aboutsummaryrefslogtreecommitdiff
path: root/pcap-nit.c
Commit message (Collapse)AuthorAgeFilesLines
* If we can't allocate a DLT_ list, fail.Guy Harris2023-06-241-7/+7
| | | | | | | | Some code already was doing that (for example, pcap-bpf.c if fetching the DLT list with an ioctl), and, if you can't allocate a DLT_ list, which is usually pretty small, you may have other memory allocation problems later, so letting the program open an interface (and not get a correct list of all link-layer types supported) may not be worth it.
* Prefix routines declared in pcap-int.h with pcap_.Guy Harris2023-05-261-1/+1
| | | | | This avoids potential and, in one case (SIMH), actual collisions with names in other libraries or in applications using libpcap.
* struct pcap: Update buffer type from "void *" to "u_char *"Francois-Xavier Le Bail2023-05-181-1/+1
| | | | | | | | | | | | | | | | | | | | | This change should avoid these cppcheck warnings: pcap-hurd.c:77:18: warning: 'p->buffer' is of type 'void *'. When using void pointers in calculations, the behaviour is undefined. [arithOperationsOnVoidPointer] pkt = p->buffer + offsetof(struct net_rcv_msg, packet) ^ pcap-hurd.c:78:8: warning: 'p->buffer+offsetof(struct net_rcv_msg,packet)' is of type 'void *'. When using void pointers in calculations, the behaviour is undefined. [arithOperationsOnVoidPointer] + sizeof(struct packet_header) - ETH_HLEN; ^ pcap-hurd.c:79:25: warning: 'p->buffer' is of type 'void *'. When using void pointers in calculations, the behaviour is undefined. [arithOperationsOnVoidPointer] memmove(pkt, p->buffer + offsetof(struct net_rcv_msg, header), ^ Remove some '(u_char *)' casts accordingly.
* Make sure no read routine process more than INT_MAX packets.Guy Harris2022-01-261-0/+3
| | | | | | | | | | | | | | | | | | | Some read routines don't read a single bufferful of packets and process just those packets; if packets continue to be made available, they could conceivably process an arbitrary number of packets. That would mean that the packet count overflows; either that makes it look like a negative number, making it look as if an error occurred, or makes it look like a too-small positive number. This can't be fixed by making the count 64-bit, as it ultimately gets returned by pcap_dispatch(), which is defined to return an int. Instead, if the maximum packet count argument to those routines is a value that means "no maximum", we set the maximum to INT_MAX. Those routines are *not* defined to loop forever, so this isn't an issue. This should fix issue #1087.
* Handle the pcap_t+private data in a fashion that makes fewer assumptions.Guy Harris2020-07-011-1/+1
| | | | | | | | | | | | | | | The sizeof operator and alignof macro can be given a type "name" that's anonymous, e.g. sizeof(struct { int a; char *b; }). Have pcap_create_common() and pcap_open_offline_common() take, as arguments, the total size of a structure containing both the pcap_t and the private data as members, and the offset of the private data in that structure, and define macros that calculate those given, as an argument, the data type of the private data. This avoids making assumptions about the alignment of those two items within the structure; that *might* fix GitHub issue #940 if the issue is that the ARM compiler being used does 16-byte alignment of the private structure, rather than the 8-byte alignment we were wiring in.
* Don't use ctype.h macros.Guy Harris2019-08-311-1/+0
| | | | | | | | | | | | | | | Some of them are locale-dependent, and all of them run the risk of failing if you hand them a char with the 8th bit set. Define our own locale-independent macros that can be handed any integral value. Don't include <ctype.h>. This should address the issue in GitHub pull request #839, and should also catch any (highly unlikely) cases in which something other than Boring Old Space And Tab and, sometimes, CR and LF are treated as white space. (No, we don't want FF or VT treated as white space.)
* Remove some workarounds for old compilers.Guy Harris2019-08-091-1/+1
| | | | | | | | | | | | | Require Visual Studio 2015 or later; fail if we don't have it, and remove checks for older versions. That means we have C99-compliant snprintf() and vsnprintf(); require them when configuring for UN*X, and then use them directly, rather than having wrappers for systems lacking them. If we're using MSVC, skip the tests for options to request C99 compatibility - either we have VS 2015, which is sufficient, or we don't, in which case we fail.
