117683Spst/* 217683Spst * Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996 317683Spst * The Regents of the University of California. All rights reserved. 417683Spst * 517683Spst * Redistribution and use in source and binary forms, with or without 617683Spst * modification, are permitted provided that: (1) source code distributions 717683Spst * retain the above copyright notice and this paragraph in its entirety, (2) 817683Spst * distributions including binary code include the above copyright notice and 917683Spst * this paragraph in its entirety in the documentation or other materials 1017683Spst * provided with the distribution, and (3) all advertising materials mentioning 1117683Spst * features or use of this software display the following acknowledgement: 1217683Spst * ``This product includes software developed by the University of California, 1317683Spst * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of 1417683Spst * the University nor the names of its contributors may be used to endorse 1517683Spst * or promote products derived from this software without specific prior 1617683Spst * written permission. 1717683Spst * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED 1817683Spst * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF 1917683Spst * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 2026175Sfenner * 2126175Sfenner * packet filter subroutines for tcpdump 2226175Sfenner * Extraction/creation by Jeffrey Mogul, DECWRL 2317683Spst */ 2426175Sfenner 2517683Spst#ifndef lint 26127664Sbmsstatic const char rcsid[] _U_ = 27214518Srpaulo "@(#) $Header: /tcpdump/master/libpcap/pcap-pf.c,v 1.97 2008-04-14 20:40:58 guy Exp $ (LBL)"; 2817683Spst#endif 2917683Spst 3075107Sfenner#ifdef HAVE_CONFIG_H 3175107Sfenner#include "config.h" 3275107Sfenner#endif 3375107Sfenner 3417683Spst#include <sys/types.h> 3517683Spst#include <sys/time.h> 3617683Spst#include <sys/timeb.h> 3717683Spst#include <sys/socket.h> 3817683Spst#include <sys/file.h> 3917683Spst#include <sys/ioctl.h> 4017683Spst#include <net/pfilt.h> 4117683Spst 4217683Spststruct mbuf; 4317683Spststruct rtentry; 4417683Spst#include <net/if.h> 4517683Spst 4617683Spst#include <netinet/in.h> 4717683Spst#include <netinet/in_systm.h> 4817683Spst#include <netinet/ip.h> 4917683Spst#include <netinet/if_ether.h> 5017683Spst#include <netinet/ip_var.h> 5117683Spst#include <netinet/udp.h> 5217683Spst#include <netinet/udp_var.h> 5317683Spst#include <netinet/tcp.h> 5417683Spst#include <netinet/tcpip.h> 5517683Spst 5617683Spst#include <ctype.h> 5717683Spst#include <errno.h> 5817683Spst#include <netdb.h> 5917683Spst#include <stdio.h> 6017683Spst#include <stdlib.h> 6117683Spst#include <string.h> 6217683Spst#include <unistd.h> 6317683Spst 64127664Sbms/* 65190225Srpaulo * Make "pcap.h" not include "pcap/bpf.h"; we are going to include the 66127664Sbms * native OS version, as we need various BPF ioctls from it. 67127664Sbms */ 68127664Sbms#define PCAP_DONT_INCLUDE_PCAP_BPF_H 69127664Sbms#include <net/bpf.h> 70127664Sbms 7117683Spst#include "pcap-int.h" 7217683Spst 7317683Spst#ifdef HAVE_OS_PROTO_H 7417683Spst#include "os-proto.h" 7517683Spst#endif 7617683Spst 77127664Sbmsstatic int pcap_setfilter_pf(pcap_t *, struct bpf_program *); 78127664Sbms 7917683Spst/* 8017683Spst * BUFSPACE is the size in bytes of the packet read buffer. Most tcpdump 8117683Spst * applications aren't going to need more than 200 bytes of packet header 8217683Spst * and the read shouldn't return more packets than packetfilter's internal 8317683Spst * queue limit (bounded at 256). 