
16  *	Engineering Group at Lawrence Berkeley Laboratory.
17  * 4. Neither the name of the University nor of the Laboratory may be used
18  *    to endorse or promote products derived from this software without
19  *    specific prior written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  */
33 
34 #ifndef lint
35 static const char rcsid[] _U_ =
36     "@(#) $Header: /tcpdump/master/libpcap/pcap.c,v 1.128 2008-12-23 20:13:29 guy Exp $ (LBL)";
37 #endif
38 
39 #ifdef HAVE_CONFIG_H
40 #include "config.h"
41 #endif
42 
43 #ifdef WIN32
44 #include <pcap-stdinc.h>
45 #else /* WIN32 */
46 #if HAVE_INTTYPES_H
47 #include <inttypes.h>
48 #elif HAVE_STDINT_H
49 #include <stdint.h>
50 #endif
51 #ifdef HAVE_SYS_BITYPES_H
52 #include <sys/bitypes.h>
53 #endif
54 #include <sys/types.h>
55 #endif /* WIN32 */
56 
57 #include <stdio.h>
58 #include <stdlib.h>
59 #include <string.h>
60 #if !defined(_MSC_VER) && !defined(__BORLANDC__) && !defined(__MINGW32__)
61 #include <unistd.h>
62 #endif
63 #include <fcntl.h>
64 #include <errno.h>
65 
66 #ifdef HAVE_OS_PROTO_H
67 #include "os-proto.h"
68 #endif
69 
70 #ifdef MSDOS
71 #include "pcap-dos.h"
72 #endif
73 
74 #include "pcap-int.h"
75 
76 #ifdef HAVE_DAG_API
77 #include "pcap-dag.h"
78 #endif /* HAVE_DAG_API */
79 
80 #ifdef HAVE_SEPTEL_API
81 #include "pcap-septel.h"
82 #endif /* HAVE_SEPTEL_API */
83 
84 #ifdef HAVE_SNF_API
85 #include "pcap-snf.h"
86 #endif /* HAVE_SNF_API */
87 
88 #ifdef PCAP_SUPPORT_USB
89 #include "pcap-usb-linux.h"
90 #endif
91 
92 #ifdef PCAP_SUPPORT_BT
93 #include "pcap-bt-linux.h"
94 #endif
95 
96 #ifdef PCAP_SUPPORT_CAN
97 #include "pcap-can-linux.h"
98 #endif
99 
100 #ifdef PCAP_SUPPORT_CANUSB
101 #include "pcap-canusb-linux.h"
102 #endif
103 
104 #ifdef PCAP_SUPPORT_NETFILTER
105 #include "pcap-netfilter-linux.h"
106 #endif
107 
108 #ifdef PCAP_SUPPORT_DBUS
109 #include "pcap-dbus.h"
110 #endif
111 
112 int
pcap_not_initialized(pcap_t * pcap _U_)113 pcap_not_initialized(pcap_t *pcap _U_)
114 {
115 	/* this means 'not initialized' */
116 	return (PCAP_ERROR_NOT_ACTIVATED);
117 }
118 
119 #ifdef WIN32
120 Adapter *
pcap_no_adapter(pcap_t * pcap _U_)121 pcap_no_adapter(pcap_t *pcap _U_)
122 {
123 	return (NULL);
124 }
125 #endif
126 
127 /*
128  * Returns 1 if rfmon mode can be set on the pcap_t, 0 if it can't,
129  * a PCAP_ERROR value on an error.
130  */
131 int
pcap_can_set_rfmon(pcap_t * p)132 pcap_can_set_rfmon(pcap_t *p)
133 {
134 	return (p->can_set_rfmon_op(p));
135 }
136 
137 /*
138  * For systems where rfmon mode is never supported.
139  */
140 static int
pcap_cant_set_rfmon(pcap_t * p _U_)141 pcap_cant_set_rfmon(pcap_t *p _U_)
142 {
143 	return (0);
144 }
145 
146 /*
147  * Sets *tstamp_typesp to point to an array 1 or more supported time stamp
148  * types; the return value is the number of supported time stamp types.
149  * The list should be freed by a call to pcap_free_tstamp_types() when
150  * you're done with it.
151  *
152  * A return value of 0 means "you don't get a choice of time stamp type",
153  * in which case *tstamp_typesp is set to null.
154  *
155  * PCAP_ERROR is returned on error.
156  */
157 int
pcap_list_tstamp_types(pcap_t * p,int ** tstamp_typesp)158 pcap_list_tstamp_types(pcap_t *p, int **tstamp_typesp)
159 {
160 	if (p->tstamp_type_count == 0) {
161 		/*
162 		 * We don't support multiple time stamp types.
163 		 */
164 		*tstamp_typesp = NULL;
165 	} else {
166 		*tstamp_typesp = (int*)calloc(sizeof(**tstamp_typesp),
167 		    p->tstamp_type_count);
168 		if (*tstamp_typesp == NULL) {
169 			(void)snprintf(p->errbuf, sizeof(p->errbuf),
170 			    "malloc: %s", pcap_strerror(errno));
171 			return (PCAP_ERROR);
172 		}
173 		(void)memcpy(*tstamp_typesp, p->tstamp_type_list,
174 		    sizeof(**tstamp_typesp) * p->tstamp_type_count);
175 	}
176 	return (p->tstamp_type_count);
177 }
178 
179 /*
180  * In Windows, you might have a library built with one version of the
181  * C runtime library and an application built with another version of
182  * the C runtime library, which means that the library might use one
183  * version of malloc() and free() and the application might use another
184  * version of malloc() and free().  If so, that means something
185  * allocated by the library cannot be freed by the application, so we
186  * need to have a pcap_free_tstamp_types() routine to free up the list
187  * allocated by pcap_list_tstamp_types(), even though it's just a wrapper
188  * around free().
189  */
190 void
pcap_free_tstamp_types(int * tstamp_type_list)191 pcap_free_tstamp_types(int *tstamp_type_list)
192 {
193 	free(tstamp_type_list);
194 }
195 
196 /*
197  * Default one-shot callback; overridden for capture types where the
198  * packet data cannot be guaranteed to be available after the callback
199  * returns, so that a copy must be made.
200  */
201 void
pcap_oneshot(u_char * user,const struct pcap_pkthdr * h,const u_char * pkt)202 pcap_oneshot(u_char *user, const struct pcap_pkthdr *h, const u_char *pkt)
203 {
204 	struct oneshot_userdata *sp = (struct oneshot_userdata *)user;
205 
206 	*sp->hdr = *h;
207 	*sp->pkt = pkt;
208 }
209 
210 const u_char *
pcap_next(pcap_t * p,struct pcap_pkthdr * h)211 pcap_next(pcap_t *p, struct pcap_pkthdr *h)
212 {
213 	struct oneshot_userdata s;
214 	const u_char *pkt;
215 
216 	s.hdr = h;
217 	s.pkt = &pkt;
218 	s.pd = p;
219 	if (pcap_dispatch(p, 1, p->oneshot_callback, (u_char *)&s) <= 0)
220 		return (0);
221 	return (pkt);
222 }
223 
224 int
pcap_next_ex(pcap_t * p,struct pcap_pkthdr ** pkt_header,const u_char ** pkt_data)225 pcap_next_ex(pcap_t *p, struct pcap_pkthdr **pkt_header,
226     const u_char **pkt_data)
227 {
228 	struct oneshot_userdata s;
229 
230 	s.hdr = &p->pcap_header;
231 	s.pkt = pkt_data;
232 	s.pd = p;
233 
234 	/* Saves a pointer to the packet headers */
235 	*pkt_header= &p->pcap_header;
236 
237 	if (p->rfile != NULL) {
238 		int status;
239 
240 		/* We are on an offline capture */
241 		status = pcap_offline_read(p, 1, p->oneshot_callback,
242 		    (u_char *)&s);
243 
244 		/*
245 		 * Return codes for pcap_offline_read() are:
246 		 *   -  0: EOF
247 		 *   - -1: error
248 		 *   - >1: OK
249 		 * The first one ('0') conflicts with the return code of
250 		 * 0 from pcap_read() meaning "no packets arrived before
251 		 * the timeout expired", so we map it to -2 so you can
252 		 * distinguish between an EOF from a savefile and a
253 		 * "no packets arrived before the timeout expired, try
254 		 * again" from a live capture.
255 		 */
256 		if (status == 0)
257 			return (-2);
258 		else
259 			return (status);
260 	}
261 
262 	/*
263 	 * Return codes for pcap_read() are:
264 	 *   -  0: timeout
265 	 *   - -1: error
266 	 *   - -2: loop was broken out of with pcap_breakloop()
267 	 *   - >1: OK
268 	 * The first one ('0') conflicts with the return code of 0 from
269 	 * pcap_offline_read() meaning "end of file".
270 	*/
271 	return (p->read_op(p, 1, p->oneshot_callback, (u_char *)&s));
272 }
273 
274 #if defined(DAG_ONLY)
275 int
pcap_findalldevs(pcap_if_t ** alldevsp,char * errbuf)276 pcap_findalldevs(pcap_if_t **alldevsp, char *errbuf)
277 {
278 	return (dag_findalldevs(alldevsp, errbuf));
279 }
280 
281 pcap_t *
pcap_create(const char * source,char * errbuf)282 pcap_create(const char *source, char *errbuf)
283 {
284 	return (dag_create(source, errbuf));
285 }
286 #elif defined(SEPTEL_ONLY)
287 int
pcap_findalldevs(pcap_if_t ** alldevsp,char * errbuf)288 pcap_findalldevs(pcap_if_t **alldevsp, char *errbuf)
289 {
290 	return (septel_findalldevs(alldevsp, errbuf));
291 }
292 
293 pcap_t *
pcap_create(const char * source,char * errbuf)294 pcap_create(const char *source, char *errbuf)
295 {
296 	return (septel_create(source, errbuf));
297 }
298 #elif defined(SNF_ONLY)
299 int
pcap_findalldevs(pcap_if_t ** alldevsp,char * errbuf)300 pcap_findalldevs(pcap_if_t **alldevsp, char *errbuf)
301 {
302 	return (snf_findalldevs(alldevsp, errbuf));
303 }
304 
305 pcap_t *
pcap_create(const char * source,char * errbuf)306 pcap_create(const char *source, char *errbuf)
307 {
308 	return (snf_create(source, errbuf));
309 }
310 #else /* regular pcap */
311 struct capture_source_type {
312 	int (*findalldevs_op)(pcap_if_t **, char *);
313 	pcap_t *(*create_op)(const char *, char *, int *);
314 } capture_source_types[] = {
315 #ifdef HAVE_DAG_API
316 	{ dag_findalldevs, dag_create },
317 #endif
318 #ifdef HAVE_SEPTEL_API
319 	{ septel_findalldevs, septel_create },
320 #endif
321 #ifdef HAVE_SNF_API
322 	{ snf_findalldevs, snf_create },
323 #endif
324 #ifdef PCAP_SUPPORT_BT
325 	{ bt_findalldevs, bt_create },
326 #endif
327 #if PCAP_SUPPORT_CANUSB
328 	{ canusb_findalldevs, canusb_create },
329 #endif
330 #ifdef PCAP_SUPPORT_CAN
331 	{ can_findalldevs, can_create },
332 #endif
333 #ifdef PCAP_SUPPORT_USB
334 	{ usb_findalldevs, usb_create },
335 #endif
336 #ifdef PCAP_SUPPORT_NETFILTER
337 	{ netfilter_findalldevs, netfilter_create },
338 #endif
339 #ifdef PCAP_SUPPORT_DBUS
340 	{ dbus_findalldevs, dbus_create },
341 #endif
342 	{ NULL, NULL }
343 };
344 
345 /*
346  * Get a list of all capture sources that are up and that we can open.
