nexmon – Blame information for rev 1

Subversion Repositories:
Rev:
Rev Author Line No. Line
1 office 1 /*
2 * Copyright (c) 1993, 1994, 1995, 1996, 1998
3 * The Regents of the University of California. All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
16 * written permission.
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
20 */
21  
22 #ifdef HAVE_CONFIG_H
23 #include "config.h"
24 #endif
25  
26 #include <sys/param.h> /* optionally get BSD define */
27 #ifdef HAVE_ZEROCOPY_BPF
28 #include <sys/mman.h>
29 #endif
30 #include <sys/socket.h>
31 #include <time.h>
32 /*
33 * <net/bpf.h> defines ioctls, but doesn't include <sys/ioccom.h>.
34 *
35 * We include <sys/ioctl.h> as it might be necessary to declare ioctl();
36 * at least on *BSD and Mac OS X, it also defines various SIOC ioctls -
37 * we could include <sys/sockio.h>, but if we're already including
38 * <sys/ioctl.h>, which includes <sys/sockio.h> on those platforms,
39 * there's not much point in doing so.
40 *
41 * If we have <sys/ioccom.h>, we include it as well, to handle systems
42 * such as Solaris which don't arrange to include <sys/ioccom.h> if you
43 * include <sys/ioctl.h>
44 */
45 #include <sys/ioctl.h>
46 #ifdef HAVE_SYS_IOCCOM_H
47 #include <sys/ioccom.h>
48 #endif
49 #include <sys/utsname.h>
50  
51 #ifdef HAVE_ZEROCOPY_BPF
52 #include <machine/atomic.h>
53 #endif
54  
55 #include <net/if.h>
56  
57 #ifdef _AIX
58  
59 /*
60 * Make "pcap.h" not include "pcap/bpf.h"; we are going to include the
61 * native OS version, as we need "struct bpf_config" from it.
62 */
63 #define PCAP_DONT_INCLUDE_PCAP_BPF_H
64  
65 #include <sys/types.h>
66  
67 /*
68 * Prevent bpf.h from redefining the DLT_ values to their
69 * IFT_ values, as we're going to return the standard libpcap
70 * values, not IBM's non-standard IFT_ values.
71 */
72 #undef _AIX
73 #include <net/bpf.h>
74 #define _AIX
75  
76 #include <net/if_types.h> /* for IFT_ values */
77 #include <sys/sysconfig.h>
78 #include <sys/device.h>
79 #include <sys/cfgodm.h>
80 #include <cf.h>
81  
82 #ifdef __64BIT__
83 #define domakedev makedev64
84 #define getmajor major64
85 #define bpf_hdr bpf_hdr32
86 #else /* __64BIT__ */
87 #define domakedev makedev
88 #define getmajor major
89 #endif /* __64BIT__ */
90  
91 #define BPF_NAME "bpf"
92 #define BPF_MINORS 4
93 #define DRIVER_PATH "/usr/lib/drivers"
94 #define BPF_NODE "/dev/bpf"
95 static int bpfloadedflag = 0;
96 static int odmlockid = 0;
97  
98 static int bpf_load(char *errbuf);
99  
100 #else /* _AIX */
101  
102 #include <net/bpf.h>
103  
104 #endif /* _AIX */
105  
106 #include <ctype.h>
107 #include <fcntl.h>
108 #include <errno.h>
109 #include <netdb.h>
110 #include <stdio.h>
111 #include <stdlib.h>
112 #include <string.h>
113 #include <unistd.h>
114  
115 #ifdef HAVE_NET_IF_MEDIA_H
116 # include <net/if_media.h>
117 #endif
118  
119 #include "pcap-int.h"
120  
121 #ifdef HAVE_OS_PROTO_H
122 #include "os-proto.h"
123 #endif
124  
125 /*
126 * Later versions of NetBSD stick padding in front of FDDI frames
127 * to align the IP header on a 4-byte boundary.
128 */
129 #if defined(__NetBSD__) && __NetBSD_Version__ > 106000000
130 #define PCAP_FDDIPAD 3
131 #endif
132  
133 /*
134 * Private data for capturing on BPF devices.
135 */
136 struct pcap_bpf {
137 #ifdef PCAP_FDDIPAD
138 int fddipad;
139 #endif
140  
141 #ifdef HAVE_ZEROCOPY_BPF
142 /*
143 * Zero-copy read buffer -- for zero-copy BPF. 'buffer' above will
144 * alternative between these two actual mmap'd buffers as required.
145 * As there is a header on the front size of the mmap'd buffer, only
146 * some of the buffer is exposed to libpcap as a whole via bufsize;
147 * zbufsize is the true size. zbuffer tracks the current zbuf
148 * assocated with buffer so that it can be used to decide which the
149 * next buffer to read will be.
150 */
151 u_char *zbuf1, *zbuf2, *zbuffer;
152 u_int zbufsize;
153 u_int zerocopy;
154 u_int interrupted;
155 struct timespec firstsel;
156 /*
157 * If there's currently a buffer being actively processed, then it is
158 * referenced here; 'buffer' is also pointed at it, but offset by the
159 * size of the header.
160 */
161 struct bpf_zbuf_header *bzh;
162 int nonblock; /* true if in nonblocking mode */
163 #endif /* HAVE_ZEROCOPY_BPF */
164  
165 char *device; /* device name */
166 int filtering_in_kernel; /* using kernel filter */
167 int must_do_on_close; /* stuff we must do when we close */
168 };
169  
170 /*
171 * Stuff to do when we close.
172 */
173 #define MUST_CLEAR_RFMON 0x00000001 /* clear rfmon (monitor) mode */
174  
175 #ifdef BIOCGDLTLIST
176 # if (defined(HAVE_NET_IF_MEDIA_H) && defined(IFM_IEEE80211)) && !defined(__APPLE__)
177 #define HAVE_BSD_IEEE80211
178 # endif
179  
180 # if defined(__APPLE__) || defined(HAVE_BSD_IEEE80211)
181 static int find_802_11(struct bpf_dltlist *);
182  
183 # ifdef HAVE_BSD_IEEE80211
184 static int monitor_mode(pcap_t *, int);
185 # endif
186  
187 # if defined(__APPLE__)
188 static void remove_en(pcap_t *);
189 static void remove_802_11(pcap_t *);
190 # endif
191  
192 # endif /* defined(__APPLE__) || defined(HAVE_BSD_IEEE80211) */
193  
194 #endif /* BIOCGDLTLIST */
195  
196 #if defined(sun) && defined(LIFNAMSIZ) && defined(lifr_zoneid)
197 #include <zone.h>
198 #endif
199  
200 /*
201 * We include the OS's <net/bpf.h>, not our "pcap/bpf.h", so we probably
202 * don't get DLT_DOCSIS defined.
203 */
204 #ifndef DLT_DOCSIS
205 #define DLT_DOCSIS 143
206 #endif
207  
208 /*
209 * On OS X, we don't even get any of the 802.11-plus-radio-header DLT_'s
210 * defined, even though some of them are used by various Airport drivers.
211 */
212 #ifndef DLT_PRISM_HEADER
213 #define DLT_PRISM_HEADER 119
214 #endif
215 #ifndef DLT_AIRONET_HEADER
216 #define DLT_AIRONET_HEADER 120
217 #endif
218 #ifndef DLT_IEEE802_11_RADIO
219 #define DLT_IEEE802_11_RADIO 127
220 #endif
221 #ifndef DLT_IEEE802_11_RADIO_AVS
222 #define DLT_IEEE802_11_RADIO_AVS 163
223 #endif
224  
225 static int pcap_can_set_rfmon_bpf(pcap_t *p);
226 static int pcap_activate_bpf(pcap_t *p);
227 static int pcap_setfilter_bpf(pcap_t *p, struct bpf_program *fp);
228 static int pcap_setdirection_bpf(pcap_t *, pcap_direction_t);
229 static int pcap_set_datalink_bpf(pcap_t *p, int dlt);
230  
231 /*
232 * For zerocopy bpf, the setnonblock/getnonblock routines need to modify
233 * pb->nonblock so we don't call select(2) if the pcap handle is in non-
234 * blocking mode.
235 */
236 static int
237 pcap_getnonblock_bpf(pcap_t *p, char *errbuf)
238 {
239 #ifdef HAVE_ZEROCOPY_BPF
240 struct pcap_bpf *pb = p->priv;
241  
242 if (pb->zerocopy)
243 return (pb->nonblock);
244 #endif
245 return (pcap_getnonblock_fd(p, errbuf));
246 }
247  
248 static int
249 pcap_setnonblock_bpf(pcap_t *p, int nonblock, char *errbuf)
250 {
251 #ifdef HAVE_ZEROCOPY_BPF
252 struct pcap_bpf *pb = p->priv;
253  
254 if (pb->zerocopy) {
255 pb->nonblock = nonblock;
256 return (0);
257 }
258 #endif
259 return (pcap_setnonblock_fd(p, nonblock, errbuf));
260 }
261  
262 #ifdef HAVE_ZEROCOPY_BPF
263 /*
264 * Zero-copy BPF buffer routines to check for and acknowledge BPF data in
265 * shared memory buffers.
266 *
267 * pcap_next_zbuf_shm(): Check for a newly available shared memory buffer,
268 * and set up p->buffer and cc to reflect one if available. Notice that if
269 * there was no prior buffer, we select zbuf1 as this will be the first
270 * buffer filled for a fresh BPF session.
271 */
272 static int
273 pcap_next_zbuf_shm(pcap_t *p, int *cc)
274 {
275 struct pcap_bpf *pb = p->priv;
276 struct bpf_zbuf_header *bzh;
277  
278 if (pb->zbuffer == pb->zbuf2 || pb->zbuffer == NULL) {
279 bzh = (struct bpf_zbuf_header *)pb->zbuf1;
280 if (bzh->bzh_user_gen !=
281 atomic_load_acq_int(&bzh->bzh_kernel_gen)) {
282 pb->bzh = bzh;
283 pb->zbuffer = (u_char *)pb->zbuf1;
284 p->buffer = pb->zbuffer + sizeof(*bzh);
285 *cc = bzh->bzh_kernel_len;
286 return (1);
287 }
288 } else if (pb->zbuffer == pb->zbuf1) {
289 bzh = (struct bpf_zbuf_header *)pb->zbuf2;
290 if (bzh->bzh_user_gen !=
291 atomic_load_acq_int(&bzh->bzh_kernel_gen)) {
292 pb->bzh = bzh;
293 pb->zbuffer = (u_char *)pb->zbuf2;
294 p->buffer = pb->zbuffer + sizeof(*bzh);
295 *cc = bzh->bzh_kernel_len;
296 return (1);
297 }
298 }
299 *cc = 0;
300 return (0);
301 }
302  
303 /*
304 * pcap_next_zbuf() -- Similar to pcap_next_zbuf_shm(), except wait using
305 * select() for data or a timeout, and possibly force rotation of the buffer
306 * in the event we time out or are in immediate mode. Invoke the shared
307 * memory check before doing system calls in order to avoid doing avoidable
308 * work.
309 */
310 static int
311 pcap_next_zbuf(pcap_t *p, int *cc)
312 {
313 struct pcap_bpf *pb = p->priv;
314 struct bpf_zbuf bz;
315 struct timeval tv;
316 struct timespec cur;
317 fd_set r_set;
318 int data, r;
319 int expire, tmout;
320  
321 #define TSTOMILLI(ts) (((ts)->tv_sec * 1000) + ((ts)->tv_nsec / 1000000))
322 /*
323 * Start out by seeing whether anything is waiting by checking the
324 * next shared memory buffer for data.
325 */
326 data = pcap_next_zbuf_shm(p, cc);
327 if (data)
328 return (data);
329 /*
330 * If a previous sleep was interrupted due to signal delivery, make
331 * sure that the timeout gets adjusted accordingly. This requires
332 * that we analyze when the timeout should be been expired, and
333 * subtract the current time from that. If after this operation,
334 * our timeout is less then or equal to zero, handle it like a
335 * regular timeout.
