contrib/libpcap/pcap-bpf.c

   1 /*
   2  * Copyright (c) 1993, 1994, 1995, 1996, 1998
   3  *      The Regents of the University of California.  All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that: (1) source code distributions
   7  * retain the above copyright notice and this paragraph in its entirety, (2)
   8  * distributions including binary code include the above copyright notice and
   9  * this paragraph in its entirety in the documentation or other materials
  10  * provided with the distribution, and (3) all advertising materials mentioning
  11  * features or use of this software display the following acknowledgement:
  12  * ``This product includes software developed by the University of California,
  13  * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
  14  * the University nor the names of its contributors may be used to endorse
  15  * or promote products derived from this software without specific prior
  16  * written permission.
  17  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
  18  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
  19  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  20  *
  21  * $FreeBSD$
  22  */
  23 #ifndef lint
  24 static const char rcsid[] _U_ =
  25     "@(#) $Header: /tcpdump/master/libpcap/pcap-bpf.c,v 1.116 2008-09-16 18:42:29 guy Exp $ (LBL)";
  26 #endif
  27
  28 #ifdef HAVE_CONFIG_H
  29 #include "config.h"
  30 #endif
  31
  32 #include <sys/param.h>                  /* optionally get BSD define */
  33 #ifdef HAVE_ZEROCOPY_BPF
  34 #include <sys/mman.h>
  35 #endif
  36 #include <sys/time.h>
  37 #include <sys/socket.h>
  38 /*
  39  * <net/bpf.h> defines ioctls, but doesn't include <sys/ioccom.h>.
  40  *
  41  * We include <sys/ioctl.h> as it might be necessary to declare ioctl();
  42  * at least on *BSD and Mac OS X, it also defines various SIOC ioctls -
  43  * we could include <sys/sockio.h>, but if we're already including
  44  * <sys/ioctl.h>, which includes <sys/sockio.h> on those platforms,
  45  * there's not much point in doing so.
  46  *
  47  * If we have <sys/ioccom.h>, we include it as well, to handle systems
  48  * such as Solaris which don't arrange to include <sys/ioccom.h> if you
  49  * include <sys/ioctl.h>
  50  */
  51 #include <sys/ioctl.h>
  52 #ifdef HAVE_SYS_IOCCOM_H
  53 #include <sys/ioccom.h>
  54 #endif
  55 #include <sys/utsname.h>
  56
  57 #ifdef HAVE_ZEROCOPY_BPF
  58 #include <machine/atomic.h>
  59 #endif
  60
  61 #include <net/if.h>
  62
  63 #ifdef _AIX
  64
  65 /*
  66  * Make "pcap.h" not include "pcap/bpf.h"; we are going to include the
  67  * native OS version, as we need "struct bpf_config" from it.
  68  */
  69 #define PCAP_DONT_INCLUDE_PCAP_BPF_H
  70
  71 #include <sys/types.h>
  72
  73 /*
  74  * Prevent bpf.h from redefining the DLT_ values to their
  75  * IFT_ values, as we're going to return the standard libpcap
  76  * values, not IBM's non-standard IFT_ values.
  77  */
  78 #undef _AIX
  79 #include <net/bpf.h>
  80 #define _AIX
  81
  82 #include <net/if_types.h>               /* for IFT_ values */
  83 #include <sys/sysconfig.h>
  84 #include <sys/device.h>
  85 #include <sys/cfgodm.h>
  86 #include <cf.h>
  87
  88 #ifdef __64BIT__
  89 #define domakedev makedev64
  90 #define getmajor major64
  91 #define bpf_hdr bpf_hdr32
  92 #else /* __64BIT__ */
  93 #define domakedev makedev
  94 #define getmajor major
  95 #endif /* __64BIT__ */
  96
  97 #define BPF_NAME "bpf"
  98 #define BPF_MINORS 4
  99 #define DRIVER_PATH "/usr/lib/drivers"
 100 #define BPF_NODE "/dev/bpf"
 101 static int bpfloadedflag = 0;
 102 static int odmlockid = 0;
 103
 104 static int bpf_load(char *errbuf);
 105
 106 #else /* _AIX */
 107
 108 #include <net/bpf.h>
 109
 110 #endif /* _AIX */
 111
 112 #include <ctype.h>
 113 #include <fcntl.h>
 114 #include <errno.h>
 115 #include <netdb.h>
 116 #include <stdio.h>
 117 #include <stdlib.h>
 118 #include <string.h>
 119 #include <unistd.h>
 120
 121 #ifdef HAVE_NET_IF_MEDIA_H
 122 # include <net/if_media.h>
 123 #endif
 124
 125 #include "pcap-int.h"
 126
 127 #ifdef HAVE_DAG_API
 128 #include "pcap-dag.h"
 129 #endif /* HAVE_DAG_API */
 130
 131 #ifdef HAVE_SNF_API
 132 #include "pcap-snf.h"
 133 #endif /* HAVE_SNF_API */
 134
 135 #ifdef HAVE_OS_PROTO_H
 136 #include "os-proto.h"
 137 #endif
 138
 139 #ifdef BIOCGDLTLIST
 140 # if (defined(HAVE_NET_IF_MEDIA_H) && defined(IFM_IEEE80211)) && !defined(__APPLE__)
 141 #define HAVE_BSD_IEEE80211
 142 # endif
 143
 144 # if defined(__APPLE__) || defined(HAVE_BSD_IEEE80211)
 145 static int find_802_11(struct bpf_dltlist *);
 146
 147 #  ifdef HAVE_BSD_IEEE80211
 148 static int monitor_mode(pcap_t *, int);
 149 #  endif
 150
 151 #  if defined(__APPLE__)
 152 static void remove_en(pcap_t *);
 153 static void remove_802_11(pcap_t *);
 154 #  endif
 155
 156 # endif /* defined(__APPLE__) || defined(HAVE_BSD_IEEE80211) */
 157
 158 #endif /* BIOCGDLTLIST */
 159
 160 /*
 161  * We include the OS's <net/bpf.h>, not our "pcap/bpf.h", so we probably
 162  * don't get DLT_DOCSIS defined.
 163  */
 164 #ifndef DLT_DOCSIS
 165 #define DLT_DOCSIS      143
 166 #endif
 167
 168 /*
 169  * On OS X, we don't even get any of the 802.11-plus-radio-header DLT_'s
 170  * defined, even though some of them are used by various Airport drivers.
 171  */
 172 #ifndef DLT_PRISM_HEADER
 173 #define DLT_PRISM_HEADER        119
 174 #endif
 175 #ifndef DLT_AIRONET_HEADER
 176 #define DLT_AIRONET_HEADER      120
 177 #endif
 178 #ifndef DLT_IEEE802_11_RADIO
 179 #define DLT_IEEE802_11_RADIO    127
 180 #endif
 181 #ifndef DLT_IEEE802_11_RADIO_AVS
 182 #define DLT_IEEE802_11_RADIO_AVS 163
 183 #endif
 184
 185 static int pcap_can_set_rfmon_bpf(pcap_t *p);
 186 static int pcap_activate_bpf(pcap_t *p);
 187 static int pcap_setfilter_bpf(pcap_t *p, struct bpf_program *fp);
 188 static int pcap_setdirection_bpf(pcap_t *, pcap_direction_t);
 189 static int pcap_set_datalink_bpf(pcap_t *p, int dlt);
 190
 191 #ifdef HAVE_ZEROCOPY_BPF
 192 /*
 193  * For zerocopy bpf, we need to override the setnonblock/getnonblock routines
 194  * so we don't call select(2) if the pcap handle is in non-blocking mode.  We
 195  * preserve the timeout supplied by pcap_open functions to make sure it
 196  * does not get clobbered if the pcap handle moves between blocking and non-
 197  * blocking mode.
 198  */
 199 static int
 200 pcap_getnonblock_zbuf(pcap_t *p, char *errbuf)
 201 {
 202         /*
 203          * Use a negative value for the timeout to represent that the
 204          * pcap handle is in non-blocking mode.
 205          */
 206         return (p->md.timeout < 0);
 207 }
 208
 209 static int
 210 pcap_setnonblock_zbuf(pcap_t *p, int nonblock, char *errbuf)
 211 {
 212         /*
 213          * Map each value to the corresponding 2's complement, to
 214          * preserve the timeout value provided with pcap_set_timeout.
 215          * (from pcap-linux.c).
 216          */
 217         if (nonblock) {
 218                 if (p->md.timeout >= 0) {
 219                         /*
 220                          * Timeout is non-negative, so we're not already
 221                          * in non-blocking mode; set it to the 2's
 222                          * complement, to make it negative, as an
 223                          * indication that we're in non-blocking mode.
 224                          */
 225                         p->md.timeout = p->md.timeout * -1 - 1;
 226                 }
 227         } else {
 228                 if (p->md.timeout < 0) {
 229                         /*
 230                          * Timeout is negative, so we're not already
 231                          * in blocking mode; reverse the previous
 232                          * operation, to make the timeout non-negative
 233                          * again.
 234                          */
 235                         p->md.timeout = (p->md.timeout + 1) * -1;
 236                 }
 237         }
 238         return (0);
 239 }
 240
 241 /*
 242  * Zero-copy specific close method.  Un-map the shared buffers then call
 243  * pcap_cleanup_live_common.
 244  */
 245 static void
 246 pcap_cleanup_zbuf(pcap_t *p)
 247 {
 248         /*
 249          * Delete the mappings.  Note that p->buffer gets initialized to one
 250          * of the mmapped regions in this case, so do not try and free it
 251          * directly; null it out so that pcap_cleanup_live_common() doesn't
 252          * try to free it.
 253          */
 254         if (p->md.zbuf1 != MAP_FAILED && p->md.zbuf1 != NULL)
 255                 (void) munmap(p->md.zbuf1, p->md.zbufsize);
 256         if (p->md.zbuf2 != MAP_FAILED && p->md.zbuf2 != NULL)
 257                 (void) munmap(p->md.zbuf2, p->md.zbufsize);
 258         p->buffer = NULL;
 259         pcap_cleanup_live_common(p);
 260 }
 261
 262 /*
 263  * Zero-copy BPF buffer routines to check for and acknowledge BPF data in
 264  * shared memory buffers.
 265  *
 266  * pcap_next_zbuf_shm(): Check for a newly available shared memory buffer,
 267  * and set up p->buffer and cc to reflect one if available.  Notice that if
 268  * there was no prior buffer, we select zbuf1 as this will be the first
 269  * buffer filled for a fresh BPF session.
 270  */
 271 static int
 272 pcap_next_zbuf_shm(pcap_t *p, int *cc)
 273 {
 274         struct bpf_zbuf_header *bzh;
 275
 276         if (p->md.zbuffer == p->md.zbuf2 || p->md.zbuffer == NULL) {
 277                 bzh = (struct bpf_zbuf_header *)p->md.zbuf1;
 278                 if (bzh->bzh_user_gen !=
 279                     atomic_load_acq_int(&bzh->bzh_kernel_gen)) {
 280                         p->md.bzh = bzh;
 281                         p->md.zbuffer = (u_char *)p->md.zbuf1;
 282                         p->buffer = p->md.zbuffer + sizeof(*bzh);
 283                         *cc = bzh->bzh_kernel_len;
 284                         return (1);
 285                 }
 286         } else if (p->md.zbuffer == p->md.zbuf1) {
 287                 bzh = (struct bpf_zbuf_header *)p->md.zbuf2;
 288                 if (bzh->bzh_user_gen !=
 289                     atomic_load_acq_int(&bzh->bzh_kernel_gen)) {
 290                         p->md.bzh = bzh;
 291                         p->md.zbuffer = (u_char *)p->md.zbuf2;
 292                         p->buffer = p->md.zbuffer + sizeof(*bzh);
 293                         *cc = bzh->bzh_kernel_len;
 294                         return (1);
 295                 }
 296         }
 297         *cc = 0;
 298         return (0);
 299 }
 300
 301 /*
 302  * pcap_next_zbuf() -- Similar to pcap_next_zbuf_shm(), except wait using
 303  * select() for data or a timeout, and possibly force rotation of the buffer
 304  * in the event we time out or are in immediate mode.  Invoke the shared
 305  * memory check before doing system calls in order to avoid doing avoidable
 306  * work.
 307  */
 308 static int
 309 pcap_next_zbuf(pcap_t *p, int *cc)
 310 {
 311         struct bpf_zbuf bz;
 312         struct timeval tv;
 313         struct timespec cur;
 314         fd_set r_set;
 315         int data, r;
 316         int expire, tmout;
 317
 318 #define TSTOMILLI(ts) (((ts)->tv_sec * 1000) + ((ts)->tv_nsec / 1000000))
 319         /*
 320          * Start out by seeing whether anything is waiting by checking the
 321          * next shared memory buffer for data.
