aboutsummaryrefslogtreecommitdiff
path: root/pcap/pcap.h
Commit message (Collapse)AuthorAgeFilesLines
* pcap savefile: Use Reserved1 and Reserved2 in the per-file headerFrancois-Xavier Le Bail2023-05-231-2/+2
| | | | | | | | This part is in line with the draft-ietf-opsawg-pcap. Moreover: Update some comments. Update pcap-sita.html.
* Revert "pcap: Update the per-file header to use reserved1 and reserved2"Francois-Xavier Le Bail2023-05-231-2/+2
| | | | | | | | This reverts commit c2dfd817646d071bf62a3968a0454301e5395d18. From a Denis remark: struct pcap_file_header is in a public header. pcap-savefile.manfile.in will be updated separately.
* pcap: Update the per-file header to use reserved1 and reserved2Francois-Xavier Le Bail2023-05-201-2/+2
| | | | | | Update pcap-savefile.manfile.in accordingly. This is in line with the draft-ietf-opsawg-pcap.
* Fix spaces before tabs in indentationFrancois-Xavier Le Bail2023-02-151-2/+2
|
* Add an option to force memory-mapped buffers to be mapped as accessible to ↵Hans Leidekker2022-12-201-0/+1
| | | | 32-bit code.
* Use _declspec(deprecated(msg)) rather than __pragma(deprecated).Guy Harris2022-08-231-6/+6
| | | | | | _declspec(deprecated(msg)) doesn't require the function name, and takes a message as an argument and causes it to be used as the warning/error message for use of an undeclared function.
* Fix some typosFrancois-Xavier Le Bail2022-08-011-1/+1
| | | | [skip ci]
* Deprecate pcap_compile_nopcap().Denis Ovsienko2022-06-141-1/+2
| | | | As discussed on the mailing list in August 2020.
* Mark the option APIs as "first available in 1.11".Guy Harris2022-03-081-2/+11
|
* Merge branch 'master' into pcap-optionsGuy Harris2022-03-081-15/+238
|\
| * Update a comment to reflect the addition of TLS support. [skip ci]Guy Harris2022-03-071-4/+5
| | | | | | | | | | If TLS is used with rpcap, user names and pasword don't go over the wire in clear text.
| * support user/pass in rpcap:// and rpcaps:// source URIsRyan Castellucci2022-03-071-5/+9
| |
| * pcap: fix the handling of the reserved field.Guy Harris2022-03-041-2/+3
| | | | | | | | | | | | Don't commit to it being a "class" field. Fix the bitfield for it.
| * Reject pcap files if the "link-layer types plus other stuff" is invalid.Guy Harris2022-03-041-4/+51
| | | | | | | | | | | | | | | | There's a reserved field that was originally intended to handle alternate link-layer type values; it would contain a "class" value indicating what the lower 16 bits of the field indicate. We currently only support a "class" value of 0, meaning "it's a LINKTYPE_ value". Reject files where it's non-zero.
| * pcap_handle: fix deprecation warning.Guy Harris2022-01-021-1/+1
| | | | | | | | | | | | | | | | Don't tell people to use a routine that doesn't exist; instead, if they need it, tell them to request it ("request" includes "give us a reason to believe that they really need it" - what operations do you expect to do on the HANDLE in question? Note that pcap_getevent() is what you want if you want to wait for an event on it.).
| * Fix a comment in pcap/pcap.h. [skip ci]Denis Ovsienko2021-12-311-1/+1
| |
| * Revert "Don't wrap chunks of headers with extern "C" { ... }."Guy Harris2021-03-171-113/+121
| | | | | | | | | | | | | | This reverts commit 8b6b13d4cbb685db047af04c49817ed81fff7c35. That solution allowed you to intermix declarations/definitions and before the extern "C", so you can see what's being imported.
| * Don't wrap chunks of headers with extern "C" { ... }.Guy Harris2021-03-171-121/+113
| | | | | | | | | | | | | | | | | | | | | | Instead, explictly flag individual functions with extern "C" by adding it to the tag we're already using for exported functions, and creating a new tag to use for non-exported functions. Rename those tags, and the tags used for exported data, to say what they do, rather than saying "this is an API" (we may export things we don't want to be treated as part of the API, but that we have to export because some programs use them).
| * Label most functions by the first release in which they're available.Guy Harris2020-12-201-0/+170
| | | | | | | | | | | | | | | | This 1) indicates what version of libpcap first had a given API and 2) allows upstream providers whose build environments allow APIs to be designated as "first available in this release" to do so by appropriately defining them. ("Upstream providers" here means "Apple", as far as I know, but perhaps there are others.)