336 */
337 tmout = p->opt.timeout;
338 if (tmout)
339 (void) clock_gettime(CLOCK_MONOTONIC, &cur);
340 if (pb->interrupted && p->opt.timeout) {
341 expire = TSTOMILLI(&pb->firstsel) + p->opt.timeout;
342 tmout = expire - TSTOMILLI(&cur);
343 #undef TSTOMILLI
344 if (tmout <= 0) {
345 pb->interrupted = 0;
346 data = pcap_next_zbuf_shm(p, cc);
347 if (data)
348 return (data);
349 if (ioctl(p->fd, BIOCROTZBUF, &bz) < 0) {
350 (void) snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
351 "BIOCROTZBUF: %s", strerror(errno));
352 return (PCAP_ERROR);
353 }
354 return (pcap_next_zbuf_shm(p, cc));
355 }
356 }
357 /*
358 * No data in the buffer, so must use select() to wait for data or
359 * the next timeout. Note that we only call select if the handle
360 * is in blocking mode.
361 */
362 if (!pb->nonblock) {
363 FD_ZERO(&r_set);
364 FD_SET(p->fd, &r_set);
365 if (tmout != 0) {
366 tv.tv_sec = tmout / 1000;
367 tv.tv_usec = (tmout * 1000) % 1000000;
368 }
369 r = select(p->fd + 1, &r_set, NULL, NULL,
370 p->opt.timeout != 0 ? &tv : NULL);
371 if (r < 0 && errno == EINTR) {
372 if (!pb->interrupted && p->opt.timeout) {
373 pb->interrupted = 1;
374 pb->firstsel = cur;
375 }
376 return (0);
377 } else if (r < 0) {
378 (void) snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
379 "select: %s", strerror(errno));
380 return (PCAP_ERROR);
381 }
382 }
383 pb->interrupted = 0;
384 /*
385 * Check again for data, which may exist now that we've either been
386 * woken up as a result of data or timed out. Try the "there's data"
387 * case first since it doesn't require a system call.
388 */
389 data = pcap_next_zbuf_shm(p, cc);
390 if (data)
391 return (data);
392 /*
393 * Try forcing a buffer rotation to dislodge timed out or immediate
394 * data.
395 */
396 if (ioctl(p->fd, BIOCROTZBUF, &bz) < 0) {
397 (void) snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
398 "BIOCROTZBUF: %s", strerror(errno));
399 return (PCAP_ERROR);
400 }
401 return (pcap_next_zbuf_shm(p, cc));
402 }
403  
404 /*
405 * Notify kernel that we are done with the buffer. We don't reset zbuffer so
406 * that we know which buffer to use next time around.
407 */
408 static int
409 pcap_ack_zbuf(pcap_t *p)
410 {
411 struct pcap_bpf *pb = p->priv;
412  
413 atomic_store_rel_int(&pb->bzh->bzh_user_gen,
414 pb->bzh->bzh_kernel_gen);
415 pb->bzh = NULL;
416 p->buffer = NULL;
417 return (0);
418 }
419 #endif /* HAVE_ZEROCOPY_BPF */
420  
421 pcap_t *
422 pcap_create_interface(const char *device, char *ebuf)
423 {
424 pcap_t *p;
425  
426 p = pcap_create_common(device, ebuf, sizeof (struct pcap_bpf));
427 if (p == NULL)
428 return (NULL);
429  
430 p->activate_op = pcap_activate_bpf;
431 p->can_set_rfmon_op = pcap_can_set_rfmon_bpf;
432 return (p);
433 }
434  
435 /*
436 * On success, returns a file descriptor for a BPF device.
437 * On failure, returns a PCAP_ERROR_ value, and sets p->errbuf.
438 */
439 static int
440 bpf_open(pcap_t *p)
441 {
442 int fd;
443 #ifdef HAVE_CLONING_BPF
444 static const char device[] = "/dev/bpf";
445 #else
446 int n = 0;
447 char device[sizeof "/dev/bpf0000000000"];
448 #endif
449  
450 #ifdef _AIX
451 /*
452 * Load the bpf driver, if it isn't already loaded,
453 * and create the BPF device entries, if they don't
454 * already exist.
455 */
456 if (bpf_load(p->errbuf) == PCAP_ERROR)
457 return (PCAP_ERROR);
458 #endif
459  
460 #ifdef HAVE_CLONING_BPF
461 if ((fd = open(device, O_RDWR)) == -1 &&
462 (errno != EACCES || (fd = open(device, O_RDONLY)) == -1)) {
463 if (errno == EACCES)
464 fd = PCAP_ERROR_PERM_DENIED;
465 else
466 fd = PCAP_ERROR;
467 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
468 "(cannot open device) %s: %s", device, pcap_strerror(errno));
469 }
470 #else
471 /*
472 * Go through all the minors and find one that isn't in use.
473 */
474 do {
475 (void)snprintf(device, sizeof(device), "/dev/bpf%d", n++);
476 /*
477 * Initially try a read/write open (to allow the inject
478 * method to work). If that fails due to permission
479 * issues, fall back to read-only. This allows a
480 * non-root user to be granted specific access to pcap
481 * capabilities via file permissions.
482 *
483 * XXX - we should have an API that has a flag that
484 * controls whether to open read-only or read-write,
485 * so that denial of permission to send (or inability
486 * to send, if sending packets isn't supported on
487 * the device in question) can be indicated at open
488 * time.
489 */
490 fd = open(device, O_RDWR);
491 if (fd == -1 && errno == EACCES)
492 fd = open(device, O_RDONLY);
493 } while (fd < 0 && errno == EBUSY);
494  
495 /*
496 * XXX better message for all minors used
497 */
498 if (fd < 0) {
499 switch (errno) {
500  
501 case ENOENT:
502 fd = PCAP_ERROR;
503 if (n == 1) {
504 /*
505 * /dev/bpf0 doesn't exist, which
506 * means we probably have no BPF
507 * devices.
508 */
509 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
510 "(there are no BPF devices)");
511 } else {
512 /*
513 * We got EBUSY on at least one
514 * BPF device, so we have BPF
515 * devices, but all the ones
516 * that exist are busy.
517 */
518 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
519 "(all BPF devices are busy)");
520 }
521 break;
522  
523 case EACCES:
524 /*
525 * Got EACCES on the last device we tried,
526 * and EBUSY on all devices before that,
527 * if any.
528 */
529 fd = PCAP_ERROR_PERM_DENIED;
530 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
531 "(cannot open BPF device) %s: %s", device,
532 pcap_strerror(errno));
533 break;
534  
535 default:
536 /*
537 * Some other problem.
538 */
539 fd = PCAP_ERROR;
540 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
541 "(cannot open BPF device) %s: %s", device,
542 pcap_strerror(errno));
543 break;
544 }
545 }
546 #endif
547  
548 return (fd);
549 }
550  
551 #ifdef BIOCGDLTLIST
552 static int
553 get_dlt_list(int fd, int v, struct bpf_dltlist *bdlp, char *ebuf)
554 {
555 memset(bdlp, 0, sizeof(*bdlp));
556 if (ioctl(fd, BIOCGDLTLIST, (caddr_t)bdlp) == 0) {
557 u_int i;
558 int is_ethernet;
559  
560 bdlp->bfl_list = (u_int *) malloc(sizeof(u_int) * (bdlp->bfl_len + 1));
561 if (bdlp->bfl_list == NULL) {
562 (void)snprintf(ebuf, PCAP_ERRBUF_SIZE, "malloc: %s",
563 pcap_strerror(errno));
564 return (PCAP_ERROR);
565 }
566  
567 if (ioctl(fd, BIOCGDLTLIST, (caddr_t)bdlp) < 0) {
568 (void)snprintf(ebuf, PCAP_ERRBUF_SIZE,
569 "BIOCGDLTLIST: %s", pcap_strerror(errno));
570 free(bdlp->bfl_list);
571 return (PCAP_ERROR);
572 }
573  
574 /*
575 * OK, for real Ethernet devices, add DLT_DOCSIS to the
576 * list, so that an application can let you choose it,
577 * in case you're capturing DOCSIS traffic that a Cisco
578 * Cable Modem Termination System is putting out onto
579 * an Ethernet (it doesn't put an Ethernet header onto
580 * the wire, it puts raw DOCSIS frames out on the wire
581 * inside the low-level Ethernet framing).
582 *
583 * A "real Ethernet device" is defined here as a device
584 * that has a link-layer type of DLT_EN10MB and that has
585 * no alternate link-layer types; that's done to exclude
586 * 802.11 interfaces (which might or might not be the
587 * right thing to do, but I suspect it is - Ethernet <->
588 * 802.11 bridges would probably badly mishandle frames
589 * that don't have Ethernet headers).
590 *
591 * On Solaris with BPF, Ethernet devices also offer
592 * DLT_IPNET, so we, if DLT_IPNET is defined, we don't
593 * treat it as an indication that the device isn't an
594 * Ethernet.
595 */
596 if (v == DLT_EN10MB) {
597 is_ethernet = 1;
598 for (i = 0; i < bdlp->bfl_len; i++) {
599 if (bdlp->bfl_list[i] != DLT_EN10MB
600 #ifdef DLT_IPNET
601 && bdlp->bfl_list[i] != DLT_IPNET
602 #endif
603 ) {
604 is_ethernet = 0;
605 break;
606 }
607 }
608 if (is_ethernet) {
609 /*
610 * We reserved one more slot at the end of
611 * the list.
612 */
613 bdlp->bfl_list[bdlp->bfl_len] = DLT_DOCSIS;
614 bdlp->bfl_len++;
615 }
616 }
617 } else {
618 /*
619 * EINVAL just means "we don't support this ioctl on
620 * this device"; don't treat it as an error.
621 */
622 if (errno != EINVAL) {
623 (void)snprintf(ebuf, PCAP_ERRBUF_SIZE,
624 "BIOCGDLTLIST: %s", pcap_strerror(errno));
625 return (PCAP_ERROR);
626 }
627 }
628 return (0);
629 }
630 #endif
631  
632 static int
633 pcap_can_set_rfmon_bpf(pcap_t *p)
634 {
635 #if defined(__APPLE__)
636 struct utsname osinfo;
637 struct ifreq ifr;
638 int fd;
639 #ifdef BIOCGDLTLIST
640 struct bpf_dltlist bdl;
641 #endif
642  
643 /*
644 * The joys of monitor mode on OS X.
645 *
646 * Prior to 10.4, it's not supported at all.
647 *
648 * In 10.4, if adapter enN supports monitor mode, there's a
649 * wltN adapter corresponding to it; you open it, instead of
650 * enN, to get monitor mode. You get whatever link-layer
651 * headers it supplies.
652 *
653 * In 10.5, and, we assume, later releases, if adapter enN
654 * supports monitor mode, it offers, among its selectable
655 * DLT_ values, values that let you get the 802.11 header;
656 * selecting one of those values puts the adapter into monitor
657 * mode (i.e., you can't get 802.11 headers except in monitor
658 * mode, and you can't get Ethernet headers in monitor mode).
659 */
660 if (uname(&osinfo) == -1) {
661 /*
662 * Can't get the OS version; just say "no".
663 */
664 return (0);
665 }
666 /*
667 * We assume osinfo.sysname is "Darwin", because
668 * __APPLE__ is defined. We just check the version.
669 */
670 if (osinfo.release[0] < '8' && osinfo.release[1] == '.') {
671 /*
672 * 10.3 (Darwin 7.x) or earlier.
673 * Monitor mode not supported.
674 */
675 return (0);
676 }
677 if (osinfo.release[0] == '8' && osinfo.release[1] == '.') {
678 /*
679 * 10.4 (Darwin 8.x). s/en/wlt/, and check
680 * whether the device exists.
681 */
682 if (strncmp(p->opt.source, "en", 2) != 0) {
683 /*
684 * Not an enN device; no monitor mode.
685 */
686 return (0);
687 }
688 fd = socket(AF_INET, SOCK_DGRAM, 0);
689 if (fd == -1) {
690 (void)snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
691 "socket: %s", pcap_strerror(errno));
692 return (PCAP_ERROR);
693 }
694 strlcpy(ifr.ifr_name, "wlt", sizeof(ifr.ifr_name));
695 strlcat(ifr.ifr_name, p->opt.source + 2, sizeof(ifr.ifr_name));
696 if (ioctl(fd, SIOCGIFFLAGS, (char *)&ifr) < 0) {
697 /*
698 * No such device?