347  * Returns -1 on error, 0 otherwise.
348  * The list, as returned through "alldevsp", may be null if no interfaces
349  * were up and could be opened.
350  */
351 int
pcap_findalldevs(pcap_if_t ** alldevsp,char * errbuf)352 pcap_findalldevs(pcap_if_t **alldevsp, char *errbuf)
353 {
354 	size_t i;
355 
356 	/*
357 	 * Get the list of regular interfaces first.
358 	 */
359 	if (pcap_findalldevs_interfaces(alldevsp, errbuf) == -1)
360 		return (-1);	/* failure */
361 
362 	/*
363 	 * Add any interfaces that need a platform-specific mechanism
364 	 * to find.
365 	 */
366 	if (pcap_platform_finddevs(alldevsp, errbuf) == -1) {
367 		/*
368 		 * We had an error; free the list we've been
369 		 * constructing.
370 		 */
371 		if (*alldevsp != NULL) {
372 			pcap_freealldevs(*alldevsp);
373 			*alldevsp = NULL;
374 		}
375 		return (-1);
376 	}
377 
378 	/*
379 	 * Ask each of the non-local-network-interface capture
380 	 * source types what interfaces they have.
381 	 */
382 	for (i = 0; capture_source_types[i].findalldevs_op != NULL; i++) {
383 		if (capture_source_types[i].findalldevs_op(alldevsp, errbuf) == -1) {
384 			/*
385 			 * We had an error; free the list we've been
386 			 * constructing.
387 			 */
388 			if (*alldevsp != NULL) {
389 				pcap_freealldevs(*alldevsp);
390 				*alldevsp = NULL;
391 			}
392 			return (-1);
393 		}
394 	}
395 	return (0);
396 }
397 
398 pcap_t *
pcap_create(const char * source,char * errbuf)399 pcap_create(const char *source, char *errbuf)
400 {
401 	size_t i;
402 	int is_theirs;
403 	pcap_t *p;
404 
405 	/*
406 	 * A null source name is equivalent to the "any" device -
407 	 * which might not be supported on this platform, but
408 	 * this means that you'll get a "not supported" error
409 	 * rather than, say, a crash when we try to dereference
410 	 * the null pointer.
411 	 */
412 	if (source == NULL)
413 		source = "any";
414 
415 	/*
416 	 * Try each of the non-local-network-interface capture
417 	 * source types until we find one that works for this
418 	 * device or run out of types.
419 	 */
420 	for (i = 0; capture_source_types[i].create_op != NULL; i++) {
421 		is_theirs = 0;
422 		p = capture_source_types[i].create_op(source, errbuf, &is_theirs);
423 		if (is_theirs) {
424 			/*
425 			 * The device name refers to a device of the
426 			 * type in question; either it succeeded,
427 			 * in which case p refers to a pcap_t to
428 			 * later activate for the device, or it
429 			 * failed, in which case p is null and we
430 			 * should return that to report the failure
431 			 * to create.
432 			 */
433 			return (p);
434 		}
435 	}
436 
437 	/*
438 	 * OK, try it as a regular network interface.
439 	 */
440 	return (pcap_create_interface(source, errbuf));
441 }
442 #endif
443 
444 static void
initialize_ops(pcap_t * p)445 initialize_ops(pcap_t *p)
446 {
447 	/*
448 	 * Set operation pointers for operations that only work on
449 	 * an activated pcap_t to point to a routine that returns
450 	 * a "this isn't activated" error.
451 	 */
452 	p->read_op = (read_op_t)pcap_not_initialized;
453 	p->inject_op = (inject_op_t)pcap_not_initialized;
454 	p->setfilter_op = (setfilter_op_t)pcap_not_initialized;
455 	p->setdirection_op = (setdirection_op_t)pcap_not_initialized;
456 	p->set_datalink_op = (set_datalink_op_t)pcap_not_initialized;
457 	p->getnonblock_op = (getnonblock_op_t)pcap_not_initialized;
458 	p->setnonblock_op = (setnonblock_op_t)pcap_not_initialized;
459 	p->stats_op = (stats_op_t)pcap_not_initialized;
460 #ifdef WIN32
461 	p->setbuff_op = (setbuff_op_t)pcap_not_initialized;
462 	p->setmode_op = (setmode_op_t)pcap_not_initialized;
463 	p->setmintocopy_op = (setmintocopy_op_t)pcap_not_initialized;
464 	p->getadapter_op = pcap_no_adapter;
465 #endif
466 
467 	/*
468 	 * Default cleanup operation - implementations can override
469 	 * this, but should call pcap_cleanup_live_common() after
470 	 * doing their own additional cleanup.
471 	 */
472 	p->cleanup_op = pcap_cleanup_live_common;
473 
474 	/*
475 	 * In most cases, the standard one-shot callback can
476 	 * be used for pcap_next()/pcap_next_ex().
477 	 */
478 	p->oneshot_callback = pcap_oneshot;
479 }
480 
481 static pcap_t *
pcap_alloc_pcap_t(char * ebuf,size_t size)482 pcap_alloc_pcap_t(char *ebuf, size_t size)
483 {
484 	char *chunk;
485 	pcap_t *p;
486 
487 	/*
488 	 * Allocate a chunk of memory big enough for a pcap_t
489 	 * plus a structure following it of size "size".  The
490 	 * structure following it is a private data structure
491 	 * for the routines that handle this pcap_t.
492 	 */
493 	chunk = malloc(sizeof (pcap_t) + size);
494 	if (chunk == NULL) {
495 		snprintf(ebuf, PCAP_ERRBUF_SIZE, "malloc: %s",
496 		    pcap_strerror(errno));
497 		return (NULL);
498 	}
499 	memset(chunk, 0, sizeof (pcap_t) + size);
500 
501 	/*
502 	 * Get a pointer to the pcap_t at the beginning.
503 	 */
504 	p = (pcap_t *)chunk;
505 
506 #ifndef WIN32
507 	p->fd = -1;	/* not opened yet */
508 	p->selectable_fd = -1;
509 #endif
510 
511 	if (size == 0) {
512 		/* No private data was requested. */
513 		p->priv = NULL;
514 	} else {
515 		/*
516 		 * Set the pointer to the private data; that's the structure
517 		 * of size "size" following the pcap_t.
518 		 */
519 		p->priv = (void *)(chunk + sizeof (pcap_t));
520 	}
521 
522 	return (p);
523 }
524 
525 pcap_t *
pcap_create_common(const char * source,char * ebuf,size_t size)526 pcap_create_common(const char *source, char *ebuf, size_t size)
527 {
528 	pcap_t *p;
529 
530 	p = pcap_alloc_pcap_t(ebuf, size);
531 	if (p == NULL)
532 		return (NULL);
533 
534 	p->opt.source = strdup(source);
535 	if (p->opt.source == NULL) {
536 		snprintf(ebuf, PCAP_ERRBUF_SIZE, "malloc: %s",
537 		    pcap_strerror(errno));
538 		free(p);
539 		return (NULL);
540 	}
541 
542 	/*
543 	 * Default to "can't set rfmon mode"; if it's supported by
544 	 * a platform, the create routine that called us can set
545 	 * the op to its routine to check whether a particular
546 	 * device supports it.
547 	 */
548 	p->can_set_rfmon_op = pcap_cant_set_rfmon;
549 
550 	initialize_ops(p);
551 
552 	/* put in some defaults*/
553  	pcap_set_snaplen(p, 65535);	/* max packet size */
554 	p->opt.timeout = 0;		/* no timeout specified */
555 	p->opt.buffer_size = 0;		/* use the platform's default */
556 	p->opt.promisc = 0;
557 	p->opt.rfmon = 0;
558 	p->opt.immediate = 0;
559 	p->opt.tstamp_type = -1;	/* default to not setting time stamp type */
560 	p->opt.tstamp_precision = PCAP_TSTAMP_PRECISION_MICRO;
561 	return (p);
562 }
563 
564 int
pcap_check_activated(pcap_t * p)565 pcap_check_activated(pcap_t *p)
566 {
567 	if (p->activated) {
568 		snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "can't perform "
569 			" operation on activated capture");
570 		return (-1);
571 	}
572 	return (0);
573 }
574 
575 int
pcap_set_snaplen(pcap_t * p,int snaplen)576 pcap_set_snaplen(pcap_t *p, int snaplen)
577 {
578 	if (pcap_check_activated(p))
579 		return (PCAP_ERROR_ACTIVATED);
580 	p->snapshot = snaplen;
581 	return (0);
582 }
583 
584 int
pcap_set_promisc(pcap_t * p,int promisc)585 pcap_set_promisc(pcap_t *p, int promisc)
586 {
587 	if (pcap_check_activated(p))
588 		return (PCAP_ERROR_ACTIVATED);
589 	p->opt.promisc = promisc;
590 	return (0);
591 }
592 
593 int
pcap_set_rfmon(pcap_t * p,int rfmon)594 pcap_set_rfmon(pcap_t *p, int rfmon)
595 {
596 	if (pcap_check_activated(p))
597 		return (PCAP_ERROR_ACTIVATED);
598 	p->opt.rfmon = rfmon;
599 	return (0);
600 }
601 
602 int
pcap_set_timeout(pcap_t * p,int timeout_ms)603 pcap_set_timeout(pcap_t *p, int timeout_ms)
604 {
605 	if (pcap_check_activated(p))
606 		return (PCAP_ERROR_ACTIVATED);
607 	p->opt.timeout = timeout_ms;
608 	return (0);
609 }
610 
611 int
pcap_set_tstamp_type(pcap_t * p,int tstamp_type)612 pcap_set_tstamp_type(pcap_t *p, int tstamp_type)
613 {
614 	int i;
615 
616 	if (pcap_check_activated(p))
617 		return (PCAP_ERROR_ACTIVATED);
618 
619 	/*
620 	 * If p->tstamp_type_count is 0, we only support PCAP_TSTAMP_HOST;
621 	 * the default time stamp type is PCAP_TSTAMP_HOST.
