The Android Open Source Project | 478ab6c | 2009-03-03 19:30:05 -0800 | [diff] [blame] | 1 | /* |
| 2 | * Copyright (c) 1994, 1995, 1996 |
| 3 | * The Regents of the University of California. All rights reserved. |
| 4 | * |
| 5 | * Redistribution and use in source and binary forms, with or without |
| 6 | * modification, are permitted provided that the following conditions |
| 7 | * are met: |
| 8 | * 1. Redistributions of source code must retain the above copyright |
| 9 | * notice, this list of conditions and the following disclaimer. |
| 10 | * 2. Redistributions in binary form must reproduce the above copyright |
| 11 | * notice, this list of conditions and the following disclaimer in the |
| 12 | * documentation and/or other materials provided with the distribution. |
| 13 | * 3. All advertising materials mentioning features or use of this software |
| 14 | * must display the following acknowledgement: |
| 15 | * This product includes software developed by the Computer Systems |
| 16 | * Engineering Group at Lawrence Berkeley Laboratory. |
| 17 | * 4. Neither the name of the University nor of the Laboratory may be used |
| 18 | * to endorse or promote products derived from this software without |
| 19 | * specific prior written permission. |
| 20 | * |
| 21 | * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND |
| 22 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
| 23 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE |
| 24 | * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE |
| 25 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL |
| 26 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS |
| 27 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
| 28 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT |
| 29 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY |
| 30 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF |
| 31 | * SUCH DAMAGE. |
The Android Open Source Project | 478ab6c | 2009-03-03 19:30:05 -0800 | [diff] [blame] | 32 | */ |
| 33 | |
| 34 | #ifndef pcap_int_h |
JP Abgrall | 511eca3 | 2014-02-12 13:46:45 -0800 | [diff] [blame] | 35 | #define pcap_int_h |
| 36 | |
Haibo Huang | ee759ce | 2021-01-05 21:34:29 -0800 | [diff] [blame] | 37 | #include <stddef.h> |
| 38 | |
Haibo Huang | 165065a | 2018-07-23 17:26:52 -0700 | [diff] [blame] | 39 | #include <signal.h> |
| 40 | |
JP Abgrall | 511eca3 | 2014-02-12 13:46:45 -0800 | [diff] [blame] | 41 | #include <pcap/pcap.h> |
The Android Open Source Project | 478ab6c | 2009-03-03 19:30:05 -0800 | [diff] [blame] | 42 | |
Elliott Hughes | 773b27c | 2021-08-20 17:37:36 -0700 | [diff] [blame] | 43 | #ifdef MSDOS |
| 44 | #include <fcntl.h> |
| 45 | #include <io.h> |
| 46 | #endif |
| 47 | |
Haibo Huang | 165065a | 2018-07-23 17:26:52 -0700 | [diff] [blame] | 48 | #include "varattrs.h" |
| 49 | #include "fmtutils.h" |
| 50 | |
Elliott Hughes | 773b27c | 2021-08-20 17:37:36 -0700 | [diff] [blame] | 51 | #include <stdarg.h> |
| 52 | |
| 53 | #include "portability.h" |
| 54 | |
Haibo Huang | 165065a | 2018-07-23 17:26:52 -0700 | [diff] [blame] | 55 | /* |
| 56 | * Version string. |
| 57 | * Uses PACKAGE_VERSION from config.h. |
| 58 | */ |
| 59 | #define PCAP_VERSION_STRING "libpcap version " PACKAGE_VERSION |
| 60 | |
The Android Open Source Project | 478ab6c | 2009-03-03 19:30:05 -0800 | [diff] [blame] | 61 | #ifdef __cplusplus |
| 62 | extern "C" { |
| 63 | #endif |
| 64 | |
Haibo Huang | ee759ce | 2021-01-05 21:34:29 -0800 | [diff] [blame] | 65 | /* |
| 66 | * If pcap_new_api is set, we disable pcap_lookupdev(), because: |
| 67 | * |
| 68 | * it's not thread-safe, and is marked as deprecated, on all |
| 69 | * platforms; |
| 70 | * |
| 71 | * on Windows, it may return UTF-16LE strings, which the program |
| 72 | * might then pass to pcap_create() (or to pcap_open_live(), which |
| 73 | * then passes them to pcap_create()), requiring pcap_create() to |
| 74 | * check for UTF-16LE strings using a hack, and that hack 1) |
| 75 | * *cannot* be 100% reliable and 2) runs the risk of going past the |
| 76 | * end of the string. |
| 77 | * |
| 78 | * We keep it around in legacy mode for compatibility. |
| 79 | * |
| 80 | * We also disable the aforementioned hack in pcap_create(). |
| 81 | */ |
| 82 | extern int pcap_new_api; |
| 83 | |
| 84 | /* |
| 85 | * If pcap_utf_8_mode is set, on Windows we treat strings as UTF-8. |
| 86 | * |
| 87 | * On UN*Xes, we assume all strings are and should be in UTF-8, regardless |
| 88 | * of the setting of this flag. |
| 89 | */ |
| 90 | extern int pcap_utf_8_mode; |
| 91 | |
JP Abgrall | 511eca3 | 2014-02-12 13:46:45 -0800 | [diff] [blame] | 92 | /* |
| 93 | * Swap byte ordering of unsigned long long timestamp on a big endian |