699 */
700 close(fd);
701 return (0);
702 }
703 close(fd);
704 return (1);
705 }
706  
707 #ifdef BIOCGDLTLIST
708 /*
709 * Everything else is 10.5 or later; for those,
710 * we just open the enN device, and check whether
711 * we have any 802.11 devices.
712 *
713 * First, open a BPF device.
714 */
715 fd = bpf_open(p);
716 if (fd < 0)
717 return (fd); /* fd is the appropriate error code */
718  
719 /*
720 * Now bind to the device.
721 */
722 (void)strncpy(ifr.ifr_name, p->opt.source, sizeof(ifr.ifr_name));
723 if (ioctl(fd, BIOCSETIF, (caddr_t)&ifr) < 0) {
724 switch (errno) {
725  
726 case ENXIO:
727 /*
728 * There's no such device.
729 */
730 close(fd);
731 return (PCAP_ERROR_NO_SUCH_DEVICE);
732  
733 case ENETDOWN:
734 /*
735 * Return a "network down" indication, so that
736 * the application can report that rather than
737 * saying we had a mysterious failure and
738 * suggest that they report a problem to the
739 * libpcap developers.
740 */
741 close(fd);
742 return (PCAP_ERROR_IFACE_NOT_UP);
743  
744 default:
745 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
746 "BIOCSETIF: %s: %s",
747 p->opt.source, pcap_strerror(errno));
748 close(fd);
749 return (PCAP_ERROR);
750 }
751 }
752  
753 /*
754 * We know the default link type -- now determine all the DLTs
755 * this interface supports. If this fails with EINVAL, it's
756 * not fatal; we just don't get to use the feature later.
757 * (We don't care about DLT_DOCSIS, so we pass DLT_NULL
758 * as the default DLT for this adapter.)
759 */
760 if (get_dlt_list(fd, DLT_NULL, &bdl, p->errbuf) == PCAP_ERROR) {
761 close(fd);
762 return (PCAP_ERROR);
763 }
764 if (find_802_11(&bdl) != -1) {
765 /*
766 * We have an 802.11 DLT, so we can set monitor mode.
767 */
768 free(bdl.bfl_list);
769 close(fd);
770 return (1);
771 }
772 free(bdl.bfl_list);
773 #endif /* BIOCGDLTLIST */
774 return (0);
775 #elif defined(HAVE_BSD_IEEE80211)
776 int ret;
777  
778 ret = monitor_mode(p, 0);
779 if (ret == PCAP_ERROR_RFMON_NOTSUP)
780 return (0); /* not an error, just a "can't do" */
781 if (ret == 0)
782 return (1); /* success */
783 return (ret);
784 #else
785 return (0);
786 #endif
787 }
788  
789 static int
790 pcap_stats_bpf(pcap_t *p, struct pcap_stat *ps)
791 {
792 struct bpf_stat s;
793  
794 /*
795 * "ps_recv" counts packets handed to the filter, not packets
796 * that passed the filter. This includes packets later dropped
797 * because we ran out of buffer space.
798 *
799 * "ps_drop" counts packets dropped inside the BPF device
800 * because we ran out of buffer space. It doesn't count
801 * packets dropped by the interface driver. It counts
802 * only packets that passed the filter.
803 *
804 * Both statistics include packets not yet read from the kernel
805 * by libpcap, and thus not yet seen by the application.
806 */
807 if (ioctl(p->fd, BIOCGSTATS, (caddr_t)&s) < 0) {
808 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "BIOCGSTATS: %s",
809 pcap_strerror(errno));
810 return (PCAP_ERROR);
811 }
812  
813 ps->ps_recv = s.bs_recv;
814 ps->ps_drop = s.bs_drop;
815 ps->ps_ifdrop = 0;
816 return (0);
817 }
818  
819 static int
820 pcap_read_bpf(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
821 {
822 struct pcap_bpf *pb = p->priv;
823 int cc;
824 int n = 0;
825 register u_char *bp, *ep;
826 u_char *datap;
827 #ifdef PCAP_FDDIPAD
828 register int pad;
829 #endif
830 #ifdef HAVE_ZEROCOPY_BPF
831 int i;
832 #endif
833  
834 again:
835 /*
836 * Has "pcap_breakloop()" been called?
837 */
838 if (p->break_loop) {
839 /*
840 * Yes - clear the flag that indicates that it
841 * has, and return PCAP_ERROR_BREAK to indicate
842 * that we were told to break out of the loop.
843 */
844 p->break_loop = 0;
845 return (PCAP_ERROR_BREAK);
846 }
847 cc = p->cc;
848 if (p->cc == 0) {
849 /*
850 * When reading without zero-copy from a file descriptor, we
851 * use a single buffer and return a length of data in the
852 * buffer. With zero-copy, we update the p->buffer pointer
853 * to point at whatever underlying buffer contains the next
854 * data and update cc to reflect the data found in the
855 * buffer.
856 */
857 #ifdef HAVE_ZEROCOPY_BPF
858 if (pb->zerocopy) {
859 if (p->buffer != NULL)
860 pcap_ack_zbuf(p);
861 i = pcap_next_zbuf(p, &cc);
862 if (i == 0)
863 goto again;
864 if (i < 0)
865 return (PCAP_ERROR);
866 } else
867 #endif
868 {
869 cc = read(p->fd, (char *)p->buffer, p->bufsize);
870 }
871 if (cc < 0) {
872 /* Don't choke when we get ptraced */
873 switch (errno) {
874  
875 case EINTR:
876 goto again;
877  
878 #ifdef _AIX
879 case EFAULT:
880 /*
881 * Sigh. More AIX wonderfulness.
882 *
883 * For some unknown reason the uiomove()
884 * operation in the bpf kernel extension
885 * used to copy the buffer into user
886 * space sometimes returns EFAULT. I have
887 * no idea why this is the case given that
888 * a kernel debugger shows the user buffer
889 * is correct. This problem appears to
890 * be mostly mitigated by the memset of
891 * the buffer before it is first used.
892 * Very strange.... Shaun Clowes
893 *
894 * In any case this means that we shouldn't
895 * treat EFAULT as a fatal error; as we
896 * don't have an API for returning
897 * a "some packets were dropped since
898 * the last packet you saw" indication,
899 * we just ignore EFAULT and keep reading.
900 */
901 goto again;
902 #endif
903  
904 case EWOULDBLOCK:
905 return (0);
906  
907 case ENXIO:
908 /*
909 * The device on which we're capturing
910 * went away.
911 *
912 * XXX - we should really return
913 * PCAP_ERROR_IFACE_NOT_UP, but
914 * pcap_dispatch() etc. aren't
915 * defined to retur that.
916 */
917 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
918 "The interface went down");
919 return (PCAP_ERROR);
920  
921 #if defined(sun) && !defined(BSD) && !defined(__svr4__) && !defined(__SVR4)
922 /*
923 * Due to a SunOS bug, after 2^31 bytes, the kernel
924 * file offset overflows and read fails with EINVAL.
925 * The lseek() to 0 will fix things.
926 */
927 case EINVAL:
928 if (lseek(p->fd, 0L, SEEK_CUR) +
929 p->bufsize < 0) {
930 (void)lseek(p->fd, 0L, SEEK_SET);
931 goto again;
932 }
933 /* fall through */
934 #endif
935 }
936 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "read: %s",
937 pcap_strerror(errno));
938 return (PCAP_ERROR);
939 }
940 bp = p->buffer;
941 } else
942 bp = p->bp;
943  
944 /*
945 * Loop through each packet.
946 */
947 #define bhp ((struct bpf_hdr *)bp)
948 ep = bp + cc;
949 #ifdef PCAP_FDDIPAD
950 pad = p->fddipad;
951 #endif
952 while (bp < ep) {
953 register int caplen, hdrlen;
954  
955 /*
956 * Has "pcap_breakloop()" been called?
957 * If so, return immediately - if we haven't read any
958 * packets, clear the flag and return PCAP_ERROR_BREAK
959 * to indicate that we were told to break out of the loop,
960 * otherwise leave the flag set, so that the *next* call
961 * will break out of the loop without having read any
962 * packets, and return the number of packets we've
963 * processed so far.
964 */
965 if (p->break_loop) {
966 p->bp = bp;
967 p->cc = ep - bp;
968 /*
969 * ep is set based on the return value of read(),
970 * but read() from a BPF device doesn't necessarily
971 * return a value that's a multiple of the alignment
972 * value for BPF_WORDALIGN(). However, whenever we
973 * increment bp, we round up the increment value by
974 * a value rounded up by BPF_WORDALIGN(), so we
975 * could increment bp past ep after processing the
976 * last packet in the buffer.
977 *
978 * We treat ep < bp as an indication that this
979 * happened, and just set p->cc to 0.
980 */
981 if (p->cc < 0)
982 p->cc = 0;
983 if (n == 0) {
984 p->break_loop = 0;
985 return (PCAP_ERROR_BREAK);
986 } else
987 return (n);
988 }
989  
990 caplen = bhp->bh_caplen;
991 hdrlen = bhp->bh_hdrlen;
992 datap = bp + hdrlen;
993 /*
994 * Short-circuit evaluation: if using BPF filter
995 * in kernel, no need to do it now - we already know
996 * the packet passed the filter.
997 *
998 #ifdef PCAP_FDDIPAD
999 * Note: the filter code was generated assuming
1000 * that p->fddipad was the amount of padding
1001 * before the header, as that's what's required
1002 * in the kernel, so we run the filter before
1003 * skipping that padding.
1004 #endif
1005 */
1006 if (pb->filtering_in_kernel ||
1007 bpf_filter(p->fcode.bf_insns, datap, bhp->bh_datalen, caplen)) {
1008 struct pcap_pkthdr pkthdr;
1009  
1010 pkthdr.ts.tv_sec = bhp->bh_tstamp.tv_sec;
1011 #ifdef _AIX
1012 /*
1013 * AIX's BPF returns seconds/nanoseconds time
1014 * stamps, not seconds/microseconds time stamps.
1015 */
1016 pkthdr.ts.tv_usec = bhp->bh_tstamp.tv_usec/1000;
1017 #else
1018 pkthdr.ts.tv_usec = bhp->bh_tstamp.tv_usec;
1019 #endif
1020 #ifdef PCAP_FDDIPAD
1021 if (caplen > pad)
1022 pkthdr.caplen = caplen - pad;
1023 else
1024 pkthdr.caplen = 0;
1025 if (bhp->bh_datalen > pad)
1026 pkthdr.len = bhp->bh_datalen - pad;
1027 else
1028 pkthdr.len = 0;
1029 datap += pad;
1030 #else
1031 pkthdr.caplen = caplen;
1032 pkthdr.len = bhp->bh_datalen;
1033 #endif
1034 (*callback)(user, &pkthdr, datap);
1035 bp += BPF_WORDALIGN(caplen + hdrlen);
1036 if (++n >= cnt && !PACKET_COUNT_IS_UNLIMITED(cnt)) {
1037 p->bp = bp;
1038 p->cc = ep - bp;
1039 /*
1040 * See comment above about p->cc < 0.
1041 */
1042 if (p->cc < 0)
1043 p->cc = 0;
1044 return (n);
1045 }
1046 } else {
1047 /*
1048 * Skip this packet.
1049 */
1050 bp += BPF_WORDALIGN(caplen + hdrlen);
1051 }
1052 }
1053 #undef bhp
1054 p->cc = 0;
1055 return (n);
1056 }
1057  
1058 static int
1059 pcap_inject_bpf(pcap_t *p, const void *buf, size_t size)
1060 {
1061 int ret;
1062  
1063 ret = write(p->fd, buf, size);
1064 #ifdef __APPLE__
1065 if (ret == -1 && errno == EAFNOSUPPORT) {
1066 /*
1067 * In Mac OS X, there's a bug wherein setting the
1068 * BIOCSHDRCMPLT flag causes writes to fail; see,
1069 * for example:
1070 *
1071 * http://cerberus.sourcefire.com/~jeff/archives/patches/macosx/BIOCSHDRCMPLT-10.3.3.patch
1072 *
1073 * So, if, on OS X, we get EAFNOSUPPORT from the write, we
1074 * assume it's due to that bug, and turn off that flag
1075 * and try again. If we succeed, it either means that
1076 * somebody applied the fix from that URL, or other patches
1077 * for that bug from
1078 *
1079 * http://cerberus.sourcefire.com/~jeff/archives/patches/macosx/
1080 *
1081 * and are running a Darwin kernel with those fixes, or
1082 * that Apple fixed the problem in some OS X release.