622 	 */
623 	if (p->tstamp_type_count == 0) {
624 		if (tstamp_type == PCAP_TSTAMP_HOST) {
625 			p->opt.tstamp_type = tstamp_type;
626 			return (0);
627 		}
628 	} else {
629 		/*
630 		 * Check whether we claim to support this type of time stamp.
631 		 */
632 		for (i = 0; i < p->tstamp_type_count; i++) {
633 			if (p->tstamp_type_list[i] == tstamp_type) {
634 				/*
635 				 * Yes.
636 				 */
637 				p->opt.tstamp_type = tstamp_type;
638 				return (0);
639 			}
640 		}
641 	}
642 
643 	/*
644 	 * We don't support this type of time stamp.
645 	 */
646 	return (PCAP_WARNING_TSTAMP_TYPE_NOTSUP);
647 }
648 
649 int
pcap_set_immediate_mode(pcap_t * p,int immediate)650 pcap_set_immediate_mode(pcap_t *p, int immediate)
651 {
652 	if (pcap_check_activated(p))
653 		return (PCAP_ERROR_ACTIVATED);
654 	p->opt.immediate = immediate;
655 	return (0);
656 }
657 
658 int
pcap_set_buffer_size(pcap_t * p,int buffer_size)659 pcap_set_buffer_size(pcap_t *p, int buffer_size)
660 {
661 	if (pcap_check_activated(p))
662 		return (PCAP_ERROR_ACTIVATED);
663 	p->opt.buffer_size = buffer_size;
664 	return (0);
665 }
666 
667 int
pcap_set_tstamp_precision(pcap_t * p,int tstamp_precision)668 pcap_set_tstamp_precision(pcap_t *p, int tstamp_precision)
669 {
670 	int i;
671 
672 	if (pcap_check_activated(p))
673 		return (PCAP_ERROR_ACTIVATED);
674 
675 	/*
676 	 * If p->tstamp_precision_count is 0, we only support setting
677 	 * the time stamp precision to microsecond precision; every
678 	 * pcap module *MUST* support microsecond precision, even if
679 	 * it does so by converting the native precision to
680 	 * microseconds.
681 	 */
682 	if (p->tstamp_precision_count == 0) {
683 		if (tstamp_precision == PCAP_TSTAMP_PRECISION_MICRO) {
684 			p->opt.tstamp_precision = tstamp_precision;
685 			return (0);
686 		}
687 	} else {
688 		/*
689 		 * Check whether we claim to support this precision of
690 		 * time stamp.
691 		 */
692 		for (i = 0; i < p->tstamp_precision_count; i++) {
693 			if (p->tstamp_precision_list[i] == tstamp_precision) {
694 				/*
695 				 * Yes.
696 				 */
697 				p->opt.tstamp_precision = tstamp_precision;
698 				return (0);
699 			}
700 		}
701 	}
702 
703 	/*
704 	 * We don't support this time stamp precision.
705 	 */
706 	return (PCAP_ERROR_TSTAMP_PRECISION_NOTSUP);
707 }
708 
709 int
pcap_get_tstamp_precision(pcap_t * p)710 pcap_get_tstamp_precision(pcap_t *p)
711 {
712         return (p->opt.tstamp_precision);
713 }
714 
715 int
pcap_activate(pcap_t * p)716 pcap_activate(pcap_t *p)
717 {
718 	int status;
719 
720 	/*
721 	 * Catch attempts to re-activate an already-activated
722 	 * pcap_t; this should, for example, catch code that
723 	 * calls pcap_open_live() followed by pcap_activate(),
724 	 * as some code that showed up in a Stack Exchange
725 	 * question did.
726 	 */
727 	if (pcap_check_activated(p))
728 		return (PCAP_ERROR_ACTIVATED);
729 	status = p->activate_op(p);
730 	if (status >= 0)
731 		p->activated = 1;
732 	else {
733 		if (p->errbuf[0] == '\0') {
734 			/*
735 			 * No error message supplied by the activate routine;
736 			 * for the benefit of programs that don't specially
737 			 * handle errors other than PCAP_ERROR, return the
738 			 * error message corresponding to the status.
739 			 */
740 			snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "%s",
741 			    pcap_statustostr(status));
742 		}
743 
744 		/*
745 		 * Undo any operation pointer setting, etc. done by
746 		 * the activate operation.
747 		 */
748 		initialize_ops(p);
749 	}
750 	return (status);
751 }
752 
753 pcap_t *
pcap_open_live(const char * source,int snaplen,int promisc,int to_ms,char * errbuf)754 pcap_open_live(const char *source, int snaplen, int promisc, int to_ms, char *errbuf)
755 {
756 	pcap_t *p;
757 	int status;
758 
759 	p = pcap_create(source, errbuf);
760 	if (p == NULL)
761 		return (NULL);
762 	status = pcap_set_snaplen(p, snaplen);
763 	if (status < 0)
764 		goto fail;
765 	status = pcap_set_promisc(p, promisc);
766 	if (status < 0)
767 		goto fail;
768 	status = pcap_set_timeout(p, to_ms);
769 	if (status < 0)
770 		goto fail;
771 	/*
772 	 * Mark this as opened with pcap_open_live(), so that, for
773 	 * example, we show the full list of DLT_ values, rather
774 	 * than just the ones that are compatible with capturing
775 	 * when not in monitor mode.  That allows existing applications
776 	 * to work the way they used to work, but allows new applications
777 	 * that know about the new open API to, for example, find out the
778 	 * DLT_ values that they can select without changing whether
779 	 * the adapter is in monitor mode or not.
780 	 */
781 	p->oldstyle = 1;
782 	status = pcap_activate(p);
783 	if (status < 0)
784 		goto fail;
785 	return (p);
786 fail:
787 	if (status == PCAP_ERROR)
788 		snprintf(errbuf, PCAP_ERRBUF_SIZE, "%s: %s", source,
789 		    p->errbuf);
790 	else if (status == PCAP_ERROR_NO_SUCH_DEVICE ||
791 	    status == PCAP_ERROR_PERM_DENIED ||
792 	    status == PCAP_ERROR_PROMISC_PERM_DENIED)
793 		snprintf(errbuf, PCAP_ERRBUF_SIZE, "%s: %s (%s)", source,
794 		    pcap_statustostr(status), p->errbuf);
795 	else
796 		snprintf(errbuf, PCAP_ERRBUF_SIZE, "%s: %s", source,
797 		    pcap_statustostr(status));
798 	pcap_close(p);
799 	return (NULL);
800 }
801 
802 pcap_t *
pcap_open_offline_common(char * ebuf,size_t size)803 pcap_open_offline_common(char *ebuf, size_t size)
804 {
805 	pcap_t *p;
806 
807 	p = pcap_alloc_pcap_t(ebuf, size);
808 	if (p == NULL)
809 		return (NULL);
810 
811 	p->opt.tstamp_precision = PCAP_TSTAMP_PRECISION_MICRO;
812 	p->opt.source = strdup("(savefile)");
813 	if (p->opt.source == NULL) {
814 		snprintf(ebuf, PCAP_ERRBUF_SIZE, "malloc: %s",
815 		    pcap_strerror(errno));
816 		free(p);
817 		return (NULL);
818 	}
819 
820 	return (p);
821 }
822 
823 int
pcap_dispatch(pcap_t * p,int cnt,pcap_handler callback,u_char * user)824 pcap_dispatch(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
825 {
826 	return (p->read_op(p, cnt, callback, user));
827 }
828 
829 /*
830  * XXX - is this necessary?
831  */
832 int
pcap_read(pcap_t * p,int cnt,pcap_handler callback,u_char * user)833 pcap_read(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
834 {
835 
836 	return (p->read_op(p, cnt, callback, user));
837 }
838 
839 int
pcap_loop(pcap_t * p,int cnt,pcap_handler callback,u_char * user)840 pcap_loop(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
841 {
842 	register int n;
843 
844 	for (;;) {
845 		if (p->rfile != NULL) {
846 			/*
847 			 * 0 means EOF, so don't loop if we get 0.
848 			 */
849 			n = pcap_offline_read(p, cnt, callback, user);
850 		} else {
851 			/*
852 			 * XXX keep reading until we get something
853 			 * (or an error occurs)
854 			 */
855 			do {
856 				n = p->read_op(p, cnt, callback, user);
857 			} while (n == 0);
858 		}
859 		if (n <= 0)
860 			return (n);
861 		if (!PACKET_COUNT_IS_UNLIMITED(cnt)) {
862 			cnt -= n;
863 			if (cnt <= 0)
864 				return (0);
865 		}
866 	}
867 }
868 
869 /*
870  * Force the loop in "pcap_read()" or "pcap_read_offline()" to terminate.
871  */
872 void
pcap_breakloop(pcap_t * p)873 pcap_breakloop(pcap_t *p)
874 {
875 	p->break_loop = 1;
876 }
877 
878 int
pcap_datalink(pcap_t * p)879 pcap_datalink(pcap_t *p)
880 {
881 	if (!p->activated)
882 		return (PCAP_ERROR_NOT_ACTIVATED);
883 	return (p->linktype);
884 }
885 
886 int
pcap_datalink_ext(pcap_t * p)887 pcap_datalink_ext(pcap_t *p)
888 {
889 	if (!p->activated)
890 		return (PCAP_ERROR_NOT_ACTIVATED);
891 	return (p->linktype_ext);
892 }
893 
894 int
pcap_list_datalinks(pcap_t * p,int ** dlt_buffer)895 pcap_list_datalinks(pcap_t *p, int **dlt_buffer)
896 {
897 	if (!p->activated)
898 		return (PCAP_ERROR_NOT_ACTIVATED);
899 	if (p->dlt_count == 0) {
900 		/*
901 		 * We couldn't fetch the list of DLTs, which means
902 		 * this platform doesn't support changing the
903 		 * DLT for an interface.  Return a list of DLTs
904 		 * containing only the DLT this device supports.