| 94 | * machine. |
| 95 | */ |
Haibo Huang | 165065a | 2018-07-23 17:26:52 -0700 | [diff] [blame] | 96 | #define SWAPLL(ull) ((ull & 0xff00000000000000ULL) >> 56) | \ |
| 97 | ((ull & 0x00ff000000000000ULL) >> 40) | \ |
| 98 | ((ull & 0x0000ff0000000000ULL) >> 24) | \ |
| 99 | ((ull & 0x000000ff00000000ULL) >> 8) | \ |
| 100 | ((ull & 0x00000000ff000000ULL) << 8) | \ |
| 101 | ((ull & 0x0000000000ff0000ULL) << 24) | \ |
| 102 | ((ull & 0x000000000000ff00ULL) << 40) | \ |
| 103 | ((ull & 0x00000000000000ffULL) << 56) |
The Android Open Source Project | 478ab6c | 2009-03-03 19:30:05 -0800 | [diff] [blame] | 104 | |
Elliott Hughes | d8845d7 | 2015-10-19 18:07:04 -0700 | [diff] [blame] | 105 | /* |
| 106 | * Maximum snapshot length. |
| 107 | * |
| 108 | * Somewhat arbitrary, but chosen to be: |
| 109 | * |
| 110 | * 1) big enough for maximum-size Linux loopback packets (65549) |
| 111 | * and some USB packets captured with USBPcap: |
| 112 | * |
Haibo Huang | ee759ce | 2021-01-05 21:34:29 -0800 | [diff] [blame] | 113 | * https://desowin.org/usbpcap/ |
Elliott Hughes | d8845d7 | 2015-10-19 18:07:04 -0700 | [diff] [blame] | 114 | * |
| 115 | * (> 131072, < 262144) |
| 116 | * |
| 117 | * and |
| 118 | * |
| 119 | * 2) small enough not to cause attempts to allocate huge amounts of |
| 120 | * memory; some applications might use the snapshot length in a |
| 121 | * savefile header to control the size of the buffer they allocate, |
Haibo Huang | 4ccd683 | 2020-04-23 18:03:48 -0700 | [diff] [blame] | 122 | * so a size of, say, 2^31-1 might not work well. (libpcap uses it |
| 123 | * as a hint, but doesn't start out allocating a buffer bigger than |
| 124 | * 2 KiB, and grows the buffer as necessary, but not beyond the |
| 125 | * per-linktype maximum snapshot length. Other code might naively |
| 126 | * use it; we want to avoid writing a too-large snapshot length, |
| 127 | * in order not to cause that code problems.) |
Elliott Hughes | d8845d7 | 2015-10-19 18:07:04 -0700 | [diff] [blame] | 128 | * |
| 129 | * We don't enforce this in pcap_set_snaplen(), but we use it internally. |
| 130 | */ |
| 131 | #define MAXIMUM_SNAPLEN 262144 |
| 132 | |
Haibo Huang | ee759ce | 2021-01-05 21:34:29 -0800 | [diff] [blame] | 133 | /* |
| 134 | * Locale-independent macros for testing character types. |
| 135 | * These can be passed any integral value, without worrying about, for |
| 136 | * example, sign-extending char values, unlike the C macros. |
| 137 | */ |
| 138 | #define PCAP_ISDIGIT(c) \ |
| 139 | ((c) >= '0' && (c) <= '9') |
| 140 | #define PCAP_ISXDIGIT(c) \ |
| 141 | (((c) >= '0' && (c) <= '9') || \ |
| 142 | ((c) >= 'A' && (c) <= 'F') || \ |
| 143 | ((c) >= 'a' && (c) <= 'f')) |
| 144 | |
JP Abgrall | 511eca3 | 2014-02-12 13:46:45 -0800 | [diff] [blame] | 145 | struct pcap_opt { |
Elliott Hughes | 965a4b5 | 2017-05-15 10:37:39 -0700 | [diff] [blame] | 146 | char *device; |
JP Abgrall | 511eca3 | 2014-02-12 13:46:45 -0800 | [diff] [blame] | 147 | int timeout; /* timeout for buffering */ |
Elliott Hughes | 965a4b5 | 2017-05-15 10:37:39 -0700 | [diff] [blame] | 148 | u_int buffer_size; |
JP Abgrall | 511eca3 | 2014-02-12 13:46:45 -0800 | [diff] [blame] | 149 | int promisc; |
| 150 | int rfmon; /* monitor mode */ |
| 151 | int immediate; /* immediate mode - deliver packets as soon as they arrive */ |
Haibo Huang | 165065a | 2018-07-23 17:26:52 -0700 | [diff] [blame] | 152 | int nonblock; /* non-blocking mode - don't wait for packets to be delivered, return "no packets available" */ |
JP Abgrall | 511eca3 | 2014-02-12 13:46:45 -0800 | [diff] [blame] | 153 | int tstamp_type; |
| 154 | int tstamp_precision; |
Haibo Huang | 165065a | 2018-07-23 17:26:52 -0700 | [diff] [blame] | 155 | |
| 156 | /* |
| 157 | * Platform-dependent options. |
| 158 | */ |
| 159 | #ifdef __linux__ |
| 160 | int protocol; /* protocol to use when creating PF_PACKET socket */ |
| 161 | #endif |
| 162 | #ifdef _WIN32 |
| 163 | int nocapture_local;/* disable NPF loopback */ |
| 164 | #endif |
The Android Open Source Project | 478ab6c | 2009-03-03 19:30:05 -0800 | [diff] [blame] | 165 | }; |
| 166 | |
JP Abgrall | 511eca3 | 2014-02-12 13:46:45 -0800 | [diff] [blame] | 167 | typedef int (*activate_op_t)(pcap_t *); |
| 168 | typedef int (*can_set_rfmon_op_t)(pcap_t *); |
| 169 | typedef int (*read_op_t)(pcap_t *, int cnt, pcap_handler, u_char *); |
Haibo Huang | 165065a | 2018-07-23 17:26:52 -0700 | [diff] [blame] | 170 | typedef int (*next_packet_op_t)(pcap_t *, struct pcap_pkthdr *, u_char **); |
Haibo Huang | ee759ce | 2021-01-05 21:34:29 -0800 | [diff] [blame] | 171 | typedef int (*inject_op_t)(pcap_t *, const void *, int); |
Haibo Huang | 165065a | 2018-07-23 17:26:52 -0700 | [diff] [blame] | 172 | typedef void (*save_current_filter_op_t)(pcap_t *, const char *); |