1083 */
1084 u_int spoof_eth_src = 0;
1085  
1086 if (ioctl(p->fd, BIOCSHDRCMPLT, &spoof_eth_src) == -1) {
1087 (void)snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1088 "send: can't turn off BIOCSHDRCMPLT: %s",
1089 pcap_strerror(errno));
1090 return (PCAP_ERROR);
1091 }
1092  
1093 /*
1094 * Now try the write again.
1095 */
1096 ret = write(p->fd, buf, size);
1097 }
1098 #endif /* __APPLE__ */
1099 if (ret == -1) {
1100 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "send: %s",
1101 pcap_strerror(errno));
1102 return (PCAP_ERROR);
1103 }
1104 return (ret);
1105 }
1106  
1107 #ifdef _AIX
1108 static int
1109 bpf_odminit(char *errbuf)
1110 {
1111 char *errstr;
1112  
1113 if (odm_initialize() == -1) {
1114 if (odm_err_msg(odmerrno, &errstr) == -1)
1115 errstr = "Unknown error";
1116 snprintf(errbuf, PCAP_ERRBUF_SIZE,
1117 "bpf_load: odm_initialize failed: %s",
1118 errstr);
1119 return (PCAP_ERROR);
1120 }
1121  
1122 if ((odmlockid = odm_lock("/etc/objrepos/config_lock", ODM_WAIT)) == -1) {
1123 if (odm_err_msg(odmerrno, &errstr) == -1)
1124 errstr = "Unknown error";
1125 snprintf(errbuf, PCAP_ERRBUF_SIZE,
1126 "bpf_load: odm_lock of /etc/objrepos/config_lock failed: %s",
1127 errstr);
1128 (void)odm_terminate();
1129 return (PCAP_ERROR);
1130 }
1131  
1132 return (0);
1133 }
1134  
1135 static int
1136 bpf_odmcleanup(char *errbuf)
1137 {
1138 char *errstr;
1139  
1140 if (odm_unlock(odmlockid) == -1) {
1141 if (errbuf != NULL) {
1142 if (odm_err_msg(odmerrno, &errstr) == -1)
1143 errstr = "Unknown error";
1144 snprintf(errbuf, PCAP_ERRBUF_SIZE,
1145 "bpf_load: odm_unlock failed: %s",
1146 errstr);
1147 }
1148 return (PCAP_ERROR);
1149 }
1150  
1151 if (odm_terminate() == -1) {
1152 if (errbuf != NULL) {
1153 if (odm_err_msg(odmerrno, &errstr) == -1)
1154 errstr = "Unknown error";
1155 snprintf(errbuf, PCAP_ERRBUF_SIZE,
1156 "bpf_load: odm_terminate failed: %s",
1157 errstr);
1158 }
1159 return (PCAP_ERROR);
1160 }
1161  
1162 return (0);
1163 }
1164  
1165 static int
1166 bpf_load(char *errbuf)
1167 {
1168 long major;
1169 int *minors;
1170 int numminors, i, rc;
1171 char buf[1024];
1172 struct stat sbuf;
1173 struct bpf_config cfg_bpf;
1174 struct cfg_load cfg_ld;
1175 struct cfg_kmod cfg_km;
1176  
1177 /*
1178 * This is very very close to what happens in the real implementation
1179 * but I've fixed some (unlikely) bug situations.
1180 */
1181 if (bpfloadedflag)
1182 return (0);
1183  
1184 if (bpf_odminit(errbuf) == PCAP_ERROR)
1185 return (PCAP_ERROR);
1186  
1187 major = genmajor(BPF_NAME);
1188 if (major == -1) {
1189 snprintf(errbuf, PCAP_ERRBUF_SIZE,
1190 "bpf_load: genmajor failed: %s", pcap_strerror(errno));
1191 (void)bpf_odmcleanup(NULL);
1192 return (PCAP_ERROR);
1193 }
1194  
1195 minors = getminor(major, &numminors, BPF_NAME);
1196 if (!minors) {
1197 minors = genminor("bpf", major, 0, BPF_MINORS, 1, 1);
1198 if (!minors) {
1199 snprintf(errbuf, PCAP_ERRBUF_SIZE,
1200 "bpf_load: genminor failed: %s",
1201 pcap_strerror(errno));
1202 (void)bpf_odmcleanup(NULL);
1203 return (PCAP_ERROR);
1204 }
1205 }
1206  
1207 if (bpf_odmcleanup(errbuf) == PCAP_ERROR)
1208 return (PCAP_ERROR);
1209  
1210 rc = stat(BPF_NODE "0", &sbuf);
1211 if (rc == -1 && errno != ENOENT) {
1212 snprintf(errbuf, PCAP_ERRBUF_SIZE,
1213 "bpf_load: can't stat %s: %s",
1214 BPF_NODE "0", pcap_strerror(errno));
1215 return (PCAP_ERROR);
1216 }
1217  
1218 if (rc == -1 || getmajor(sbuf.st_rdev) != major) {
1219 for (i = 0; i < BPF_MINORS; i++) {
1220 sprintf(buf, "%s%d", BPF_NODE, i);
1221 unlink(buf);
1222 if (mknod(buf, S_IRUSR | S_IFCHR, domakedev(major, i)) == -1) {
1223 snprintf(errbuf, PCAP_ERRBUF_SIZE,
1224 "bpf_load: can't mknod %s: %s",
1225 buf, pcap_strerror(errno));
1226 return (PCAP_ERROR);
1227 }
1228 }
1229 }
1230  
1231 /* Check if the driver is loaded */
1232 memset(&cfg_ld, 0x0, sizeof(cfg_ld));
1233 cfg_ld.path = buf;
1234 sprintf(cfg_ld.path, "%s/%s", DRIVER_PATH, BPF_NAME);
1235 if ((sysconfig(SYS_QUERYLOAD, (void *)&cfg_ld, sizeof(cfg_ld)) == -1) ||
1236 (cfg_ld.kmid == 0)) {
1237 /* Driver isn't loaded, load it now */
1238 if (sysconfig(SYS_SINGLELOAD, (void *)&cfg_ld, sizeof(cfg_ld)) == -1) {
1239 snprintf(errbuf, PCAP_ERRBUF_SIZE,
1240 "bpf_load: could not load driver: %s",
1241 strerror(errno));
1242 return (PCAP_ERROR);
1243 }
1244 }
1245  
1246 /* Configure the driver */
1247 cfg_km.cmd = CFG_INIT;
1248 cfg_km.kmid = cfg_ld.kmid;
1249 cfg_km.mdilen = sizeof(cfg_bpf);
1250 cfg_km.mdiptr = (void *)&cfg_bpf;
1251 for (i = 0; i < BPF_MINORS; i++) {
1252 cfg_bpf.devno = domakedev(major, i);
1253 if (sysconfig(SYS_CFGKMOD, (void *)&cfg_km, sizeof(cfg_km)) == -1) {
1254 snprintf(errbuf, PCAP_ERRBUF_SIZE,
1255 "bpf_load: could not configure driver: %s",
1256 strerror(errno));
1257 return (PCAP_ERROR);
1258 }
1259 }
1260  
1261 bpfloadedflag = 1;
1262  
1263 return (0);
1264 }
1265 #endif
1266  
1267 /*
1268 * Turn off rfmon mode if necessary.
1269 */
1270 static void
1271 pcap_cleanup_bpf(pcap_t *p)
1272 {
1273 struct pcap_bpf *pb = p->priv;
1274 #ifdef HAVE_BSD_IEEE80211
1275 int sock;
1276 struct ifmediareq req;
1277 struct ifreq ifr;
1278 #endif
1279  
1280 if (pb->must_do_on_close != 0) {
1281 /*
1282 * There's something we have to do when closing this
1283 * pcap_t.
1284 */
1285 #ifdef HAVE_BSD_IEEE80211
1286 if (pb->must_do_on_close & MUST_CLEAR_RFMON) {
1287 /*
1288 * We put the interface into rfmon mode;
1289 * take it out of rfmon mode.
1290 *
1291 * XXX - if somebody else wants it in rfmon
1292 * mode, this code cannot know that, so it'll take
1293 * it out of rfmon mode.
1294 */
1295 sock = socket(AF_INET, SOCK_DGRAM, 0);
1296 if (sock == -1) {
1297 fprintf(stderr,
1298 "Can't restore interface flags (socket() failed: %s).\n"
1299 "Please adjust manually.\n",
1300 strerror(errno));
1301 } else {
1302 memset(&req, 0, sizeof(req));
1303 strncpy(req.ifm_name, pb->device,
1304 sizeof(req.ifm_name));
1305 if (ioctl(sock, SIOCGIFMEDIA, &req) < 0) {
1306 fprintf(stderr,
1307 "Can't restore interface flags (SIOCGIFMEDIA failed: %s).\n"
1308 "Please adjust manually.\n",
1309 strerror(errno));
1310 } else {
1311 if (req.ifm_current & IFM_IEEE80211_MONITOR) {
1312 /*
1313 * Rfmon mode is currently on;
1314 * turn it off.
1315 */
1316 memset(&ifr, 0, sizeof(ifr));
1317 (void)strncpy(ifr.ifr_name,
1318 pb->device,
1319 sizeof(ifr.ifr_name));
1320 ifr.ifr_media =
1321 req.ifm_current & ~IFM_IEEE80211_MONITOR;
1322 if (ioctl(sock, SIOCSIFMEDIA,
1323 &ifr) == -1) {
1324 fprintf(stderr,
1325 "Can't restore interface flags (SIOCSIFMEDIA failed: %s).\n"
1326 "Please adjust manually.\n",
1327 strerror(errno));
1328 }
1329 }
1330 }
1331 close(sock);
1332 }
1333 }
1334 #endif /* HAVE_BSD_IEEE80211 */
1335  
1336 /*
1337 * Take this pcap out of the list of pcaps for which we
1338 * have to take the interface out of some mode.
1339 */
1340 pcap_remove_from_pcaps_to_close(p);
1341 pb->must_do_on_close = 0;
1342 }
1343  
1344 #ifdef HAVE_ZEROCOPY_BPF
1345 if (pb->zerocopy) {
1346 /*
1347 * Delete the mappings. Note that p->buffer gets
1348 * initialized to one of the mmapped regions in
1349 * this case, so do not try and free it directly;
1350 * null it out so that pcap_cleanup_live_common()
1351 * doesn't try to free it.
1352 */
1353 if (pb->zbuf1 != MAP_FAILED && pb->zbuf1 != NULL)
1354 (void) munmap(pb->zbuf1, pb->zbufsize);
1355 if (pb->zbuf2 != MAP_FAILED && pb->zbuf2 != NULL)
1356 (void) munmap(pb->zbuf2, pb->zbufsize);
1357 p->buffer = NULL;
1358 }
1359 #endif
1360 if (pb->device != NULL) {
1361 free(pb->device);
1362 pb->device = NULL;
1363 }
1364 pcap_cleanup_live_common(p);
1365 }
1366  
1367 static int
1368 check_setif_failure(pcap_t *p, int error)
1369 {
1370 #ifdef __APPLE__
1371 int fd;
1372 struct ifreq ifr;
1373 int err;
1374 #endif
1375  
1376 if (error == ENXIO) {
1377 /*
1378 * No such device exists.
1379 */
1380 #ifdef __APPLE__
1381 if (p->opt.rfmon && strncmp(p->opt.source, "wlt", 3) == 0) {
1382 /*
1383 * Monitor mode was requested, and we're trying
1384 * to open a "wltN" device. Assume that this
1385 * is 10.4 and that we were asked to open an
1386 * "enN" device; if that device exists, return
1387 * "monitor mode not supported on the device".
1388 */
1389 fd = socket(AF_INET, SOCK_DGRAM, 0);
1390 if (fd != -1) {
1391 strlcpy(ifr.ifr_name, "en",
1392 sizeof(ifr.ifr_name));
1393 strlcat(ifr.ifr_name, p->opt.source + 3,
1394 sizeof(ifr.ifr_name));
1395 if (ioctl(fd, SIOCGIFFLAGS, (char *)&ifr) < 0) {
1396 /*
1397 * We assume this failed because
1398 * the underlying device doesn't
1399 * exist.