905 		 */
906 		*dlt_buffer = (int*)malloc(sizeof(**dlt_buffer));
907 		if (*dlt_buffer == NULL) {
908 			(void)snprintf(p->errbuf, sizeof(p->errbuf),
909 			    "malloc: %s", pcap_strerror(errno));
910 			return (PCAP_ERROR);
911 		}
912 		**dlt_buffer = p->linktype;
913 		return (1);
914 	} else {
915 		*dlt_buffer = (int*)calloc(sizeof(**dlt_buffer), p->dlt_count);
916 		if (*dlt_buffer == NULL) {
917 			(void)snprintf(p->errbuf, sizeof(p->errbuf),
918 			    "malloc: %s", pcap_strerror(errno));
919 			return (PCAP_ERROR);
920 		}
921 		(void)memcpy(*dlt_buffer, p->dlt_list,
922 		    sizeof(**dlt_buffer) * p->dlt_count);
923 		return (p->dlt_count);
924 	}
925 }
926 
927 /*
928  * In Windows, you might have a library built with one version of the
929  * C runtime library and an application built with another version of
930  * the C runtime library, which means that the library might use one
931  * version of malloc() and free() and the application might use another
932  * version of malloc() and free().  If so, that means something
933  * allocated by the library cannot be freed by the application, so we
934  * need to have a pcap_free_datalinks() routine to free up the list
935  * allocated by pcap_list_datalinks(), even though it's just a wrapper
936  * around free().
937  */
938 void
pcap_free_datalinks(int * dlt_list)939 pcap_free_datalinks(int *dlt_list)
940 {
941 	free(dlt_list);
942 }
943 
944 int
pcap_set_datalink(pcap_t * p,int dlt)945 pcap_set_datalink(pcap_t *p, int dlt)
946 {
947 	int i;
948 	const char *dlt_name;
949 
950 	if (p->dlt_count == 0 || p->set_datalink_op == NULL) {
951 		/*
952 		 * We couldn't fetch the list of DLTs, or we don't
953 		 * have a "set datalink" operation, which means
954 		 * this platform doesn't support changing the
955 		 * DLT for an interface.  Check whether the new
956 		 * DLT is the one this interface supports.
957 		 */
958 		if (p->linktype != dlt)
959 			goto unsupported;
960 
961 		/*
962 		 * It is, so there's nothing we need to do here.
963 		 */
964 		return (0);
965 	}
966 	for (i = 0; i < p->dlt_count; i++)
967 		if (p->dlt_list[i] == dlt)
968 			break;
969 	if (i >= p->dlt_count)
970 		goto unsupported;
971 	if (p->dlt_count == 2 && p->dlt_list[0] == DLT_EN10MB &&
972 	    dlt == DLT_DOCSIS) {
973 		/*
974 		 * This is presumably an Ethernet device, as the first
975 		 * link-layer type it offers is DLT_EN10MB, and the only
976 		 * other type it offers is DLT_DOCSIS.  That means that
977 		 * we can't tell the driver to supply DOCSIS link-layer
978 		 * headers - we're just pretending that's what we're
979 		 * getting, as, presumably, we're capturing on a dedicated
980 		 * link to a Cisco Cable Modem Termination System, and
981 		 * it's putting raw DOCSIS frames on the wire inside low-level
982 		 * Ethernet framing.
983 		 */
984 		p->linktype = dlt;
985 		return (0);
986 	}
987 	if (p->set_datalink_op(p, dlt) == -1)
988 		return (-1);
989 	p->linktype = dlt;
990 	return (0);
991 
992 unsupported:
993 	dlt_name = pcap_datalink_val_to_name(dlt);
994 	if (dlt_name != NULL) {
995 		(void) snprintf(p->errbuf, sizeof(p->errbuf),
996 		    "%s is not one of the DLTs supported by this device",
997 		    dlt_name);
998 	} else {
999 		(void) snprintf(p->errbuf, sizeof(p->errbuf),
1000 		    "DLT %d is not one of the DLTs supported by this device",
1001 		    dlt);
1002 	}
1003 	return (-1);
1004 }
1005 
1006 /*
1007  * This array is designed for mapping upper and lower case letter
1008  * together for a case independent comparison.  The mappings are
1009  * based upon ascii character sequences.
1010  */
1011 static const u_char charmap[] = {
1012 	(u_char)'\000', (u_char)'\001', (u_char)'\002', (u_char)'\003',
1013 	(u_char)'\004', (u_char)'\005', (u_char)'\006', (u_char)'\007',
1014 	(u_char)'\010', (u_char)'\011', (u_char)'\012', (u_char)'\013',
1015 	(u_char)'\014', (u_char)'\015', (u_char)'\016', (u_char)'\017',
1016 	(u_char)'\020', (u_char)'\021', (u_char)'\022', (u_char)'\023',
1017 	(u_char)'\024', (u_char)'\025', (u_char)'\026', (u_char)'\027',
1018 	(u_char)'\030', (u_char)'\031', (u_char)'\032', (u_char)'\033',
1019 	(u_char)'\034', (u_char)'\035', (u_char)'\036', (u_char)'\037',
1020 	(u_char)'\040', (u_char)'\041', (u_char)'\042', (u_char)'\043',
1021 	(u_char)'\044', (u_char)'\045', (u_char)'\046', (u_char)'\047',
1022 	(u_char)'\050', (u_char)'\051', (u_char)'\052', (u_char)'\053',
1023 	(u_char)'\054', (u_char)'\055', (u_char)'\056', (u_char)'\057',
1024 	(u_char)'\060', (u_char)'\061', (u_char)'\062', (u_char)'\063',
1025 	(u_char)'\064', (u_char)'\065', (u_char)'\066', (u_char)'\067',
1026 	(u_char)'\070', (u_char)'\071', (u_char)'\072', (u_char)'\073',
1027 	(u_char)'\074', (u_char)'\075', (u_char)'\076', (u_char)'\077',
1028 	(u_char)'\100', (u_char)'\141', (u_char)'\142', (u_char)'\143',
1029 	(u_char)'\144', (u_char)'\145', (u_char)'\146', (u_char)'\147',
1030 	(u_char)'\150', (u_char)'\151', (u_char)'\152', (u_char)'\153',
1031 	(u_char)'\154', (u_char)'\155', (u_char)'\156', (u_char)'\157',
1032 	(u_char)'\160', (u_char)'\161', (u_char)'\162', (u_char)'\163',
1033 	(u_char)'\164', (u_char)'\165', (u_char)'\166', (u_char)'\167',
1034 	(u_char)'\170', (u_char)'\171', (u_char)'\172', (u_char)'\133',
1035 	(u_char)'\134', (u_char)'\135', (u_char)'\136', (u_char)'\137',
1036 	(u_char)'\140', (u_char)'\141', (u_char)'\142', (u_char)'\143',
1037 	(u_char)'\144', (u_char)'\145', (u_char)'\146', (u_char)'\147',
1038 	(u_char)'\150', (u_char)'\151', (u_char)'\152', (u_char)'\153',
1039 	(u_char)'\154', (u_char)'\155', (u_char)'\156', (u_char)'\157',
1040 	(u_char)'\160', (u_char)'\161', (u_char)'\162', (u_char)'\163',
1041 	(u_char)'\164', (u_char)'\165', (u_char)'\166', (u_char)'\167',
1042 	(u_char)'\170', (u_char)'\171', (u_char)'\172', (u_char)'\173',
1043 	(u_char)'\174', (u_char)'\175', (u_char)'\176', (u_char)'\177',
1044 	(u_char)'\200', (u_char)'\201', (u_char)'\202', (u_char)'\203',
1045 	(u_char)'\204', (u_char)'\205', (u_char)'\206', (u_char)'\207',
1046 	(u_char)'\210', (u_char)'\211', (u_char)'\212', (u_char)'\213',
1047 	(u_char)'\214', (u_char)'\215', (u_char)'\216', (u_char)'\217',
1048 	(u_char)'\220', (u_char)'\221', (u_char)'\222', (u_char)'\223',
1049 	(u_char)'\224', (u_char)'\225', (u_char)'\226', (u_char)'\227',
1050 	(u_char)'\230', (u_char)'\231', (u_char)'\232', (u_char)'\233',
1051 	(u_char)'\234', (u_char)'\235', (u_char)'\236', (u_char)'\237',
1052 	(u_char)'\240', (u_char)'\241', (u_char)'\242', (u_char)'\243',
1053 	(u_char)'\244', (u_char)'\245', (u_char)'\246', (u_char)'\247',
1054 	(u_char)'\250', (u_char)'\251', (u_char)'\252', (u_char)'\253',
1055 	(u_char)'\254', (u_char)'\255', (u_char)'\256', (u_char)'\257',
1056 	(u_char)'\260', (u_char)'\261', (u_char)'\262', (u_char)'\263',
1057 	(u_char)'\264', (u_char)'\265', (u_char)'\266', (u_char)'\267',
1058 	(u_char)'\270', (u_char)'\271', (u_char)'\272', (u_char)'\273',
1059 	(u_char)'\274', (u_char)'\275', (u_char)'\276', (u_char)'\277',