JP Abgrall | 511eca3 | 2014-02-12 13:46:45 -0800 | [diff] [blame] | 173 | typedef int (*setfilter_op_t)(pcap_t *, struct bpf_program *); |
| 174 | typedef int (*setdirection_op_t)(pcap_t *, pcap_direction_t); |
| 175 | typedef int (*set_datalink_op_t)(pcap_t *, int); |
Haibo Huang | 165065a | 2018-07-23 17:26:52 -0700 | [diff] [blame] | 176 | typedef int (*getnonblock_op_t)(pcap_t *); |
| 177 | typedef int (*setnonblock_op_t)(pcap_t *, int); |
JP Abgrall | 511eca3 | 2014-02-12 13:46:45 -0800 | [diff] [blame] | 178 | typedef int (*stats_op_t)(pcap_t *, struct pcap_stat *); |
Haibo Huang | ee759ce | 2021-01-05 21:34:29 -0800 | [diff] [blame] | 179 | typedef void (*breakloop_op_t)(pcap_t *); |
Elliott Hughes | 965a4b5 | 2017-05-15 10:37:39 -0700 | [diff] [blame] | 180 | #ifdef _WIN32 |
| 181 | typedef struct pcap_stat *(*stats_ex_op_t)(pcap_t *, int *); |
JP Abgrall | 511eca3 | 2014-02-12 13:46:45 -0800 | [diff] [blame] | 182 | typedef int (*setbuff_op_t)(pcap_t *, int); |
| 183 | typedef int (*setmode_op_t)(pcap_t *, int); |
| 184 | typedef int (*setmintocopy_op_t)(pcap_t *, int); |
Elliott Hughes | 965a4b5 | 2017-05-15 10:37:39 -0700 | [diff] [blame] | 185 | typedef HANDLE (*getevent_op_t)(pcap_t *); |
| 186 | typedef int (*oid_get_request_op_t)(pcap_t *, bpf_u_int32, void *, size_t *); |
| 187 | typedef int (*oid_set_request_op_t)(pcap_t *, bpf_u_int32, const void *, size_t *); |
| 188 | typedef u_int (*sendqueue_transmit_op_t)(pcap_t *, pcap_send_queue *, int); |
| 189 | typedef int (*setuserbuffer_op_t)(pcap_t *, int); |
| 190 | typedef int (*live_dump_op_t)(pcap_t *, char *, int, int); |
| 191 | typedef int (*live_dump_ended_op_t)(pcap_t *, int); |
| 192 | typedef PAirpcapHandle (*get_airpcap_handle_op_t)(pcap_t *); |
The Android Open Source Project | 478ab6c | 2009-03-03 19:30:05 -0800 | [diff] [blame] | 193 | #endif |
JP Abgrall | 511eca3 | 2014-02-12 13:46:45 -0800 | [diff] [blame] | 194 | typedef void (*cleanup_op_t)(pcap_t *); |
The Android Open Source Project | 478ab6c | 2009-03-03 19:30:05 -0800 | [diff] [blame] | 195 | |
| 196 | /* |
JP Abgrall | 511eca3 | 2014-02-12 13:46:45 -0800 | [diff] [blame] | 197 | * We put all the stuff used in the read code path at the beginning, |
| 198 | * to try to keep it together in the same cache line or lines. |
The Android Open Source Project | 478ab6c | 2009-03-03 19:30:05 -0800 | [diff] [blame] | 199 | */ |
The Android Open Source Project | 478ab6c | 2009-03-03 19:30:05 -0800 | [diff] [blame] | 200 | struct pcap { |
JP Abgrall | 511eca3 | 2014-02-12 13:46:45 -0800 | [diff] [blame] | 201 | /* |
| 202 | * Method to call to read packets on a live capture. |
| 203 | */ |
| 204 | read_op_t read_op; |
| 205 | |
| 206 | /* |
Haibo Huang | 165065a | 2018-07-23 17:26:52 -0700 | [diff] [blame] | 207 | * Method to call to read the next packet from a savefile. |
JP Abgrall | 511eca3 | 2014-02-12 13:46:45 -0800 | [diff] [blame] | 208 | */ |
Haibo Huang | 165065a | 2018-07-23 17:26:52 -0700 | [diff] [blame] | 209 | next_packet_op_t next_packet_op; |
JP Abgrall | 511eca3 | 2014-02-12 13:46:45 -0800 | [diff] [blame] | 210 | |
Elliott Hughes | 965a4b5 | 2017-05-15 10:37:39 -0700 | [diff] [blame] | 211 | #ifdef _WIN32 |
Haibo Huang | 165065a | 2018-07-23 17:26:52 -0700 | [diff] [blame] | 212 | HANDLE handle; |
The Android Open Source Project | 478ab6c | 2009-03-03 19:30:05 -0800 | [diff] [blame] | 213 | #else |
| 214 | int fd; |
Elliott Hughes | 965a4b5 | 2017-05-15 10:37:39 -0700 | [diff] [blame] | 215 | #endif /* _WIN32 */ |
The Android Open Source Project | 478ab6c | 2009-03-03 19:30:05 -0800 | [diff] [blame] | 216 | |
| 217 | /* |
| 218 | * Read buffer. |
| 219 | */ |
Elliott Hughes | 965a4b5 | 2017-05-15 10:37:39 -0700 | [diff] [blame] | 220 | u_int bufsize; |
| 221 | void *buffer; |
The Android Open Source Project | 478ab6c | 2009-03-03 19:30:05 -0800 | [diff] [blame] | 222 | u_char *bp; |
| 223 | int cc; |
| 224 | |
Haibo Huang | 165065a | 2018-07-23 17:26:52 -0700 | [diff] [blame] | 225 | sig_atomic_t break_loop; /* flag set to force break from packet-reading loop */ |
JP Abgrall | 511eca3 | 2014-02-12 13:46:45 -0800 | [diff] [blame] | 226 | |
| 227 | void *priv; /* private data for methods */ |
| 228 | |
Haibo Huang | 165065a | 2018-07-23 17:26:52 -0700 | [diff] [blame] | 229 | #ifdef ENABLE_REMOTE |
| 230 | struct pcap_samp rmt_samp; /* parameters related to the sampling process. */ |
| 231 | #endif |
| 232 | |
JP Abgrall | 511eca3 | 2014-02-12 13:46:45 -0800 | [diff] [blame] | 233 | int swapped; |
| 234 | FILE *rfile; /* null if live capture, non-null if savefile */ |
Elliott Hughes | 965a4b5 | 2017-05-15 10:37:39 -0700 | [diff] [blame] | 235 | u_int fddipad; |