1400 */
1401 err = PCAP_ERROR_NO_SUCH_DEVICE;
1402 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1403 "SIOCGIFFLAGS on %s failed: %s",
1404 ifr.ifr_name, pcap_strerror(errno));
1405 } else {
1406 /*
1407 * The underlying "enN" device
1408 * exists, but there's no
1409 * corresponding "wltN" device;
1410 * that means that the "enN"
1411 * device doesn't support
1412 * monitor mode, probably because
1413 * it's an Ethernet device rather
1414 * than a wireless device.
1415 */
1416 err = PCAP_ERROR_RFMON_NOTSUP;
1417 }
1418 close(fd);
1419 } else {
1420 /*
1421 * We can't find out whether there's
1422 * an underlying "enN" device, so
1423 * just report "no such device".
1424 */
1425 err = PCAP_ERROR_NO_SUCH_DEVICE;
1426 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1427 "socket() failed: %s",
1428 pcap_strerror(errno));
1429 }
1430 return (err);
1431 }
1432 #endif
1433 /*
1434 * No such device.
1435 */
1436 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "BIOCSETIF failed: %s",
1437 pcap_strerror(errno));
1438 return (PCAP_ERROR_NO_SUCH_DEVICE);
1439 } else if (errno == ENETDOWN) {
1440 /*
1441 * Return a "network down" indication, so that
1442 * the application can report that rather than
1443 * saying we had a mysterious failure and
1444 * suggest that they report a problem to the
1445 * libpcap developers.
1446 */
1447 return (PCAP_ERROR_IFACE_NOT_UP);
1448 } else {
1449 /*
1450 * Some other error; fill in the error string, and
1451 * return PCAP_ERROR.
1452 */
1453 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "BIOCSETIF: %s: %s",
1454 p->opt.source, pcap_strerror(errno));
1455 return (PCAP_ERROR);
1456 }
1457 }
1458  
1459 /*
1460 * Default capture buffer size.
1461 * 32K isn't very much for modern machines with fast networks; we
1462 * pick .5M, as that's the maximum on at least some systems with BPF.
1463 *
1464 * However, on AIX 3.5, the larger buffer sized caused unrecoverable
1465 * read failures under stress, so we leave it as 32K; yet another
1466 * place where AIX's BPF is broken.
1467 */
1468 #ifdef _AIX
1469 #define DEFAULT_BUFSIZE 32768
1470 #else
1471 #define DEFAULT_BUFSIZE 524288
1472 #endif
1473  
1474 static int
1475 pcap_activate_bpf(pcap_t *p)
1476 {
1477 struct pcap_bpf *pb = p->priv;
1478 int status = 0;
1479 #ifdef HAVE_BSD_IEEE80211
1480 int retv;
1481 #endif
1482 int fd;
1483 #ifdef LIFNAMSIZ
1484 char *zonesep;
1485 struct lifreq ifr;
1486 char *ifrname = ifr.lifr_name;
1487 const size_t ifnamsiz = sizeof(ifr.lifr_name);
1488 #else
1489 struct ifreq ifr;
1490 char *ifrname = ifr.ifr_name;
1491 const size_t ifnamsiz = sizeof(ifr.ifr_name);
1492 #endif
1493 struct bpf_version bv;
1494 #ifdef __APPLE__
1495 int sockfd;
1496 char *wltdev = NULL;
1497 #endif
1498 #ifdef BIOCGDLTLIST
1499 struct bpf_dltlist bdl;
1500 #if defined(__APPLE__) || defined(HAVE_BSD_IEEE80211)
1501 int new_dlt;
1502 #endif
1503 #endif /* BIOCGDLTLIST */
1504 #if defined(BIOCGHDRCMPLT) && defined(BIOCSHDRCMPLT)
1505 u_int spoof_eth_src = 1;
1506 #endif
1507 u_int v;
1508 struct bpf_insn total_insn;
1509 struct bpf_program total_prog;
1510 struct utsname osinfo;
1511 int have_osinfo = 0;
1512 #ifdef HAVE_ZEROCOPY_BPF
1513 struct bpf_zbuf bz;
1514 u_int bufmode, zbufmax;
1515 #endif
1516  
1517 fd = bpf_open(p);
1518 if (fd < 0) {
1519 status = fd;
1520 goto bad;
1521 }
1522  
1523 p->fd = fd;
1524  
1525 if (ioctl(fd, BIOCVERSION, (caddr_t)&bv) < 0) {
1526 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "BIOCVERSION: %s",
1527 pcap_strerror(errno));
1528 status = PCAP_ERROR;
1529 goto bad;
1530 }
1531 if (bv.bv_major != BPF_MAJOR_VERSION ||
1532 bv.bv_minor < BPF_MINOR_VERSION) {
1533 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1534 "kernel bpf filter out of date");
1535 status = PCAP_ERROR;
1536 goto bad;
1537 }
1538  
1539 #if defined(LIFNAMSIZ) && defined(ZONENAME_MAX) && defined(lifr_zoneid)
1540 /*
1541 * Retrieve the zoneid of the zone we are currently executing in.
1542 */
1543 if ((ifr.lifr_zoneid = getzoneid()) == -1) {
1544 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "getzoneid(): %s",
1545 pcap_strerror(errno));
1546 status = PCAP_ERROR;
1547 goto bad;
1548 }
1549 /*
1550 * Check if the given source datalink name has a '/' separated
1551 * zonename prefix string. The zonename prefixed source datalink can
1552 * be used by pcap consumers in the Solaris global zone to capture
1553 * traffic on datalinks in non-global zones. Non-global zones
1554 * do not have access to datalinks outside of their own namespace.
1555 */
1556 if ((zonesep = strchr(p->opt.source, '/')) != NULL) {
1557 char path_zname[ZONENAME_MAX];
1558 int znamelen;
1559 char *lnamep;
1560  
1561 if (ifr.lifr_zoneid != GLOBAL_ZONEID) {
1562 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1563 "zonename/linkname only valid in global zone.");
1564 status = PCAP_ERROR;
1565 goto bad;
1566 }
1567 znamelen = zonesep - p->opt.source;
1568 (void) strlcpy(path_zname, p->opt.source, znamelen + 1);
1569 ifr.lifr_zoneid = getzoneidbyname(path_zname);
1570 if (ifr.lifr_zoneid == -1) {
1571 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1572 "getzoneidbyname(%s): %s", path_zname,
1573 pcap_strerror(errno));
1574 status = PCAP_ERROR;
1575 goto bad;
1576 }
1577 lnamep = strdup(zonesep + 1);
1578 free(p->opt.source);
1579 p->opt.source = lnamep;
1580 }
1581 #endif
1582  
1583 pb->device = strdup(p->opt.source);
1584 if (pb->device == NULL) {
1585 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "strdup: %s",
1586 pcap_strerror(errno));
1587 status = PCAP_ERROR;
1588 goto bad;
1589 }
1590  
1591 /*
1592 * Attempt to find out the version of the OS on which we're running.
1593 */
1594 if (uname(&osinfo) == 0)
1595 have_osinfo = 1;
1596  
1597 #ifdef __APPLE__
1598 /*
1599 * See comment in pcap_can_set_rfmon_bpf() for an explanation
1600 * of why we check the version number.
1601 */
1602 if (p->opt.rfmon) {
1603 if (have_osinfo) {
1604 /*
1605 * We assume osinfo.sysname is "Darwin", because
1606 * __APPLE__ is defined. We just check the version.
1607 */
1608 if (osinfo.release[0] < '8' &&
1609 osinfo.release[1] == '.') {
1610 /*
1611 * 10.3 (Darwin 7.x) or earlier.
1612 */
1613 status = PCAP_ERROR_RFMON_NOTSUP;
1614 goto bad;
1615 }
1616 if (osinfo.release[0] == '8' &&
1617 osinfo.release[1] == '.') {
1618 /*
1619 * 10.4 (Darwin 8.x). s/en/wlt/
1620 */
1621 if (strncmp(p->opt.source, "en", 2) != 0) {
1622 /*
1623 * Not an enN device; check
1624 * whether the device even exists.
1625 */
1626 sockfd = socket(AF_INET, SOCK_DGRAM, 0);
1627 if (sockfd != -1) {
1628 strlcpy(ifrname,
1629 p->opt.source, ifnamsiz);
1630 if (ioctl(sockfd, SIOCGIFFLAGS,
1631 (char *)&ifr) < 0) {
1632 /*
1633 * We assume this
1634 * failed because
1635 * the underlying
1636 * device doesn't
1637 * exist.
1638 */
1639 status = PCAP_ERROR_NO_SUCH_DEVICE;
1640 snprintf(p->errbuf,
1641 PCAP_ERRBUF_SIZE,
1642 "SIOCGIFFLAGS failed: %s",
1643 pcap_strerror(errno));
1644 } else
1645 status = PCAP_ERROR_RFMON_NOTSUP;
1646 close(sockfd);
1647 } else {
1648 /*
1649 * We can't find out whether
1650 * the device exists, so just
1651 * report "no such device".
1652 */
1653 status = PCAP_ERROR_NO_SUCH_DEVICE;
1654 snprintf(p->errbuf,
1655 PCAP_ERRBUF_SIZE,
1656 "socket() failed: %s",
1657 pcap_strerror(errno));
1658 }
1659 goto bad;
1660 }
1661 wltdev = malloc(strlen(p->opt.source) + 2);
1662 if (wltdev == NULL) {
1663 (void)snprintf(p->errbuf,
1664 PCAP_ERRBUF_SIZE, "malloc: %s",
1665 pcap_strerror(errno));
1666 status = PCAP_ERROR;
1667 goto bad;
1668 }
1669 strcpy(wltdev, "wlt");
1670 strcat(wltdev, p->opt.source + 2);
1671 free(p->opt.source);
1672 p->opt.source = wltdev;
1673 }
1674 /*
1675 * Everything else is 10.5 or later; for those,
1676 * we just open the enN device, and set the DLT.
1677 */
1678 }
1679 }
1680 #endif /* __APPLE__ */
1681 #ifdef HAVE_ZEROCOPY_BPF
1682 /*
1683 * If the BPF extension to set buffer mode is present, try setting
1684 * the mode to zero-copy. If that fails, use regular buffering. If
1685 * it succeeds but other setup fails, return an error to the user.
1686 */
1687 bufmode = BPF_BUFMODE_ZBUF;
1688 if (ioctl(fd, BIOCSETBUFMODE, (caddr_t)&bufmode) == 0) {
1689 /*
1690 * We have zerocopy BPF; use it.
1691 */
1692 pb->zerocopy = 1;
1693  
1694 /*
1695 * How to pick a buffer size: first, query the maximum buffer
1696 * size supported by zero-copy. This also lets us quickly
1697 * determine whether the kernel generally supports zero-copy.
1698 * Then, if a buffer size was specified, use that, otherwise
1699 * query the default buffer size, which reflects kernel
1700 * policy for a desired default. Round to the nearest page
1701 * size.
1702 */
1703 if (ioctl(fd, BIOCGETZMAX, (caddr_t)&zbufmax) < 0) {
1704 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "BIOCGETZMAX: %s",
1705 pcap_strerror(errno));
1706 status = PCAP_ERROR;
1707 goto bad;
1708 }
1709  
1710 if (p->opt.buffer_size != 0) {
1711 /*
1712 * A buffer size was explicitly specified; use it.