 322          */
 323         data = pcap_next_zbuf_shm(p, cc);
 324         if (data)
 325                 return (data);
 326         /*
 327          * If a previous sleep was interrupted due to signal delivery, make
 328          * sure that the timeout gets adjusted accordingly.  This requires
 329          * that we analyze when the timeout should be been expired, and
 330          * subtract the current time from that.  If after this operation,
 331          * our timeout is less then or equal to zero, handle it like a
 332          * regular timeout.
 333          */
 334         tmout = p->md.timeout;
 335         if (tmout)
 336                 (void) clock_gettime(CLOCK_MONOTONIC, &cur);
 337         if (p->md.interrupted && p->md.timeout) {
 338                 expire = TSTOMILLI(&p->md.firstsel) + p->md.timeout;
 339                 tmout = expire - TSTOMILLI(&cur);
 340 #undef TSTOMILLI
 341                 if (tmout <= 0) {
 342                         p->md.interrupted = 0;
 343                         data = pcap_next_zbuf_shm(p, cc);
 344                         if (data)
 345                                 return (data);
 346                         if (ioctl(p->fd, BIOCROTZBUF, &bz) < 0) {
 347                                 (void) snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 348                                     "BIOCROTZBUF: %s", strerror(errno));
 349                                 return (PCAP_ERROR);
 350                         }
 351                         return (pcap_next_zbuf_shm(p, cc));
 352                 }
 353         }
 354         /*
 355          * No data in the buffer, so must use select() to wait for data or
 356          * the next timeout.  Note that we only call select if the handle
 357          * is in blocking mode.
 358          */
 359         if (p->md.timeout >= 0) {
 360                 FD_ZERO(&r_set);
 361                 FD_SET(p->fd, &r_set);
 362                 if (tmout != 0) {
 363                         tv.tv_sec = tmout / 1000;
 364                         tv.tv_usec = (tmout * 1000) % 1000000;
 365                 }
 366                 r = select(p->fd + 1, &r_set, NULL, NULL,
 367                     p->md.timeout != 0 ? &tv : NULL);
 368                 if (r < 0 && errno == EINTR) {
 369                         if (!p->md.interrupted && p->md.timeout) {
 370                                 p->md.interrupted = 1;
 371                                 p->md.firstsel = cur;
 372                         }
 373                         return (0);
 374                 } else if (r < 0) {
 375                         (void) snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 376                             "select: %s", strerror(errno));
 377                         return (PCAP_ERROR);
 378                 }
 379         }
 380         p->md.interrupted = 0;
 381         /*
 382          * Check again for data, which may exist now that we've either been
 383          * woken up as a result of data or timed out.  Try the "there's data"
 384          * case first since it doesn't require a system call.
 385          */
 386         data = pcap_next_zbuf_shm(p, cc);
 387         if (data)
 388                 return (data);
 389         /*
 390          * Try forcing a buffer rotation to dislodge timed out or immediate
 391          * data.
 392          */
 393         if (ioctl(p->fd, BIOCROTZBUF, &bz) < 0) {
 394                 (void) snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 395                     "BIOCROTZBUF: %s", strerror(errno));
 396                 return (PCAP_ERROR);
 397         }
 398         return (pcap_next_zbuf_shm(p, cc));
 399 }
 400
 401 /*
 402  * Notify kernel that we are done with the buffer.  We don't reset zbuffer so
 403  * that we know which buffer to use next time around.
 404  */
 405 static int
 406 pcap_ack_zbuf(pcap_t *p)
 407 {
 408
 409         atomic_store_rel_int(&p->md.bzh->bzh_user_gen,
 410             p->md.bzh->bzh_kernel_gen);
 411         p->md.bzh = NULL;
 412         p->buffer = NULL;
 413         return (0);
 414 }
 415 #endif
 416
 417 pcap_t *
 418 pcap_create(const char *device, char *ebuf)
 419 {
 420         pcap_t *p;
 421
 422 #ifdef HAVE_DAG_API
 423         if (strstr(device, "dag"))
 424                 return (dag_create(device, ebuf));
 425 #endif /* HAVE_DAG_API */
 426 #ifdef HAVE_SNF_API
 427         if (strstr(device, "snf"))
 428                 return (snf_create(device, ebuf));
 429 #endif /* HAVE_SNF_API */
 430
 431         p = pcap_create_common(device, ebuf);
 432         if (p == NULL)
 433                 return (NULL);
 434
 435         p->activate_op = pcap_activate_bpf;
 436         p->can_set_rfmon_op = pcap_can_set_rfmon_bpf;
 437         return (p);
 438 }
 439
 440 static int
 441 bpf_open(pcap_t *p)
 442 {
 443         int fd;
 444 #ifdef HAVE_CLONING_BPF
 445         static const char device[] = "/dev/bpf";
 446 #else
 447         int n = 0;
 448         char device[sizeof "/dev/bpf0000000000"];
 449 #endif
 450
 451 #ifdef _AIX
 452         /*
 453          * Load the bpf driver, if it isn't already loaded,
 454          * and create the BPF device entries, if they don't
 455          * already exist.
 456          */
 457         if (bpf_load(p->errbuf) == PCAP_ERROR)
 458                 return (PCAP_ERROR);
 459 #endif
 460
 461 #ifdef HAVE_CLONING_BPF
 462         if ((fd = open(device, O_RDWR)) == -1 &&
 463             (errno != EACCES || (fd = open(device, O_RDONLY)) == -1)) {
 464                 if (errno == EACCES)
 465                         fd = PCAP_ERROR_PERM_DENIED;
 466                 else
 467                         fd = PCAP_ERROR;
 468                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 469                   "(cannot open device) %s: %s", device, pcap_strerror(errno));
 470         }
 471 #else
 472         /*
 473          * Go through all the minors and find one that isn't in use.
 474          */
 475         do {
 476                 (void)snprintf(device, sizeof(device), "/dev/bpf%d", n++);
 477                 /*
 478                  * Initially try a read/write open (to allow the inject
 479                  * method to work).  If that fails due to permission
 480                  * issues, fall back to read-only.  This allows a
 481                  * non-root user to be granted specific access to pcap
 482                  * capabilities via file permissions.
 483                  *
 484                  * XXX - we should have an API that has a flag that
 485                  * controls whether to open read-only or read-write,
 486                  * so that denial of permission to send (or inability
 487                  * to send, if sending packets isn't supported on
 488                  * the device in question) can be indicated at open
 489                  * time.
 490                  */
 491                 fd = open(device, O_RDWR);
 492                 if (fd == -1 && errno == EACCES)
 493                         fd = open(device, O_RDONLY);
 494         } while (fd < 0 && errno == EBUSY);
 495
 496         /*
 497          * XXX better message for all minors used
 498          */
 499         if (fd < 0) {
 500                 if (errno == EACCES)
 501                         fd = PCAP_ERROR_PERM_DENIED;
 502                 else
 503                         fd = PCAP_ERROR;
 504                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "(no devices found) %s: %s",
 505                     device, pcap_strerror(errno));
 506         }
 507 #endif
 508
 509         return (fd);
 510 }
 511
 512 #ifdef BIOCGDLTLIST
 513 static int
 514 get_dlt_list(int fd, int v, struct bpf_dltlist *bdlp, char *ebuf)
 515 {
 516         memset(bdlp, 0, sizeof(*bdlp));
 517         if (ioctl(fd, BIOCGDLTLIST, (caddr_t)bdlp) == 0) {
 518                 u_int i;
 519                 int is_ethernet;
 520
 521                 bdlp->bfl_list = (u_int *) malloc(sizeof(u_int) * (bdlp->bfl_len + 1));
 522                 if (bdlp->bfl_list == NULL) {
 523                         (void)snprintf(ebuf, PCAP_ERRBUF_SIZE, "malloc: %s",
 524                             pcap_strerror(errno));
 525                         return (PCAP_ERROR);
 526                 }
 527
 528                 if (ioctl(fd, BIOCGDLTLIST, (caddr_t)bdlp) < 0) {
 529                         (void)snprintf(ebuf, PCAP_ERRBUF_SIZE,
 530                             "BIOCGDLTLIST: %s", pcap_strerror(errno));
 531                         free(bdlp->bfl_list);
 532                         return (PCAP_ERROR);
 533                 }
 534
 535                 /*
 536                  * OK, for real Ethernet devices, add DLT_DOCSIS to the
 537                  * list, so that an application can let you choose it,
 538                  * in case you're capturing DOCSIS traffic that a Cisco
 539                  * Cable Modem Termination System is putting out onto
 540                  * an Ethernet (it doesn't put an Ethernet header onto
 541                  * the wire, it puts raw DOCSIS frames out on the wire
 542                  * inside the low-level Ethernet framing).
 543                  *
 544                  * A "real Ethernet device" is defined here as a device
 545                  * that has a link-layer type of DLT_EN10MB and that has
 546                  * no alternate link-layer types; that's done to exclude
 547                  * 802.11 interfaces (which might or might not be the
 548                  * right thing to do, but I suspect it is - Ethernet <->
 549                  * 802.11 bridges would probably badly mishandle frames
 550                  * that don't have Ethernet headers).
 551                  *
 552                  * On Solaris with BPF, Ethernet devices also offer
 553                  * DLT_IPNET, so we, if DLT_IPNET is defined, we don't
 554                  * treat it as an indication that the device isn't an
 555                  * Ethernet.
 556                  */
 557                 if (v == DLT_EN10MB) {
 558                         is_ethernet = 1;
 559                         for (i = 0; i < bdlp->bfl_len; i++) {
 560                                 if (bdlp->bfl_list[i] != DLT_EN10MB
 561 #ifdef DLT_IPNET
 562                                     && bdlp->bfl_list[i] != DLT_IPNET
 563 #endif
 564                                     ) {
 565                                         is_ethernet = 0;
 566                                         break;
 567                                 }
 568                         }
 569                         if (is_ethernet) {
 570                                 /*
 571                                  * We reserved one more slot at the end of
 572                                  * the list.
 573                                  */
 574                                 bdlp->bfl_list[bdlp->bfl_len] = DLT_DOCSIS;
 575                                 bdlp->bfl_len++;
 576                         }
 577                 }
 578         } else {
 579                 /*
 580                  * EINVAL just means "we don't support this ioctl on
 581                  * this device"; don't treat it as an error.
 582                  */
 583                 if (errno != EINVAL) {
 584                         (void)snprintf(ebuf, PCAP_ERRBUF_SIZE,
 585                             "BIOCGDLTLIST: %s", pcap_strerror(errno));
 586                         return (PCAP_ERROR);
 587                 }
 588         }
 589         return (0);
 590 }
 591 #endif
 592
 593 static int
 594 pcap_can_set_rfmon_bpf(pcap_t *p)
 595 {
 596 #if defined(__APPLE__)
 597         struct utsname osinfo;
 598         struct ifreq ifr;
 599         int fd;
 600 #ifdef BIOCGDLTLIST
 601         struct bpf_dltlist bdl;
 602 #endif
 603
 604         /*
 605          * The joys of monitor mode on OS X.
 606          *
 607          * Prior to 10.4, it's not supported at all.
 608          *
 609          * In 10.4, if adapter enN supports monitor mode, there's a
 610          * wltN adapter corresponding to it; you open it, instead of
 611          * enN, to get monitor mode.  You get whatever link-layer
 612          * headers it supplies.
 613          *
 614          * In 10.5, and, we assume, later releases, if adapter enN
 615          * supports monitor mode, it offers, among its selectable
 616          * DLT_ values, values that let you get the 802.11 header;
 617          * selecting one of those values puts the adapter into monitor
 618          * mode (i.e., you can't get 802.11 headers except in monitor
 619          * mode, and you can't get Ethernet headers in monitor mode).
 620          */
 621         if (uname(&osinfo) == -1) {
 622                 /*
 623                  * Can't get the OS version; just say "no".
 624                  */
 625                 return (0);
 626         }
 627         /*
 628          * We assume osinfo.sysname is "Darwin", because
 629          * __APPLE__ is defined.  We just check the version.
 630          */
 631         if (osinfo.release[0] < '8' && osinfo.release[1] == '.') {
 632                 /*
 633                  * 10.3 (Darwin 7.x) or earlier.
 634                  * Monitor mode not supported.
 635                  */
 636                 return (0);
 637         }
 638         if (osinfo.release[0] == '8' && osinfo.release[1] == '.') {
 639                 /*
 640                  * 10.4 (Darwin 8.x).  s/en/wlt/, and check
 641                  * whether the device exists.