* | added pcap-options.c with pcap_options structure to abstract settings that ↵Michael Richardson2022-03-081-0/+17
|/ | | | keep growing
* Fix some spelling. [skip ci]Denis Ovsienko2020-10-091-2/+2
|
* Fixup some URLs in the comments.Denis Ovsienko2020-08-021-1/+1
| | | | [skip ci]
* Don't introduce pcap_handle() unless a need for it is demonstrated.Guy Harris2020-05-311-5/+5
|
* Add pcap_handle(), and deprecate pcap_fileno(), on Windows.Guy Harris2020-05-301-0/+12
| | | | | | | | | | | | | I don't know whether a Windows HANDLE can be expected to survive conversion to an int - and there's no need for it to have to be converted. If a caller needs to do something with a HANDLE associated with a pcap_t, it should call the new pcap_handle() routine and get a HANDLE; code for UN*X that uses the result of pcap_fileno() is unlikely to work on Windows anyway. Squelch the "pointer truncation from 'HANDLE' to 'DWORD'" warning, as, if that truncation causes an issue, callers should use pcap_handle(), and if it *doesn't* cause an issue, it's, well, not an issue.
* Fix typos in some commentsFrancois-Xavier Le Bail2020-05-241-1/+1
| | | | [skip ci]
* Add support for UTF-8 strings on Windows.Guy Harris2020-04-111-0/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add a routine pcap_init() that initializes pcap, specifying whether strings should be treated as being in UTF-8 or a local character encoding. On UN*Xes, we don't change our behavior based on that setting; if there is ever an issue with local character encodings *other* than UTF-8, we can use it. On Windows, the local character encoding is the local ANSI code page; if pcap_init() isn't called, or is called with PCAP_CHAR_ENC_LOCAL, strings are treated as being in the current ANSI code page, as before, otherwise they're treated as being in UTF-8. This includes file path names and error messages. In addition, if pcap_init() is called, regardless of the options, we disable pcap_lookupdev(), making it always return NULL, as it retunred *UTF-16LE* strings (plural!) on Windows NT, and pcap_create() had to check for UTF-16LE strings to work around that. That workaround is unsafe (it will read past the end of the input string if the string is one ASCII character), and is also disabled if pcap_init() is called. We also make rpcapd send UTF-8 error message strings over the wire; sending local code page strings is a Bad Idea, as the client has no idea what the server's code page is. (Do not assume the client and server are necessarily in the same location.) Fix the capitalization of "Winsock" while we're at it; Microsoft appears to spell it "Winsock", rather than "WinSock".
* On Linux, return error on interface going away, not just going down.Guy Harris2020-01-291-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is a pain to detect, because the PF_PACKET socket code appears to get separate "interface went down" and "interface went away" notifications in my "unplug a USB Wi-Fi adapter" tests on my VMware Fusion Ubuntu 18.04 virtual machine (5.3.0 kernel), and the first notification delivers a wakeup and returns ENETDOWN while the second notificaiton delivers *no* wakeup and sets the ifindex member of the struct packet_sock for the socket, so there's nothing we can test after the wakeup that's guaranteed to indicate that the interface has disappeared. So what we have to do is remember the ENETDOWN but not return it as an error, and then arrange to periodically check whether the interface is still there; if it isn't, we *then* return the "interface went away" error, and, if we see traffic or see that the interface is up, we clear the remembered ENETDOWN and stop doing the periodic checks. This is tricky, because it needs to work not only for blocking pcap_t's, where we're in a loop doing poll() calls, so we can keep checking within the loop, but also for non-blocking pcap_t's on which the caller is doing select()/poll()/epoll_wait(). In order to make *that* work, we need to tweak the semantics of pcap_get_required_select_timeout() so that it's not guaranteed that it will always return the same value, so that it should be called within event loops rather than called once outside the event loop. Normally, there is no timeout required for Linux PF_PACKET sockets, but when we're doing the periodic tests, the timeout is required. While we're doing that, we make the return value of pcap_get_required_select_timeout() a const pointer - there was no good reason for the caller to modify it (it doesn't belong to the caller). If poll() returns POLLERR, use getsockopt(SO_ERROR) to get the socket error, rather than a read(). Update the documentation to reflect this, and make various other cleanups (including documenting the error return value for pcap_get_selectable_fd() to -1 rather than PCAP_ERROR - it's not an error code, it's just a specific error value). Also note that, for kqueues on *BSD/macOS and for select/poll on Linux, the timeout needn't be used as a timeout for the call - you can have a timer, so that when that *particular* timer fires, you try calling pcap_dispatch() on the pcap_t to which it corresponds. Update selpolltest to add more capabilities needed when testing this on Linux. This should address GitHub issue #859 and pull request #858.