1713 */
1714 v = p->opt.buffer_size;
1715 } else {
1716 if ((ioctl(fd, BIOCGBLEN, (caddr_t)&v) < 0) ||
1717 v < DEFAULT_BUFSIZE)
1718 v = DEFAULT_BUFSIZE;
1719 }
1720 #ifndef roundup
1721 #define roundup(x, y) ((((x)+((y)-1))/(y))*(y)) /* to any y */
1722 #endif
1723 pb->zbufsize = roundup(v, getpagesize());
1724 if (pb->zbufsize > zbufmax)
1725 pb->zbufsize = zbufmax;
1726 pb->zbuf1 = mmap(NULL, pb->zbufsize, PROT_READ | PROT_WRITE,
1727 MAP_ANON, -1, 0);
1728 pb->zbuf2 = mmap(NULL, pb->zbufsize, PROT_READ | PROT_WRITE,
1729 MAP_ANON, -1, 0);
1730 if (pb->zbuf1 == MAP_FAILED || pb->zbuf2 == MAP_FAILED) {
1731 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "mmap: %s",
1732 pcap_strerror(errno));
1733 status = PCAP_ERROR;
1734 goto bad;
1735 }
1736 memset(&bz, 0, sizeof(bz)); /* bzero() deprecated, replaced with memset() */
1737 bz.bz_bufa = pb->zbuf1;
1738 bz.bz_bufb = pb->zbuf2;
1739 bz.bz_buflen = pb->zbufsize;
1740 if (ioctl(fd, BIOCSETZBUF, (caddr_t)&bz) < 0) {
1741 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "BIOCSETZBUF: %s",
1742 pcap_strerror(errno));
1743 status = PCAP_ERROR;
1744 goto bad;
1745 }
1746 (void)strncpy(ifrname, p->opt.source, ifnamsiz);
1747 if (ioctl(fd, BIOCSETIF, (caddr_t)&ifr) < 0) {
1748 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "BIOCSETIF: %s: %s",
1749 p->opt.source, pcap_strerror(errno));
1750 status = PCAP_ERROR;
1751 goto bad;
1752 }
1753 v = pb->zbufsize - sizeof(struct bpf_zbuf_header);
1754 } else
1755 #endif
1756 {
1757 /*
1758 * We don't have zerocopy BPF.
1759 * Set the buffer size.
1760 */
1761 if (p->opt.buffer_size != 0) {
1762 /*
1763 * A buffer size was explicitly specified; use it.
1764 */
1765 if (ioctl(fd, BIOCSBLEN,
1766 (caddr_t)&p->opt.buffer_size) < 0) {
1767 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1768 "BIOCSBLEN: %s: %s", p->opt.source,
1769 pcap_strerror(errno));
1770 status = PCAP_ERROR;
1771 goto bad;
1772 }
1773  
1774 /*
1775 * Now bind to the device.
1776 */
1777 (void)strncpy(ifrname, p->opt.source, ifnamsiz);
1778 #ifdef BIOCSETLIF
1779 if (ioctl(fd, BIOCSETLIF, (caddr_t)&ifr) < 0)
1780 #else
1781 if (ioctl(fd, BIOCSETIF, (caddr_t)&ifr) < 0)
1782 #endif
1783 {
1784 status = check_setif_failure(p, errno);
1785 goto bad;
1786 }
1787 } else {
1788 /*
1789 * No buffer size was explicitly specified.
1790 *
1791 * Try finding a good size for the buffer;
1792 * DEFAULT_BUFSIZE may be too big, so keep
1793 * cutting it in half until we find a size
1794 * that works, or run out of sizes to try.
1795 * If the default is larger, don't make it smaller.
1796 */
1797 if ((ioctl(fd, BIOCGBLEN, (caddr_t)&v) < 0) ||
1798 v < DEFAULT_BUFSIZE)
1799 v = DEFAULT_BUFSIZE;
1800 for ( ; v != 0; v >>= 1) {
1801 /*
1802 * Ignore the return value - this is because the
1803 * call fails on BPF systems that don't have
1804 * kernel malloc. And if the call fails, it's
1805 * no big deal, we just continue to use the
1806 * standard buffer size.
1807 */
1808 (void) ioctl(fd, BIOCSBLEN, (caddr_t)&v);
1809  
1810 (void)strncpy(ifrname, p->opt.source, ifnamsiz);
1811 #ifdef BIOCSETLIF
1812 if (ioctl(fd, BIOCSETLIF, (caddr_t)&ifr) >= 0)
1813 #else
1814 if (ioctl(fd, BIOCSETIF, (caddr_t)&ifr) >= 0)
1815 #endif
1816 break; /* that size worked; we're done */
1817  
1818 if (errno != ENOBUFS) {
1819 status = check_setif_failure(p, errno);
1820 goto bad;
1821 }
1822 }
1823  
1824 if (v == 0) {
1825 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1826 "BIOCSBLEN: %s: No buffer size worked",
1827 p->opt.source);
1828 status = PCAP_ERROR;
1829 goto bad;
1830 }
1831 }
1832 }
1833  
1834 /* Get the data link layer type. */
1835 if (ioctl(fd, BIOCGDLT, (caddr_t)&v) < 0) {
1836 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "BIOCGDLT: %s",
1837 pcap_strerror(errno));
1838 status = PCAP_ERROR;
1839 goto bad;
1840 }
1841  
1842 #ifdef _AIX
1843 /*
1844 * AIX's BPF returns IFF_ types, not DLT_ types, in BIOCGDLT.
1845 */
1846 switch (v) {
1847  
1848 case IFT_ETHER:
1849 case IFT_ISO88023:
1850 v = DLT_EN10MB;
1851 break;
1852  
1853 case IFT_FDDI:
1854 v = DLT_FDDI;
1855 break;
1856  
1857 case IFT_ISO88025:
1858 v = DLT_IEEE802;
1859 break;
1860  
1861 case IFT_LOOP:
1862 v = DLT_NULL;
1863 break;
1864  
1865 default:
1866 /*
1867 * We don't know what to map this to yet.
1868 */
1869 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "unknown interface type %u",
1870 v);
1871 status = PCAP_ERROR;
1872 goto bad;
1873 }
1874 #endif
1875 #if _BSDI_VERSION - 0 >= 199510
1876 /* The SLIP and PPP link layer header changed in BSD/OS 2.1 */
1877 switch (v) {
1878  
1879 case DLT_SLIP:
1880 v = DLT_SLIP_BSDOS;
1881 break;
1882  
1883 case DLT_PPP:
1884 v = DLT_PPP_BSDOS;
1885 break;
1886  
1887 case 11: /*DLT_FR*/
1888 v = DLT_FRELAY;
1889 break;
1890  
1891 case 12: /*DLT_C_HDLC*/
1892 v = DLT_CHDLC;
1893 break;
1894 }
1895 #endif
1896  
1897 #ifdef BIOCGDLTLIST
1898 /*
1899 * We know the default link type -- now determine all the DLTs
1900 * this interface supports. If this fails with EINVAL, it's
1901 * not fatal; we just don't get to use the feature later.
1902 */
1903 if (get_dlt_list(fd, v, &bdl, p->errbuf) == -1) {
1904 status = PCAP_ERROR;
1905 goto bad;
1906 }
1907 p->dlt_count = bdl.bfl_len;
1908 p->dlt_list = bdl.bfl_list;
1909  
1910 #ifdef __APPLE__
1911 /*
1912 * Monitor mode fun, continued.
1913 *
1914 * For 10.5 and, we're assuming, later releases, as noted above,
1915 * 802.1 adapters that support monitor mode offer both DLT_EN10MB,
1916 * DLT_IEEE802_11, and possibly some 802.11-plus-radio-information
1917 * DLT_ value. Choosing one of the 802.11 DLT_ values will turn
1918 * monitor mode on.
1919 *
1920 * Therefore, if the user asked for monitor mode, we filter out
1921 * the DLT_EN10MB value, as you can't get that in monitor mode,
1922 * and, if the user didn't ask for monitor mode, we filter out
1923 * the 802.11 DLT_ values, because selecting those will turn
1924 * monitor mode on. Then, for monitor mode, if an 802.11-plus-
1925 * radio DLT_ value is offered, we try to select that, otherwise
1926 * we try to select DLT_IEEE802_11.
1927 */
1928 if (have_osinfo) {
1929 if (isdigit((unsigned)osinfo.release[0]) &&
1930 (osinfo.release[0] == '9' ||
1931 isdigit((unsigned)osinfo.release[1]))) {
1932 /*
1933 * 10.5 (Darwin 9.x), or later.
1934 */
1935 new_dlt = find_802_11(&bdl);
1936 if (new_dlt != -1) {
1937 /*
1938 * We have at least one 802.11 DLT_ value,
1939 * so this is an 802.11 interface.
1940 * new_dlt is the best of the 802.11
1941 * DLT_ values in the list.
1942 */
1943 if (p->opt.rfmon) {
1944 /*
1945 * Our caller wants monitor mode.
1946 * Purge DLT_EN10MB from the list
1947 * of link-layer types, as selecting
1948 * it will keep monitor mode off.
1949 */
1950 remove_en(p);
1951  
1952 /*
1953 * If the new mode we want isn't
1954 * the default mode, attempt to
1955 * select the new mode.
1956 */
1957 if (new_dlt != v) {
1958 if (ioctl(p->fd, BIOCSDLT,
1959 &new_dlt) != -1) {
1960 /*
1961 * We succeeded;
1962 * make this the
1963 * new DLT_ value.
1964 */
1965 v = new_dlt;
1966 }
1967 }
1968 } else {
1969 /*
1970 * Our caller doesn't want
1971 * monitor mode. Unless this
1972 * is being done by pcap_open_live(),
1973 * purge the 802.11 link-layer types
1974 * from the list, as selecting
1975 * one of them will turn monitor
1976 * mode on.
1977 */
1978 if (!p->oldstyle)
1979 remove_802_11(p);
1980 }
1981 } else {
1982 if (p->opt.rfmon) {
1983 /*
1984 * The caller requested monitor
1985 * mode, but we have no 802.11
1986 * link-layer types, so they
1987 * can't have it.
1988 */
1989 status = PCAP_ERROR_RFMON_NOTSUP;
1990 goto bad;
1991 }
1992 }
1993 }
1994 }
1995 #elif defined(HAVE_BSD_IEEE80211)
1996 /*
1997 * *BSD with the new 802.11 ioctls.
1998 * Do we want monitor mode?
1999 */
2000 if (p->opt.rfmon) {
2001 /*
2002 * Try to put the interface into monitor mode.
2003 */
2004 retv = monitor_mode(p, 1);
2005 if (retv != 0) {
2006 /*
2007 * We failed.
2008 */
2009 status = retv;
2010 goto bad;
2011 }
2012  
2013 /*
2014 * We're in monitor mode.
2015 * Try to find the best 802.11 DLT_ value and, if we
2016 * succeed, try to switch to that mode if we're not
2017 * already in that mode.
2018 */
2019 new_dlt = find_802_11(&bdl);
2020 if (new_dlt != -1) {
2021 /*
2022 * We have at least one 802.11 DLT_ value.
2023 * new_dlt is the best of the 802.11
2024 * DLT_ values in the list.
2025 *
2026 * If the new mode we want isn't the default mode,
2027 * attempt to select the new mode.
2028 */
2029 if (new_dlt != v) {
2030 if (ioctl(p->fd, BIOCSDLT, &new_dlt) != -1) {
2031 /*
2032 * We succeeded; make this the
2033 * new DLT_ value.
2034 */
2035 v = new_dlt;
2036 }
2037 }
2038 }
2039 }
2040 #endif /* various platforms */
2041 #endif /* BIOCGDLTLIST */
2042  
2043 /*
2044 * If this is an Ethernet device, and we don't have a DLT_ list,
2045 * give it a list with DLT_EN10MB and DLT_DOCSIS. (That'd give
2046 * 802.11 interfaces DLT_DOCSIS, which isn't the right thing to
2047 * do, but there's not much we can do about that without finding
2048 * some other way of determining whether it's an Ethernet or 802.11
2049 * device.)
2050 */
2051 if (v == DLT_EN10MB && p->dlt_count == 0) {
2052 p->dlt_list = (u_int *) malloc(sizeof(u_int) * 2);
2053 /*
2054 * If that fails, just leave the list empty.
2055 */
2056 if (p->dlt_list != NULL) {
2057 p->dlt_list[0] = DLT_EN10MB;
2058 p->dlt_list[1] = DLT_DOCSIS;
2059 p->dlt_count = 2;
2060 }
2061 }
2062 #ifdef PCAP_FDDIPAD
2063 if (v == DLT_FDDI)
2064 p->fddipad = PCAP_FDDIPAD;
2065 else
2066 #endif
2067 p->fddipad = 0;
2068 p->linktype = v;
2069  
2070 #if defined(BIOCGHDRCMPLT) && defined(BIOCSHDRCMPLT)
2071 /*
2072 * Do a BIOCSHDRCMPLT, if defined, to turn that flag on, so
2073 * the link-layer source address isn't forcibly overwritten.
2074 * (Should we ignore errors? Should we do this only if
2075 * we're open for writing?)