 642                  */
 643                 if (strncmp(p->opt.source, "en", 2) != 0) {
 644                         /*
 645                          * Not an enN device; no monitor mode.
 646                          */
 647                         return (0);
 648                 }
 649                 fd = socket(AF_INET, SOCK_DGRAM, 0);
 650                 if (fd == -1) {
 651                         (void)snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 652                             "socket: %s", pcap_strerror(errno));
 653                         return (PCAP_ERROR);
 654                 }
 655                 strlcpy(ifr.ifr_name, "wlt", sizeof(ifr.ifr_name));
 656                 strlcat(ifr.ifr_name, p->opt.source + 2, sizeof(ifr.ifr_name));
 657                 if (ioctl(fd, SIOCGIFFLAGS, (char *)&ifr) < 0) {
 658                         /*
 659                          * No such device?
 660                          */
 661                         close(fd);
 662                         return (0);
 663                 }
 664                 close(fd);
 665                 return (1);
 666         }
 667
 668 #ifdef BIOCGDLTLIST
 669         /*
 670          * Everything else is 10.5 or later; for those,
 671          * we just open the enN device, and check whether
 672          * we have any 802.11 devices.
 673          *
 674          * First, open a BPF device.
 675          */
 676         fd = bpf_open(p);
 677         if (fd < 0)
 678                 return (fd);
 679
 680         /*
 681          * Now bind to the device.
 682          */
 683         (void)strncpy(ifr.ifr_name, p->opt.source, sizeof(ifr.ifr_name));
 684         if (ioctl(fd, BIOCSETIF, (caddr_t)&ifr) < 0) {
 685                 if (errno == ENETDOWN) {
 686                         /*
 687                          * Return a "network down" indication, so that
 688                          * the application can report that rather than
 689                          * saying we had a mysterious failure and
 690                          * suggest that they report a problem to the
 691                          * libpcap developers.
 692                          */
 693                         close(fd);
 694                         return (PCAP_ERROR_IFACE_NOT_UP);
 695                 } else {
 696                         snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 697                             "BIOCSETIF: %s: %s",
 698                             p->opt.source, pcap_strerror(errno));
 699                         close(fd);
 700                         return (PCAP_ERROR);
 701                 }
 702         }
 703
 704         /*
 705          * We know the default link type -- now determine all the DLTs
 706          * this interface supports.  If this fails with EINVAL, it's
 707          * not fatal; we just don't get to use the feature later.
 708          * (We don't care about DLT_DOCSIS, so we pass DLT_NULL
 709          * as the default DLT for this adapter.)
 710          */
 711         if (get_dlt_list(fd, DLT_NULL, &bdl, p->errbuf) == PCAP_ERROR) {
 712                 close(fd);
 713                 return (PCAP_ERROR);
 714         }
 715         if (find_802_11(&bdl) != -1) {
 716                 /*
 717                  * We have an 802.11 DLT, so we can set monitor mode.
 718                  */
 719                 free(bdl.bfl_list);
 720                 close(fd);
 721                 return (1);
 722         }
 723         free(bdl.bfl_list);
 724 #endif /* BIOCGDLTLIST */
 725         return (0);
 726 #elif defined(HAVE_BSD_IEEE80211)
 727         int ret;
 728
 729         ret = monitor_mode(p, 0);
 730         if (ret == PCAP_ERROR_RFMON_NOTSUP)
 731                 return (0);     /* not an error, just a "can't do" */
 732         if (ret == 0)
 733                 return (1);     /* success */
 734         return (ret);
 735 #else
 736         return (0);
 737 #endif
 738 }
 739
 740 static int
 741 pcap_stats_bpf(pcap_t *p, struct pcap_stat *ps)
 742 {
 743         struct bpf_stat s;
 744
 745         /*
 746          * "ps_recv" counts packets handed to the filter, not packets
 747          * that passed the filter.  This includes packets later dropped
 748          * because we ran out of buffer space.
 749          *
 750          * "ps_drop" counts packets dropped inside the BPF device
 751          * because we ran out of buffer space.  It doesn't count
 752          * packets dropped by the interface driver.  It counts
 753          * only packets that passed the filter.
 754          *
 755          * Both statistics include packets not yet read from the kernel
 756          * by libpcap, and thus not yet seen by the application.
 757          */
 758         if (ioctl(p->fd, BIOCGSTATS, (caddr_t)&s) < 0) {
 759                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "BIOCGSTATS: %s",
 760                     pcap_strerror(errno));
 761                 return (PCAP_ERROR);
 762         }
 763
 764         ps->ps_recv = s.bs_recv;
 765         ps->ps_drop = s.bs_drop;
 766         ps->ps_ifdrop = 0;
 767         return (0);
 768 }
 769
 770 static int
 771 pcap_read_bpf(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
 772 {
 773         int cc;
 774         int n = 0;
 775         register u_char *bp, *ep;
 776         u_char *datap;
 777 #ifdef PCAP_FDDIPAD
 778         register int pad;
 779 #endif
 780 #ifdef HAVE_ZEROCOPY_BPF
 781         int i;
 782 #endif
 783
 784  again:
 785         /*
 786          * Has "pcap_breakloop()" been called?
 787          */
 788         if (p->break_loop) {
 789                 /*
 790                  * Yes - clear the flag that indicates that it
 791                  * has, and return PCAP_ERROR_BREAK to indicate
 792                  * that we were told to break out of the loop.
 793                  */
 794                 p->break_loop = 0;
 795                 return (PCAP_ERROR_BREAK);
 796         }
 797         cc = p->cc;
 798         if (p->cc == 0) {
 799                 /*
 800                  * When reading without zero-copy from a file descriptor, we
 801                  * use a single buffer and return a length of data in the
 802                  * buffer.  With zero-copy, we update the p->buffer pointer
 803                  * to point at whatever underlying buffer contains the next
 804                  * data and update cc to reflect the data found in the
 805                  * buffer.
 806                  */
 807 #ifdef HAVE_ZEROCOPY_BPF
 808                 if (p->md.zerocopy) {
 809                         if (p->buffer != NULL)
 810                                 pcap_ack_zbuf(p);
 811                         i = pcap_next_zbuf(p, &cc);
 812                         if (i == 0)
 813                                 goto again;
 814                         if (i < 0)
 815                                 return (PCAP_ERROR);
 816                 } else
 817 #endif
 818                 {
 819                         cc = read(p->fd, (char *)p->buffer, p->bufsize);
 820                 }
 821                 if (cc < 0) {
 822                         /* Don't choke when we get ptraced */
 823                         switch (errno) {
 824
 825                         case EINTR:
 826                                 goto again;
 827
 828 #ifdef _AIX
 829                         case EFAULT:
 830                                 /*
 831                                  * Sigh.  More AIX wonderfulness.
 832                                  *
 833                                  * For some unknown reason the uiomove()
 834                                  * operation in the bpf kernel extension
 835                                  * used to copy the buffer into user
 836                                  * space sometimes returns EFAULT. I have
 837                                  * no idea why this is the case given that
 838                                  * a kernel debugger shows the user buffer
 839                                  * is correct. This problem appears to
 840                                  * be mostly mitigated by the memset of
 841                                  * the buffer before it is first used.
 842                                  * Very strange.... Shaun Clowes
 843                                  *
 844                                  * In any case this means that we shouldn't
 845                                  * treat EFAULT as a fatal error; as we
 846                                  * don't have an API for returning
 847                                  * a "some packets were dropped since
 848                                  * the last packet you saw" indication,
 849                                  * we just ignore EFAULT and keep reading.
 850                                  */
 851                                 goto again;
 852 #endif
 853
 854                         case EWOULDBLOCK:
 855                                 return (0);
 856
 857                         case ENXIO:
 858                                 /*
 859                                  * The device on which we're capturing
 860                                  * went away.
 861                                  *
 862                                  * XXX - we should really return
 863                                  * PCAP_ERROR_IFACE_NOT_UP, but
 864                                  * pcap_dispatch() etc. aren't
 865                                  * defined to retur that.
 866                                  */
 867                                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 868                                     "The interface went down");
 869                                 return (PCAP_ERROR);
 870
 871 #if defined(sun) && !defined(BSD) && !defined(__svr4__) && !defined(__SVR4)
 872                         /*
 873                          * Due to a SunOS bug, after 2^31 bytes, the kernel
 874                          * file offset overflows and read fails with EINVAL.
 875                          * The lseek() to 0 will fix things.
 876                          */
 877                         case EINVAL:
 878                                 if (lseek(p->fd, 0L, SEEK_CUR) +
 879                                     p->bufsize < 0) {
 880                                         (void)lseek(p->fd, 0L, SEEK_SET);
 881                                         goto again;
 882                                 }
 883                                 /* fall through */
 884 #endif
 885                         }
 886                         snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "read: %s",
 887                             pcap_strerror(errno));
 888                         return (PCAP_ERROR);
 889                 }
 890                 bp = p->buffer;
 891         } else
 892                 bp = p->bp;
 893
 894         /*
 895          * Loop through each packet.
 896          */
 897 #define bhp ((struct bpf_hdr *)bp)
 898         ep = bp + cc;
 899 #ifdef PCAP_FDDIPAD
 900         pad = p->fddipad;
 901 #endif
 902         while (bp < ep) {
 903                 register int caplen, hdrlen;
 904
 905                 /*
 906                  * Has "pcap_breakloop()" been called?
 907                  * If so, return immediately - if we haven't read any
 908                  * packets, clear the flag and return PCAP_ERROR_BREAK
 909                  * to indicate that we were told to break out of the loop,
 910                  * otherwise leave the flag set, so that the *next* call
 911                  * will break out of the loop without having read any
 912                  * packets, and return the number of packets we've
 913                  * processed so far.
 914                  */
 915                 if (p->break_loop) {
 916                         if (n == 0) {
 917                                 p->break_loop = 0;
 918                                 return (PCAP_ERROR_BREAK);
 919                         } else {
 920                                 p->bp = bp;
 921                                 p->cc = ep - bp;
 922                                 return (n);
 923                         }
 924                 }
 925
 926                 caplen = bhp->bh_caplen;
 927                 hdrlen = bhp->bh_hdrlen;
 928                 datap = bp + hdrlen;
 929                 /*
 930                  * Short-circuit evaluation: if using BPF filter
 931                  * in kernel, no need to do it now - we already know
 932                  * the packet passed the filter.
 933                  *
 934 #ifdef PCAP_FDDIPAD
 935                  * Note: the filter code was generated assuming
 936                  * that p->fddipad was the amount of padding
 937                  * before the header, as that's what's required
 938                  * in the kernel, so we run the filter before
 939                  * skipping that padding.
 940 #endif
 941                  */
 942                 if (p->md.use_bpf ||
 943                     bpf_filter(p->fcode.bf_insns, datap, bhp->bh_datalen, caplen)) {
 944                         struct pcap_pkthdr pkthdr;
 945
 946                         pkthdr.ts.tv_sec = bhp->bh_tstamp.tv_sec;
 947 #ifdef _AIX
 948                         /*
 949                          * AIX's BPF returns seconds/nanoseconds time
 950                          * stamps, not seconds/microseconds time stamps.
 951                          */
 952                         pkthdr.ts.tv_usec = bhp->bh_tstamp.tv_usec/1000;
 953 #else
 954                         pkthdr.ts.tv_usec = bhp->bh_tstamp.tv_usec;
 955 #endif
 956 #ifdef PCAP_FDDIPAD
 957                         if (caplen > pad)
 958                                 pkthdr.caplen = caplen - pad;
 959                         else
 960                                 pkthdr.caplen = 0;
 961                         if (bhp->bh_datalen > pad)
 962                                 pkthdr.len = bhp->bh_datalen - pad;
 963                         else
 964                                 pkthdr.len = 0;
 965                         datap += pad;
 966 #else
 967                         pkthdr.caplen = caplen;
 968                         pkthdr.len = bhp->bh_datalen;
 969 #endif
 970                         (*callback)(user, &pkthdr, datap);
 971                         bp += BPF_WORDALIGN(caplen + hdrlen);
 972                         if (++n >= cnt && cnt > 0) {
 973                                 p->bp = bp;
 974                                 p->cc = ep - bp;
 975                                 return (n);
 976                         }
 977                 } else {
 978                         /*
 979                          * Skip this packet.