8417683Spst */ 8517683Spst#define BUFSPACE (200 * 256) 8617683Spst 87127664Sbmsstatic int 88127664Sbmspcap_read_pf(pcap_t *pc, int cnt, pcap_handler callback, u_char *user) 8917683Spst{ 9017683Spst register u_char *p, *bp; 9117683Spst register int cc, n, buflen, inc; 9217683Spst register struct enstamp *sp; 9317683Spst#ifdef LBL_ALIGN 9417683Spst struct enstamp stamp; 9517683Spst#endif 9617683Spst#ifdef PCAP_FDDIPAD 9717683Spst register int pad; 9817683Spst#endif 9917683Spst 10017683Spst again: 10117683Spst cc = pc->cc; 10217683Spst if (cc == 0) { 10317683Spst cc = read(pc->fd, (char *)pc->buffer + pc->offset, pc->bufsize); 10417683Spst if (cc < 0) { 10517683Spst if (errno == EWOULDBLOCK) 10617683Spst return (0); 10717683Spst if (errno == EINVAL && 10817683Spst lseek(pc->fd, 0L, SEEK_CUR) + pc->bufsize < 0) { 10917683Spst /* 11017683Spst * Due to a kernel bug, after 2^31 bytes, 11117683Spst * the kernel file offset overflows and 11217683Spst * read fails with EINVAL. The lseek() 11317683Spst * to 0 will fix things. 11417683Spst */ 11517683Spst (void)lseek(pc->fd, 0L, SEEK_SET); 11617683Spst goto again; 11717683Spst } 11875107Sfenner snprintf(pc->errbuf, sizeof(pc->errbuf), "pf read: %s", 11917683Spst pcap_strerror(errno)); 12017683Spst return (-1); 12117683Spst } 12217683Spst bp = pc->buffer + pc->offset; 12317683Spst } else 12417683Spst bp = pc->bp; 12517683Spst /* 12617683Spst * Loop through each packet. 12717683Spst */ 12817683Spst n = 0; 12917683Spst#ifdef PCAP_FDDIPAD 130147894Ssam pad = pc->fddipad; 13117683Spst#endif 13217683Spst while (cc > 0) { 133127664Sbms /* 134127664Sbms * Has "pcap_breakloop()" been called? 135127664Sbms * If so, return immediately - if we haven't read any 136127664Sbms * packets, clear the flag and return -2 to indicate 137127664Sbms * that we were told to break out of the loop, otherwise 138127664Sbms * leave the flag set, so that the *next* call will break 139127664Sbms * out of the loop without having read any packets, and 140127664Sbms * return the number of packets we've processed so far. 141127664Sbms */ 142127664Sbms if (pc->break_loop) { 143127664Sbms if (n == 0) { 144127664Sbms pc->break_loop = 0; 145127664Sbms return (-2); 146127664Sbms } else { 147127664Sbms pc->cc = cc; 148127664Sbms pc->bp = bp; 149127664Sbms return (n); 150127664Sbms } 151127664Sbms } 15217683Spst if (cc < sizeof(*sp)) { 15375107Sfenner snprintf(pc->errbuf, sizeof(pc->errbuf), 15475107Sfenner "pf short read (%d)", cc); 15517683Spst return (-1); 15617683Spst } 15717683Spst#ifdef LBL_ALIGN 15817683Spst if ((long)bp & 3) { 15917683Spst sp = &stamp; 16017683Spst memcpy((char *)sp, (char *)bp, sizeof(*sp)); 16117683Spst } else 16217683Spst#endif 16317683Spst sp = (struct enstamp *)bp; 16417683Spst if (sp->ens_stamplen != sizeof(*sp)) { 16575107Sfenner snprintf(pc->errbuf, sizeof(pc->errbuf), 16675107Sfenner "pf short stamplen (%d)", 16717683Spst sp->ens_stamplen); 16817683Spst return (-1); 16917683Spst } 17017683Spst 17117683Spst p = bp + sp->ens_stamplen; 17217683Spst buflen = sp->ens_count; 17317683Spst if (buflen > pc->snapshot) 17417683Spst buflen = pc->snapshot; 17517683Spst 17617683Spst /* Calculate inc before possible pad update */ 17717683Spst inc = ENALIGN(buflen + sp->ens_stamplen); 17817683Spst cc -= inc; 17917683Spst bp += inc; 18017683Spst pc->md.TotPkts++; 18117683Spst pc->md.TotDrops += sp->ens_dropped; 18217683Spst pc->md.TotMissed = sp->ens_ifoverflows; 18317683Spst if (pc->md.OrigMissed < 0) 18417683Spst pc->md.OrigMissed = pc->md.TotMissed; 18517683Spst 18617683Spst /* 18717683Spst * Short-circuit evaluation: if using BPF filter 188190225Srpaulo * in kernel, no need to do it now - we already know 189190225Srpaulo * the packet passed the filter. 