* Work around for bogus definition of _MSC_VER with non-MS compilers.Guy Harris2019-12-181-0/+43
| | | | | | | | | | | | | | Try to work around software using pcap that defines _MSC_VER with non-MS compilers before including pcap.h. We expect _MSC_VER to be defined only for Microsoft's compiler, and to be defined with a value that reflects what version of the compiler is being used, so that we can determine, among other things, what Microsoft extensions are available. Try to detect it being defined by other software that wants to trick us into thinking something's being compiled with Microsoft's compiler, and undo the definition of _MSC_VER.
* Fix typo in pcap/pcap.h.Nan Xiao2019-11-191-1/+1
|
* Make "{un}synced with the system clock" a property of more time stamp types.Guy Harris2019-11-161-10/+15
| | | | | | | | | | | | | Define PCAP_TSTAMP_HOST_{LOW,HI}PREC as synced with the system clock; add a new PCAP_TSTAMP_HOST_HIPREC_UNSYNCED type for high-precision time stamps not necessarily synced with the system clock. This should better match Npcap, including a proposed future "high precision and synced with the system clock" time stamps for Npcap on Windows 8 and later. (This may still not match what FreeBSD offers, but at least it removes an Npcap mismatch.)
* Fix typo in pcap/pcap.h.Nan Xiao2019-11-141-1/+1
|
* Fix typo in pcap/pcap.h.Nan Xiao2019-10-301-1/+1
|
* Report the DLT description in error messagesBill Fenner2019-04-151-0/+1
| | | | | | | | Introduce pcap_datalink_val_to_description_or_dlt, and use that when reporting an error. This was inspired by seeing "tcpdump: no VLAN support for data link type 113". The new equivalent message is "tcpdump: no VLAN support for Linux cooked".
* pcap_dump_fopen differing Windows CRTs work-aroundAlex Smith2019-03-081-1/+22
| | | | | | | | Make pcap_dump_fopen() a macro on Windows, wrapping the caller's CRT functions for getting the raw OS file HANDLE and calling the exported hopen variant. pcap_dump_hopen() creates a stream from that using libpcap's CRT and passes that stream to the real pcap_dump_fopen(). This mirrors what was done for pcap_fopen_offline().
* Put the Windows-vs-non-Windows socket defines in <pcap/socket.h>.Guy Harris2019-01-091-28/+2
|
* Don't include pcap/pcap.h just to get SOCKET defined.Guy Harris2019-01-071-2/+9
| | | | Put it in portability.h as well, with redefinition protections.
* Unbreak source and binary compatibility.Guy Harris2019-01-061-0/+3
| | | | | | We can't change the signature of pcap_remoteact_accept(); add pcap_remoteact_accept_ex() with the new signature, and have pcap_remoteact_accept() as a wrapper with the old signature.
* Merge branch 'master' of https://github.com/rixed/libpcap into rixed-masterGuy Harris2019-01-061-1/+4
|\
| * SSL: implement encryption of active connections control socketsCedric Cellier2018-09-131-1/+1
| | | | | | | | Added one boolean argument to pcap_remoteact_accept().
| * TLS for rpcap: also encrypt the control socketCedric Cellier2018-09-131-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | This patch also encode the control sockets in adition to the data socket. Clients performs a TLS handshake when the scheme is rpcaps:// rather than rpcap://. Both active and passive modes are supported, but transfert via UDP is not (yet) supported (the lib returns an error in that case). I did some adaptation to the windows code but couldn't tested so for all I know it may not even compile. Also tried to fix the indentation.