 980                          */
 981                         bp += BPF_WORDALIGN(caplen + hdrlen);
 982                 }
 983         }
 984 #undef bhp
 985         p->cc = 0;
 986         return (n);
 987 }
 988
 989 static int
 990 pcap_inject_bpf(pcap_t *p, const void *buf, size_t size)
 991 {
 992         int ret;
 993
 994         ret = write(p->fd, buf, size);
 995 #ifdef __APPLE__
 996         if (ret == -1 && errno == EAFNOSUPPORT) {
 997                 /*
 998                  * In Mac OS X, there's a bug wherein setting the
 999                  * BIOCSHDRCMPLT flag causes writes to fail; see,
1000                  * for example:
1001                  *
1002                  *      http://cerberus.sourcefire.com/~jeff/archives/patches/macosx/BIOCSHDRCMPLT-10.3.3.patch
1003                  *
1004                  * So, if, on OS X, we get EAFNOSUPPORT from the write, we
1005                  * assume it's due to that bug, and turn off that flag
1006                  * and try again.  If we succeed, it either means that
1007                  * somebody applied the fix from that URL, or other patches
1008                  * for that bug from
1009                  *
1010                  *      http://cerberus.sourcefire.com/~jeff/archives/patches/macosx/
1011                  *
1012                  * and are running a Darwin kernel with those fixes, or
1013                  * that Apple fixed the problem in some OS X release.
1014                  */
1015                 u_int spoof_eth_src = 0;
1016
1017                 if (ioctl(p->fd, BIOCSHDRCMPLT, &spoof_eth_src) == -1) {
1018                         (void)snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1019                             "send: can't turn off BIOCSHDRCMPLT: %s",
1020                             pcap_strerror(errno));
1021                         return (PCAP_ERROR);
1022                 }
1023
1024                 /*
1025                  * Now try the write again.
1026                  */
1027                 ret = write(p->fd, buf, size);
1028         }
1029 #endif /* __APPLE__ */
1030         if (ret == -1) {
1031                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "send: %s",
1032                     pcap_strerror(errno));
1033                 return (PCAP_ERROR);
1034         }
1035         return (ret);
1036 }
1037
1038 #ifdef _AIX
1039 static int
1040 bpf_odminit(char *errbuf)
1041 {
1042         char *errstr;
1043
1044         if (odm_initialize() == -1) {
1045                 if (odm_err_msg(odmerrno, &errstr) == -1)
1046                         errstr = "Unknown error";
1047                 snprintf(errbuf, PCAP_ERRBUF_SIZE,
1048                     "bpf_load: odm_initialize failed: %s",
1049                     errstr);
1050                 return (PCAP_ERROR);
1051         }
1052
1053         if ((odmlockid = odm_lock("/etc/objrepos/config_lock", ODM_WAIT)) == -1) {
1054                 if (odm_err_msg(odmerrno, &errstr) == -1)
1055                         errstr = "Unknown error";
1056                 snprintf(errbuf, PCAP_ERRBUF_SIZE,
1057                     "bpf_load: odm_lock of /etc/objrepos/config_lock failed: %s",
1058                     errstr);
1059                 (void)odm_terminate();
1060                 return (PCAP_ERROR);
1061         }
1062
1063         return (0);
1064 }
1065
1066 static int
1067 bpf_odmcleanup(char *errbuf)
1068 {
1069         char *errstr;
1070
1071         if (odm_unlock(odmlockid) == -1) {
1072                 if (errbuf != NULL) {
1073                         if (odm_err_msg(odmerrno, &errstr) == -1)
1074                                 errstr = "Unknown error";
1075                         snprintf(errbuf, PCAP_ERRBUF_SIZE,
1076                             "bpf_load: odm_unlock failed: %s",
1077                             errstr);
1078                 }
1079                 return (PCAP_ERROR);
1080         }
1081
1082         if (odm_terminate() == -1) {
1083                 if (errbuf != NULL) {
1084                         if (odm_err_msg(odmerrno, &errstr) == -1)
1085                                 errstr = "Unknown error";
1086                         snprintf(errbuf, PCAP_ERRBUF_SIZE,
1087                             "bpf_load: odm_terminate failed: %s",
1088                             errstr);
1089                 }
1090                 return (PCAP_ERROR);
1091         }
1092
1093         return (0);
1094 }
1095
1096 static int
1097 bpf_load(char *errbuf)
1098 {
1099         long major;
1100         int *minors;
1101         int numminors, i, rc;
1102         char buf[1024];
1103         struct stat sbuf;
1104         struct bpf_config cfg_bpf;
1105         struct cfg_load cfg_ld;
1106         struct cfg_kmod cfg_km;
1107
1108         /*
1109          * This is very very close to what happens in the real implementation
1110          * but I've fixed some (unlikely) bug situations.
1111          */
1112         if (bpfloadedflag)
1113                 return (0);
1114
1115         if (bpf_odminit(errbuf) == PCAP_ERROR)
1116                 return (PCAP_ERROR);
1117
1118         major = genmajor(BPF_NAME);
1119         if (major == -1) {
1120                 snprintf(errbuf, PCAP_ERRBUF_SIZE,
1121                     "bpf_load: genmajor failed: %s", pcap_strerror(errno));
1122                 (void)bpf_odmcleanup(NULL);
1123                 return (PCAP_ERROR);
1124         }
1125
1126         minors = getminor(major, &numminors, BPF_NAME);
1127         if (!minors) {
1128                 minors = genminor("bpf", major, 0, BPF_MINORS, 1, 1);
1129                 if (!minors) {
1130                         snprintf(errbuf, PCAP_ERRBUF_SIZE,
1131                             "bpf_load: genminor failed: %s",
1132                             pcap_strerror(errno));
1133                         (void)bpf_odmcleanup(NULL);
1134                         return (PCAP_ERROR);
1135                 }
1136         }
1137
1138         if (bpf_odmcleanup(errbuf) == PCAP_ERROR)
1139                 return (PCAP_ERROR);
1140
1141         rc = stat(BPF_NODE "0", &sbuf);
1142         if (rc == -1 && errno != ENOENT) {
1143                 snprintf(errbuf, PCAP_ERRBUF_SIZE,
1144                     "bpf_load: can't stat %s: %s",
1145                     BPF_NODE "0", pcap_strerror(errno));
1146                 return (PCAP_ERROR);
1147         }
1148
1149         if (rc == -1 || getmajor(sbuf.st_rdev) != major) {
1150                 for (i = 0; i < BPF_MINORS; i++) {
1151                         sprintf(buf, "%s%d", BPF_NODE, i);
1152                         unlink(buf);
1153                         if (mknod(buf, S_IRUSR | S_IFCHR, domakedev(major, i)) == -1) {
1154                                 snprintf(errbuf, PCAP_ERRBUF_SIZE,
1155                                     "bpf_load: can't mknod %s: %s",
1156                                     buf, pcap_strerror(errno));
1157                                 return (PCAP_ERROR);
1158                         }
1159                 }
1160         }
1161
1162         /* Check if the driver is loaded */
1163         memset(&cfg_ld, 0x0, sizeof(cfg_ld));
1164         cfg_ld.path = buf;
1165         sprintf(cfg_ld.path, "%s/%s", DRIVER_PATH, BPF_NAME);
1166         if ((sysconfig(SYS_QUERYLOAD, (void *)&cfg_ld, sizeof(cfg_ld)) == -1) ||
1167             (cfg_ld.kmid == 0)) {
1168                 /* Driver isn't loaded, load it now */
1169                 if (sysconfig(SYS_SINGLELOAD, (void *)&cfg_ld, sizeof(cfg_ld)) == -1) {
1170                         snprintf(errbuf, PCAP_ERRBUF_SIZE,
1171                             "bpf_load: could not load driver: %s",
1172                             strerror(errno));
1173                         return (PCAP_ERROR);
1174                 }
1175         }
1176
1177         /* Configure the driver */
1178         cfg_km.cmd = CFG_INIT;
1179         cfg_km.kmid = cfg_ld.kmid;
1180         cfg_km.mdilen = sizeof(cfg_bpf);
1181         cfg_km.mdiptr = (void *)&cfg_bpf;
1182         for (i = 0; i < BPF_MINORS; i++) {
1183                 cfg_bpf.devno = domakedev(major, i);
1184                 if (sysconfig(SYS_CFGKMOD, (void *)&cfg_km, sizeof(cfg_km)) == -1) {
1185                         snprintf(errbuf, PCAP_ERRBUF_SIZE,
1186                             "bpf_load: could not configure driver: %s",
1187                             strerror(errno));
1188                         return (PCAP_ERROR);
1189                 }
1190         }
1191
1192         bpfloadedflag = 1;
1193
1194         return (0);
1195 }
1196 #endif
1197
1198 /*
1199  * Turn off rfmon mode if necessary.
1200  */
1201 static void
1202 pcap_cleanup_bpf(pcap_t *p)
1203 {
1204 #ifdef HAVE_BSD_IEEE80211
1205         int sock;
1206         struct ifmediareq req;
1207         struct ifreq ifr;
1208 #endif
1209
1210         if (p->md.must_do_on_close != 0) {
1211                 /*
1212                  * There's something we have to do when closing this
1213                  * pcap_t.
1214                  */
1215 #ifdef HAVE_BSD_IEEE80211
1216                 if (p->md.must_do_on_close & MUST_CLEAR_RFMON) {
1217                         /*
1218                          * We put the interface into rfmon mode;
1219                          * take it out of rfmon mode.
1220                          *
1221                          * XXX - if somebody else wants it in rfmon
1222                          * mode, this code cannot know that, so it'll take
1223                          * it out of rfmon mode.
1224                          */
1225                         sock = socket(AF_INET, SOCK_DGRAM, 0);
1226                         if (sock == -1) {
1227                                 fprintf(stderr,
1228                                     "Can't restore interface flags (socket() failed: %s).\n"
1229                                     "Please adjust manually.\n",
1230                                     strerror(errno));
1231                         } else {
1232                                 memset(&req, 0, sizeof(req));
1233                                 strncpy(req.ifm_name, p->md.device,
1234                                     sizeof(req.ifm_name));
1235                                 if (ioctl(sock, SIOCGIFMEDIA, &req) < 0) {
1236                                         fprintf(stderr,
1237                                             "Can't restore interface flags (SIOCGIFMEDIA failed: %s).\n"
1238                                             "Please adjust manually.\n",
1239                                             strerror(errno));
1240                                 } else {
1241                                         if (req.ifm_current & IFM_IEEE80211_MONITOR) {
1242                                                 /*
1243                                                  * Rfmon mode is currently on;
1244                                                  * turn it off.
1245                                                  */
1246                                                 memset(&ifr, 0, sizeof(ifr));
1247                                                 (void)strncpy(ifr.ifr_name,
1248                                                     p->md.device,
1249                                                     sizeof(ifr.ifr_name));
1250                                                 ifr.ifr_media =
1251                                                     req.ifm_current & ~IFM_IEEE80211_MONITOR;
1252                                                 if (ioctl(sock, SIOCSIFMEDIA,
1253                                                     &ifr) == -1) {
1254                                                         fprintf(stderr,
1255                                                             "Can't restore interface flags (SIOCSIFMEDIA failed: %s).\n"
1256                                                             "Please adjust manually.\n",
1257                                                             strerror(errno));
1258                                                 }
1259                                         }
1260                                 }
1261                                 close(sock);
1262                         }
1263                 }
1264 #endif /* HAVE_BSD_IEEE80211 */
1265
1266                 /*
1267                  * Take this pcap out of the list of pcaps for which we
1268                  * have to take the interface out of some mode.
1269                  */
1270                 pcap_remove_from_pcaps_to_close(p);
1271                 p->md.must_do_on_close = 0;
1272         }
1273
1274 #ifdef HAVE_ZEROCOPY_BPF
1275         /*
1276          * In zero-copy mode, p->buffer is just a pointer into one of the two
1277          * memory-mapped buffers, so no need to free it.
1278          */
1279         if (p->md.zerocopy) {
1280                 if (p->md.zbuf1 != MAP_FAILED && p->md.zbuf1 != NULL)
1281                         munmap(p->md.zbuf1, p->md.zbufsize);
1282                 if (p->md.zbuf2 != MAP_FAILED && p->md.zbuf2 != NULL)
1283                         munmap(p->md.zbuf2, p->md.zbufsize);
1284         }
1285 #endif
1286         if (p->md.device != NULL) {
1287                 free(p->md.device);
1288                 p->md.device = NULL;
1289         }
1290         pcap_cleanup_live_common(p);
1291 }
1292
1293 static int
1294 check_setif_failure(pcap_t *p, int error)
1295 {
1296 #ifdef __APPLE__
1297         int fd;
1298         struct ifreq ifr;
1299         int err;
1300 #endif
1301
1302         if (error == ENXIO) {
1303                 /*
1304                  * No such device exists.
1305                  */
1306 #ifdef __APPLE__
1307                 if (p->opt.rfmon && strncmp(p->opt.source, "wlt", 3) == 0) {
1308                         /*
1309                          * Monitor mode was requested, and we're trying
1310                          * to open a "wltN" device.  Assume that this
1311                          * is 10.4 and that we were asked to open an
1312                          * "enN" device; if that device exists, return
1313                          * "monitor mode not supported on the device".