190146768Ssam * 191146768Ssam#ifdef PCAP_FDDIPAD 192146768Ssam * Note: the filter code was generated assuming 193147894Ssam * that pc->fddipad was the amount of padding 194146768Ssam * before the header, as that's what's required 195146768Ssam * in the kernel, so we run the filter before 196146768Ssam * skipping that padding. 197146768Ssam#endif 19817683Spst */ 199190225Srpaulo if (pc->md.use_bpf || 200190225Srpaulo bpf_filter(pc->fcode.bf_insns, p, sp->ens_count, buflen)) { 20117683Spst struct pcap_pkthdr h; 20217683Spst pc->md.TotAccepted++; 20317683Spst h.ts = sp->ens_tstamp; 20417683Spst#ifdef PCAP_FDDIPAD 20517683Spst h.len = sp->ens_count - pad; 20617683Spst#else 20717683Spst h.len = sp->ens_count; 20817683Spst#endif 209146768Ssam#ifdef PCAP_FDDIPAD 210146768Ssam p += pad; 211146768Ssam buflen -= pad; 212146768Ssam#endif 21317683Spst h.caplen = buflen; 21417683Spst (*callback)(user, &h, p); 21517683Spst if (++n >= cnt && cnt > 0) { 21617683Spst pc->cc = cc; 21717683Spst pc->bp = bp; 21817683Spst return (n); 21917683Spst } 22017683Spst } 22117683Spst } 22217683Spst pc->cc = 0; 22317683Spst return (n); 22417683Spst} 22517683Spst 226127664Sbmsstatic int 227146768Ssampcap_inject_pf(pcap_t *p, const void *buf, size_t size) 228146768Ssam{ 229146768Ssam int ret; 230146768Ssam 231146768Ssam ret = write(p->fd, buf, size); 232146768Ssam if (ret == -1) { 233146768Ssam snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "send: %s", 234146768Ssam pcap_strerror(errno)); 235146768Ssam return (-1); 236146768Ssam } 237146768Ssam return (ret); 238146768Ssam} 239146768Ssam 240146768Ssamstatic int 241127664Sbmspcap_stats_pf(pcap_t *p, struct pcap_stat *ps) 24217683Spst{ 24317683Spst 24498530Sfenner /* 24598530Sfenner * If packet filtering is being done in the kernel: 24698530Sfenner * 24798530Sfenner * "ps_recv" counts only packets that passed the filter. 24898530Sfenner * This does not include packets dropped because we 24998530Sfenner * ran out of buffer space. (XXX - perhaps it should, 25098530Sfenner * by adding "ps_drop" to "ps_recv", for compatibility 25198530Sfenner * with some other platforms. On the other hand, on 25298530Sfenner * some platforms "ps_recv" counts only packets that 25398530Sfenner * passed the filter, and on others it counts packets 25498530Sfenner * that didn't pass the filter....) 25598530Sfenner * 25698530Sfenner * "ps_drop" counts packets that passed the kernel filter 25798530Sfenner * (if any) but were dropped because the input queue was 25898530Sfenner * full. 25998530Sfenner * 26098530Sfenner * "ps_ifdrop" counts packets dropped by the network 26198530Sfenner * inteface (regardless of whether they would have passed 26298530Sfenner * the input filter, of course). 26398530Sfenner * 26498530Sfenner * If packet filtering is not being done in the kernel: 26598530Sfenner * 26698530Sfenner * "ps_recv" counts only packets that passed the filter. 