* Squelch more narrowing warnings.Guy Harris2018-09-121-1/+1
|
* Clean up the declaration of the packet-filtering routines.Guy Harris2018-08-311-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If net/bpf.h declares bpf_filter() one way and libpcap defines it another way, even pcap-bpf.c needs a declaration that matches how libpcap defines it, not how net/bpf.h (mistakenly) declares it. ("Mistakenly" because it should *not* be declaring the kernel's version of bpf_filter() unless it's being used in a *kernel* build; other *BSDs, and macOS, declare it only in kernel builds by testing for a #define such as KERNEL or KERNEL_PRIVATE, but NetBSD doesn't - it *should*, but it doesn't.) So we rename the internal-to-pcap filtering routine as pcap_filter(), which is not exported from libpcap, and have bpf_filter() be a wrapper around pcap_filter() that is exported. Use pcap_filter(), rather than bpf_filter(), for all filtering inside libpcap (except for filtering that uses bpf_filter_with_aux_data(), which we rename pcap_filter_with_aux_data()). Do the same for bpf_validate(), which is *also* declared in net/bpf.h, even for non-kernel builds, in NetBSD. As we're not exporting pcap_filter_with_aux_data(), don't even *declare* it in a public header; don't declare struct bpf_aux_data in a public header, either. That way we can change it without worrying about breaking APIs or ABIs; we may do that if, for example, we want to support the "inbound" and "outbound" filters when reading pcapng files, adding a direction indicator to that structure. Declare bpf_filter() in pcap/bpf.h even on NetBSD and QNX; pcap-bpf.c doesn't include pcap/bpf.h (it sets a #define to force pcap/pcap.h not to include it), so we won't get any collisions if net/bpf.h (which it does include) declares it. The only collisions will occur in programs that include *both* pcap/pcap.h or pcap/bpf.h *and* net/bpf.h, and that will occur only if net/bpf.h declares bpf_filter() even when building userland code, and the correct fix for *that* is to fix net/bpf.h not to declare them in non-kernel builds.
* Pass the "get additional flags" function to the findalldevs helpers.Guy Harris2018-04-301-2/+3
| | | | | This lets us make it a static function - or eliminate it entirely for pcap-null.c.
* Fix function signatures.Guy Harris2018-04-291-1/+1
|
* Add more interface flags to pcap_findalldevs().Guy Harris2018-04-291-0/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | We add: PCAP_IF_WIRELESS, which indicates whether the interface is "wireless" or not. PCAP_IF_CONNECTION_STATUS, which is a bitmask for a two-bit field that can have one of the values: PCAP_IF_CONNECTION_STATUS_UNKNOWN if the status of whether the interface is "connected" or "disconnected" is unknown; PCAP_IF_CONNECTION_STATUS_CONNECTED if the interface is "connected"; PCAP_IF_CONNECTION_STATUS_DISCONNECTED if the interface is "disconnected"; PCAP_IF_CONNECTION_STATUS_NOT_APPLICABLE if the notion of "connected" or "disconnected" doesn't apply to this interface. Take that into account when sorting interfaces in the interface list, penalizing "disconnected" interfaces, as you won't see traffic on them if they're not wireless and you'd have to be in some form of "monitor mode" to see traffic on them if they're wireless. This should address GitHub issue #700.
* Add a routine to format error messages with an errno-based message at the end.Guy Harris2017-11-151-11/+12
| | | | | | | | | | | | | | That routine will use strerror_s() or strerror_r() if available, in a fashion that's thread-safe. Otherwise, it falls back on pcap_strerror(). Use it in both libpcap and rpcapd. Given that we check for errors in strerror_r(), hopefully this will squelch warnings with newer version of GCC and GNU libc; whilst the macOS (and other BSD-flavored?) strerror_r() always fills in a message, that's not required by the Single UNIX Specification, as far as I can tell, so we apparently really *do* need to check for errors.