JP Abgrall | 511eca3 | 2014-02-12 13:46:45 -0800 | [diff] [blame] | 236 | struct pcap *next; /* list of open pcaps that need stuff cleared on close */ |
| 237 | |
| 238 | /* |
| 239 | * File version number; meaningful only for a savefile, but we |
| 240 | * keep it here so that apps that (mistakenly) ask for the |
| 241 | * version numbers will get the same zero values that they |
| 242 | * always did. |
| 243 | */ |
| 244 | int version_major; |
| 245 | int version_minor; |
| 246 | |
| 247 | int snapshot; |
| 248 | int linktype; /* Network linktype */ |
Haibo Huang | ee759ce | 2021-01-05 21:34:29 -0800 | [diff] [blame] | 249 | int linktype_ext; /* Extended information stored in the linktype field of a file */ |
JP Abgrall | 511eca3 | 2014-02-12 13:46:45 -0800 | [diff] [blame] | 250 | int offset; /* offset for proper alignment */ |
| 251 | int activated; /* true if the capture is really started */ |
| 252 | int oldstyle; /* if we're opening with pcap_open_live() */ |
| 253 | |
| 254 | struct pcap_opt opt; |
| 255 | |
The Android Open Source Project | 478ab6c | 2009-03-03 19:30:05 -0800 | [diff] [blame] | 256 | /* |
| 257 | * Place holder for pcap_next(). |
| 258 | */ |
| 259 | u_char *pkt; |
| 260 | |
Elliott Hughes | 965a4b5 | 2017-05-15 10:37:39 -0700 | [diff] [blame] | 261 | #ifdef _WIN32 |
Haibo Huang | 165065a | 2018-07-23 17:26:52 -0700 | [diff] [blame] | 262 | struct pcap_stat stat; /* used for pcap_stats_ex() */ |
Elliott Hughes | 965a4b5 | 2017-05-15 10:37:39 -0700 | [diff] [blame] | 263 | #endif |
| 264 | |
The Android Open Source Project | 478ab6c | 2009-03-03 19:30:05 -0800 | [diff] [blame] | 265 | /* We're accepting only packets in this direction/these directions. */ |
| 266 | pcap_direction_t direction; |
| 267 | |
| 268 | /* |
Elliott Hughes | d8845d7 | 2015-10-19 18:07:04 -0700 | [diff] [blame] | 269 | * Flags to affect BPF code generation. |
| 270 | */ |
| 271 | int bpf_codegen_flags; |
| 272 | |
Haibo Huang | 165065a | 2018-07-23 17:26:52 -0700 | [diff] [blame] | 273 | #if !defined(_WIN32) && !defined(MSDOS) |
| 274 | int selectable_fd; /* FD on which select()/poll()/epoll_wait()/kevent()/etc. can be done */ |
| 275 | |
| 276 | /* |
| 277 | * In case there either is no selectable FD, or there is but |
| 278 | * it doesn't necessarily work (e.g., if it doesn't get notified |
| 279 | * if the packet capture timeout expires before the buffer |
| 280 | * fills up), this points to a timeout that should be used |
| 281 | * in select()/poll()/epoll_wait()/kevent() call. The pcap_t should |
| 282 | * be put into non-blocking mode, and, if the timeout expires on |
| 283 | * the call, an attempt should be made to read packets from all |
| 284 | * pcap_t's with a required timeout, and the code must be |
| 285 | * prepared not to see any packets from the attempt. |
| 286 | */ |
Haibo Huang | ee759ce | 2021-01-05 21:34:29 -0800 | [diff] [blame] | 287 | const struct timeval *required_select_timeout; |
Haibo Huang | 165065a | 2018-07-23 17:26:52 -0700 | [diff] [blame] | 288 | #endif |
| 289 | |
Elliott Hughes | d8845d7 | 2015-10-19 18:07:04 -0700 | [diff] [blame] | 290 | /* |
The Android Open Source Project | 478ab6c | 2009-03-03 19:30:05 -0800 | [diff] [blame] | 291 | * Placeholder for filter code if bpf not in kernel. |
| 292 | */ |
| 293 | struct bpf_program fcode; |
| 294 | |
| 295 | char errbuf[PCAP_ERRBUF_SIZE + 1]; |
Haibo Huang | ee759ce | 2021-01-05 21:34:29 -0800 | [diff] [blame] | 296 | #ifdef _WIN32 |
| 297 | char acp_errbuf[PCAP_ERRBUF_SIZE + 1]; /* buffer for local code page error strings */ |
| 298 | #endif |
The Android Open Source Project | 478ab6c | 2009-03-03 19:30:05 -0800 | [diff] [blame] | 299 | int dlt_count; |
| 300 | u_int *dlt_list; |
JP Abgrall | 511eca3 | 2014-02-12 13:46:45 -0800 | [diff] [blame] | 301 | int tstamp_type_count; |
| 302 | u_int *tstamp_type_list; |
| 303 | int tstamp_precision_count; |
| 304 | u_int *tstamp_precision_list; |
The Android Open Source Project | 478ab6c | 2009-03-03 19:30:05 -0800 | [diff] [blame] | 305 | |
| 306 | struct pcap_pkthdr pcap_header; /* This is needed for the pcap_next_ex() to work */ |
JP Abgrall | 511eca3 | 2014-02-12 13:46:45 -0800 | [diff] [blame] | 307 | |
| 308 | /* |
| 309 | * More methods. |
| 310 | */ |
| 311 | activate_op_t activate_op; |
| 312 | can_set_rfmon_op_t can_set_rfmon_op; |
| 313 | inject_op_t inject_op; |
Haibo Huang | 165065a | 2018-07-23 17:26:52 -0700 | [diff] [blame] | 314 | save_current_filter_op_t save_current_filter_op; |
JP Abgrall | 511eca3 | 2014-02-12 13:46:45 -0800 | [diff] [blame] | 315 | setfilter_op_t setfilter_op; |
| 316 | setdirection_op_t setdirection_op; |
| 317 | set_datalink_op_t set_datalink_op; |
| 318 | getnonblock_op_t getnonblock_op; |