* | More constification of arguments.Guy Harris2018-12-251-2/+2
|/ | | | | | | | | | We don't modify the source argument to pcap_findalldevs_ex(), so make that a promise, so compilers don't get upset when a constant string is passed. See, for example: https://stackoverflow.com/questions/52397129/winpcap-findalldevs-const-char-incompatible-to-char
* Fix multiple declaration of bpf_ functionsbleader2018-08-301-14/+0
| | | | | | | | | | | | | | pcap.h will include pcap/pcap.h and pcap/bpf.h that both defines the bpf_filter and bpf_validate functions. In most cases this won't be an issue, most people are using the libpcap as a system library, gcc preprocessor will therefore disable part of the warnings according to the `3` in https://gcc.gnu.org/onlinedocs/cpp/Preprocessor-Output.html In case libpcap is included in a project that actually have more warning (-Wredundant-decls), and also using local headers we end up having quite a lot of warning.
* Set always 'time zone offset' field to zero in the pcap file headerFrancois-Xavier Le Bail2018-08-011-2/+3
| | | | | | | | | | | | | As documented in https://www.tcpdump.org/manpages/pcap-savefile.5.txt, this field must be 0. It was previously propagated from the input file to the output file when reading/writing with: tcpdump -r input.pcap -w output.pcap Add/update the appropriate comments. Moreover: Set the initializations in the order of structure fields.
* Rename pcap_set_protocol() to pcap_set_protocol_linux().Denis Ovsienko2018-07-111-1/+1
| | | | | As discussed on tcpdump-workers: emphasize the fact this function is Linux-specific.
* Don't try to distinguish "unsupported OID" from "hard error".Guy Harris2018-04-291-1/+0
| | | | | We don't seem to reliably get the NDIS "unsupported OID" errors from packet.dll, so just treat *all* OID get errors as "try something else".
* Add more interface flags to pcap_findalldevs().Guy Harris2018-04-291-3/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | We add: PCAP_IF_WIRELESS, which indicates whether the interface is "wireless" or not. PCAP_IF_CONNECTION_STATUS, which is a bitmask for a two-bit field that can have one of the values: PCAP_IF_CONNECTION_STATUS_UNKNOWN if the status of whether the interface is "connected" or "disconnected" is unknown; PCAP_IF_CONNECTION_STATUS_CONNECTED if the interface is "connected"; PCAP_IF_CONNECTION_STATUS_DISCONNECTED if the interface is "disconnected"; PCAP_IF_CONNECTION_STATUS_NOT_APPLICABLE if the notion of "connected" or "disconnected" doesn't apply to this interface. Take that into account when sorting interfaces in the interface list, penalizing "disconnected" interfaces, as you won't see traffic on them if they're not wireless and you'd have to be in some form of "monitor mode" to see traffic on them if they're wireless. This should address GitHub issue #700.
* Add a new API to handle some non-select()able devices.Guy Harris2018-01-191-0/+1
| | | | | | | | | | | DAG adapters don't support blocking until packets arrive; a program using select()/poll()/epoll()/kqueue-based event loop must periodically poll DAG pcap_t's to see if they have packets available. Add pcap_get_required_select_timeout(), which returns a pointer to a struct timeval containing the appropriate timeout interval if polling is required and NULL if polling isn't required or isn't supported. Clean up the pcap_get_selectable_fd() documentation while we're at it.
* Use BUILDING_PCAP to mean "we're building libpcap".Guy Harris2017-11-271-1/+1
| | | | | | "We're building libpcap" and "we're building a libpcap shared library" are different; the former is true even when building a static libpcap. Use BUILDING_PCAP for the former and pcap_EXPORTS for the latter.
* Use pcap_EXPORTS rather than BUILDING_PCAP to control export/import in headers.Guy Harris2017-11-271-1/+1
| | | | | CMake automatically defines pcap_EXPORTS, so we don't have to define anything ourselves. Define it with autotools as well.
* We need pcap-inttypes.h for int64_t.Guy Harris2017-09-291-0/+2
|
generated by cgit v1.2.3 (git 2.39.1) at 2025-05-12 17:54:45 +0000