2076 *
2077 * XXX - I seem to remember some packet-sending bug in some
2078 * BSDs - check CVS log for "bpf.c"?
2079 */
2080 if (ioctl(fd, BIOCSHDRCMPLT, &spoof_eth_src) == -1) {
2081 (void)snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
2082 "BIOCSHDRCMPLT: %s", pcap_strerror(errno));
2083 status = PCAP_ERROR;
2084 goto bad;
2085 }
2086 #endif
2087 /* set timeout */
2088 #ifdef HAVE_ZEROCOPY_BPF
2089 /*
2090 * In zero-copy mode, we just use the timeout in select().
2091 * XXX - what if we're in non-blocking mode and the *application*
2092 * is using select() or poll() or kqueues or....?
2093 */
2094 if (p->opt.timeout && !pb->zerocopy) {
2095 #else
2096 if (p->opt.timeout) {
2097 #endif
2098 /*
2099 * XXX - is this seconds/nanoseconds in AIX?
2100 * (Treating it as such doesn't fix the timeout
2101 * problem described below.)
2102 *
2103 * XXX - Mac OS X 10.6 mishandles BIOCSRTIMEOUT in
2104 * 64-bit userland - it takes, as an argument, a
2105 * "struct BPF_TIMEVAL", which has 32-bit tv_sec
2106 * and tv_usec, rather than a "struct timeval".
2107 *
2108 * If this platform defines "struct BPF_TIMEVAL",
2109 * we check whether the structure size in BIOCSRTIMEOUT
2110 * is that of a "struct timeval" and, if not, we use
2111 * a "struct BPF_TIMEVAL" rather than a "struct timeval".
2112 * (That way, if the bug is fixed in a future release,
2113 * we will still do the right thing.)
2114 */
2115 struct timeval to;
2116 #ifdef HAVE_STRUCT_BPF_TIMEVAL
2117 struct BPF_TIMEVAL bpf_to;
2118  
2119 if (IOCPARM_LEN(BIOCSRTIMEOUT) != sizeof(struct timeval)) {
2120 bpf_to.tv_sec = p->opt.timeout / 1000;
2121 bpf_to.tv_usec = (p->opt.timeout * 1000) % 1000000;
2122 if (ioctl(p->fd, BIOCSRTIMEOUT, (caddr_t)&bpf_to) < 0) {
2123 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
2124 "BIOCSRTIMEOUT: %s", pcap_strerror(errno));
2125 status = PCAP_ERROR;
2126 goto bad;
2127 }
2128 } else {
2129 #endif
2130 to.tv_sec = p->opt.timeout / 1000;
2131 to.tv_usec = (p->opt.timeout * 1000) % 1000000;
2132 if (ioctl(p->fd, BIOCSRTIMEOUT, (caddr_t)&to) < 0) {
2133 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
2134 "BIOCSRTIMEOUT: %s", pcap_strerror(errno));
2135 status = PCAP_ERROR;
2136 goto bad;
2137 }
2138 #ifdef HAVE_STRUCT_BPF_TIMEVAL
2139 }
2140 #endif
2141 }
2142  
2143 #ifdef BIOCIMMEDIATE
2144 /*
2145 * Darren Reed notes that
2146 *
2147 * On AIX (4.2 at least), if BIOCIMMEDIATE is not set, the
2148 * timeout appears to be ignored and it waits until the buffer
2149 * is filled before returning. The result of not having it
2150 * set is almost worse than useless if your BPF filter
2151 * is reducing things to only a few packets (i.e. one every
2152 * second or so).
2153 *
2154 * so we always turn BIOCIMMEDIATE mode on if this is AIX.
2155 *
2156 * For other platforms, we don't turn immediate mode on by default,
2157 * as that would mean we get woken up for every packet, which
2158 * probably isn't what you want for a packet sniffer.
2159 *
2160 * We set immediate mode if the caller requested it by calling
2161 * pcap_set_immediate() before calling pcap_activate().
2162 */
2163 #ifndef _AIX
2164 if (p->opt.immediate) {
2165 #endif /* _AIX */
2166 v = 1;
2167 if (ioctl(p->fd, BIOCIMMEDIATE, &v) < 0) {
2168 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
2169 "BIOCIMMEDIATE: %s", pcap_strerror(errno));
2170 status = PCAP_ERROR;
2171 goto bad;
2172 }
2173 #ifndef _AIX
2174 }
2175 #endif /* _AIX */
2176 #else /* BIOCIMMEDIATE */
2177 if (p->opt.immediate) {
2178 /*
2179 * We don't support immediate mode. Fail.
2180 */
2181 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "Immediate mode not supported");
2182 status = PCAP_ERROR;
2183 goto bad;
2184 }
2185 #endif /* BIOCIMMEDIATE */
2186  
2187 if (p->opt.promisc) {
2188 /* set promiscuous mode, just warn if it fails */
2189 if (ioctl(p->fd, BIOCPROMISC, NULL) < 0) {
2190 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "BIOCPROMISC: %s",
2191 pcap_strerror(errno));
2192 status = PCAP_WARNING_PROMISC_NOTSUP;
2193 }
2194 }
2195  
2196 if (ioctl(fd, BIOCGBLEN, (caddr_t)&v) < 0) {
2197 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "BIOCGBLEN: %s",
2198 pcap_strerror(errno));
2199 status = PCAP_ERROR;
2200 goto bad;
2201 }
2202 p->bufsize = v;
2203 #ifdef HAVE_ZEROCOPY_BPF
2204 if (!pb->zerocopy) {
2205 #endif
2206 p->buffer = (u_char *)malloc(p->bufsize);
2207 if (p->buffer == NULL) {
2208 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "malloc: %s",
2209 pcap_strerror(errno));
2210 status = PCAP_ERROR;
2211 goto bad;
2212 }
2213 #ifdef _AIX
2214 /* For some strange reason this seems to prevent the EFAULT
2215 * problems we have experienced from AIX BPF. */
2216 memset(p->buffer, 0x0, p->bufsize);
2217 #endif
2218 #ifdef HAVE_ZEROCOPY_BPF
2219 }
2220 #endif
2221  
2222 /*
2223 * If there's no filter program installed, there's
2224 * no indication to the kernel of what the snapshot
2225 * length should be, so no snapshotting is done.
2226 *
2227 * Therefore, when we open the device, we install
2228 * an "accept everything" filter with the specified
2229 * snapshot length.
2230 */
2231 total_insn.code = (u_short)(BPF_RET | BPF_K);
2232 total_insn.jt = 0;
2233 total_insn.jf = 0;
2234 total_insn.k = p->snapshot;
2235  
2236 total_prog.bf_len = 1;
2237 total_prog.bf_insns = &total_insn;
2238 if (ioctl(p->fd, BIOCSETF, (caddr_t)&total_prog) < 0) {
2239 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "BIOCSETF: %s",
2240 pcap_strerror(errno));
2241 status = PCAP_ERROR;
2242 goto bad;
2243 }
2244  
2245 /*
2246 * On most BPF platforms, either you can do a "select()" or
2247 * "poll()" on a BPF file descriptor and it works correctly,
2248 * or you can do it and it will return "readable" if the
2249 * hold buffer is full but not if the timeout expires *and*
2250 * a non-blocking read will, if the hold buffer is empty
2251 * but the store buffer isn't empty, rotate the buffers
2252 * and return what packets are available.
2253 *
2254 * In the latter case, the fact that a non-blocking read
2255 * will give you the available packets means you can work
2256 * around the failure of "select()" and "poll()" to wake up
2257 * and return "readable" when the timeout expires by using
2258 * the timeout as the "select()" or "poll()" timeout, putting
2259 * the BPF descriptor into non-blocking mode, and read from
2260 * it regardless of whether "select()" reports it as readable
2261 * or not.
2262 *
2263 * However, in FreeBSD 4.3 and 4.4, "select()" and "poll()"
2264 * won't wake up and return "readable" if the timer expires
2265 * and non-blocking reads return EWOULDBLOCK if the hold
2266 * buffer is empty, even if the store buffer is non-empty.
2267 *
2268 * This means the workaround in question won't work.
2269 *
2270 * Therefore, on FreeBSD 4.3 and 4.4, we set "p->selectable_fd"
2271 * to -1, which means "sorry, you can't use 'select()' or 'poll()'
2272 * here". On all other BPF platforms, we set it to the FD for
2273 * the BPF device; in NetBSD, OpenBSD, and Darwin, a non-blocking
2274 * read will, if the hold buffer is empty and the store buffer
2275 * isn't empty, rotate the buffers and return what packets are
2276 * there (and in sufficiently recent versions of OpenBSD
2277 * "select()" and "poll()" should work correctly).
2278 *
2279 * XXX - what about AIX?
2280 */
2281 p->selectable_fd = p->fd; /* assume select() works until we know otherwise */
2282 if (have_osinfo) {
2283 /*
2284 * We can check what OS this is.
2285 */
2286 if (strcmp(osinfo.sysname, "FreeBSD") == 0) {
2287 if (strncmp(osinfo.release, "4.3-", 4) == 0 ||
2288 strncmp(osinfo.release, "4.4-", 4) == 0)
2289 p->selectable_fd = -1;
2290 }
2291 }
2292  
2293 p->read_op = pcap_read_bpf;
2294 p->inject_op = pcap_inject_bpf;
2295 p->setfilter_op = pcap_setfilter_bpf;
2296 p->setdirection_op = pcap_setdirection_bpf;
2297 p->set_datalink_op = pcap_set_datalink_bpf;
2298 p->getnonblock_op = pcap_getnonblock_bpf;
2299 p->setnonblock_op = pcap_setnonblock_bpf;
2300 p->stats_op = pcap_stats_bpf;
2301 p->cleanup_op = pcap_cleanup_bpf;
2302  
2303 return (status);
2304 bad:
2305 pcap_cleanup_bpf(p);
2306 return (status);
2307 }
2308  
2309 int
2310 pcap_platform_finddevs(pcap_if_t **alldevsp, char *errbuf)
2311 {
2312 return (0);
2313 }
2314  
2315 #ifdef HAVE_BSD_IEEE80211
2316 static int
2317 monitor_mode(pcap_t *p, int set)
2318 {
2319 struct pcap_bpf *pb = p->priv;
2320 int sock;
2321 struct ifmediareq req;
2322 int *media_list;
2323 int i;
2324 int can_do;
2325 struct ifreq ifr;
2326  
2327 sock = socket(AF_INET, SOCK_DGRAM, 0);
2328 if (sock == -1) {
2329 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "can't open socket: %s",
2330 pcap_strerror(errno));
2331 return (PCAP_ERROR);
2332 }
2333  
2334 memset(&req, 0, sizeof req);
2335 strncpy(req.ifm_name, p->opt.source, sizeof req.ifm_name);
2336  
2337 /*
2338 * Find out how many media types we have.
2339 */
2340 if (ioctl(sock, SIOCGIFMEDIA, &req) < 0) {
2341 /*
2342 * Can't get the media types.
2343 */
2344 switch (errno) {
2345  
2346 case ENXIO:
2347 /*
2348 * There's no such device.
2349 */
2350 close(sock);
2351 return (PCAP_ERROR_NO_SUCH_DEVICE);
2352  
2353 case EINVAL:
2354 /*
2355 * Interface doesn't support SIOC{G,S}IFMEDIA.
2356 */
2357 close(sock);
2358 return (PCAP_ERROR_RFMON_NOTSUP);
2359  
2360 default:
2361 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
2362 "SIOCGIFMEDIA 1: %s", pcap_strerror(errno));
2363 close(sock);
2364 return (PCAP_ERROR);
2365 }
2366 }
2367 if (req.ifm_count == 0) {
2368 /*
2369 * No media types.
2370 */
2371 close(sock);
2372 return (PCAP_ERROR_RFMON_NOTSUP);
2373 }
2374  
2375 /*
2376 * Allocate a buffer to hold all the media types, and
2377 * get the media types.
2378 */
2379 media_list = malloc(req.ifm_count * sizeof(int));
2380 if (media_list == NULL) {
2381 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "malloc: %s",
2382 pcap_strerror(errno));
2383 close(sock);
2384 return (PCAP_ERROR);
2385 }
2386 req.ifm_ulist = media_list;
2387 if (ioctl(sock, SIOCGIFMEDIA, &req) < 0) {
2388 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "SIOCGIFMEDIA: %s",
2389 pcap_strerror(errno));
2390 free(media_list);
2391 close(sock);
2392 return (PCAP_ERROR);
2393 }
2394  
2395 /*
2396 * Look for an 802.11 "automatic" media type.