1060 	(u_char)'\300', (u_char)'\341', (u_char)'\342', (u_char)'\343',
1061 	(u_char)'\344', (u_char)'\345', (u_char)'\346', (u_char)'\347',
1062 	(u_char)'\350', (u_char)'\351', (u_char)'\352', (u_char)'\353',
1063 	(u_char)'\354', (u_char)'\355', (u_char)'\356', (u_char)'\357',
1064 	(u_char)'\360', (u_char)'\361', (u_char)'\362', (u_char)'\363',
1065 	(u_char)'\364', (u_char)'\365', (u_char)'\366', (u_char)'\367',
1066 	(u_char)'\370', (u_char)'\371', (u_char)'\372', (u_char)'\333',
1067 	(u_char)'\334', (u_char)'\335', (u_char)'\336', (u_char)'\337',
1068 	(u_char)'\340', (u_char)'\341', (u_char)'\342', (u_char)'\343',
1069 	(u_char)'\344', (u_char)'\345', (u_char)'\346', (u_char)'\347',
1070 	(u_char)'\350', (u_char)'\351', (u_char)'\352', (u_char)'\353',
1071 	(u_char)'\354', (u_char)'\355', (u_char)'\356', (u_char)'\357',
1072 	(u_char)'\360', (u_char)'\361', (u_char)'\362', (u_char)'\363',
1073 	(u_char)'\364', (u_char)'\365', (u_char)'\366', (u_char)'\367',
1074 	(u_char)'\370', (u_char)'\371', (u_char)'\372', (u_char)'\373',
1075 	(u_char)'\374', (u_char)'\375', (u_char)'\376', (u_char)'\377',
1076 };
1077 
1078 int
pcap_strcasecmp(const char * s1,const char * s2)1079 pcap_strcasecmp(const char *s1, const char *s2)
1080 {
1081 	register const u_char	*cm = charmap,
1082 				*us1 = (const u_char *)s1,
1083 				*us2 = (const u_char *)s2;
1084 
1085 	while (cm[*us1] == cm[*us2++])
1086 		if (*us1++ == '\0')
1087 			return(0);
1088 	return (cm[*us1] - cm[*--us2]);
1089 }
1090 
1091 struct dlt_choice {
1092 	const char *name;
1093 	const char *description;
1094 	int	dlt;
1095 };
1096 
1097 #define DLT_CHOICE(code, description) { #code, description, code }
1098 #define DLT_CHOICE_SENTINEL { NULL, NULL, 0 }
1099 
1100 static struct dlt_choice dlt_choices[] = {
1101 	DLT_CHOICE(DLT_NULL, "BSD loopback"),
1102 	DLT_CHOICE(DLT_EN10MB, "Ethernet"),
1103 	DLT_CHOICE(DLT_IEEE802, "Token ring"),
1104 	DLT_CHOICE(DLT_ARCNET, "BSD ARCNET"),
1105 	DLT_CHOICE(DLT_SLIP, "SLIP"),
1106 	DLT_CHOICE(DLT_PPP, "PPP"),
1107 	DLT_CHOICE(DLT_FDDI, "FDDI"),
1108 	DLT_CHOICE(DLT_ATM_RFC1483, "RFC 1483 LLC-encapsulated ATM"),
1109 	DLT_CHOICE(DLT_RAW, "Raw IP"),
1110 	DLT_CHOICE(DLT_SLIP_BSDOS, "BSD/OS SLIP"),
1111 	DLT_CHOICE(DLT_PPP_BSDOS, "BSD/OS PPP"),
1112 	DLT_CHOICE(DLT_ATM_CLIP, "Linux Classical IP-over-ATM"),
1113 	DLT_CHOICE(DLT_PPP_SERIAL, "PPP over serial"),
1114 	DLT_CHOICE(DLT_PPP_ETHER, "PPPoE"),
1115         DLT_CHOICE(DLT_SYMANTEC_FIREWALL, "Symantec Firewall"),
1116 	DLT_CHOICE(DLT_C_HDLC, "Cisco HDLC"),
1117 	DLT_CHOICE(DLT_IEEE802_11, "802.11"),
1118 	DLT_CHOICE(DLT_FRELAY, "Frame Relay"),
1119 	DLT_CHOICE(DLT_LOOP, "OpenBSD loopback"),
1120 	DLT_CHOICE(DLT_ENC, "OpenBSD encapsulated IP"),
1121 	DLT_CHOICE(DLT_LINUX_SLL, "Linux cooked"),
1122 	DLT_CHOICE(DLT_LTALK, "Localtalk"),
1123 	DLT_CHOICE(DLT_PFLOG, "OpenBSD pflog file"),
1124 	DLT_CHOICE(DLT_PFSYNC, "Packet filter state syncing"),
1125 	DLT_CHOICE(DLT_PRISM_HEADER, "802.11 plus Prism header"),
1126 	DLT_CHOICE(DLT_IP_OVER_FC, "RFC 2625 IP-over-Fibre Channel"),
1127 	DLT_CHOICE(DLT_SUNATM, "Sun raw ATM"),
1128 	DLT_CHOICE(DLT_IEEE802_11_RADIO, "802.11 plus radiotap header"),
1129 	DLT_CHOICE(DLT_ARCNET_LINUX, "Linux ARCNET"),
1130         DLT_CHOICE(DLT_JUNIPER_MLPPP, "Juniper Multi-Link PPP"),
1131 	DLT_CHOICE(DLT_JUNIPER_MLFR, "Juniper Multi-Link Frame Relay"),
1132         DLT_CHOICE(DLT_JUNIPER_ES, "Juniper Encryption Services PIC"),
1133         DLT_CHOICE(DLT_JUNIPER_GGSN, "Juniper GGSN PIC"),
1134 	DLT_CHOICE(DLT_JUNIPER_MFR, "Juniper FRF.16 Frame Relay"),
1135         DLT_CHOICE(DLT_JUNIPER_ATM2, "Juniper ATM2 PIC"),
1136         DLT_CHOICE(DLT_JUNIPER_SERVICES, "Juniper Advanced Services PIC"),
1137         DLT_CHOICE(DLT_JUNIPER_ATM1, "Juniper ATM1 PIC"),
1138 	DLT_CHOICE(DLT_APPLE_IP_OVER_IEEE1394, "Apple IP-over-IEEE 1394"),
1139 	DLT_CHOICE(DLT_MTP2_WITH_PHDR, "SS7 MTP2 with Pseudo-header"),
1140 	DLT_CHOICE(DLT_MTP2, "SS7 MTP2"),
1141 	DLT_CHOICE(DLT_MTP3, "SS7 MTP3"),
1142 	DLT_CHOICE(DLT_SCCP, "SS7 SCCP"),
1143 	DLT_CHOICE(DLT_DOCSIS, "DOCSIS"),
1144 	DLT_CHOICE(DLT_LINUX_IRDA, "Linux IrDA"),
1145 	DLT_CHOICE(DLT_IEEE802_11_RADIO_AVS, "802.11 plus AVS radio information header"),
1146         DLT_CHOICE(DLT_JUNIPER_MONITOR, "Juniper Passive Monitor PIC"),
1147 	DLT_CHOICE(DLT_BACNET_MS_TP, "BACnet MS/TP"),
1148 	DLT_CHOICE(DLT_PPP_PPPD, "PPP for pppd, with direction flag"),
1149 	DLT_CHOICE(DLT_JUNIPER_PPPOE, "Juniper PPPoE"),
1150 	DLT_CHOICE(DLT_JUNIPER_PPPOE_ATM, "Juniper PPPoE/ATM"),
1151 	DLT_CHOICE(DLT_GPRS_LLC, "GPRS LLC"),
1152 	DLT_CHOICE(DLT_GPF_T, "GPF-T"),
1153 	DLT_CHOICE(DLT_GPF_F, "GPF-F"),
1154 	DLT_CHOICE(DLT_JUNIPER_PIC_PEER, "Juniper PIC Peer"),
1155 	DLT_CHOICE(DLT_ERF_ETH,	"Ethernet with Endace ERF header"),
1156 	DLT_CHOICE(DLT_ERF_POS, "Packet-over-SONET with Endace ERF header"),
1157 	DLT_CHOICE(DLT_LINUX_LAPD, "Linux vISDN LAPD"),
1158 	DLT_CHOICE(DLT_JUNIPER_ETHER, "Juniper Ethernet"),
1159 	DLT_CHOICE(DLT_JUNIPER_PPP, "Juniper PPP"),
1160 	DLT_CHOICE(DLT_JUNIPER_FRELAY, "Juniper Frame Relay"),
1161 	DLT_CHOICE(DLT_JUNIPER_CHDLC, "Juniper C-HDLC"),
1162 	DLT_CHOICE(DLT_MFR, "FRF.16 Frame Relay"),
1163 	DLT_CHOICE(DLT_JUNIPER_VP, "Juniper Voice PIC"),
1164 	DLT_CHOICE(DLT_A429, "Arinc 429"),
1165 	DLT_CHOICE(DLT_A653_ICM, "Arinc 653 Interpartition Communication"),
1166 	DLT_CHOICE(DLT_USB, "USB"),
1167 	DLT_CHOICE(DLT_BLUETOOTH_HCI_H4, "Bluetooth HCI UART transport layer"),
1168 	DLT_CHOICE(DLT_IEEE802_16_MAC_CPS, "IEEE 802.16 MAC Common Part Sublayer"),
1169 	DLT_CHOICE(DLT_USB_LINUX, "USB with Linux header"),
1170 	DLT_CHOICE(DLT_CAN20B, "Controller Area Network (CAN) v. 2.0B"),
1171 	DLT_CHOICE(DLT_IEEE802_15_4_LINUX, "IEEE 802.15.4 with Linux padding"),
1172 	DLT_CHOICE(DLT_PPI, "Per-Packet Information"),
1173 	DLT_CHOICE(DLT_IEEE802_16_MAC_CPS_RADIO, "IEEE 802.16 MAC Common Part Sublayer plus radiotap header"),
1174 	DLT_CHOICE(DLT_JUNIPER_ISM, "Juniper Integrated Service Module"),
1175 	DLT_CHOICE(DLT_IEEE802_15_4, "IEEE 802.15.4 with FCS"),
1176 	DLT_CHOICE(DLT_SITA, "SITA pseudo-header"),
1177 	DLT_CHOICE(DLT_ERF, "Endace ERF header"),
1178 	DLT_CHOICE(DLT_RAIF1, "Ethernet with u10 Networks pseudo-header"),
1179 	DLT_CHOICE(DLT_IPMB, "IPMB"),
1180 	DLT_CHOICE(DLT_JUNIPER_ST, "Juniper Secure Tunnel"),
1181 	DLT_CHOICE(DLT_BLUETOOTH_HCI_H4_WITH_PHDR, "Bluetooth HCI UART transport layer plus pseudo-header"),
1182 	DLT_CHOICE(DLT_AX25_KISS, "AX.25 with KISS header"),
1183 	DLT_CHOICE(DLT_IEEE802_15_4_NONASK_PHY, "IEEE 802.15.4 with non-ASK PHY data"),
1184 	DLT_CHOICE(DLT_MPLS, "MPLS with label as link-layer header"),
1185 	DLT_CHOICE(DLT_USB_LINUX_MMAPPED, "USB with padded Linux header"),
1186 	DLT_CHOICE(DLT_DECT, "DECT"),
1187 	DLT_CHOICE(DLT_AOS, "AOS Space Data Link protocol"),
1188 	DLT_CHOICE(DLT_WIHART, "Wireless HART"),
1189 	DLT_CHOICE(DLT_FC_2, "Fibre Channel FC-2"),
1190 	DLT_CHOICE(DLT_FC_2_WITH_FRAME_DELIMS, "Fibre Channel FC-2 with frame delimiters"),
1191 	DLT_CHOICE(DLT_IPNET, "Solaris ipnet"),