* No need to generate version.c or pcap_version.h.Guy Harris2017-10-031-2/+0
| | | | We can get the project version from config.h, so do so.
* Push pcap_lib_version() into the pcap-XXX.c files.Guy Harris2017-09-061-3/+5
| | | | | | | | This lets us move the Windows version to pcap-win32.c, so we don't have to include packet32.h in pcap.c. It also gets rid of some #ifdefs, and lets us construct the version string on UN*X platforms, and MS-DOS, at compile time.
* Always include <config.h> rather than "config.h".Guy Harris2017-08-181-1/+1
| | | | | | | | This can prevent bizarre failures if, for example, you've done a configuration in the top-level source directory, leaving behind one config.h file, and then do an out-of-tree build in another directory, with different configuration options. This way, we always pick up the same config.h, in the build directory.
* Make the checks and adjustment of the snapshot length module-dependent.Guy Harris2017-06-011-0/+11
| | | | | | | | | | | | | Also, initialize the snapshot length to 0, meaning "not specified", so that the default snapshot length, if not specified, is also module-dependent. That way, D-Bus has a maximum and default of 128MB, as that's the maximum message size, but other capture devices have the current MAXIMUM_SNAPLEN, so we can handle full-size D-Bus messages without advertising an overly-large snapshot length for other devices, potentially causing libpcap and programs using it or reading libpcap files to allocate overly-large buffers for other capture devices.
* Allow a platform to add information to the version string.Guy Harris2017-05-161-0/+9
| | | | | For example, on Linux, we add information about memory-mapped capture support; see comments on GitHub issue #600.
* Have a pcap_if_list_t structure for use by the findalldevs code.Guy Harris2017-01-181-2/+2
| | | | | | | It's not part of the API, but it's an internal structure used by the findalldevs code. Currently, it just has a pointer to the beginning of the list, but it could change in order to speed up the process of adding to the list.
* pcap_create_interface() needs the interface name on Linux.Guy Harris2016-06-301-1/+1
| | | | | So pass it the interface name, and use the name passed to it rather than the name in the pcap_t - which hasn't yet been set at that point.
* Don't have pcap_create_common() set opt.device.Guy Harris2016-06-301-2/+2
| | | | | | | Instead, have pcap_create() do so. Also have pcap_create() on Windows handle converting a little-endian UCS-2/UTF-16 string to ASCII.
* Rename opt.source to opt.device.Guy Harris2016-06-291-1/+1
| | | | | | | For local captures, it's jut the device. If we add remote capture support, we'll be handed a URL, and will split the URL into multiple components, and will store the various components in the opt structure, with the path of the URL being opt.device.
* Let the platform decide how to check capturable interfaces.Guy Harris2016-06-281-1/+18
| | | | | | | | | | | | | | | | | | | (Git's annoying policy of expecting a short one-line description of every change means that the first line isn't very explanatory.) Make pcap_findalldevs_interfaces() take as an argument a function that's used to check whether an interface can be captured on or not, rather than doing the check by trying to open the device for capturing. This lets pcap_findalldevs() find interfaces even if you don't have permission to capture on them; that way, instead of users saying "why isn't {tcpdump -D, tshark -D, dumpcap -D, Wireshark, etc.} showing me any interfaces?", they'll say "why am I getting a 'you don't have permissions' error when I try to capture on this interface?", which is a better description of the underlying problem. On some platforms, it also avoids a bunch of extra work when getting a list of interfaces.
* Have pcap_platform_finddevs() do all the "find local interfaces" work.Guy Harris2016-06-261-1/+1
| | | | | | | | Have pcap_findalldevs() call it to find *all* the local interfaces. pcap_platform_finddevs() might call pcap_findalldevs_interfaces() or might do the work itself. Further work to come.
* Use pcap_snprintf() instead of snprintf().Guy Harris2015-11-031-6/+6
| | | | | | | | | | | On UN*Xes with snprintf(), we just #define pcap_snprintf to snprintf. On UN*Xes without snprintf(), we provide our own, but call it pcap_snprintf(). On Windows, we have a routine that wraps _snprintf(), with C99 semantics (ensuring null termination if the string won't fit), called pcap_snprintf(), and use that.