26798530Sfenner * 26898530Sfenner * "ps_drop" counts packets that were dropped because the 26998530Sfenner * input queue was full, regardless of whether they passed 27098530Sfenner * the userland filter. 27198530Sfenner * 27298530Sfenner * "ps_ifdrop" counts packets dropped by the network 27398530Sfenner * inteface (regardless of whether they would have passed 27498530Sfenner * the input filter, of course). 27598530Sfenner * 27698530Sfenner * These statistics don't include packets not yet read from 27798530Sfenner * the kernel by libpcap, but they may include packets not 27898530Sfenner * yet read from libpcap by the application. 27998530Sfenner */ 28017683Spst ps->ps_recv = p->md.TotAccepted; 28117683Spst ps->ps_drop = p->md.TotDrops; 28217683Spst ps->ps_ifdrop = p->md.TotMissed - p->md.OrigMissed; 28317683Spst return (0); 28417683Spst} 28517683Spst 286146768Ssam/* 287190225Srpaulo * We include the OS's <net/bpf.h>, not our "pcap/bpf.h", so we probably 288146768Ssam * don't get DLT_DOCSIS defined. 289146768Ssam */ 290146768Ssam#ifndef DLT_DOCSIS 291146768Ssam#define DLT_DOCSIS 143 292146768Ssam#endif 293127664Sbms 294190225Srpaulostatic int 295190225Srpaulopcap_activate_pf(pcap_t *p) 29617683Spst{ 29717683Spst short enmode; 29817683Spst int backlog = -1; /* request the most */ 29917683Spst struct enfilter Filter; 30017683Spst struct endevp devparams; 30117683Spst 302127664Sbms /* 303146768Ssam * Initially try a read/write open (to allow the inject 304146768Ssam * method to work). If that fails due to permission 305146768Ssam * issues, fall back to read-only. This allows a 306146768Ssam * non-root user to be granted specific access to pcap 307146768Ssam * capabilities via file permissions. 308146768Ssam * 309146768Ssam * XXX - we should have an API that has a flag that 310146768Ssam * controls whether to open read-only or read-write, 311146768Ssam * so that denial of permission to send (or inability 312146768Ssam * to send, if sending packets isn't supported on 313146768Ssam * the device in question) can be indicated at open 314146768Ssam * time. 315146768Ssam * 316127664Sbms * XXX - we assume here that "pfopen()" does not, in fact, modify 317127664Sbms * its argument, even though it takes a "char *" rather than a 318127664Sbms * "const char *" as its first argument. That appears to be 319127664Sbms * the case, at least on Digital UNIX 4.0. 320127664Sbms */ 321190225Srpaulo p->fd = pfopen(p->opt.source, O_RDWR); 322146768Ssam if (p->fd == -1 && errno == EACCES) 323190225Srpaulo p->fd = pfopen(p->opt.source, O_RDONLY); 32417683Spst if (p->fd < 0) { 325190225Srpaulo snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "pf open: %s: %s\n\ 326127664Sbmsyour system may not be properly configured; see the packetfilter(4) man page\n", 327190225Srpaulo p->opt.source, pcap_strerror(errno)); 32817683Spst goto bad; 32917683Spst } 33017683Spst p->md.OrigMissed = -1; 33117683Spst enmode = ENTSTAMP|ENBATCH|ENNONEXCL; 332190225Srpaulo if (p->opt.promisc) 33317683Spst enmode |= ENPROMISC; 33417683Spst if (ioctl(p->fd, EIOCMBIS, (caddr_t)&enmode) < 0) { 335190225Srpaulo snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "EIOCMBIS: %s", 33675107Sfenner pcap_strerror(errno)); 33717683Spst goto bad; 33817683Spst } 33917683Spst#ifdef ENCOPYALL 34017683Spst /* Try to set COPYALL mode so that we see packets to ourself */ 34117683Spst enmode = ENCOPYALL; 34217683Spst (void)ioctl(p->fd, EIOCMBIS, (caddr_t)&enmode);/* OK if this fails */ 