1192 	DLT_CHOICE(DLT_CAN_SOCKETCAN, "CAN-bus with SocketCAN headers"),
1193 	DLT_CHOICE(DLT_IPV4, "Raw IPv4"),
1194 	DLT_CHOICE(DLT_IPV6, "Raw IPv6"),
1195 	DLT_CHOICE(DLT_IEEE802_15_4_NOFCS, "IEEE 802.15.4 without FCS"),
1196 	DLT_CHOICE(DLT_JUNIPER_VS, "Juniper Virtual Server"),
1197 	DLT_CHOICE(DLT_JUNIPER_SRX_E2E, "Juniper SRX E2E"),
1198 	DLT_CHOICE(DLT_JUNIPER_FIBRECHANNEL, "Juniper Fibre Channel"),
1199 	DLT_CHOICE(DLT_DVB_CI, "DVB-CI"),
1200 	DLT_CHOICE(DLT_JUNIPER_ATM_CEMIC, "Juniper ATM CEMIC"),
1201 	DLT_CHOICE(DLT_NFLOG, "Linux netfilter log messages"),
1202 	DLT_CHOICE(DLT_NETANALYZER, "Ethernet with Hilscher netANALYZER pseudo-header"),
1203 	DLT_CHOICE(DLT_NETANALYZER_TRANSPARENT, "Ethernet with Hilscher netANALYZER pseudo-header and with preamble and SFD"),
1204 	DLT_CHOICE(DLT_IPOIB, "RFC 4391 IP-over-Infiniband"),
1205 	DLT_CHOICE(DLT_DBUS, "D-Bus"),
1206 	DLT_CHOICE_SENTINEL
1207 };
1208 
1209 int
pcap_datalink_name_to_val(const char * name)1210 pcap_datalink_name_to_val(const char *name)
1211 {
1212 	int i;
1213 
1214 	for (i = 0; dlt_choices[i].name != NULL; i++) {
1215 		if (pcap_strcasecmp(dlt_choices[i].name + sizeof("DLT_") - 1,
1216 		    name) == 0)
1217 			return (dlt_choices[i].dlt);
1218 	}
1219 	return (-1);
1220 }
1221 
1222 const char *
pcap_datalink_val_to_name(int dlt)1223 pcap_datalink_val_to_name(int dlt)
1224 {
1225 	int i;
1226 
1227 	for (i = 0; dlt_choices[i].name != NULL; i++) {
1228 		if (dlt_choices[i].dlt == dlt)
1229 			return (dlt_choices[i].name + sizeof("DLT_") - 1);
1230 	}
1231 	return (NULL);
1232 }
1233 
1234 const char *
pcap_datalink_val_to_description(int dlt)1235 pcap_datalink_val_to_description(int dlt)
1236 {
1237 	int i;
1238 
1239 	for (i = 0; dlt_choices[i].name != NULL; i++) {
1240 		if (dlt_choices[i].dlt == dlt)
1241 			return (dlt_choices[i].description);
1242 	}
1243 	return (NULL);
1244 }
1245 
1246 struct tstamp_type_choice {
1247 	const char *name;
1248 	const char *description;
1249 	int	type;
1250 };
1251 
1252 static struct tstamp_type_choice tstamp_type_choices[] = {
1253 	{ "host", "Host", PCAP_TSTAMP_HOST },
1254 	{ "host_lowprec", "Host, low precision", PCAP_TSTAMP_HOST_LOWPREC },
1255 	{ "host_hiprec", "Host, high precision", PCAP_TSTAMP_HOST_HIPREC },
1256 	{ "adapter", "Adapter", PCAP_TSTAMP_ADAPTER },
1257 	{ "adapter_unsynced", "Adapter, not synced with system time", PCAP_TSTAMP_ADAPTER_UNSYNCED },
1258 	{ NULL, NULL, 0 }
1259 };
1260 
1261 int
pcap_tstamp_type_name_to_val(const char * name)1262 pcap_tstamp_type_name_to_val(const char *name)
1263 {
1264 	int i;
1265 
1266 	for (i = 0; tstamp_type_choices[i].name != NULL; i++) {
1267 		if (pcap_strcasecmp(tstamp_type_choices[i].name, name) == 0)
1268 			return (tstamp_type_choices[i].type);
1269 	}
1270 	return (PCAP_ERROR);
1271 }
1272 
1273 const char *
pcap_tstamp_type_val_to_name(int tstamp_type)1274 pcap_tstamp_type_val_to_name(int tstamp_type)
1275 {
1276 	int i;
1277 
1278 	for (i = 0; tstamp_type_choices[i].name != NULL; i++) {
1279 		if (tstamp_type_choices[i].type == tstamp_type)
1280 			return (tstamp_type_choices[i].name);
1281 	}
1282 	return (NULL);
1283 }
1284 
1285 const char *
pcap_tstamp_type_val_to_description(int tstamp_type)1286 pcap_tstamp_type_val_to_description(int tstamp_type)
1287 {
1288 	int i;
1289 
1290 	for (i = 0; tstamp_type_choices[i].name != NULL; i++) {
1291 		if (tstamp_type_choices[i].type == tstamp_type)
1292 			return (tstamp_type_choices[i].description);
1293 	}
1294 	return (NULL);
1295 }
1296 
1297 int
pcap_snapshot(pcap_t * p)1298 pcap_snapshot(pcap_t *p)
1299 {
1300 	if (!p->activated)
1301 		return (PCAP_ERROR_NOT_ACTIVATED);
1302 	return (p->snapshot);
1303 }
1304 
1305 int
pcap_is_swapped(pcap_t * p)1306 pcap_is_swapped(pcap_t *p)
1307 {
1308 	if (!p->activated)
1309 		return (PCAP_ERROR_NOT_ACTIVATED);
1310 	return (p->swapped);
1311 }
1312 
1313 int
pcap_major_version(pcap_t * p)1314 pcap_major_version(pcap_t *p)
1315 {
1316 	if (!p->activated)
1317 		return (PCAP_ERROR_NOT_ACTIVATED);
1318 	return (p->version_major);
1319 }
1320 
1321 int
pcap_minor_version(pcap_t * p)1322 pcap_minor_version(pcap_t *p)
1323 {
1324 	if (!p->activated)
1325 		return (PCAP_ERROR_NOT_ACTIVATED);
1326 	return (p->version_minor);
1327 }
1328 
1329 FILE *
pcap_file(pcap_t * p)1330 pcap_file(pcap_t *p)
1331 {
1332 	return (p->rfile);
1333 }
1334 
1335 int
pcap_fileno(pcap_t * p)1336 pcap_fileno(pcap_t *p)
1337 {
1338 #ifndef WIN32
1339 	return (p->fd);
1340 #else
1341 	if (p->adapter != NULL)
1342 		return ((int)(DWORD)p->adapter->hFile);
1343 	else
1344 		return (PCAP_ERROR);
1345 #endif
1346 }
1347 
1348 #if !defined(WIN32) && !defined(MSDOS)
1349 int
pcap_get_selectable_fd(pcap_t * p)1350 pcap_get_selectable_fd(pcap_t *p)
1351 {
1352 	return (p->selectable_fd);
1353 }
1354 #endif
1355 
1356 void
pcap_perror(pcap_t * p,char * prefix)1357 pcap_perror(pcap_t *p, char *prefix)
1358 {
1359 	fprintf(stderr, "%s: %s\n", prefix, p->errbuf);
1360 }
1361 
1362 char *
pcap_geterr(pcap_t * p)1363 pcap_geterr(pcap_t *p)
1364 {
1365 	return (p->errbuf);
1366 }
1367 
1368 int
pcap_getnonblock(pcap_t * p,char * errbuf)1369 pcap_getnonblock(pcap_t *p, char *errbuf)
1370 {
1371 	int ret;
1372 
1373 	ret = p->getnonblock_op(p, errbuf);
1374 	if (ret == -1) {
1375 		/*
1376 		 * In case somebody depended on the bug wherein
1377 		 * the error message was put into p->errbuf
1378 		 * by pcap_getnonblock_fd().
1379 		 */
1380 		strlcpy(p->errbuf, errbuf, PCAP_ERRBUF_SIZE);
1381 	}
1382 	return (ret);
1383 }
1384 
1385 /*
1386  * Get the current non-blocking mode setting, under the assumption that
1387  * it's just the standard POSIX non-blocking flag.
1388  *
1389  * We don't look at "p->nonblock", in case somebody tweaked the FD
1390  * directly.
1391  */
1392 #if !defined(WIN32) && !defined(MSDOS)
1393 int
pcap_getnonblock_fd(pcap_t * p,char * errbuf)1394 pcap_getnonblock_fd(pcap_t *p, char *errbuf)
1395 {
1396 	int fdflags;
1397 
1398 	fdflags = fcntl(p->fd, F_GETFL, 0);
1399 	if (fdflags == -1) {
1400 		snprintf(errbuf, PCAP_ERRBUF_SIZE, "F_GETFL: %s",
1401 		    pcap_strerror(errno));
1402 		return (-1);
1403 	}
1404 	if (fdflags & O_NONBLOCK)
1405 		return (1);
1406 	else
1407 		return (0);
1408 }
1409 #endif
1410 
1411 int
pcap_setnonblock(pcap_t * p,int nonblock,char * errbuf)1412 pcap_setnonblock(pcap_t *p, int nonblock, char *errbuf)
1413 {
1414 	int ret;
1415 
1416 	ret = p->setnonblock_op(p, nonblock, errbuf);
1417 	if (ret == -1) {
1418 		/*
1419 		 * In case somebody depended on the bug wherein
1420 		 * the error message was put into p->errbuf
1421 		 * by pcap_setnonblock_fd().
1422 		 */
1423 		strlcpy(p->errbuf, errbuf, PCAP_ERRBUF_SIZE);
1424 	}
1425 	return (ret);
1426 }
1427 
1428 #if !defined(WIN32) && !defined(MSDOS)
1429 /*
1430  * Set non-blocking mode, under the assumption that it's just the
1431  * standard POSIX non-blocking flag.  (This can be called by the
1432  * per-platform non-blocking-mode routine if that routine also
1433  * needs to do some additional work.)