1314                          */
1315                         fd = socket(AF_INET, SOCK_DGRAM, 0);
1316                         if (fd != -1) {
1317                                 strlcpy(ifr.ifr_name, "en",
1318                                     sizeof(ifr.ifr_name));
1319                                 strlcat(ifr.ifr_name, p->opt.source + 3,
1320                                     sizeof(ifr.ifr_name));
1321                                 if (ioctl(fd, SIOCGIFFLAGS, (char *)&ifr) < 0) {
1322                                         /*
1323                                          * We assume this failed because
1324                                          * the underlying device doesn't
1325                                          * exist.
1326                                          */
1327                                         err = PCAP_ERROR_NO_SUCH_DEVICE;
1328                                         snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1329                                             "SIOCGIFFLAGS on %s failed: %s",
1330                                             ifr.ifr_name, pcap_strerror(errno));
1331                                 } else {
1332                                         /*
1333                                          * The underlying "enN" device
1334                                          * exists, but there's no
1335                                          * corresponding "wltN" device;
1336                                          * that means that the "enN"
1337                                          * device doesn't support
1338                                          * monitor mode, probably because
1339                                          * it's an Ethernet device rather
1340                                          * than a wireless device.
1341                                          */
1342                                         err = PCAP_ERROR_RFMON_NOTSUP;
1343                                 }
1344                                 close(fd);
1345                         } else {
1346                                 /*
1347                                  * We can't find out whether there's
1348                                  * an underlying "enN" device, so
1349                                  * just report "no such device".
1350                                  */
1351                                 err = PCAP_ERROR_NO_SUCH_DEVICE;
1352                                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1353                                     "socket() failed: %s",
1354                                     pcap_strerror(errno));
1355                         }
1356                         return (err);
1357                 }
1358 #endif
1359                 /*
1360                  * No such device.
1361                  */
1362                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "BIOCSETIF failed: %s",
1363                     pcap_strerror(errno));
1364                 return (PCAP_ERROR_NO_SUCH_DEVICE);
1365         } else if (errno == ENETDOWN) {
1366                 /*
1367                  * Return a "network down" indication, so that
1368                  * the application can report that rather than
1369                  * saying we had a mysterious failure and
1370                  * suggest that they report a problem to the
1371                  * libpcap developers.
1372                  */
1373                 return (PCAP_ERROR_IFACE_NOT_UP);
1374         } else {
1375                 /*
1376                  * Some other error; fill in the error string, and
1377                  * return PCAP_ERROR.
1378                  */
1379                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "BIOCSETIF: %s: %s",
1380                     p->opt.source, pcap_strerror(errno));
1381                 return (PCAP_ERROR);
1382         }
1383 }
1384
1385 /*
1386  * Default capture buffer size.
1387  * 32K isn't very much for modern machines with fast networks; we
1388  * pick .5M, as that's the maximum on at least some systems with BPF.
1389  */
1390 #define DEFAULT_BUFSIZE 524288
1391
1392 static int
1393 pcap_activate_bpf(pcap_t *p)
1394 {
1395         int status = 0;
1396         int fd;
1397         struct ifreq ifr;
1398         struct bpf_version bv;
1399 #ifdef __APPLE__
1400         int sockfd;
1401         char *wltdev = NULL;
1402 #endif
1403 #ifdef BIOCGDLTLIST
1404         struct bpf_dltlist bdl;
1405 #if defined(__APPLE__) || defined(HAVE_BSD_IEEE80211)
1406         int new_dlt;
1407 #endif
1408 #endif /* BIOCGDLTLIST */
1409 #if defined(BIOCGHDRCMPLT) && defined(BIOCSHDRCMPLT)
1410         u_int spoof_eth_src = 1;
1411 #endif
1412         u_int v;
1413         struct bpf_insn total_insn;
1414         struct bpf_program total_prog;
1415         struct utsname osinfo;
1416
1417 #ifdef HAVE_DAG_API
1418         if (strstr(device, "dag")) {
1419                 return dag_open_live(device, snaplen, promisc, to_ms, ebuf);
1420         }
1421 #endif /* HAVE_DAG_API */
1422
1423 #ifdef BIOCGDLTLIST
1424         memset(&bdl, 0, sizeof(bdl));
1425         int have_osinfo = 0;
1426 #ifdef HAVE_ZEROCOPY_BPF
1427         struct bpf_zbuf bz;
1428         u_int bufmode, zbufmax;
1429 #endif
1430
1431         fd = bpf_open(p);
1432         if (fd < 0) {
1433                 status = fd;
1434                 goto bad;
1435         }
1436
1437         p->fd = fd;
1438
1439         if (ioctl(fd, BIOCVERSION, (caddr_t)&bv) < 0) {
1440                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "BIOCVERSION: %s",
1441                     pcap_strerror(errno));
1442                 status = PCAP_ERROR;
1443                 goto bad;
1444         }
1445         if (bv.bv_major != BPF_MAJOR_VERSION ||
1446             bv.bv_minor < BPF_MINOR_VERSION) {
1447                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1448                     "kernel bpf filter out of date");
1449                 status = PCAP_ERROR;
1450                 goto bad;
1451         }
1452
1453         p->md.device = strdup(p->opt.source);
1454         if (p->md.device == NULL) {
1455                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "strdup: %s",
1456                      pcap_strerror(errno));
1457                 status = PCAP_ERROR;
1458                 goto bad;
1459         }
1460
1461         /*
1462          * Try finding a good size for the buffer; 32768 may be too
1463          * big, so keep cutting it in half until we find a size
1464          * that works, or run out of sizes to try.  If the default
1465          * is larger, don't make it smaller.
1466          *
1467          * XXX - there should be a user-accessible hook to set the
1468          * initial buffer size.
1469          * Attempt to find out the version of the OS on which we're running.
1470          */
1471         if (uname(&osinfo) == 0)
1472                 have_osinfo = 1;
1473
1474 #ifdef __APPLE__
1475         /*
1476          * See comment in pcap_can_set_rfmon_bpf() for an explanation
1477          * of why we check the version number.
1478          */
1479         if (p->opt.rfmon) {
1480                 if (have_osinfo) {
1481                         /*
1482                          * We assume osinfo.sysname is "Darwin", because
1483                          * __APPLE__ is defined.  We just check the version.
1484                          */
1485                         if (osinfo.release[0] < '8' &&
1486                             osinfo.release[1] == '.') {
1487                                 /*
1488                                  * 10.3 (Darwin 7.x) or earlier.
1489                                  */
1490                                 status = PCAP_ERROR_RFMON_NOTSUP;
1491                                 goto bad;
1492                         }
1493                         if (osinfo.release[0] == '8' &&
1494                             osinfo.release[1] == '.') {
1495                                 /*
1496                                  * 10.4 (Darwin 8.x).  s/en/wlt/
1497                                  */
1498                                 if (strncmp(p->opt.source, "en", 2) != 0) {
1499                                         /*
1500                                          * Not an enN device; check
1501                                          * whether the device even exists.
1502                                          */
1503                                         sockfd = socket(AF_INET, SOCK_DGRAM, 0);
1504                                         if (sockfd != -1) {
1505                                                 strlcpy(ifr.ifr_name,
1506                                                     p->opt.source,
1507                                                     sizeof(ifr.ifr_name));
1508                                                 if (ioctl(sockfd, SIOCGIFFLAGS,
1509                                                     (char *)&ifr) < 0) {
1510                                                         /*
1511                                                          * We assume this
1512                                                          * failed because
1513                                                          * the underlying
1514                                                          * device doesn't
1515                                                          * exist.
1516                                                          */
1517                                                         status = PCAP_ERROR_NO_SUCH_DEVICE;
1518                                                         snprintf(p->errbuf,
1519                                                             PCAP_ERRBUF_SIZE,
1520                                                             "SIOCGIFFLAGS failed: %s",
1521                                                             pcap_strerror(errno));
1522                                                 } else
1523                                                         status = PCAP_ERROR_RFMON_NOTSUP;
1524                                                 close(sockfd);
1525                                         } else {
1526                                                 /*
1527                                                  * We can't find out whether
1528                                                  * the device exists, so just
1529                                                  * report "no such device".
1530                                                  */
1531                                                 status = PCAP_ERROR_NO_SUCH_DEVICE;
1532                                                 snprintf(p->errbuf,
1533                                                     PCAP_ERRBUF_SIZE,
1534                                                     "socket() failed: %s",
1535                                                     pcap_strerror(errno));
1536                                         }
1537                                         goto bad;
1538                                 }
1539                                 wltdev = malloc(strlen(p->opt.source) + 2);
1540                                 if (wltdev == NULL) {
1541                                         (void)snprintf(p->errbuf,
1542                                             PCAP_ERRBUF_SIZE, "malloc: %s",
1543                                             pcap_strerror(errno));
1544                                         status = PCAP_ERROR;
1545                                         goto bad;
1546                                 }
1547                                 strcpy(wltdev, "wlt");
1548                                 strcat(wltdev, p->opt.source + 2);
1549                                 free(p->opt.source);
1550                                 p->opt.source = wltdev;
1551                         }
1552                         /*
1553                          * Everything else is 10.5 or later; for those,
1554                          * we just open the enN device, and set the DLT.
1555                          */
1556                 }
1557         }
1558 #endif /* __APPLE__ */
1559 #ifdef HAVE_ZEROCOPY_BPF
1560         /*
1561          * If the BPF extension to set buffer mode is present, try setting
1562          * the mode to zero-copy.  If that fails, use regular buffering.  If
1563          * it succeeds but other setup fails, return an error to the user.
1564          */
1565         bufmode = BPF_BUFMODE_ZBUF;
1566         if (ioctl(fd, BIOCSETBUFMODE, (caddr_t)&bufmode) == 0) {
1567                 /*
1568                  * We have zerocopy BPF; use it.
1569                  */
1570                 p->md.zerocopy = 1;
1571
1572                 /*
1573                  * Set the cleanup and set/get nonblocking mode ops
1574                  * as appropriate for zero-copy mode.
1575                  */
1576                 p->cleanup_op = pcap_cleanup_zbuf;
1577                 p->setnonblock_op = pcap_setnonblock_zbuf;
1578                 p->getnonblock_op = pcap_getnonblock_zbuf;
1579
1580                 /*
1581                  * How to pick a buffer size: first, query the maximum buffer
1582                  * size supported by zero-copy.  This also lets us quickly
1583                  * determine whether the kernel generally supports zero-copy.
1584                  * Then, if a buffer size was specified, use that, otherwise
1585                  * query the default buffer size, which reflects kernel
1586                  * policy for a desired default.  Round to the nearest page
1587                  * size.
1588                  */
1589                 if (ioctl(fd, BIOCGETZMAX, (caddr_t)&zbufmax) < 0) {
1590                         snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "BIOCGETZMAX: %s",
1591                             pcap_strerror(errno));
1592                         goto bad;
1593                 }
1594
1595                 if (p->opt.buffer_size != 0) {
1596                         /*
1597                          * A buffer size was explicitly specified; use it.
1598                          */
1599                         v = p->opt.buffer_size;
1600                 } else {
1601                         if ((ioctl(fd, BIOCGBLEN, (caddr_t)&v) < 0) ||
1602                             v < DEFAULT_BUFSIZE)
1603                                 v = DEFAULT_BUFSIZE;
1604                 }
1605 #ifndef roundup
1606 #define roundup(x, y)   ((((x)+((y)-1))/(y))*(y))  /* to any y */
1607 #endif
1608                 p->md.zbufsize = roundup(v, getpagesize());
1609                 if (p->md.zbufsize > zbufmax)
1610                         p->md.zbufsize = zbufmax;
1611                 p->md.zbuf1 = mmap(NULL, p->md.zbufsize, PROT_READ | PROT_WRITE,
1612                     MAP_ANON, -1, 0);
1613                 p->md.zbuf2 = mmap(NULL, p->md.zbufsize, PROT_READ | PROT_WRITE,
1614                     MAP_ANON, -1, 0);
1615                 if (p->md.zbuf1 == MAP_FAILED || p->md.zbuf2 == MAP_FAILED) {
1616                         snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "mmap: %s",
1617                             pcap_strerror(errno));
1618                         goto bad;
1619                 }
1620                 bzero(&bz, sizeof(bz));
1621                 bz.bz_bufa = p->md.zbuf1;
1622                 bz.bz_bufb = p->md.zbuf2;
1623                 bz.bz_buflen = p->md.zbufsize;
1624                 if (ioctl(fd, BIOCSETZBUF, (caddr_t)&bz) < 0) {
1625                         snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "BIOCSETZBUF: %s",
1626                             pcap_strerror(errno));
1627                         goto bad;
1628                 }
1629                 (void)strncpy(ifr.ifr_name, p->opt.source, sizeof(ifr.ifr_name));
1630                 if (ioctl(fd, BIOCSETIF, (caddr_t)&ifr) < 0) {
1631                         snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "BIOCSETIF: %s: %s",
1632                             p->opt.source, pcap_strerror(errno));
1633                         goto bad;
1634                 }
1635                 v = p->md.zbufsize - sizeof(struct bpf_zbuf_header);
1636         } else
1637 #endif
1638         {
1639                 /*
1640                  * We don't have zerocopy BPF.