34317683Spst#endif 34417683Spst /* set the backlog */ 34517683Spst if (ioctl(p->fd, EIOCSETW, (caddr_t)&backlog) < 0) { 346190225Srpaulo snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "EIOCSETW: %s", 34775107Sfenner pcap_strerror(errno)); 34817683Spst goto bad; 34917683Spst } 35017683Spst /* discover interface type */ 35117683Spst if (ioctl(p->fd, EIOCDEVP, (caddr_t)&devparams) < 0) { 352190225Srpaulo snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "EIOCDEVP: %s", 35375107Sfenner pcap_strerror(errno)); 35417683Spst goto bad; 35517683Spst } 35617683Spst /* HACK: to compile prior to Ultrix 4.2 */ 35717683Spst#ifndef ENDT_FDDI 35817683Spst#define ENDT_FDDI 4 35917683Spst#endif 36017683Spst switch (devparams.end_dev_type) { 36117683Spst 36217683Spst case ENDT_10MB: 36317683Spst p->linktype = DLT_EN10MB; 36417683Spst p->offset = 2; 365146768Ssam /* 366146768Ssam * This is (presumably) a real Ethernet capture; give it a 367146768Ssam * link-layer-type list with DLT_EN10MB and DLT_DOCSIS, so 368146768Ssam * that an application can let you choose it, in case you're 369146768Ssam * capturing DOCSIS traffic that a Cisco Cable Modem 370146768Ssam * Termination System is putting out onto an Ethernet (it 371146768Ssam * doesn't put an Ethernet header onto the wire, it puts raw 372146768Ssam * DOCSIS frames out on the wire inside the low-level 373146768Ssam * Ethernet framing). 374146768Ssam */ 375146768Ssam p->dlt_list = (u_int *) malloc(sizeof(u_int) * 2); 376146768Ssam /* 377146768Ssam * If that fails, just leave the list empty. 378146768Ssam */ 379146768Ssam if (p->dlt_list != NULL) { 380146768Ssam p->dlt_list[0] = DLT_EN10MB; 381146768Ssam p->dlt_list[1] = DLT_DOCSIS; 382146768Ssam p->dlt_count = 2; 383146768Ssam } 38417683Spst break; 38517683Spst 38617683Spst case ENDT_FDDI: 38717683Spst p->linktype = DLT_FDDI; 38817683Spst break; 38917683Spst 39098530Sfenner#ifdef ENDT_SLIP 39198530Sfenner case ENDT_SLIP: 39298530Sfenner p->linktype = DLT_SLIP; 39398530Sfenner break; 39498530Sfenner#endif 39598530Sfenner 39698530Sfenner#ifdef ENDT_PPP 39798530Sfenner case ENDT_PPP: 39898530Sfenner p->linktype = DLT_PPP; 39998530Sfenner break; 40098530Sfenner#endif 40198530Sfenner 40298530Sfenner#ifdef ENDT_LOOPBACK 40398530Sfenner case ENDT_LOOPBACK: 40417683Spst /* 40598530Sfenner * It appears to use Ethernet framing, at least on 40698530Sfenner * Digital UNIX 4.0. 40717683Spst */ 40817683Spst p->linktype = DLT_EN10MB; 40917683Spst p->offset = 2; 41017683Spst break; 41198530Sfenner#endif 41298530Sfenner 41398530Sfenner#ifdef ENDT_TRN 41498530Sfenner case ENDT_TRN: 41598530Sfenner p->linktype = DLT_IEEE802; 41698530Sfenner break; 41798530Sfenner#endif 41898530Sfenner 41998530Sfenner default: 42098530Sfenner /* 42198530Sfenner * XXX - what about ENDT_IEEE802? The pfilt.h header 42298530Sfenner * file calls this "IEEE 802 networks (non-Ethernet)", 42398530Sfenner * but that doesn't specify a specific link layer type; 42498530Sfenner * it could be 802.4, or 802.5 (except that 802.5 is 42598530Sfenner * ENDT_TRN), or 802.6, or 802.11, or.... That's why 42698530Sfenner * DLT_IEEE802 was hijacked to mean Token Ring in various 42798530Sfenner * BSDs, and why we went along with that hijacking. 42898530Sfenner * 42998530Sfenner * XXX - what about ENDT_HDLC and ENDT_NULL? 43098530Sfenner * Presumably, as ENDT_OTHER is just "Miscellaneous 43198530Sfenner * framing", there's not much we can do, as that 43298530Sfenner * doesn't specify a particular type of header. 