| 319 | setnonblock_op_t setnonblock_op; |
| 320 | stats_op_t stats_op; |
Haibo Huang | ee759ce | 2021-01-05 21:34:29 -0800 | [diff] [blame] | 321 | breakloop_op_t breakloop_op; |
JP Abgrall | 511eca3 | 2014-02-12 13:46:45 -0800 | [diff] [blame] | 322 | |
| 323 | /* |
| 324 | * Routine to use as callback for pcap_next()/pcap_next_ex(). |
| 325 | */ |
| 326 | pcap_handler oneshot_callback; |
| 327 | |
Elliott Hughes | 965a4b5 | 2017-05-15 10:37:39 -0700 | [diff] [blame] | 328 | #ifdef _WIN32 |
JP Abgrall | 511eca3 | 2014-02-12 13:46:45 -0800 | [diff] [blame] | 329 | /* |
| 330 | * These are, at least currently, specific to the Win32 NPF |
| 331 | * driver. |
| 332 | */ |
Elliott Hughes | 965a4b5 | 2017-05-15 10:37:39 -0700 | [diff] [blame] | 333 | stats_ex_op_t stats_ex_op; |
JP Abgrall | 511eca3 | 2014-02-12 13:46:45 -0800 | [diff] [blame] | 334 | setbuff_op_t setbuff_op; |
| 335 | setmode_op_t setmode_op; |
| 336 | setmintocopy_op_t setmintocopy_op; |
Elliott Hughes | 965a4b5 | 2017-05-15 10:37:39 -0700 | [diff] [blame] | 337 | getevent_op_t getevent_op; |
| 338 | oid_get_request_op_t oid_get_request_op; |
| 339 | oid_set_request_op_t oid_set_request_op; |
| 340 | sendqueue_transmit_op_t sendqueue_transmit_op; |
| 341 | setuserbuffer_op_t setuserbuffer_op; |
| 342 | live_dump_op_t live_dump_op; |
| 343 | live_dump_ended_op_t live_dump_ended_op; |
| 344 | get_airpcap_handle_op_t get_airpcap_handle_op; |
JP Abgrall | 511eca3 | 2014-02-12 13:46:45 -0800 | [diff] [blame] | 345 | #endif |
| 346 | cleanup_op_t cleanup_op; |
The Android Open Source Project | 478ab6c | 2009-03-03 19:30:05 -0800 | [diff] [blame] | 347 | }; |
| 348 | |
| 349 | /* |
Elliott Hughes | d8845d7 | 2015-10-19 18:07:04 -0700 | [diff] [blame] | 350 | * BPF code generation flags. |
| 351 | */ |
| 352 | #define BPF_SPECIAL_VLAN_HANDLING 0x00000001 /* special VLAN handling for Linux */ |
| 353 | |
| 354 | /* |
The Android Open Source Project | 478ab6c | 2009-03-03 19:30:05 -0800 | [diff] [blame] | 355 | * This is a timeval as stored in a savefile. |
| 356 | * It has to use the same types everywhere, independent of the actual |
| 357 | * `struct timeval'; `struct timeval' has 32-bit tv_sec values on some |
| 358 | * platforms and 64-bit tv_sec values on other platforms, and writing |
| 359 | * out native `struct timeval' values would mean files could only be |
| 360 | * read on systems with the same tv_sec size as the system on which |
| 361 | * the file was written. |
| 362 | */ |
| 363 | |
| 364 | struct pcap_timeval { |
| 365 | bpf_int32 tv_sec; /* seconds */ |
| 366 | bpf_int32 tv_usec; /* microseconds */ |
| 367 | }; |
| 368 | |
| 369 | /* |
| 370 | * This is a `pcap_pkthdr' as actually stored in a savefile. |
| 371 | * |
| 372 | * Do not change the format of this structure, in any way (this includes |
| 373 | * changes that only affect the length of fields in this structure), |
| 374 | * and do not make the time stamp anything other than seconds and |
| 375 | * microseconds (e.g., seconds and nanoseconds). Instead: |
| 376 | * |
| 377 | * introduce a new structure for the new format; |
| 378 | * |
JP Abgrall | 511eca3 | 2014-02-12 13:46:45 -0800 | [diff] [blame] | 379 | * send mail to "tcpdump-workers@lists.tcpdump.org", requesting |
| 380 | * a new magic number for your new capture file format, and, when |
The Android Open Source Project | 478ab6c | 2009-03-03 19:30:05 -0800 | [diff] [blame] | 381 | * you get the new magic number, put it in "savefile.c"; |
| 382 | * |
| 383 | * use that magic number for save files with the changed record |
| 384 | * header; |
| 385 | * |
| 386 | * make the code in "savefile.c" capable of reading files with |
| 387 | * the old record header as well as files with the new record header |
| 388 | * (using the magic number to determine the header format). |
| 389 | * |
JP Abgrall | 511eca3 | 2014-02-12 13:46:45 -0800 | [diff] [blame] | 390 | * Then supply the changes by forking the branch at |
| 391 | * |
Haibo Huang | ee759ce | 2021-01-05 21:34:29 -0800 | [diff] [blame] | 392 | * https://github.com/the-tcpdump-group/libpcap/tree/master |
JP Abgrall | 511eca3 | 2014-02-12 13:46:45 -0800 | [diff] [blame] | 393 | * |
| 394 | * and issuing a pull request, so that future versions of libpcap and |
| 395 | * programs that use it (such as tcpdump) will be able to read your new |
| 396 | * capture file format. |
The Android Open Source Project | 478ab6c | 2009-03-03 19:30:05 -0800 | [diff] [blame] | 397 | */ |
| 398 | |
| 399 | struct pcap_sf_pkthdr { |
| 400 | struct pcap_timeval ts; /* time stamp */ |
| 401 | bpf_u_int32 caplen; /* length of portion present */ |
Haibo Huang | ee759ce | 2021-01-05 21:34:29 -0800 | [diff] [blame] | 402 | bpf_u_int32 len; /* length of this packet (off wire) */ |