1434  */
1435 int
pcap_setnonblock_fd(pcap_t * p,int nonblock,char * errbuf)1436 pcap_setnonblock_fd(pcap_t *p, int nonblock, char *errbuf)
1437 {
1438 	int fdflags;
1439 
1440 	fdflags = fcntl(p->fd, F_GETFL, 0);
1441 	if (fdflags == -1) {
1442 		snprintf(errbuf, PCAP_ERRBUF_SIZE, "F_GETFL: %s",
1443 		    pcap_strerror(errno));
1444 		return (-1);
1445 	}
1446 	if (nonblock)
1447 		fdflags |= O_NONBLOCK;
1448 	else
1449 		fdflags &= ~O_NONBLOCK;
1450 	if (fcntl(p->fd, F_SETFL, fdflags) == -1) {
1451 		snprintf(errbuf, PCAP_ERRBUF_SIZE, "F_SETFL: %s",
1452 		    pcap_strerror(errno));
1453 		return (-1);
1454 	}
1455 	return (0);
1456 }
1457 #endif
1458 
1459 #ifdef WIN32
1460 /*
1461  * Generate a string for the last Win32-specific error (i.e. an error generated when
1462  * calling a Win32 API).
1463  * For errors occurred during standard C calls, we still use pcap_strerror()
1464  */
1465 char *
pcap_win32strerror(void)1466 pcap_win32strerror(void)
1467 {
1468 	DWORD error;
1469 	static char errbuf[PCAP_ERRBUF_SIZE+1];
1470 	int errlen;
1471 	char *p;
1472 
1473 	error = GetLastError();
1474 	FormatMessage(FORMAT_MESSAGE_FROM_SYSTEM, NULL, error, 0, errbuf,
1475 	    PCAP_ERRBUF_SIZE, NULL);
1476 
1477 	/*
1478 	 * "FormatMessage()" "helpfully" sticks CR/LF at the end of the
1479 	 * message.  Get rid of it.
1480 	 */
1481 	errlen = strlen(errbuf);
1482 	if (errlen >= 2) {
1483 		errbuf[errlen - 1] = '\0';
1484 		errbuf[errlen - 2] = '\0';
1485 	}
1486 	p = strchr(errbuf, '\0');
1487 	snprintf (p, sizeof(errbuf)-(p-errbuf), " (%lu)", error);
1488 	return (errbuf);
1489 }
1490 #endif
1491 
1492 /*
1493  * Generate error strings for PCAP_ERROR_ and PCAP_WARNING_ values.
1494  */
1495 const char *
pcap_statustostr(int errnum)1496 pcap_statustostr(int errnum)
1497 {
1498 	static char ebuf[15+10+1];
1499 
1500 	switch (errnum) {
1501 
1502 	case PCAP_WARNING:
1503 		return("Generic warning");
1504 
1505 	case PCAP_WARNING_TSTAMP_TYPE_NOTSUP:
1506 		return ("That type of time stamp is not supported by that device");
1507 
1508 	case PCAP_WARNING_PROMISC_NOTSUP:
1509 		return ("That device doesn't support promiscuous mode");
1510 
1511 	case PCAP_ERROR:
1512 		return("Generic error");
1513 
1514 	case PCAP_ERROR_BREAK:
1515 		return("Loop terminated by pcap_breakloop");
1516 
1517 	case PCAP_ERROR_NOT_ACTIVATED:
1518 		return("The pcap_t has not been activated");
1519 
1520 	case PCAP_ERROR_ACTIVATED:
1521 		return ("The setting can't be changed after the pcap_t is activated");
1522 
1523 	case PCAP_ERROR_NO_SUCH_DEVICE:
1524 		return ("No such device exists");
1525 
1526 	case PCAP_ERROR_RFMON_NOTSUP:
1527 		return ("That device doesn't support monitor mode");
1528 
1529 	case PCAP_ERROR_NOT_RFMON:
1530 		return ("That operation is supported only in monitor mode");
1531 
1532 	case PCAP_ERROR_PERM_DENIED:
1533 		return ("You don't have permission to capture on that device");
1534 
1535 	case PCAP_ERROR_IFACE_NOT_UP:
1536 		return ("That device is not up");
1537 
1538 	case PCAP_ERROR_CANTSET_TSTAMP_TYPE:
1539 		return ("That device doesn't support setting the time stamp type");
1540 
1541 	case PCAP_ERROR_PROMISC_PERM_DENIED:
1542 		return ("You don't have permission to capture in promiscuous mode on that device");
1543 
1544 	case PCAP_ERROR_TSTAMP_PRECISION_NOTSUP:
1545 		return ("That device doesn't support that time stamp precision");
1546 	}
1547 	(void)snprintf(ebuf, sizeof ebuf, "Unknown error: %d", errnum);
1548 	return(ebuf);
1549 }
1550 
1551 /*
1552  * Not all systems have strerror().
1553  */
1554 const char *
pcap_strerror(int errnum)1555 pcap_strerror(int errnum)
1556 {
1557 #ifdef HAVE_STRERROR
1558 	return (strerror(errnum));
1559 #else
1560 	extern int sys_nerr;
1561 	extern const char *const sys_errlist[];
1562 	static char ebuf[15+10+1];
1563 
1564 	if ((unsigned int)errnum < sys_nerr)
1565 		return ((char *)sys_errlist[errnum]);
1566 	(void)snprintf(ebuf, sizeof ebuf, "Unknown error: %d", errnum);
1567 	return(ebuf);
1568 #endif
1569 }
1570 
1571 int
pcap_setfilter(pcap_t * p,struct bpf_program * fp)1572 pcap_setfilter(pcap_t *p, struct bpf_program *fp)
1573 {
1574 	return (p->setfilter_op(p, fp));
1575 }
1576 
1577 /*
1578  * Set direction flag, which controls whether we accept only incoming
1579  * packets, only outgoing packets, or both.
1580  * Note that, depending on the platform, some or all direction arguments
1581  * might not be supported.
1582  */
1583 int
pcap_setdirection(pcap_t * p,pcap_direction_t d)1584 pcap_setdirection(pcap_t *p, pcap_direction_t d)
1585 {
1586 	if (p->setdirection_op == NULL) {
1587 		snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1588 		    "Setting direction is not implemented on this platform");
1589 		return (-1);
1590 	} else
1591 		return (p->setdirection_op(p, d));
1592 }
1593 
1594 int
pcap_stats(pcap_t * p,struct pcap_stat * ps)1595 pcap_stats(pcap_t *p, struct pcap_stat *ps)
1596 {
1597 	return (p->stats_op(p, ps));
1598 }
1599 
1600 static int
pcap_stats_dead(pcap_t * p,struct pcap_stat * ps _U_)1601 pcap_stats_dead(pcap_t *p, struct pcap_stat *ps _U_)
1602 {
1603 	snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1604 	    "Statistics aren't available from a pcap_open_dead pcap_t");
1605 	return (-1);
1606 }
1607 
1608 #ifdef WIN32
1609 int
pcap_setbuff(pcap_t * p,int dim)1610 pcap_setbuff(pcap_t *p, int dim)
1611 {
1612 	return (p->setbuff_op(p, dim));
1613 }
1614 
1615 static int
pcap_setbuff_dead(pcap_t * p,int dim)1616 pcap_setbuff_dead(pcap_t *p, int dim)
1617 {
1618 	snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1619 	    "The kernel buffer size cannot be set on a pcap_open_dead pcap_t");
1620 	return (-1);
1621 }
1622 
1623 int
pcap_setmode(pcap_t * p,int mode)1624 pcap_setmode(pcap_t *p, int mode)
1625 {
1626 	return (p->setmode_op(p, mode));
1627 }
1628 
1629 static int
pcap_setmode_dead(pcap_t * p,int mode)1630 pcap_setmode_dead(pcap_t *p, int mode)
1631 {
1632 	snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1633 	    "impossible to set mode on a pcap_open_dead pcap_t");
1634 	return (-1);
1635 }
1636 
1637 int
pcap_setmintocopy(pcap_t * p,int size)1638 pcap_setmintocopy(pcap_t *p, int size)
1639 {
1640 	return (p->setmintocopy_op(p, size));
1641 }
1642 
1643 Adapter *
pcap_get_adapter(pcap_t * p)1644 pcap_get_adapter(pcap_t *p)
1645 {
1646 	return (p->getadapter_op(p));
1647 }
1648 
1649 static int
pcap_setmintocopy_dead(pcap_t * p,int size)1650 pcap_setmintocopy_dead(pcap_t *p, int size)
1651 {
1652 	snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1653 	    "The mintocopy parameter cannot be set on a pcap_open_dead pcap_t");
1654 	return (-1);
1655 }
1656 #endif
1657 
1658 /*
1659  * On some platforms, we need to clean up promiscuous or monitor mode
1660  * when we close a device - and we want that to happen even if the
1661  * application just exits without explicitl closing devices.
1662  * On those platforms, we need to register a "close all the pcaps"
1663  * routine to be called when we exit, and need to maintain a list of
1664  * pcaps that need to be closed to clean up modes.
1665  *
1666  * XXX - not thread-safe.
1667  */
1668 
1669 /*
1670  * List of pcaps on which we've done something that needs to be
1671  * cleaned up.
1672  * If there are any such pcaps, we arrange to call "pcap_close_all()"
1673  * when we exit, and have it close all of them.
1674  */
1675 static struct pcap *pcaps_to_close;
1676 
1677 /*
1678  * TRUE if we've already called "atexit()" to cause "pcap_close_all()" to
1679  * be called on exit.
1680  */
1681 static int did_atexit;
1682 
1683 static void
pcap_close_all(void)1684 pcap_close_all(void)
1685 {
1686 	struct pcap *handle;
1687 
1688 	while ((handle = pcaps_to_close) != NULL)
1689 		pcap_close(handle);
1690 }
1691 
1692 int
pcap_do_addexit(pcap_t * p)1693 pcap_do_addexit(pcap_t *p)
1694 {
1695 	/*
1696 	 * If we haven't already done so, arrange to have
1697 	 * "pcap_close_all()" called when we exit.
1698 	 */
1699 	if (!did_atexit) {
1700 		if (atexit(pcap_close_all) == -1) {
1701 			/*
1702 			 * "atexit()" failed; let our caller know.