43398530Sfenner */ 434190225Srpaulo snprintf(p->errbuf, PCAP_ERRBUF_SIZE, 435190225Srpaulo "unknown data-link type %u", devparams.end_dev_type); 43698530Sfenner goto bad; 43717683Spst } 43817683Spst /* set truncation */ 43917683Spst#ifdef PCAP_FDDIPAD 440146768Ssam if (p->linktype == DLT_FDDI) { 441147894Ssam p->fddipad = PCAP_FDDIPAD; 442146768Ssam 44317683Spst /* packetfilter includes the padding in the snapshot */ 444190225Srpaulo p->snapshot += PCAP_FDDIPAD; 445146768Ssam } else 446146768Ssam p->fddipad = 0; 44717683Spst#endif 448190225Srpaulo if (ioctl(p->fd, EIOCTRUNCATE, (caddr_t)&p->snapshot) < 0) { 449190225Srpaulo snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "EIOCTRUNCATE: %s", 45075107Sfenner pcap_strerror(errno)); 45117683Spst goto bad; 45217683Spst } 45317683Spst /* accept all packets */ 45475107Sfenner memset(&Filter, 0, sizeof(Filter)); 45517683Spst Filter.enf_Priority = 37; /* anything > 2 */ 45617683Spst Filter.enf_FilterLen = 0; /* means "always true" */ 45717683Spst if (ioctl(p->fd, EIOCSETF, (caddr_t)&Filter) < 0) { 458190225Srpaulo snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "EIOCSETF: %s", 45975107Sfenner pcap_strerror(errno)); 46017683Spst goto bad; 46117683Spst } 46217683Spst 463190225Srpaulo if (p->md.timeout != 0) { 46417683Spst struct timeval timeout; 465190225Srpaulo timeout.tv_sec = p->md.timeout / 1000; 466190225Srpaulo timeout.tv_usec = (p->md.timeout * 1000) % 1000000; 46717683Spst if (ioctl(p->fd, EIOCSRTIMEOUT, (caddr_t)&timeout) < 0) { 468190225Srpaulo snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "EIOCSRTIMEOUT: %s", 46917683Spst pcap_strerror(errno)); 47017683Spst goto bad; 47117683Spst } 47217683Spst } 473127664Sbms 47417683Spst p->bufsize = BUFSPACE; 47517683Spst p->buffer = (u_char*)malloc(p->bufsize + p->offset); 476127664Sbms if (p->buffer == NULL) { 477190225Srpaulo strlcpy(p->errbuf, pcap_strerror(errno), PCAP_ERRBUF_SIZE); 478127664Sbms goto bad; 479127664Sbms } 48017683Spst 481127664Sbms /* 482127664Sbms * "select()" and "poll()" work on packetfilter devices. 483127664Sbms */ 484127664Sbms p->selectable_fd = p->fd; 485127664Sbms 486127664Sbms p->read_op = pcap_read_pf; 487146768Ssam p->inject_op = pcap_inject_pf; 488127664Sbms p->setfilter_op = pcap_setfilter_pf; 489147894Ssam p->setdirection_op = NULL; /* Not implemented. */ 490127664Sbms p->set_datalink_op = NULL; /* can't change data link type */ 491127664Sbms p->getnonblock_op = pcap_getnonblock_fd; 492127664Sbms p->setnonblock_op = pcap_setnonblock_fd; 493127664Sbms p->stats_op = pcap_stats_pf; 494127664Sbms 495190225Srpaulo return (0); 49617683Spst bad: 497214518Srpaulo pcap_cleanup_live_common(p); 498190225Srpaulo return (PCAP_ERROR); 49917683Spst} 50017683Spst 501190225Srpaulopcap_t * 502251129Sdelphijpcap_create_interface(const char *device, char *ebuf) 503190225Srpaulo{ 504190225Srpaulo pcap_t *p; 505190225Srpaulo 506190225Srpaulo p = pcap_create_common(device, ebuf); 507190225Srpaulo if (p == NULL) 508190225Srpaulo return (NULL); 509190225Srpaulo 510190225Srpaulo p->activate_op = pcap_activate_pf; 511190225Srpaulo return (p); 512190225Srpaulo} 513190225Srpaulo 51417683Spstint 515127664Sbmspcap_platform_finddevs(pcap_if_t **alldevsp, char *errbuf) 51617683Spst{ 517127664Sbms return (0); 518127664Sbms} 519127664Sbms 520127664Sbmsstatic int 