The Android Open Source Project | 478ab6c | 2009-03-03 19:30:05 -0800 | [diff] [blame] | 403 | }; |
| 404 | |
| 405 | /* |
| 406 | * How a `pcap_pkthdr' is actually stored in savefiles written |
| 407 | * by some patched versions of libpcap (e.g. the ones in Red |
| 408 | * Hat Linux 6.1 and 6.2). |
| 409 | * |
| 410 | * Do not change the format of this structure, in any way (this includes |
| 411 | * changes that only affect the length of fields in this structure). |
| 412 | * Instead, introduce a new structure, as per the above. |
| 413 | */ |
| 414 | |
| 415 | struct pcap_sf_patched_pkthdr { |
| 416 | struct pcap_timeval ts; /* time stamp */ |
| 417 | bpf_u_int32 caplen; /* length of portion present */ |
Haibo Huang | ee759ce | 2021-01-05 21:34:29 -0800 | [diff] [blame] | 418 | bpf_u_int32 len; /* length of this packet (off wire) */ |
The Android Open Source Project | 478ab6c | 2009-03-03 19:30:05 -0800 | [diff] [blame] | 419 | int index; |
| 420 | unsigned short protocol; |
| 421 | unsigned char pkt_type; |
| 422 | }; |
| 423 | |
JP Abgrall | 511eca3 | 2014-02-12 13:46:45 -0800 | [diff] [blame] | 424 | /* |
| 425 | * User data structure for the one-shot callback used for pcap_next() |
| 426 | * and pcap_next_ex(). |
| 427 | */ |
| 428 | struct oneshot_userdata { |
| 429 | struct pcap_pkthdr *hdr; |
| 430 | const u_char **pkt; |
| 431 | pcap_t *pd; |
| 432 | }; |
| 433 | |
The Android Open Source Project | 478ab6c | 2009-03-03 19:30:05 -0800 | [diff] [blame] | 434 | #ifndef min |
| 435 | #define min(a, b) ((a) > (b) ? (b) : (a)) |
| 436 | #endif |
| 437 | |
The Android Open Source Project | 478ab6c | 2009-03-03 19:30:05 -0800 | [diff] [blame] | 438 | int pcap_offline_read(pcap_t *, int, pcap_handler, u_char *); |
The Android Open Source Project | 478ab6c | 2009-03-03 19:30:05 -0800 | [diff] [blame] | 439 | |
The Android Open Source Project | 478ab6c | 2009-03-03 19:30:05 -0800 | [diff] [blame] | 440 | /* |
JP Abgrall | 511eca3 | 2014-02-12 13:46:45 -0800 | [diff] [blame] | 441 | * Does the packet count argument to a module's read routine say |
| 442 | * "supply packets until you run out of packets"? |
| 443 | */ |
| 444 | #define PACKET_COUNT_IS_UNLIMITED(count) ((count) <= 0) |
| 445 | |
| 446 | /* |
The Android Open Source Project | 478ab6c | 2009-03-03 19:30:05 -0800 | [diff] [blame] | 447 | * Routines that most pcap implementations can use for non-blocking mode. |
| 448 | */ |
Elliott Hughes | 965a4b5 | 2017-05-15 10:37:39 -0700 | [diff] [blame] | 449 | #if !defined(_WIN32) && !defined(MSDOS) |
Haibo Huang | 165065a | 2018-07-23 17:26:52 -0700 | [diff] [blame] | 450 | int pcap_getnonblock_fd(pcap_t *); |
| 451 | int pcap_setnonblock_fd(pcap_t *p, int); |
The Android Open Source Project | 478ab6c | 2009-03-03 19:30:05 -0800 | [diff] [blame] | 452 | #endif |
| 453 | |
JP Abgrall | 511eca3 | 2014-02-12 13:46:45 -0800 | [diff] [blame] | 454 | /* |
| 455 | * Internal interfaces for "pcap_create()". |
| 456 | * |
| 457 | * "pcap_create_interface()" is the routine to do a pcap_create on |
| 458 | * a regular network interface. There are multiple implementations |
| 459 | * of this, one for each platform type (Linux, BPF, DLPI, etc.), |
| 460 | * with the one used chosen by the configure script. |
| 461 | * |
| 462 | * "pcap_create_common()" allocates and fills in a pcap_t, for use |
| 463 | * by pcap_create routines. |
| 464 | */ |
| 465 | pcap_t *pcap_create_interface(const char *, char *); |
Haibo Huang | ee759ce | 2021-01-05 21:34:29 -0800 | [diff] [blame] | 466 | |
| 467 | /* |
| 468 | * This wrapper takes an error buffer pointer and a type to use for the |
| 469 | * private data, and calls pcap_create_common(), passing it the error |
| 470 | * buffer pointer, the size fo the private data type, in bytes, and the |
| 471 | * offset of the private data from the beginning of the structure, in |
| 472 | * bytes. |
| 473 | */ |
| 474 | #define PCAP_CREATE_COMMON(ebuf, type) \ |
| 475 | pcap_create_common(ebuf, \ |
| 476 | sizeof (struct { pcap_t __common; type __private; }), \ |
| 477 | offsetof (struct { pcap_t __common; type __private; }, __private)) |
| 478 | pcap_t *pcap_create_common(char *, size_t, size_t); |
JP Abgrall | 511eca3 | 2014-02-12 13:46:45 -0800 | [diff] [blame] | 479 | int pcap_do_addexit(pcap_t *); |
| 480 | void pcap_add_to_pcaps_to_close(pcap_t *); |
| 481 | void pcap_remove_from_pcaps_to_close(pcap_t *); |
| 482 | void pcap_cleanup_live_common(pcap_t *); |
JP Abgrall | 511eca3 | 2014-02-12 13:46:45 -0800 | [diff] [blame] | 483 | int pcap_check_activated(pcap_t *); |
Haibo Huang | ee759ce | 2021-01-05 21:34:29 -0800 | [diff] [blame] | 484 | void pcap_breakloop_common(pcap_t *); |
The Android Open Source Project | 478ab6c | 2009-03-03 19:30:05 -0800 | [diff] [blame] | 485 | |