1703 			 */
1704 			strncpy(p->errbuf, "atexit failed",
1705 			    PCAP_ERRBUF_SIZE);
1706 			return (0);
1707 		}
1708 		did_atexit = 1;
1709 	}
1710 	return (1);
1711 }
1712 
1713 void
pcap_add_to_pcaps_to_close(pcap_t * p)1714 pcap_add_to_pcaps_to_close(pcap_t *p)
1715 {
1716 	p->next = pcaps_to_close;
1717 	pcaps_to_close = p;
1718 }
1719 
1720 void
pcap_remove_from_pcaps_to_close(pcap_t * p)1721 pcap_remove_from_pcaps_to_close(pcap_t *p)
1722 {
1723 	pcap_t *pc, *prevpc;
1724 
1725 	for (pc = pcaps_to_close, prevpc = NULL; pc != NULL;
1726 	    prevpc = pc, pc = pc->next) {
1727 		if (pc == p) {
1728 			/*
1729 			 * Found it.  Remove it from the list.
1730 			 */
1731 			if (prevpc == NULL) {
1732 				/*
1733 				 * It was at the head of the list.
1734 				 */
1735 				pcaps_to_close = pc->next;
1736 			} else {
1737 				/*
1738 				 * It was in the middle of the list.
1739 				 */
1740 				prevpc->next = pc->next;
1741 			}
1742 			break;
1743 		}
1744 	}
1745 }
1746 
1747 void
pcap_cleanup_live_common(pcap_t * p)1748 pcap_cleanup_live_common(pcap_t *p)
1749 {
1750 	if (p->buffer != NULL) {
1751 		free(p->buffer);
1752 		p->buffer = NULL;
1753 	}
1754 	if (p->dlt_list != NULL) {
1755 		free(p->dlt_list);
1756 		p->dlt_list = NULL;
1757 		p->dlt_count = 0;
1758 	}
1759 	if (p->tstamp_type_list != NULL) {
1760 		free(p->tstamp_type_list);
1761 		p->tstamp_type_list = NULL;
1762 		p->tstamp_type_count = 0;
1763 	}
1764 	if (p->tstamp_precision_list != NULL) {
1765 		free(p->tstamp_precision_list);
1766 		p->tstamp_precision_list = NULL;
1767 		p->tstamp_precision_count = 0;
1768 	}
1769 	pcap_freecode(&p->fcode);
1770 #if !defined(WIN32) && !defined(MSDOS)
1771 	if (p->fd >= 0) {
1772 		close(p->fd);
1773 		p->fd = -1;
1774 	}
1775 	p->selectable_fd = -1;
1776 #endif
1777 }
1778 
1779 static void
pcap_cleanup_dead(pcap_t * p _U_)1780 pcap_cleanup_dead(pcap_t *p _U_)
1781 {
1782 	/* Nothing to do. */
1783 }
1784 
1785 pcap_t *
pcap_open_dead_with_tstamp_precision(int linktype,int snaplen,u_int precision)1786 pcap_open_dead_with_tstamp_precision(int linktype, int snaplen, u_int precision)
1787 {
1788 	pcap_t *p;
1789 
1790 	switch (precision) {
1791 
1792 	case PCAP_TSTAMP_PRECISION_MICRO:
1793 	case PCAP_TSTAMP_PRECISION_NANO:
1794 		break;
1795 
1796 	default:
1797 		return NULL;
1798 	}
1799 	p = malloc(sizeof(*p));
1800 	if (p == NULL)
1801 		return NULL;
1802 	memset (p, 0, sizeof(*p));
1803 	p->snapshot = snaplen;
1804 	p->linktype = linktype;
1805 	p->opt.tstamp_precision = precision;
1806 	p->stats_op = pcap_stats_dead;
1807 #ifdef WIN32
1808 	p->setbuff_op = pcap_setbuff_dead;
1809 	p->setmode_op = pcap_setmode_dead;
1810 	p->setmintocopy_op = pcap_setmintocopy_dead;
1811 #endif
1812 	p->cleanup_op = pcap_cleanup_dead;
1813 	p->activated = 1;
1814 	return (p);
1815 }
1816 
1817 pcap_t *
pcap_open_dead(int linktype,int snaplen)1818 pcap_open_dead(int linktype, int snaplen)
1819 {
1820 	return (pcap_open_dead_with_tstamp_precision(linktype, snaplen,
1821 	    PCAP_TSTAMP_PRECISION_MICRO));
1822 }
1823 
1824 /*
1825  * API compatible with WinPcap's "send a packet" routine - returns -1
1826  * on error, 0 otherwise.
1827  *
1828  * XXX - what if we get a short write?
1829  */
1830 int
pcap_sendpacket(pcap_t * p,const u_char * buf,int size)1831 pcap_sendpacket(pcap_t *p, const u_char *buf, int size)
1832 {
1833 	if (p->inject_op(p, buf, size) == -1)
1834 		return (-1);
1835 	return (0);
1836 }
1837 
1838 /*
1839  * API compatible with OpenBSD's "send a packet" routine - returns -1 on
1840  * error, number of bytes written otherwise.
1841  */
1842 int
pcap_inject(pcap_t * p,const void * buf,size_t size)1843 pcap_inject(pcap_t *p, const void *buf, size_t size)
1844 {
1845 	return (p->inject_op(p, buf, size));
1846 }
1847 
1848 void
pcap_close(pcap_t * p)1849 pcap_close(pcap_t *p)
1850 {
1851 	if (p->opt.source != NULL)
1852 		free(p->opt.source);
1853 	p->cleanup_op(p);
1854 	free(p);
1855 }
1856 
1857 /*
1858  * Given a BPF program, a pcap_pkthdr structure for a packet, and the raw
1859  * data for the packet, check whether the packet passes the filter.
1860  * Returns the return value of the filter program, which will be zero if
1861  * the packet doesn't pass and non-zero if the packet does pass.
1862  */
1863 int
pcap_offline_filter(const struct bpf_program * fp,const struct pcap_pkthdr * h,const u_char * pkt)1864 pcap_offline_filter(const struct bpf_program *fp, const struct pcap_pkthdr *h,
1865     const u_char *pkt)
1866 {
1867 	const struct bpf_insn *fcode = fp->bf_insns;
1868 
1869 	if (fcode != NULL)
1870 		return (bpf_filter(fcode, pkt, h->len, h->caplen));
1871 	else
1872 		return (0);
1873 }
1874 
1875 /*
1876  * We make the version string static, and return a pointer to it, rather
1877  * than exporting the version string directly.  On at least some UNIXes,
1878  * if you import data from a shared library into an program, the data is
1879  * bound into the program binary, so if the string in the version of the
1880  * library with which the program was linked isn't the same as the
1881  * string in the version of the library with which the program is being
1882  * run, various undesirable things may happen (warnings, the string
1883  * being the one from the version of the library with which the program
1884  * was linked, or even weirder things, such as the string being the one
1885  * from the library but being truncated).
1886  */
1887 #ifdef HAVE_VERSION_H
1888 #include "version.h"
1889 #else
1890 static const char pcap_version_string[] = "libpcap version 1.x.y";
1891 #endif
1892 
1893 #ifdef WIN32
1894 /*
1895  * XXX - it'd be nice if we could somehow generate the WinPcap and libpcap
1896  * version numbers when building WinPcap.  (It'd be nice to do so for
1897  * the packet.dll version number as well.)
1898  */
1899 static const char wpcap_version_string[] = "4.0";
1900 static const char pcap_version_string_fmt[] =
1901     "WinPcap version %s, based on %s";
1902 static const char pcap_version_string_packet_dll_fmt[] =
1903     "WinPcap version %s (packet.dll version %s), based on %s";
1904 static char *full_pcap_version_string;
1905 
1906 const char *
pcap_lib_version(void)1907 pcap_lib_version(void)
1908 {
1909 	char *packet_version_string;
1910 	size_t full_pcap_version_string_len;
1911 
1912 	if (full_pcap_version_string == NULL) {
1913 		/*
1914 		 * Generate the version string.
1915 		 */
1916 		packet_version_string = PacketGetVersion();
1917 		if (strcmp(wpcap_version_string, packet_version_string) == 0) {
1918 			/*
1919 			 * WinPcap version string and packet.dll version
1920 			 * string are the same; just report the WinPcap
1921 			 * version.
1922 			 */
1923 			full_pcap_version_string_len =
1924 			    (sizeof pcap_version_string_fmt - 4) +
1925 			    strlen(wpcap_version_string) +
1926 			    strlen(pcap_version_string);
1927 			full_pcap_version_string =
1928 			    malloc(full_pcap_version_string_len);
1929 			if (full_pcap_version_string == NULL)
1930 				return (NULL);
1931 			sprintf(full_pcap_version_string,
1932 			    pcap_version_string_fmt, wpcap_version_string,
1933 			    pcap_version_string);
1934 		} else {
1935 			/*
1936 			 * WinPcap version string and packet.dll version
1937 			 * string are different; that shouldn't be the
1938 			 * case (the two libraries should come from the
1939 			 * same version of WinPcap), so we report both
1940 			 * versions.
1941 			 */
1942 			full_pcap_version_string_len =
1943 			    (sizeof pcap_version_string_packet_dll_fmt - 6) +
1944 			    strlen(wpcap_version_string) +
1945 			    strlen(packet_version_string) +
1946 			    strlen(pcap_version_string);
1947 			full_pcap_version_string = malloc(full_pcap_version_string_len);
1948 			if (full_pcap_version_string == NULL)
1949 				return (NULL);
1950 			sprintf(full_pcap_version_string,
1951 			    pcap_version_string_packet_dll_fmt,
1952 			    wpcap_version_string, packet_version_string,
1953 			    pcap_version_string);
1954 		}
1955 	}
1956 	return (full_pcap_version_string);
1957 }
1958 
1959 #elif defined(MSDOS)
1960 
1961 static char *full_pcap_version_string;
1962 
1963 const char *
pcap_lib_version(void)1964 pcap_lib_version (void)
1965 {
1966 	char *packet_version_string;
1967 	size_t full_pcap_version_string_len;
1968 	static char dospfx[] = "DOS-";
1969 
1970 	if (full_pcap_version_string == NULL) {
1971 		/*
1972 		 * Generate the version string.
1973 		 */
1974 		full_pcap_version_string_len =
1975 		    sizeof dospfx + strlen(pcap_version_string);
1976 		full_pcap_version_string =
1977 		    malloc(full_pcap_version_string_len);
1978 		if (full_pcap_version_string == NULL)
1979 			return (NULL);
1980 		strcpy(full_pcap_version_string, dospfx);
1981 		strcat(full_pcap_version_string, pcap_version_string);
1982 	}
1983 	return (full_pcap_version_string);
1984 }
1985 
1986 #else /* UN*X */
1987 
1988 const char *
pcap_lib_version(void)1989 pcap_lib_version(void)
1990 {
1991 	return (pcap_version_string);
1992 }
1993 #endif
1994