1641                  * Set the buffer size.
1642                  */
1643                 if (p->opt.buffer_size != 0) {
1644                         /*
1645                          * A buffer size was explicitly specified; use it.
1646                          */
1647                         if (ioctl(fd, BIOCSBLEN,
1648                             (caddr_t)&p->opt.buffer_size) < 0) {
1649                                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1650                                     "BIOCSBLEN: %s: %s", p->opt.source,
1651                                     pcap_strerror(errno));
1652                                 status = PCAP_ERROR;
1653                                 goto bad;
1654                         }
1655
1656                         /*
1657                          * Now bind to the device.
1658                          */
1659                         (void)strncpy(ifr.ifr_name, p->opt.source,
1660                             sizeof(ifr.ifr_name));
1661                         if (ioctl(fd, BIOCSETIF, (caddr_t)&ifr) < 0) {
1662                                 status = check_setif_failure(p, errno);
1663                                 goto bad;
1664                         }
1665                 } else {
1666                         /*
1667                          * No buffer size was explicitly specified.
1668                          *
1669                          * Try finding a good size for the buffer;
1670                          * DEFAULT_BUFSIZE may be too big, so keep
1671                          * cutting it in half until we find a size
1672                          * that works, or run out of sizes to try.
1673                          * If the default is larger, don't make it smaller.
1674                          */
1675                         if ((ioctl(fd, BIOCGBLEN, (caddr_t)&v) < 0) ||
1676                             v < DEFAULT_BUFSIZE)
1677                                 v = DEFAULT_BUFSIZE;
1678                         for ( ; v != 0; v >>= 1) {
1679                                 /*
1680                                  * Ignore the return value - this is because the
1681                                  * call fails on BPF systems that don't have
1682                                  * kernel malloc.  And if the call fails, it's
1683                                  * no big deal, we just continue to use the
1684                                  * standard buffer size.
1685                                  */
1686                                 (void) ioctl(fd, BIOCSBLEN, (caddr_t)&v);
1687
1688                                 (void)strncpy(ifr.ifr_name, p->opt.source,
1689                                     sizeof(ifr.ifr_name));
1690                                 if (ioctl(fd, BIOCSETIF, (caddr_t)&ifr) >= 0)
1691                                         break;  /* that size worked; we're done */
1692
1693                                 if (errno != ENOBUFS) {
1694                                         status = check_setif_failure(p, errno);
1695                                         goto bad;
1696                                 }
1697                         }
1698
1699                         if (v == 0) {
1700                                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1701                                     "BIOCSBLEN: %s: No buffer size worked",
1702                                     p->opt.source);
1703                                 status = PCAP_ERROR;
1704                                 goto bad;
1705                         }
1706                 }
1707         }
1708 #endif
1709
1710         /* Get the data link layer type. */
1711         if (ioctl(fd, BIOCGDLT, (caddr_t)&v) < 0) {
1712                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "BIOCGDLT: %s",
1713                     pcap_strerror(errno));
1714                 status = PCAP_ERROR;
1715                 goto bad;
1716         }
1717
1718 #ifdef _AIX
1719         /*
1720          * AIX's BPF returns IFF_ types, not DLT_ types, in BIOCGDLT.
1721          */
1722         switch (v) {
1723
1724         case IFT_ETHER:
1725         case IFT_ISO88023:
1726                 v = DLT_EN10MB;
1727                 break;
1728
1729         case IFT_FDDI:
1730                 v = DLT_FDDI;
1731                 break;
1732
1733         case IFT_ISO88025:
1734                 v = DLT_IEEE802;
1735                 break;
1736
1737         case IFT_LOOP:
1738                 v = DLT_NULL;
1739                 break;
1740
1741         default:
1742                 /*
1743                  * We don't know what to map this to yet.
1744                  */
1745                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "unknown interface type %u",
1746                     v);
1747                 status = PCAP_ERROR;
1748                 goto bad;
1749         }
1750 #endif
1751 #if _BSDI_VERSION - 0 >= 199510
1752         /* The SLIP and PPP link layer header changed in BSD/OS 2.1 */
1753         switch (v) {
1754
1755         case DLT_SLIP:
1756                 v = DLT_SLIP_BSDOS;
1757                 break;
1758
1759         case DLT_PPP:
1760                 v = DLT_PPP_BSDOS;
1761                 break;
1762
1763         case 11:        /*DLT_FR*/
1764                 v = DLT_FRELAY;
1765                 break;
1766
1767         case 12:        /*DLT_C_HDLC*/
1768                 v = DLT_CHDLC;
1769                 break;
1770         }
1771 #endif
1772
1773 #ifdef BIOCGDLTLIST
1774         /*
1775          * We know the default link type -- now determine all the DLTs
1776          * this interface supports.  If this fails with EINVAL, it's
1777          * not fatal; we just don't get to use the feature later.
1778          */
1779         if (get_dlt_list(fd, v, &bdl, p->errbuf) == -1) {
1780                 status = PCAP_ERROR;
1781                 goto bad;
1782         }
1783         p->dlt_count = bdl.bfl_len;
1784         p->dlt_list = bdl.bfl_list;
1785
1786 #ifdef __APPLE__
1787         /*
1788          * Monitor mode fun, continued.
1789          *
1790          * For 10.5 and, we're assuming, later releases, as noted above,
1791          * 802.1 adapters that support monitor mode offer both DLT_EN10MB,
1792          * DLT_IEEE802_11, and possibly some 802.11-plus-radio-information
1793          * DLT_ value.  Choosing one of the 802.11 DLT_ values will turn
1794          * monitor mode on.
1795          *
1796          * Therefore, if the user asked for monitor mode, we filter out
1797          * the DLT_EN10MB value, as you can't get that in monitor mode,
1798          * and, if the user didn't ask for monitor mode, we filter out
1799          * the 802.11 DLT_ values, because selecting those will turn
1800          * monitor mode on.  Then, for monitor mode, if an 802.11-plus-
1801          * radio DLT_ value is offered, we try to select that, otherwise
1802          * we try to select DLT_IEEE802_11.
1803          */
1804         if (have_osinfo) {
1805                 if (isdigit((unsigned)osinfo.release[0]) &&
1806                      (osinfo.release[0] == '9' ||
1807                      isdigit((unsigned)osinfo.release[1]))) {
1808                         /*
1809                          * 10.5 (Darwin 9.x), or later.
1810                          */
1811                         new_dlt = find_802_11(&bdl);
1812                         if (new_dlt != -1) {
1813                                 /*
1814                                  * We have at least one 802.11 DLT_ value,
1815                                  * so this is an 802.11 interface.
1816                                  * new_dlt is the best of the 802.11
1817                                  * DLT_ values in the list.
1818                                  */
1819                                 if (p->opt.rfmon) {
1820                                         /*
1821                                          * Our caller wants monitor mode.
1822                                          * Purge DLT_EN10MB from the list
1823                                          * of link-layer types, as selecting
1824                                          * it will keep monitor mode off.
1825                                          */
1826                                         remove_en(p);
1827
1828                                         /*
1829                                          * If the new mode we want isn't
1830                                          * the default mode, attempt to
1831                                          * select the new mode.
1832                                          */
1833                                         if (new_dlt != v) {
1834                                                 if (ioctl(p->fd, BIOCSDLT,
1835                                                     &new_dlt) != -1) {
1836                                                         /*
1837                                                          * We succeeded;
1838                                                          * make this the
1839                                                          * new DLT_ value.
1840                                                          */
1841                                                         v = new_dlt;
1842                                                 }
1843                                         }
1844                                 } else {
1845                                         /*
1846                                          * Our caller doesn't want
1847                                          * monitor mode.  Unless this
1848                                          * is being done by pcap_open_live(),
1849                                          * purge the 802.11 link-layer types
1850                                          * from the list, as selecting
1851                                          * one of them will turn monitor
1852                                          * mode on.
1853                                          */
1854                                         if (!p->oldstyle)
1855                                                 remove_802_11(p);
1856                                 }
1857                         } else {
1858                                 if (p->opt.rfmon) {
1859                                         /*
1860                                          * The caller requested monitor
1861                                          * mode, but we have no 802.11
1862                                          * link-layer types, so they
1863                                          * can't have it.
1864                                          */
1865                                         status = PCAP_ERROR_RFMON_NOTSUP;
1866                                         goto bad;
1867                                 }
1868                         }
1869                 }
1870         }
1871 #elif defined(HAVE_BSD_IEEE80211)
1872         /*
1873          * *BSD with the new 802.11 ioctls.
1874          * Do we want monitor mode?
1875          */
1876         if (p->opt.rfmon) {
1877                 /*
1878                  * Try to put the interface into monitor mode.
1879                  */
1880                 status = monitor_mode(p, 1);
1881                 if (status != 0) {
1882                         /*
1883                          * We failed.
1884                          */
1885                         goto bad;
1886                 }
1887
1888                 /*
1889                  * We're in monitor mode.
1890                  * Try to find the best 802.11 DLT_ value and, if we
1891                  * succeed, try to switch to that mode if we're not
1892                  * already in that mode.
1893                  */
1894                 new_dlt = find_802_11(&bdl);
1895                 if (new_dlt != -1) {
1896                         /*
1897                          * We have at least one 802.11 DLT_ value.
1898                          * new_dlt is the best of the 802.11
1899                          * DLT_ values in the list.
1900                          *
1901                          * If the new mode we want isn't the default mode,
1902                          * attempt to select the new mode.
1903                          */
1904                         if (new_dlt != v) {
1905                                 if (ioctl(p->fd, BIOCSDLT, &new_dlt) != -1) {
1906                                         /*
1907                                          * We succeeded; make this the
1908                                          * new DLT_ value.
1909                                          */
1910                                         v = new_dlt;
1911                                 }
1912                         }
1913                 }
1914         }
1915 #endif /* various platforms */
1916 #endif /* BIOCGDLTLIST */
1917
1918         /*
1919          * If this is an Ethernet device, and we don't have a DLT_ list,
1920          * give it a list with DLT_EN10MB and DLT_DOCSIS.  (That'd give
1921          * 802.11 interfaces DLT_DOCSIS, which isn't the right thing to
1922          * do, but there's not much we can do about that without finding
1923          * some other way of determining whether it's an Ethernet or 802.11
1924          * device.)
1925          */
1926         if (v == DLT_EN10MB && p->dlt_count == 0) {
1927                 p->dlt_list = (u_int *) malloc(sizeof(u_int) * 2);
1928                 /*
1929                  * If that fails, just leave the list empty.
1930                  */
1931                 if (p->dlt_list != NULL) {
1932                         p->dlt_list[0] = DLT_EN10MB;
1933                         p->dlt_list[1] = DLT_DOCSIS;
1934                         p->dlt_count = 2;
1935                 }
1936         }
1937 #ifdef PCAP_FDDIPAD
1938         if (v == DLT_FDDI)
1939                 p->fddipad = PCAP_FDDIPAD;
1940         else
1941                 p->fddipad = 0;
1942 #endif
1943         p->linktype = v;
1944
1945 #if defined(BIOCGHDRCMPLT) && defined(BIOCSHDRCMPLT)
1946         /*
1947          * Do a BIOCSHDRCMPLT, if defined, to turn that flag on, so
1948          * the link-layer source address isn't forcibly overwritten.
1949          * (Should we ignore errors?  Should we do this only if
1950          * we're open for writing?)
1951          *
1952          * XXX - I seem to remember some packet-sending bug in some
1953          * BSDs - check CVS log for "bpf.c"?
1954          */
1955         if (ioctl(fd, BIOCSHDRCMPLT, &spoof_eth_src) == -1) {
1956                 (void)snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1957                     "BIOCSHDRCMPLT: %s", pcap_strerror(errno));
1958                 status = PCAP_ERROR;
1959                 goto bad;
1960         }
1961 #endif
1962         /* set timeout */
1963 #ifdef HAVE_ZEROCOPY_BPF
1964         if (p->md.timeout != 0 && !p->md.zerocopy) {
1965 #else
1966         if (p->md.timeout) {
1967 #endif
1968                 /*
1969                  * XXX - is this seconds/nanoseconds in AIX?