2397 * We assume that all 802.11 adapters have that media type,
2398 * and that it will carry the monitor mode supported flag.
2399 */
2400 can_do = 0;
2401 for (i = 0; i < req.ifm_count; i++) {
2402 if (IFM_TYPE(media_list[i]) == IFM_IEEE80211
2403 && IFM_SUBTYPE(media_list[i]) == IFM_AUTO) {
2404 /* OK, does it do monitor mode? */
2405 if (media_list[i] & IFM_IEEE80211_MONITOR) {
2406 can_do = 1;
2407 break;
2408 }
2409 }
2410 }
2411 free(media_list);
2412 if (!can_do) {
2413 /*
2414 * This adapter doesn't support monitor mode.
2415 */
2416 close(sock);
2417 return (PCAP_ERROR_RFMON_NOTSUP);
2418 }
2419  
2420 if (set) {
2421 /*
2422 * Don't just check whether we can enable monitor mode,
2423 * do so, if it's not already enabled.
2424 */
2425 if ((req.ifm_current & IFM_IEEE80211_MONITOR) == 0) {
2426 /*
2427 * Monitor mode isn't currently on, so turn it on,
2428 * and remember that we should turn it off when the
2429 * pcap_t is closed.
2430 */
2431  
2432 /*
2433 * If we haven't already done so, arrange to have
2434 * "pcap_close_all()" called when we exit.
2435 */
2436 if (!pcap_do_addexit(p)) {
2437 /*
2438 * "atexit()" failed; don't put the interface
2439 * in monitor mode, just give up.
2440 */
2441 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
2442 "atexit failed");
2443 close(sock);
2444 return (PCAP_ERROR);
2445 }
2446 memset(&ifr, 0, sizeof(ifr));
2447 (void)strncpy(ifr.ifr_name, p->opt.source,
2448 sizeof(ifr.ifr_name));
2449 ifr.ifr_media = req.ifm_current | IFM_IEEE80211_MONITOR;
2450 if (ioctl(sock, SIOCSIFMEDIA, &ifr) == -1) {
2451 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
2452 "SIOCSIFMEDIA: %s", pcap_strerror(errno));
2453 close(sock);
2454 return (PCAP_ERROR);
2455 }
2456  
2457 pb->must_do_on_close |= MUST_CLEAR_RFMON;
2458  
2459 /*
2460 * Add this to the list of pcaps to close when we exit.
2461 */
2462 pcap_add_to_pcaps_to_close(p);
2463 }
2464 }
2465 return (0);
2466 }
2467 #endif /* HAVE_BSD_IEEE80211 */
2468  
2469 #if defined(BIOCGDLTLIST) && (defined(__APPLE__) || defined(HAVE_BSD_IEEE80211))
2470 /*
2471 * Check whether we have any 802.11 link-layer types; return the best
2472 * of the 802.11 link-layer types if we find one, and return -1
2473 * otherwise.
2474 *
2475 * DLT_IEEE802_11_RADIO, with the radiotap header, is considered the
2476 * best 802.11 link-layer type; any of the other 802.11-plus-radio
2477 * headers are second-best; 802.11 with no radio information is
2478 * the least good.
2479 */
2480 static int
2481 find_802_11(struct bpf_dltlist *bdlp)
2482 {
2483 int new_dlt;
2484 int i;
2485  
2486 /*
2487 * Scan the list of DLT_ values, looking for 802.11 values,
2488 * and, if we find any, choose the best of them.
2489 */
2490 new_dlt = -1;
2491 for (i = 0; i < bdlp->bfl_len; i++) {
2492 switch (bdlp->bfl_list[i]) {
2493  
2494 case DLT_IEEE802_11:
2495 /*
2496 * 802.11, but no radio.
2497 *
2498 * Offer this, and select it as the new mode
2499 * unless we've already found an 802.11
2500 * header with radio information.
2501 */
2502 if (new_dlt == -1)
2503 new_dlt = bdlp->bfl_list[i];
2504 break;
2505  
2506 case DLT_PRISM_HEADER:
2507 case DLT_AIRONET_HEADER:
2508 case DLT_IEEE802_11_RADIO_AVS:
2509 /*
2510 * 802.11 with radio, but not radiotap.
2511 *
2512 * Offer this, and select it as the new mode
2513 * unless we've already found the radiotap DLT_.
2514 */
2515 if (new_dlt != DLT_IEEE802_11_RADIO)
2516 new_dlt = bdlp->bfl_list[i];
2517 break;
2518  
2519 case DLT_IEEE802_11_RADIO:
2520 /*
2521 * 802.11 with radiotap.
2522 *
2523 * Offer this, and select it as the new mode.
2524 */
2525 new_dlt = bdlp->bfl_list[i];
2526 break;
2527  
2528 default:
2529 /*
2530 * Not 802.11.
2531 */
2532 break;
2533 }
2534 }
2535  
2536 return (new_dlt);
2537 }
2538 #endif /* defined(BIOCGDLTLIST) && (defined(__APPLE__) || defined(HAVE_BSD_IEEE80211)) */
2539  
2540 #if defined(__APPLE__) && defined(BIOCGDLTLIST)
2541 /*
2542 * Remove DLT_EN10MB from the list of DLT_ values, as we're in monitor mode,
2543 * and DLT_EN10MB isn't supported in monitor mode.
2544 */
2545 static void
2546 remove_en(pcap_t *p)
2547 {
2548 int i, j;
2549  
2550 /*
2551 * Scan the list of DLT_ values and discard DLT_EN10MB.
2552 */
2553 j = 0;
2554 for (i = 0; i < p->dlt_count; i++) {
2555 switch (p->dlt_list[i]) {
2556  
2557 case DLT_EN10MB:
2558 /*
2559 * Don't offer this one.
2560 */
2561 continue;
2562  
2563 default:
2564 /*
2565 * Just copy this mode over.
2566 */
2567 break;
2568 }
2569  
2570 /*
2571 * Copy this DLT_ value to its new position.
2572 */
2573 p->dlt_list[j] = p->dlt_list[i];
2574 j++;
2575 }
2576  
2577 /*
2578 * Set the DLT_ count to the number of entries we copied.
2579 */
2580 p->dlt_count = j;
2581 }
2582  
2583 /*
2584 * Remove 802.11 link-layer types from the list of DLT_ values, as
2585 * we're not in monitor mode, and those DLT_ values will switch us
2586 * to monitor mode.
2587 */
2588 static void
2589 remove_802_11(pcap_t *p)
2590 {
2591 int i, j;
2592  
2593 /*
2594 * Scan the list of DLT_ values and discard 802.11 values.
2595 */
2596 j = 0;
2597 for (i = 0; i < p->dlt_count; i++) {
2598 switch (p->dlt_list[i]) {
2599  
2600 case DLT_IEEE802_11:
2601 case DLT_PRISM_HEADER:
2602 case DLT_AIRONET_HEADER:
2603 case DLT_IEEE802_11_RADIO:
2604 case DLT_IEEE802_11_RADIO_AVS:
2605 /*
2606 * 802.11. Don't offer this one.
2607 */
2608 continue;
2609  
2610 default:
2611 /*
2612 * Just copy this mode over.
2613 */
2614 break;
2615 }
2616  
2617 /*
2618 * Copy this DLT_ value to its new position.
2619 */
2620 p->dlt_list[j] = p->dlt_list[i];
2621 j++;
2622 }
2623  
2624 /*
2625 * Set the DLT_ count to the number of entries we copied.
2626 */
2627 p->dlt_count = j;
2628 }
2629 #endif /* defined(__APPLE__) && defined(BIOCGDLTLIST) */
2630  
2631 static int
2632 pcap_setfilter_bpf(pcap_t *p, struct bpf_program *fp)
2633 {
2634 struct pcap_bpf *pb = p->priv;
2635  
2636 /*
2637 * Free any user-mode filter we might happen to have installed.
2638 */
2639 pcap_freecode(&p->fcode);
2640  
2641 /*
2642 * Try to install the kernel filter.
2643 */
2644 if (ioctl(p->fd, BIOCSETF, (caddr_t)fp) == 0) {
2645 /*
2646 * It worked.
2647 */
2648 pb->filtering_in_kernel = 1; /* filtering in the kernel */
2649  
2650 /*
2651 * Discard any previously-received packets, as they might
2652 * have passed whatever filter was formerly in effect, but
2653 * might not pass this filter (BIOCSETF discards packets
2654 * buffered in the kernel, so you can lose packets in any
2655 * case).
2656 */
2657 p->cc = 0;
2658 return (0);
2659 }
2660  
2661 /*
2662 * We failed.
2663 *
2664 * If it failed with EINVAL, that's probably because the program
2665 * is invalid or too big. Validate it ourselves; if we like it
2666 * (we currently allow backward branches, to support protochain),
2667 * run it in userland. (There's no notion of "too big" for
2668 * userland.)
2669 *
2670 * Otherwise, just give up.
2671 * XXX - if the copy of the program into the kernel failed,
2672 * we will get EINVAL rather than, say, EFAULT on at least
2673 * some kernels.
2674 */
2675 if (errno != EINVAL) {
2676 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "BIOCSETF: %s",
2677 pcap_strerror(errno));
2678 return (-1);
2679 }
2680  
2681 /*
2682 * install_bpf_program() validates the program.
2683 *
2684 * XXX - what if we already have a filter in the kernel?
2685 */
2686 if (install_bpf_program(p, fp) < 0)
2687 return (-1);
2688 pb->filtering_in_kernel = 0; /* filtering in userland */
2689 return (0);
2690 }
2691  
2692 /*
2693 * Set direction flag: Which packets do we accept on a forwarding
2694 * single device? IN, OUT or both?
2695 */
2696 static int
2697 pcap_setdirection_bpf(pcap_t *p, pcap_direction_t d)
2698 {
2699 #if defined(BIOCSDIRECTION)
2700 u_int direction;
2701  
2702 direction = (d == PCAP_D_IN) ? BPF_D_IN :
2703 ((d == PCAP_D_OUT) ? BPF_D_OUT : BPF_D_INOUT);
2704 if (ioctl(p->fd, BIOCSDIRECTION, &direction) == -1) {
2705 (void) snprintf(p->errbuf, sizeof(p->errbuf),
2706 "Cannot set direction to %s: %s",
2707 (d == PCAP_D_IN) ? "PCAP_D_IN" :
2708 ((d == PCAP_D_OUT) ? "PCAP_D_OUT" : "PCAP_D_INOUT"),
2709 strerror(errno));
2710 return (-1);
2711 }
2712 return (0);
2713 #elif defined(BIOCSSEESENT)
2714 u_int seesent;
2715  
2716 /*
2717 * We don't support PCAP_D_OUT.
2718 */
2719 if (d == PCAP_D_OUT) {
2720 snprintf(p->errbuf, sizeof(p->errbuf),
2721 "Setting direction to PCAP_D_OUT is not supported on BPF");
2722 return -1;
2723 }
2724  
2725 seesent = (d == PCAP_D_INOUT);
2726 if (ioctl(p->fd, BIOCSSEESENT, &seesent) == -1) {
2727 (void) snprintf(p->errbuf, sizeof(p->errbuf),
2728 "Cannot set direction to %s: %s",
2729 (d == PCAP_D_INOUT) ? "PCAP_D_INOUT" : "PCAP_D_IN",
2730 strerror(errno));
2731 return (-1);
2732 }
2733 return (0);
2734 #else
2735 (void) snprintf(p->errbuf, sizeof(p->errbuf),
2736 "This system doesn't support BIOCSSEESENT, so the direction can't be set");
2737 return (-1);
2738 #endif
2739 }
2740  
2741 static int
2742 pcap_set_datalink_bpf(pcap_t *p, int dlt)
2743 {
2744 #ifdef BIOCSDLT
2745 if (ioctl(p->fd, BIOCSDLT, &dlt) == -1) {
2746 (void) snprintf(p->errbuf, sizeof(p->errbuf),
2747 "Cannot set DLT %d: %s", dlt, strerror(errno));
2748 return (-1);
2749 }
2750 #endif
2751 return (0);
2752 }