| 486 | /* |
| 487 | * Internal interfaces for "pcap_findalldevs()". |
| 488 | * |
Haibo Huang | 165065a | 2018-07-23 17:26:52 -0700 | [diff] [blame] | 489 | * A pcap_if_list_t * is a reference to a list of devices. |
| 490 | * |
| 491 | * A get_if_flags_func is a platform-dependent function called to get |
| 492 | * additional interface flags. |
| 493 | * |
| 494 | * "pcap_platform_finddevs()" is the platform-dependent routine to |
Elliott Hughes | 965a4b5 | 2017-05-15 10:37:39 -0700 | [diff] [blame] | 495 | * find local network interfaces. |
| 496 | * |
| 497 | * "pcap_findalldevs_interfaces()" is a helper to find those interfaces |
| 498 | * using the "standard" mechanisms (SIOCGIFCONF, "getifaddrs()", etc.). |
JP Abgrall | 511eca3 | 2014-02-12 13:46:45 -0800 | [diff] [blame] | 499 | * |
Haibo Huang | 165065a | 2018-07-23 17:26:52 -0700 | [diff] [blame] | 500 | * "add_dev()" adds an entry to a pcap_if_list_t. |
| 501 | * |
| 502 | * "find_dev()" tries to find a device, by name, in a pcap_if_list_t. |
| 503 | * |
| 504 | * "find_or_add_dev()" checks whether a device is already in a pcap_if_list_t |
| 505 | * and, if not, adds an entry for it. |
The Android Open Source Project | 478ab6c | 2009-03-03 19:30:05 -0800 | [diff] [blame] | 506 | */ |
Haibo Huang | 165065a | 2018-07-23 17:26:52 -0700 | [diff] [blame] | 507 | struct pcap_if_list; |
| 508 | typedef struct pcap_if_list pcap_if_list_t; |
| 509 | typedef int (*get_if_flags_func)(const char *, bpf_u_int32 *, char *); |
| 510 | int pcap_platform_finddevs(pcap_if_list_t *, char *); |
Elliott Hughes | 965a4b5 | 2017-05-15 10:37:39 -0700 | [diff] [blame] | 511 | #if !defined(_WIN32) && !defined(MSDOS) |
Haibo Huang | 165065a | 2018-07-23 17:26:52 -0700 | [diff] [blame] | 512 | int pcap_findalldevs_interfaces(pcap_if_list_t *, char *, |
| 513 | int (*)(const char *), get_if_flags_func); |
Elliott Hughes | 965a4b5 | 2017-05-15 10:37:39 -0700 | [diff] [blame] | 514 | #endif |
Haibo Huang | 165065a | 2018-07-23 17:26:52 -0700 | [diff] [blame] | 515 | pcap_if_t *find_or_add_dev(pcap_if_list_t *, const char *, bpf_u_int32, |
| 516 | get_if_flags_func, const char *, char *); |
| 517 | pcap_if_t *find_dev(pcap_if_list_t *, const char *); |
| 518 | pcap_if_t *add_dev(pcap_if_list_t *, const char *, bpf_u_int32, const char *, |
| 519 | char *); |
Elliott Hughes | d8845d7 | 2015-10-19 18:07:04 -0700 | [diff] [blame] | 520 | int add_addr_to_dev(pcap_if_t *, struct sockaddr *, size_t, |
| 521 | struct sockaddr *, size_t, struct sockaddr *, size_t, |
| 522 | struct sockaddr *dstaddr, size_t, char *errbuf); |
Elliott Hughes | 965a4b5 | 2017-05-15 10:37:39 -0700 | [diff] [blame] | 523 | #ifndef _WIN32 |
Haibo Huang | 165065a | 2018-07-23 17:26:52 -0700 | [diff] [blame] | 524 | pcap_if_t *find_or_add_if(pcap_if_list_t *, const char *, bpf_u_int32, |
| 525 | get_if_flags_func, char *); |
| 526 | int add_addr_to_if(pcap_if_list_t *, const char *, bpf_u_int32, |
| 527 | get_if_flags_func, |
| 528 | struct sockaddr *, size_t, struct sockaddr *, size_t, |
| 529 | struct sockaddr *, size_t, struct sockaddr *, size_t, char *); |
Elliott Hughes | 965a4b5 | 2017-05-15 10:37:39 -0700 | [diff] [blame] | 530 | #endif |
The Android Open Source Project | 478ab6c | 2009-03-03 19:30:05 -0800 | [diff] [blame] | 531 | |
JP Abgrall | 511eca3 | 2014-02-12 13:46:45 -0800 | [diff] [blame] | 532 | /* |
Haibo Huang | ee759ce | 2021-01-05 21:34:29 -0800 | [diff] [blame] | 533 | * Internal interfaces for "pcap_open_offline()" and other savefile |
| 534 | * I/O routines. |
JP Abgrall | 511eca3 | 2014-02-12 13:46:45 -0800 | [diff] [blame] | 535 | * |
| 536 | * "pcap_open_offline_common()" allocates and fills in a pcap_t, for use |
| 537 | * by pcap_open_offline routines. |
| 538 | * |
Haibo Huang | 4ccd683 | 2020-04-23 18:03:48 -0700 | [diff] [blame] | 539 | * "pcap_adjust_snapshot()" adjusts the snapshot to be non-zero and |
| 540 | * fit within an int. |
| 541 | * |
JP Abgrall | 511eca3 | 2014-02-12 13:46:45 -0800 | [diff] [blame] | 542 | * "sf_cleanup()" closes the file handle associated with a pcap_t, if |
| 543 | * appropriate, and frees all data common to all modules for handling |
| 544 | * savefile types. |
Haibo Huang | ee759ce | 2021-01-05 21:34:29 -0800 | [diff] [blame] | 545 | * |
| 546 | * "charset_fopen()", in UTF-8 mode on Windows, does an fopen() that |
| 547 | * treats the pathname as being in UTF-8, rather than the local |
| 548 | * code page, on Windows. |
JP Abgrall | 511eca3 | 2014-02-12 13:46:45 -0800 | [diff] [blame] | 549 | */ |
Haibo Huang | ee759ce | 2021-01-05 21:34:29 -0800 | [diff] [blame] | 550 | |
| 551 | /* |
| 552 | * This wrapper takes an error buffer pointer and a type to use for the |