1970                  * (Treating it as such doesn't fix the timeout
1971                  * problem described below.)
1972                  *
1973                  * XXX - Mac OS X 10.6 mishandles BIOCSRTIMEOUT in
1974                  * 64-bit userland - it takes, as an argument, a
1975                  * "struct BPF_TIMEVAL", which has 32-bit tv_sec
1976                  * and tv_usec, rather than a "struct timeval".
1977                  *
1978                  * If this platform defines "struct BPF_TIMEVAL",
1979                  * we check whether the structure size in BIOCSRTIMEOUT
1980                  * is that of a "struct timeval" and, if not, we use
1981                  * a "struct BPF_TIMEVAL" rather than a "struct timeval".
1982                  * (That way, if the bug is fixed in a future release,
1983                  * we will still do the right thing.)
1984                  */
1985                 struct timeval to;
1986 #ifdef HAVE_STRUCT_BPF_TIMEVAL
1987                 struct BPF_TIMEVAL bpf_to;
1988
1989                 if (IOCPARM_LEN(BIOCSRTIMEOUT) != sizeof(struct timeval)) {
1990                         bpf_to.tv_sec = p->md.timeout / 1000;
1991                         bpf_to.tv_usec = (p->md.timeout * 1000) % 1000000;
1992                         if (ioctl(p->fd, BIOCSRTIMEOUT, (caddr_t)&bpf_to) < 0) {
1993                                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1994                                     "BIOCSRTIMEOUT: %s", pcap_strerror(errno));
1995                                 status = PCAP_ERROR;
1996                                 goto bad;
1997                         }
1998                 } else {
1999 #endif
2000                         to.tv_sec = p->md.timeout / 1000;
2001                         to.tv_usec = (p->md.timeout * 1000) % 1000000;
2002                         if (ioctl(p->fd, BIOCSRTIMEOUT, (caddr_t)&to) < 0) {
2003                                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
2004                                     "BIOCSRTIMEOUT: %s", pcap_strerror(errno));
2005                                 status = PCAP_ERROR;
2006                                 goto bad;
2007                         }
2008 #ifdef HAVE_STRUCT_BPF_TIMEVAL
2009                 }
2010 #endif
2011         }
2012
2013 #ifdef _AIX
2014 #ifdef  BIOCIMMEDIATE
2015         /*
2016          * Darren Reed notes that
2017          *
2018          *      On AIX (4.2 at least), if BIOCIMMEDIATE is not set, the
2019          *      timeout appears to be ignored and it waits until the buffer
2020          *      is filled before returning.  The result of not having it
2021          *      set is almost worse than useless if your BPF filter
2022          *      is reducing things to only a few packets (i.e. one every
2023          *      second or so).
2024          *
2025          * so we turn BIOCIMMEDIATE mode on if this is AIX.
2026          *
2027          * We don't turn it on for other platforms, as that means we
2028          * get woken up for every packet, which may not be what we want;
2029          * in the Winter 1993 USENIX paper on BPF, they say:
2030          *
2031          *      Since a process might want to look at every packet on a
2032          *      network and the time between packets can be only a few
2033          *      microseconds, it is not possible to do a read system call
2034          *      per packet and BPF must collect the data from several
2035          *      packets and return it as a unit when the monitoring
2036          *      application does a read.
2037          *
2038          * which I infer is the reason for the timeout - it means we
2039          * wait that amount of time, in the hopes that more packets
2040          * will arrive and we'll get them all with one read.
2041          *
2042          * Setting BIOCIMMEDIATE mode on FreeBSD (and probably other
2043          * BSDs) causes the timeout to be ignored.
2044          *
2045          * On the other hand, some platforms (e.g., Linux) don't support
2046          * timeouts, they just hand stuff to you as soon as it arrives;
2047          * if that doesn't cause a problem on those platforms, it may
2048          * be OK to have BIOCIMMEDIATE mode on BSD as well.
2049          *
2050          * (Note, though, that applications may depend on the read
2051          * completing, even if no packets have arrived, when the timeout
2052          * expires, e.g. GUI applications that have to check for input
2053          * while waiting for packets to arrive; a non-zero timeout
2054          * prevents "select()" from working right on FreeBSD and
2055          * possibly other BSDs, as the timer doesn't start until a
2056          * "read()" is done, so the timer isn't in effect if the
2057          * application is blocked on a "select()", and the "select()"
2058          * doesn't get woken up for a BPF device until the buffer
2059          * fills up.)
2060          */
2061         v = 1;
2062         if (ioctl(p->fd, BIOCIMMEDIATE, &v) < 0) {
2063                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "BIOCIMMEDIATE: %s",
2064                     pcap_strerror(errno));
2065                 status = PCAP_ERROR;
2066                 goto bad;
2067         }
2068 #endif  /* BIOCIMMEDIATE */
2069 #endif  /* _AIX */
2070
2071         if (p->opt.promisc) {
2072                 /* set promiscuous mode, just warn if it fails */
2073                 if (ioctl(p->fd, BIOCPROMISC, NULL) < 0) {
2074                         snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "BIOCPROMISC: %s",
2075                             pcap_strerror(errno));
2076                         status = PCAP_WARNING_PROMISC_NOTSUP;
2077                 }
2078         }
2079
2080         if (ioctl(fd, BIOCGBLEN, (caddr_t)&v) < 0) {
2081                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "BIOCGBLEN: %s",
2082                     pcap_strerror(errno));
2083                 status = PCAP_ERROR;
2084                 goto bad;
2085         }
2086         p->bufsize = v;
2087 #ifdef HAVE_ZEROCOPY_BPF
2088         if (!p->md.zerocopy) {
2089 #endif
2090         p->buffer = (u_char *)malloc(p->bufsize);
2091         if (p->buffer == NULL) {
2092                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "malloc: %s",
2093                     pcap_strerror(errno));
2094                 status = PCAP_ERROR;
2095                 goto bad;
2096         }
2097 #ifdef _AIX
2098         /* For some strange reason this seems to prevent the EFAULT
2099          * problems we have experienced from AIX BPF. */
2100         memset(p->buffer, 0x0, p->bufsize);
2101 #endif
2102 #ifdef HAVE_ZEROCOPY_BPF
2103         }
2104 #endif
2105
2106         /*
2107          * If there's no filter program installed, there's
2108          * no indication to the kernel of what the snapshot
2109          * length should be, so no snapshotting is done.
2110          *
2111          * Therefore, when we open the device, we install
2112          * an "accept everything" filter with the specified
2113          * snapshot length.
2114          */
2115         total_insn.code = (u_short)(BPF_RET | BPF_K);
2116         total_insn.jt = 0;
2117         total_insn.jf = 0;
2118         total_insn.k = p->snapshot;
2119
2120         total_prog.bf_len = 1;
2121         total_prog.bf_insns = &total_insn;
2122         if (ioctl(p->fd, BIOCSETF, (caddr_t)&total_prog) < 0) {
2123                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "BIOCSETF: %s",
2124                     pcap_strerror(errno));
2125                 status = PCAP_ERROR;
2126                 goto bad;
2127         }
2128
2129         /*
2130          * On most BPF platforms, either you can do a "select()" or
2131          * "poll()" on a BPF file descriptor and it works correctly,
2132          * or you can do it and it will return "readable" if the
2133          * hold buffer is full but not if the timeout expires *and*
2134          * a non-blocking read will, if the hold buffer is empty
2135          * but the store buffer isn't empty, rotate the buffers
2136          * and return what packets are available.
2137          *
2138          * In the latter case, the fact that a non-blocking read
2139          * will give you the available packets means you can work
2140          * around the failure of "select()" and "poll()" to wake up
2141          * and return "readable" when the timeout expires by using
2142          * the timeout as the "select()" or "poll()" timeout, putting
2143          * the BPF descriptor into non-blocking mode, and read from
2144          * it regardless of whether "select()" reports it as readable
2145          * or not.
2146          *
2147          * However, in FreeBSD 4.3 and 4.4, "select()" and "poll()"
2148          * won't wake up and return "readable" if the timer expires
2149          * and non-blocking reads return EWOULDBLOCK if the hold
2150          * buffer is empty, even if the store buffer is non-empty.
2151          *
2152          * This means the workaround in question won't work.
2153          *
2154          * Therefore, on FreeBSD 4.3 and 4.4, we set "p->selectable_fd"
2155          * to -1, which means "sorry, you can't use 'select()' or 'poll()'
2156          * here".  On all other BPF platforms, we set it to the FD for
2157          * the BPF device; in NetBSD, OpenBSD, and Darwin, a non-blocking
2158          * read will, if the hold buffer is empty and the store buffer
2159          * isn't empty, rotate the buffers and return what packets are
2160          * there (and in sufficiently recent versions of OpenBSD
2161          * "select()" and "poll()" should work correctly).
2162          *
2163          * XXX - what about AIX?
2164          */
2165         p->selectable_fd = p->fd;       /* assume select() works until we know otherwise */
2166         if (have_osinfo) {
2167                 /*
2168                  * We can check what OS this is.
2169                  */
2170                 if (strcmp(osinfo.sysname, "FreeBSD") == 0) {
2171                         if (strncmp(osinfo.release, "4.3-", 4) == 0 ||
2172                              strncmp(osinfo.release, "4.4-", 4) == 0)
2173                                 p->selectable_fd = -1;
2174                 }
2175         }
2176
2177         p->read_op = pcap_read_bpf;
2178         p->inject_op = pcap_inject_bpf;
2179         p->setfilter_op = pcap_setfilter_bpf;
2180         p->setdirection_op = pcap_setdirection_bpf;
2181         p->set_datalink_op = pcap_set_datalink_bpf;
2182         p->getnonblock_op = pcap_getnonblock_fd;
2183         p->setnonblock_op = pcap_setnonblock_fd;
2184         p->stats_op = pcap_stats_bpf;
2185         p->cleanup_op = pcap_cleanup_bpf;
2186
2187         return (status);
2188  bad:
2189         pcap_cleanup_bpf(p);
2190         return (status);
2191 }
2192
2193 int
2194 pcap_platform_finddevs(pcap_if_t **alldevsp, char *errbuf)
2195 {
2196 #ifdef HAVE_DAG_API
2197         if (dag_platform_finddevs(alldevsp, errbuf) < 0)
2198                 return (-1);
2199 #endif /* HAVE_DAG_API */
2200 #ifdef HAVE_SNF_API
2201         if (snf_platform_finddevs(alldevsp, errbuf) < 0)
2202                 return (-1);
2203 #endif /* HAVE_SNF_API */
2204
2205         return (0);
2206 }
2207
2208 #ifdef HAVE_BSD_IEEE80211
2209 static int
2210 monitor_mode(pcap_t *p, int set)
2211 {
2212         int sock;
2213         struct ifmediareq req;
2214         int *media_list;
2215         int i;
2216         int can_do;
2217         struct ifreq ifr;
2218
2219         sock = socket(AF_INET, SOCK_DGRAM, 0);
2220         if (sock == -1) {
2221                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "can't open socket: %s",
2222                     pcap_strerror(errno));
2223                 return (PCAP_ERROR);
2224         }
2225
2226         memset(&req, 0, sizeof req);
2227         strncpy(req.ifm_name, p->opt.source, sizeof req.ifm_name);
2228
2229         /*
2230          * Find out how many media types we have.
2231          */
2232         if (ioctl(sock, SIOCGIFMEDIA, &req) < 0) {
2233                 /*
2234                  * Can't get the media types.
2235                  */
2236                 if (errno == EINVAL) {
2237                         /*
2238                          * Interface doesn't support SIOC{G,S}IFMEDIA.
2239                          */
2240                         close(sock);
2241                         return (PCAP_ERROR_RFMON_NOTSUP);
2242                 }
2243                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "SIOCGIFMEDIA 1: %s",
2244                     pcap_strerror(errno));
2245                 close(sock);
2246                 return (PCAP_ERROR);
2247         }
2248         if (req.ifm_count == 0) {
2249                 /*
2250                  * No media types.
2251                  */
2252                 close(sock);
2253                 return (PCAP_ERROR_RFMON_NOTSUP);
2254         }
2255
2256         /*
2257          * Allocate a buffer to hold all the media types, and
2258          * get the media types.
2259          */
2260         media_list = malloc(req.ifm_count * sizeof(int));
2261         if (media_list == NULL) {
2262                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "malloc: %s",
2263                     pcap_strerror(errno));
2264                 close(sock);
2265                 return (PCAP_ERROR);
2266         }
2267         req.ifm_ulist = media_list;
2268         if (ioctl(sock, SIOCGIFMEDIA, &req) < 0) {
2269                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "SIOCGIFMEDIA: %s",
2270                     pcap_strerror(errno));
2271                 free(media_list);
2272                 close(sock);
2273                 return (PCAP_ERROR);
2274         }
2275
2276         /*
2277          * Look for an 802.11 "automatic" media type.
