2 * Copyright (c) 1993, 1994, 1995, 1996, 1998
3 * The Regents of the University of California. All rights reserved.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
22 static const char rcsid[] =
23 "@(#) $Header: pcap-bpf.c,v 1.31 98/07/12 13:14:55 leres Exp $ (LBL)";
26 #include <sys/param.h> /* optionally get BSD define */
28 #include <sys/timeb.h>
29 #include <sys/socket.h>
31 #include <sys/ioctl.h>
46 #ifdef HAVE_OS_PROTO_H
51 pcap_stats(pcap_t *p, struct pcap_stat *ps)
55 if (ioctl(p->fd, BIOCGSTATS, (caddr_t)&s) < 0) {
56 sprintf(p->errbuf, "BIOCGSTATS: %s", pcap_strerror(errno));
60 ps->ps_recv = s.bs_recv;
61 ps->ps_drop = s.bs_drop;
66 pcap_read(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
70 register u_char *bp, *ep;
75 cc = read(p->fd, (char *)p->buffer, p->bufsize);
77 /* Don't choke when we get ptraced */
85 #if defined(sun) && !defined(BSD)
87 * Due to a SunOS bug, after 2^31 bytes, the kernel
88 * file offset overflows and read fails with EINVAL.
89 * The lseek() to 0 will fix things.
92 if (lseek(p->fd, 0L, SEEK_CUR) +
94 (void)lseek(p->fd, 0L, SEEK_SET);
100 sprintf(p->errbuf, "read: %s", pcap_strerror(errno));
108 * Loop through each packet.
110 #define bhp ((struct bpf_hdr *)bp)
113 register int caplen, hdrlen;
114 caplen = bhp->bh_caplen;
115 hdrlen = bhp->bh_hdrlen;
117 * XXX A bpf_hdr matches a pcap_pkthdr.
119 (*callback)(user, (struct pcap_pkthdr*)bp, bp + hdrlen);
120 bp += BPF_WORDALIGN(caplen + hdrlen);
121 if (++n >= cnt && cnt > 0) {
133 bpf_open(pcap_t *p, char *errbuf)
137 char device[sizeof "/dev/bpf000"];
140 * Go through all the minors and find one that isn't in use.
143 (void)sprintf(device, "/dev/bpf%d", n++);
144 fd = open(device, O_RDONLY);
145 } while (fd < 0 && errno == EBUSY);
148 * XXX better message for all minors used
151 sprintf(errbuf, "%s: %s", device, pcap_strerror(errno));
157 pcap_open_live(char *device, int snaplen, int promisc, int to_ms, char *ebuf)
161 struct bpf_version bv;
165 p = (pcap_t *)malloc(sizeof(*p));
167 sprintf(ebuf, "malloc: %s", pcap_strerror(errno));
170 bzero(p, sizeof(*p));
171 fd = bpf_open(p, ebuf);
176 p->snapshot = snaplen;
178 if (ioctl(fd, BIOCVERSION, (caddr_t)&bv) < 0) {
179 sprintf(ebuf, "BIOCVERSION: %s", pcap_strerror(errno));
182 if (bv.bv_major != BPF_MAJOR_VERSION ||
183 bv.bv_minor < BPF_MINOR_VERSION) {
184 sprintf(ebuf, "kernel bpf filter out of date");
187 v = 32768; /* XXX this should be a user-accessible hook */
188 /* Ignore the return value - this is because the call fails on
189 * BPF systems that don't have kernel malloc. And if the call
190 * fails, it's no big deal, we just continue to use the standard
193 (void) ioctl(fd, BIOCSBLEN, (caddr_t)&v);
195 (void)strncpy(ifr.ifr_name, device, sizeof(ifr.ifr_name));
196 if (ioctl(fd, BIOCSETIF, (caddr_t)&ifr) < 0) {
197 sprintf(ebuf, "%s: %s", device, pcap_strerror(errno));
200 /* Get the data link layer type. */
201 if (ioctl(fd, BIOCGDLT, (caddr_t)&v) < 0) {
202 sprintf(ebuf, "BIOCGDLT: %s", pcap_strerror(errno));
205 #if _BSDI_VERSION - 0 >= 199510
206 /* The SLIP and PPP link layer header changed in BSD/OS 2.1 */
223 to.tv_sec = to_ms / 1000;
224 to.tv_usec = (to_ms * 1000) % 1000000;
225 if (ioctl(p->fd, BIOCSRTIMEOUT, (caddr_t)&to) < 0) {
226 sprintf(ebuf, "BIOCSRTIMEOUT: %s",
227 pcap_strerror(errno));
232 /* set promiscuous mode, okay if it fails */
233 (void)ioctl(p->fd, BIOCPROMISC, NULL);
235 if (ioctl(fd, BIOCGBLEN, (caddr_t)&v) < 0) {
236 sprintf(ebuf, "BIOCGBLEN: %s", pcap_strerror(errno));
240 p->buffer = (u_char *)malloc(p->bufsize);
241 if (p->buffer == NULL) {
242 sprintf(ebuf, "malloc: %s", pcap_strerror(errno));
254 pcap_setfilter(pcap_t *p, struct bpf_program *fp)
256 if (p->sf.rfile != NULL)
258 else if (ioctl(p->fd, BIOCSETF, (caddr_t)fp) < 0) {
259 sprintf(p->errbuf, "BIOCSETF: %s", pcap_strerror(errno));