* Make the buffer member of a pcap_t a void *.Guy Harris2015-08-091-2/+2
| | | | | | | | | | | Yes, in some sense, it's an array of bytes - on modern processors, *all* data is ultimately an array of bytes - but different modules will use it in different ways, not all of which will be an undifferentiated array of bytes. This squelches a complaint from the Clang static analyzer. Clean up some code while we're at it.
* Delete trailing spaces/tabsFrancois-Xavier Le Bail2015-03-081-1/+1
|
* remove libpcap's own CVS keywordsDenis Ovsienko2014-01-031-4/+0
| | | | | | This change removes CVS keywords that express that the file belongs to libpcap repository. All such keywords represented the revision and timestamp by the end of 2008 or even older.
* Add a PACKET_COUNT_IS_UNLIMITED() to test for a packet count <= 0.Guy Harris2013-12-141-1/+1
| | | | | | | | | | | | In read routines, a packet count <= 0 means "keep supplying packets until you run out of packets in the buffer", and it means "keep supply packets until the loop is broken out of or you get an error" in pcap_loop(). Use the macro in all tests for that, so the right test is always done (i.e., a count of 0 means "unlimited", not "supply zero packets"); this fixes some cases where we weren't doing the right test (and hopefully encourages programmers to use it and get the test right in new modules).
* Rename the "private" member of a pcap_t to avoid C++ issues.Guy Harris2013-08-071-2/+2
| | | | | "private" is a C++ keyword; rename the "private" member of a pcap_t to "priv" to avoid that, as per Gisle Vanem's suggestion.
* Add an API to set "immediate mode".Guy Harris2013-05-081-10/+25
| | | | In "immediate mode", packets are delivered as soon as they arrive.
* Move platform-dependent pcap_t data out of the pcap_t structure.Guy Harris2013-05-061-5/+14
| | | | | | | | | | | | | | | Put the private data right after the pcap_t structure, with a pointer to it in the pcap_t. The initial goal is to allow new pcap modules to be added without having to hack pcap-int.h. In the longer term, we may want to freeze the pcap_t structure, except possibly for adding new method pointers at the end, and provide an ABI for adding modules. We also put the stuff used by the read path at the beginning of the pcap_t structure, to try to keep it on the same set of cache lines.
* Have non-interface modules take responsibility for identifying their devices.Guy Harris2012-06-111-1/+1
| | | | | | | | | | | | | | Have a table of routines to do pcap_create() for devices that aren't regular network interfaces. Try each of those in succession until one says "it's mine" (whether it succeeds or fails); if none do, do a pcap_create() for a regular interface. Have those routines do more stringent tests of the name - don't just accept any name that has a particular substring anywhere in it. That reduces the likelihood of a false match (as happened with the CANbus module when somebody renamed their Ethernet interface "canopy"). Have the table also include routines for pcap_findalldevs().
* If an activate routine fails, it needs to clean up the pcap_t, closeGuy Harris2009-09-211-0/+1
| | | | | | | | | anything it's opened, etc.. In addition, the op pointers need to be restored to the un-activated state; do that in pcap_activate() if the call to the activate op fails. Also, in the common cleanup code, set the fd's to -1.
* Turn close_op into cleanup_op; the routine that handles it can also beguy2008-04-141-4/+1
| | | | | | | | | | | | | | | | | | | | | | | used to clean up after a failed pcap_activate() call. Convert the existing close_op routines to cleanup_op routines, and use them to clean up; rename pcap_close_common() to pcap_cleanup_live_common(), and use it directly if there's no platform-dependent cleanup needed. That means we don't have to write the same cleanup code twice (and possibly forget stuff in the version done on a failed pcap_activate() call). Have the cleanup routines do whatever is necessary to indicate that cleanup has been done, and not do any particular cleaning up if it's already been done (i.e., don't free something if the pointer to it is null and null out the pointer once it's been freed, don't close an FD if it's -1 and set it to -1 once it's been closed, etc.). For device types/platforms where we don't support monitor mode, check for it and return PCAP_ERROR_RFMON_NOTSUP - but do so after we've checked whether we can open the device, so we return "no such device" or "permission denied" rather than "that device doesn't support monitor mode" if we can't open the device in the first place. Fix a comment.