| 553 | * private data, and calls pcap_create_common(), passing it the error |
| 554 | * buffer pointer, the size fo the private data type, in bytes, and the |
| 555 | * offset of the private data from the beginning of the structure, in |
| 556 | * bytes. |
| 557 | */ |
| 558 | #define PCAP_OPEN_OFFLINE_COMMON(ebuf, type) \ |
| 559 | pcap_open_offline_common(ebuf, \ |
| 560 | sizeof (struct { pcap_t __common; type __private; }), \ |
| 561 | offsetof (struct { pcap_t __common; type __private; }, __private)) |
| 562 | pcap_t *pcap_open_offline_common(char *ebuf, size_t total_size, |
| 563 | size_t private_data); |
Haibo Huang | 4ccd683 | 2020-04-23 18:03:48 -0700 | [diff] [blame] | 564 | bpf_u_int32 pcap_adjust_snapshot(bpf_u_int32 linktype, bpf_u_int32 snaplen); |
JP Abgrall | 511eca3 | 2014-02-12 13:46:45 -0800 | [diff] [blame] | 565 | void sf_cleanup(pcap_t *p); |
Haibo Huang | ee759ce | 2021-01-05 21:34:29 -0800 | [diff] [blame] | 566 | #ifdef _WIN32 |
| 567 | FILE *charset_fopen(const char *path, const char *mode); |
| 568 | #else |
| 569 | /* |
| 570 | * On other OSes, just use Boring Old fopen(). |
| 571 | */ |
| 572 | #define charset_fopen(path, mode) fopen((path), (mode)) |
| 573 | #endif |
| 574 | |
| 575 | /* |
| 576 | * Internal interfaces for loading code at run time. |
| 577 | */ |
| 578 | #ifdef _WIN32 |
| 579 | #define pcap_code_handle_t HMODULE |
| 580 | #define pcap_funcptr_t FARPROC |
| 581 | |
| 582 | pcap_code_handle_t pcap_load_code(const char *); |
| 583 | pcap_funcptr_t pcap_find_function(pcap_code_handle_t, const char *); |
| 584 | #endif |
JP Abgrall | 511eca3 | 2014-02-12 13:46:45 -0800 | [diff] [blame] | 585 | |
| 586 | /* |
Haibo Huang | 4ccd683 | 2020-04-23 18:03:48 -0700 | [diff] [blame] | 587 | * Internal interfaces for doing user-mode filtering of packets and |
| 588 | * validating filter programs. |
| 589 | */ |
| 590 | /* |
| 591 | * Auxiliary data, for use when interpreting a filter intended for the |
| 592 | * Linux kernel when the kernel rejects the filter (requiring us to |
| 593 | * run it in userland). It contains VLAN tag information. |
| 594 | */ |
Elliott Hughes | 773b27c | 2021-08-20 17:37:36 -0700 | [diff] [blame] | 595 | struct pcap_bpf_aux_data { |
Haibo Huang | 4ccd683 | 2020-04-23 18:03:48 -0700 | [diff] [blame] | 596 | u_short vlan_tag_present; |
| 597 | u_short vlan_tag; |
| 598 | }; |
| 599 | |
| 600 | /* |
| 601 | * Filtering routine that takes the auxiliary data as an additional |
| 602 | * argument. |
| 603 | */ |
Haibo Huang | ee759ce | 2021-01-05 21:34:29 -0800 | [diff] [blame] | 604 | u_int pcap_filter_with_aux_data(const struct bpf_insn *, |
Elliott Hughes | 773b27c | 2021-08-20 17:37:36 -0700 | [diff] [blame] | 605 | const u_char *, u_int, u_int, const struct pcap_bpf_aux_data *); |
Haibo Huang | 4ccd683 | 2020-04-23 18:03:48 -0700 | [diff] [blame] | 606 | |
| 607 | /* |
Haibo Huang | ee759ce | 2021-01-05 21:34:29 -0800 | [diff] [blame] | 608 | * Filtering routine that doesn't. |
| 609 | */ |
| 610 | u_int pcap_filter(const struct bpf_insn *, const u_char *, u_int, u_int); |
| 611 | |
| 612 | /* |
| 613 | * Routine to validate a BPF program. |
| 614 | */ |
| 615 | int pcap_validate_filter(const struct bpf_insn *, int); |
| 616 | |
| 617 | /* |
JP Abgrall | 511eca3 | 2014-02-12 13:46:45 -0800 | [diff] [blame] | 618 | * Internal interfaces for both "pcap_create()" and routines that |
| 619 | * open savefiles. |
| 620 | * |
| 621 | * "pcap_oneshot()" is the standard one-shot callback for "pcap_next()" |
| 622 | * and "pcap_next_ex()". |
| 623 | */ |
| 624 | void pcap_oneshot(u_char *, const struct pcap_pkthdr *, const u_char *); |
| 625 | |
The Android Open Source Project | 478ab6c | 2009-03-03 19:30:05 -0800 | [diff] [blame] | 626 | int install_bpf_program(pcap_t *, struct bpf_program *); |
| 627 | |
| 628 | int pcap_strcasecmp(const char *, const char *); |
| 629 | |
Haibo Huang | ee759ce | 2021-01-05 21:34:29 -0800 | [diff] [blame] | 630 | /* |
| 631 | * Internal interfaces for pcap_createsrcstr and pcap_parsesrcstr with |
| 632 | * the additional bit of information regarding SSL support (rpcap:// vs. |
| 633 | * rpcaps://). |
| 634 | */ |
| 635 | int pcap_createsrcstr_ex(char *, int, const char *, const char *, |
| 636 | const char *, unsigned char, char *); |
| 637 | int pcap_parsesrcstr_ex(const char *, int *, char *, char *, |
| 638 | char *, unsigned char *, char *); |
| 639 | |
Haibo Huang | 165065a | 2018-07-23 17:26:52 -0700 | [diff] [blame] | 640 | #ifdef YYDEBUG |
| 641 | extern int pcap_debug; |
| 642 | #endif |
| 643 | |
The Android Open Source Project | 478ab6c | 2009-03-03 19:30:05 -0800 | [diff] [blame] | 644 | #ifdef __cplusplus |
| 645 | } |
| 646 | #endif |
| 647 | |
| 648 | #endif |