521127664Sbmspcap_setfilter_pf(pcap_t *p, struct bpf_program *fp) 522127664Sbms{ 523127664Sbms struct bpf_version bv; 524127664Sbms 52517683Spst /* 526127664Sbms * See if BIOCVERSION works. If not, we assume the kernel doesn't 527127664Sbms * support BPF-style filters (it's not documented in the bpf(7) 528127664Sbms * or packetfiler(7) man pages, but the code used to fail if 529127664Sbms * BIOCSETF worked but BIOCVERSION didn't, and I've seen it do 530127664Sbms * kernel filtering in DU 4.0, so presumably BIOCVERSION works 531127664Sbms * there, at least). 53217683Spst */ 533127664Sbms if (ioctl(p->fd, BIOCVERSION, (caddr_t)&bv) >= 0) { 534127664Sbms /* 535127664Sbms * OK, we have the version of the BPF interpreter; 536127664Sbms * is it the same major version as us, and the same 537127664Sbms * or better minor version? 538127664Sbms */ 539127664Sbms if (bv.bv_major == BPF_MAJOR_VERSION && 540127664Sbms bv.bv_minor >= BPF_MINOR_VERSION) { 541127664Sbms /* 542127664Sbms * Yes. Try to install the filter. 543127664Sbms */ 544127664Sbms if (ioctl(p->fd, BIOCSETF, (caddr_t)fp) < 0) { 545127664Sbms snprintf(p->errbuf, sizeof(p->errbuf), 546127664Sbms "BIOCSETF: %s", pcap_strerror(errno)); 547127664Sbms return (-1); 548127664Sbms } 54917683Spst 550127664Sbms /* 551127664Sbms * OK, that succeeded. We're doing filtering in 552127664Sbms * the kernel. (We assume we don't have a 553127664Sbms * userland filter installed - that'd require 554127664Sbms * a previous version check to have failed but 555127664Sbms * this one to succeed.) 556127664Sbms * 557127664Sbms * XXX - this message should be supplied to the 558127664Sbms * application as a warning of some sort, 559127664Sbms * except that if it's a GUI application, it's 560127664Sbms * not clear that it should be displayed in 561127664Sbms * a window to annoy the user. 562127664Sbms */ 563127664Sbms fprintf(stderr, "tcpdump: Using kernel BPF filter\n"); 564127664Sbms p->md.use_bpf = 1; 565146768Ssam 566146768Ssam /* 567146768Ssam * Discard any previously-received packets, 568146768Ssam * as they might have passed whatever filter 569146768Ssam * was formerly in effect, but might not pass 570146768Ssam * this filter (BIOCSETF discards packets buffered 571146768Ssam * in the kernel, so you can lose packets in any 572146768Ssam * case). 573146768Ssam */ 574146768Ssam p->cc = 0; 575127664Sbms return (0); 57617683Spst } 577127664Sbms 578127664Sbms /* 579127664Sbms * We can't use the kernel's BPF interpreter; don't give 580127664Sbms * up, just log a message and be inefficient. 581127664Sbms * 582127664Sbms * XXX - this should really be supplied to the application 583127664Sbms * as a warning of some sort. 584127664Sbms */ 585127664Sbms fprintf(stderr, 586127664Sbms "tcpdump: Requires BPF language %d.%d or higher; kernel is %d.%d\n", 587127664Sbms BPF_MAJOR_VERSION, BPF_MINOR_VERSION, 588127664Sbms bv.bv_major, bv.bv_minor); 58975107Sfenner } 59017683Spst 591127664Sbms /* 592127664Sbms * We couldn't do filtering in the kernel; do it in userland. 593127664Sbms */ 594127664Sbms if (install_bpf_program(p, fp) < 0) 595127664Sbms return (-1); 596127664Sbms 597127664Sbms /* 598127664Sbms * XXX - this message should be supplied by the application as 599127664Sbms * a warning of some sort. 600127664Sbms */ 601127664Sbms fprintf(stderr, "tcpdump: Filtering in user process\n"); 602127664Sbms p->md.use_bpf = 0; 60317683Spst return (0); 60417683Spst} 605