* From Paolo Abeni and me: split pcap_open_live() into a "get a pcap_tguy2008-04-041-39/+33
| | | | | | | | | | | | | | | | handle" routine, an 'activate a pcap_t handle" routine, and some "set the properties of the pcap_t handle" routines, so that, for example, the buffer size can be set on a BPF device before the device is bound to an interface. Add additional routines to set monitor mode, and make at least an initial attempt at supporting that on Linux, *BSD, and Mac OS X 10.4 and 10.5. (Very much "initial" for Linux, which is a twisty little maze of wireless drivers, many different.) Have a "timeout" member of the pcap_md structure on all platforms, use that on Windows instead of the "timeout" member of the pcap_t structure, and get rid of the "timeout" member of that structure.
* As is done in the loop in pcap-bpf.c, check for non-positive values ofguy2008-02-021-2/+2
| | | | | "cnt", not for non-negative values, so a "cnt" of 0 is treated the same as a "cnt" of -1.
* Don't assume that p->fcode.bpf_insns remains unchanged while processingguy2007-12-051-3/+2
| | | | a bufferfull of packets - it could get changed in a callback routine.
* From Pawel Pokrywka: add support for requesting that only receivedguy2005-05-031-1/+2
| | | | | | | packets, only sent packets, or all packets be accepted, with an implementation for Linux. Add an implementation for BPF platforms that support BIOCSSEESENT.
* Add a "pcap_close_common()" routine which can be used as the closeguy2004-10-191-5/+2
| | | | | routine for some pcap-XXX.c files and can be called by the close routine in other pcap-XXX.c files.
* Add support for sending packets; includes contributions from Markguy2004-03-231-1/+31
| | | | Pizzolato <List-tcpdump-workers@subscriptions.pizzolato.net>.
* Fix cut-and-pasteos; thanks to Darren Reed for finding them.guy2004-03-211-2/+2
|
* For devices that we have some reason to believe are real live Ethernetguy2003-12-181-1/+21
| | | | | | | devices, offer DLT_DOCSIS as one of the choices of link-layer type, and support setting that type as meaning just "set libpcap's notion of the link-layer type to DLT_DOCSIS" without telling the driver to use DLT_DOCSIS.
* Add a "pcap_get_selectable_fd()" API to get an FD on which you can do aguy2003-11-211-1/+6
| | | | "select()" or "poll()" - or -1 if that won't work.
* Add "getnonblock" and "setnonblock" operations, and set the functionguy2003-11-201-1/+3
| | | | | | | pointers appropriately, rather than using #ifdefs and run-time checks. Get rid of declaration of non-existent "pcap_set_datalink_platform()" routine.
* Add _U_ to "rcsid[]" definitions, to eliminate "unused variable"guy2003-11-151-2/+2
| | | | warnings from newer versions of GCC.
* Add a "pcap_breakloop()" API to break out of the loop inguy2003-11-041-1/+21
| | | | "pcap_dispatch()" and "pcap_loop()".
* Add a "read" function pointer to the pcap_t structure, which handlesguy2003-07-251-3/+4
| | | | | | reading packets from a pcap_t, and make "pcap_read()" call it. That removes the last place where we have to check for a pcap_t that refers to a DAG card rather than a live capture, so get rid of the "is_dag" flag.
* Add a "set_datalink" function pointer to the pcap_t structure, whichhandlesguy2003-07-251-7/+2
| | | | | setting a filter for a pcap_t. Have "pcap_set_datalink()" call it, rather than explicitly calling "pcap_set_datalink_platform()".
* Add a "setfilter" function pointer to the pcap_t structure, whichguy2003-07-251-10/+2
| | | | | | | | handles setting a filter for a pcap_t. Have "pcap_setfilter()" call it, rather than being a per-platform function. The per-platform functions don't need to check for an offline capture any more, as they're not called for an offline capture (and the ones that just call "install_bpf_program()" don't need to exist at all).
generated by cgit v1.2.3 (git 2.39.1) at 2025-05-10 09:47:15 +0000