2278          * We assume that all 802.11 adapters have that media type,
2279          * and that it will carry the monitor mode supported flag.
2280          */
2281         can_do = 0;
2282         for (i = 0; i < req.ifm_count; i++) {
2283                 if (IFM_TYPE(media_list[i]) == IFM_IEEE80211
2284                     && IFM_SUBTYPE(media_list[i]) == IFM_AUTO) {
2285                         /* OK, does it do monitor mode? */
2286                         if (media_list[i] & IFM_IEEE80211_MONITOR) {
2287                                 can_do = 1;
2288                                 break;
2289                         }
2290                 }
2291         }
2292         free(media_list);
2293         if (!can_do) {
2294                 /*
2295                  * This adapter doesn't support monitor mode.
2296                  */
2297                 close(sock);
2298                 return (PCAP_ERROR_RFMON_NOTSUP);
2299         }
2300
2301         if (set) {
2302                 /*
2303                  * Don't just check whether we can enable monitor mode,
2304                  * do so, if it's not already enabled.
2305                  */
2306                 if ((req.ifm_current & IFM_IEEE80211_MONITOR) == 0) {
2307                         /*
2308                          * Monitor mode isn't currently on, so turn it on,
2309                          * and remember that we should turn it off when the
2310                          * pcap_t is closed.
2311                          */
2312
2313                         /*
2314                          * If we haven't already done so, arrange to have
2315                          * "pcap_close_all()" called when we exit.
2316                          */
2317                         if (!pcap_do_addexit(p)) {
2318                                 /*
2319                                  * "atexit()" failed; don't put the interface
2320                                  * in monitor mode, just give up.
2321                                  */
2322                                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
2323                                      "atexit failed");
2324                                 close(sock);
2325                                 return (PCAP_ERROR);
2326                         }
2327                         memset(&ifr, 0, sizeof(ifr));
2328                         (void)strncpy(ifr.ifr_name, p->opt.source,
2329                             sizeof(ifr.ifr_name));
2330                         ifr.ifr_media = req.ifm_current | IFM_IEEE80211_MONITOR;
2331                         if (ioctl(sock, SIOCSIFMEDIA, &ifr) == -1) {
2332                                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
2333                                      "SIOCSIFMEDIA: %s", pcap_strerror(errno));
2334                                 close(sock);
2335                                 return (PCAP_ERROR);
2336                         }
2337
2338                         p->md.must_do_on_close |= MUST_CLEAR_RFMON;
2339
2340                         /*
2341                          * Add this to the list of pcaps to close when we exit.
2342                          */
2343                         pcap_add_to_pcaps_to_close(p);
2344                 }
2345         }
2346         return (0);
2347 }
2348 #endif /* HAVE_BSD_IEEE80211 */
2349
2350 #if defined(BIOCGDLTLIST) && (defined(__APPLE__) || defined(HAVE_BSD_IEEE80211))
2351 /*
2352  * Check whether we have any 802.11 link-layer types; return the best
2353  * of the 802.11 link-layer types if we find one, and return -1
2354  * otherwise.
2355  *
2356  * DLT_IEEE802_11_RADIO, with the radiotap header, is considered the
2357  * best 802.11 link-layer type; any of the other 802.11-plus-radio
2358  * headers are second-best; 802.11 with no radio information is
2359  * the least good.
2360  */
2361 static int
2362 find_802_11(struct bpf_dltlist *bdlp)
2363 {
2364         int new_dlt;
2365         int i;
2366
2367         /*
2368          * Scan the list of DLT_ values, looking for 802.11 values,
2369          * and, if we find any, choose the best of them.
2370          */
2371         new_dlt = -1;
2372         for (i = 0; i < bdlp->bfl_len; i++) {
2373                 switch (bdlp->bfl_list[i]) {
2374
2375                 case DLT_IEEE802_11:
2376                         /*
2377                          * 802.11, but no radio.
2378                          *
2379                          * Offer this, and select it as the new mode
2380                          * unless we've already found an 802.11
2381                          * header with radio information.
2382                          */
2383                         if (new_dlt == -1)
2384                                 new_dlt = bdlp->bfl_list[i];
2385                         break;
2386
2387                 case DLT_PRISM_HEADER:
2388                 case DLT_AIRONET_HEADER:
2389                 case DLT_IEEE802_11_RADIO_AVS:
2390                         /*
2391                          * 802.11 with radio, but not radiotap.
2392                          *
2393                          * Offer this, and select it as the new mode
2394                          * unless we've already found the radiotap DLT_.
2395                          */
2396                         if (new_dlt != DLT_IEEE802_11_RADIO)
2397                                 new_dlt = bdlp->bfl_list[i];
2398                         break;
2399
2400                 case DLT_IEEE802_11_RADIO:
2401                         /*
2402                          * 802.11 with radiotap.
2403                          *
2404                          * Offer this, and select it as the new mode.
2405                          */
2406                         new_dlt = bdlp->bfl_list[i];
2407                         break;
2408
2409                 default:
2410                         /*
2411                          * Not 802.11.
2412                          */
2413                         break;
2414                 }
2415         }
2416
2417         return (new_dlt);
2418 }
2419 #endif /* defined(BIOCGDLTLIST) && (defined(__APPLE__) || defined(HAVE_BSD_IEEE80211)) */
2420
2421 #if defined(__APPLE__) && defined(BIOCGDLTLIST)
2422 /*
2423  * Remove DLT_EN10MB from the list of DLT_ values, as we're in monitor mode,
2424  * and DLT_EN10MB isn't supported in monitor mode.
2425  */
2426 static void
2427 remove_en(pcap_t *p)
2428 {
2429         int i, j;
2430
2431         /*
2432          * Scan the list of DLT_ values and discard DLT_EN10MB.
2433          */
2434         j = 0;
2435         for (i = 0; i < p->dlt_count; i++) {
2436                 switch (p->dlt_list[i]) {
2437
2438                 case DLT_EN10MB:
2439                         /*
2440                          * Don't offer this one.
2441                          */
2442                         continue;
2443
2444                 default:
2445                         /*
2446                          * Just copy this mode over.
2447                          */
2448                         break;
2449                 }
2450
2451                 /*
2452                  * Copy this DLT_ value to its new position.
2453                  */
2454                 p->dlt_list[j] = p->dlt_list[i];
2455                 j++;
2456         }
2457
2458         /*
2459          * Set the DLT_ count to the number of entries we copied.
2460          */
2461         p->dlt_count = j;
2462 }
2463
2464 /*
2465  * Remove 802.11 link-layer types from the list of DLT_ values, as
2466  * we're not in monitor mode, and those DLT_ values will switch us
2467  * to monitor mode.
2468  */
2469 static void
2470 remove_802_11(pcap_t *p)
2471 {
2472         int i, j;
2473
2474         /*
2475          * Scan the list of DLT_ values and discard 802.11 values.
2476          */
2477         j = 0;
2478         for (i = 0; i < p->dlt_count; i++) {
2479                 switch (p->dlt_list[i]) {
2480
2481                 case DLT_IEEE802_11:
2482                 case DLT_PRISM_HEADER:
2483                 case DLT_AIRONET_HEADER:
2484                 case DLT_IEEE802_11_RADIO:
2485                 case DLT_IEEE802_11_RADIO_AVS:
2486                         /*
2487                          * 802.11.  Don't offer this one.
2488                          */
2489                         continue;
2490
2491                 default:
2492                         /*
2493                          * Just copy this mode over.
2494                          */
2495                         break;
2496                 }
2497
2498                 /*
2499                  * Copy this DLT_ value to its new position.
2500                  */
2501                 p->dlt_list[j] = p->dlt_list[i];
2502                 j++;
2503         }
2504
2505         /*
2506          * Set the DLT_ count to the number of entries we copied.
2507          */
2508         p->dlt_count = j;
2509 }
2510 #endif /* defined(__APPLE__) && defined(BIOCGDLTLIST) */
2511
2512 static int
2513 pcap_setfilter_bpf(pcap_t *p, struct bpf_program *fp)
2514 {
2515         /*
2516          * Free any user-mode filter we might happen to have installed.
2517          */
2518         pcap_freecode(&p->fcode);
2519
2520         /*
2521          * Try to install the kernel filter.
2522          */
2523         if (ioctl(p->fd, BIOCSETF, (caddr_t)fp) == 0) {
2524                 /*
2525                  * It worked.
2526                  */
2527                 p->md.use_bpf = 1;      /* filtering in the kernel */
2528
2529                 /*
2530                  * Discard any previously-received packets, as they might
2531                  * have passed whatever filter was formerly in effect, but
2532                  * might not pass this filter (BIOCSETF discards packets
2533                  * buffered in the kernel, so you can lose packets in any
2534                  * case).
2535                  */
2536                 p->cc = 0;
2537                 return (0);
2538         }
2539
2540         /*
2541          * We failed.
2542          *
2543          * If it failed with EINVAL, that's probably because the program
2544          * is invalid or too big.  Validate it ourselves; if we like it
2545          * (we currently allow backward branches, to support protochain),
2546          * run it in userland.  (There's no notion of "too big" for
2547          * userland.)
2548          *
2549          * Otherwise, just give up.
2550          * XXX - if the copy of the program into the kernel failed,
2551          * we will get EINVAL rather than, say, EFAULT on at least
2552          * some kernels.
2553          */
2554         if (errno != EINVAL) {
2555                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "BIOCSETF: %s",
2556                     pcap_strerror(errno));
2557                 return (-1);
2558         }
2559
2560         /*
2561          * install_bpf_program() validates the program.
2562          *
2563          * XXX - what if we already have a filter in the kernel?
2564          */
2565         if (install_bpf_program(p, fp) < 0)
2566                 return (-1);
2567         p->md.use_bpf = 0;      /* filtering in userland */
2568         return (0);
2569 }
2570
2571 /*
2572  * Set direction flag: Which packets do we accept on a forwarding
2573  * single device? IN, OUT or both?
2574  */
2575 static int
2576 pcap_setdirection_bpf(pcap_t *p, pcap_direction_t d)
2577 {
2578 #if defined(BIOCSDIRECTION)
2579         u_int direction;
2580
2581         direction = (d == PCAP_D_IN) ? BPF_D_IN :
2582             ((d == PCAP_D_OUT) ? BPF_D_OUT : BPF_D_INOUT);
2583         if (ioctl(p->fd, BIOCSDIRECTION, &direction) == -1) {
2584                 (void) snprintf(p->errbuf, sizeof(p->errbuf),
2585                     "Cannot set direction to %s: %s",
2586                         (d == PCAP_D_IN) ? "PCAP_D_IN" :
2587                         ((d == PCAP_D_OUT) ? "PCAP_D_OUT" : "PCAP_D_INOUT"),
2588                         strerror(errno));
2589                 return (-1);
2590         }
2591         return (0);
2592 #elif defined(BIOCSSEESENT)
2593         u_int seesent;
2594
2595         /*
2596          * We don't support PCAP_D_OUT.
2597          */
2598         if (d == PCAP_D_OUT) {
2599                 snprintf(p->errbuf, sizeof(p->errbuf),
2600                     "Setting direction to PCAP_D_OUT is not supported on BPF");
2601                 return -1;
2602         }
2603
2604         seesent = (d == PCAP_D_INOUT);
2605         if (ioctl(p->fd, BIOCSSEESENT, &seesent) == -1) {
2606                 (void) snprintf(p->errbuf, sizeof(p->errbuf),
2607                     "Cannot set direction to %s: %s",
2608                         (d == PCAP_D_INOUT) ? "PCAP_D_INOUT" : "PCAP_D_IN",
2609                         strerror(errno));
2610                 return (-1);
2611         }
2612         return (0);
2613 #else
2614         (void) snprintf(p->errbuf, sizeof(p->errbuf),
2615             "This system doesn't support BIOCSSEESENT, so the direction can't be set");
2616         return (-1);
2617 #endif
2618 }
2619
2620 static int
2621 pcap_set_datalink_bpf(pcap_t *p, int dlt)
2622 {
2623 #ifdef BIOCSDLT
2624         if (ioctl(p->fd, BIOCSDLT, &dlt) == -1) {
2625                 (void) snprintf(p->errbuf, sizeof(p->errbuf),
2626                     "Cannot set DLT %d: %s", dlt, strerror(errno));
2627                 return (-1);
2628         }
2629 #endif
2630         return (0);
2631 }