contrib/libpcap/pcap-bpf.c

   1 /*
   2  * Copyright (c) 1993, 1994, 1995, 1996, 1998
   3  *      The Regents of the University of California.  All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that: (1) source code distributions
   7  * retain the above copyright notice and this paragraph in its entirety, (2)
   8  * distributions including binary code include the above copyright notice and
   9  * this paragraph in its entirety in the documentation or other materials
  10  * provided with the distribution, and (3) all advertising materials mentioning
  11  * features or use of this software display the following acknowledgement:
  12  * ``This product includes software developed by the University of California,
  13  * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
  14  * the University nor the names of its contributors may be used to endorse
  15  * or promote products derived from this software without specific prior
  16  * written permission.
  17  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
  18  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
  19  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  20  */
  21 #ifndef lint
  22 static const char rcsid[] _U_ =
  23     "@(#) $Header: /tcpdump/master/libpcap/pcap-bpf.c,v 1.116 2008-09-16 18:42:29 guy Exp $ (LBL)";
  24 #endif
  25
  26 #ifdef HAVE_CONFIG_H
  27 #include "config.h"
  28 #endif
  29
  30 #include <sys/param.h>                  /* optionally get BSD define */
  31 #ifdef HAVE_ZEROCOPY_BPF
  32 #include <sys/mman.h>
  33 #endif
  34 #include <sys/socket.h>
  35 #include <time.h>
  36 /*
  37  * <net/bpf.h> defines ioctls, but doesn't include <sys/ioccom.h>.
  38  *
  39  * We include <sys/ioctl.h> as it might be necessary to declare ioctl();
  40  * at least on *BSD and Mac OS X, it also defines various SIOC ioctls -
  41  * we could include <sys/sockio.h>, but if we're already including
  42  * <sys/ioctl.h>, which includes <sys/sockio.h> on those platforms,
  43  * there's not much point in doing so.
  44  *
  45  * If we have <sys/ioccom.h>, we include it as well, to handle systems
  46  * such as Solaris which don't arrange to include <sys/ioccom.h> if you
  47  * include <sys/ioctl.h>
  48  */
  49 #include <sys/ioctl.h>
  50 #ifdef HAVE_SYS_IOCCOM_H
  51 #include <sys/ioccom.h>
  52 #endif
  53 #include <sys/utsname.h>
  54
  55 #ifdef HAVE_ZEROCOPY_BPF
  56 #include <machine/atomic.h>
  57 #endif
  58
  59 #include <net/if.h>
  60
  61 #ifdef _AIX
  62
  63 /*
  64  * Make "pcap.h" not include "pcap/bpf.h"; we are going to include the
  65  * native OS version, as we need "struct bpf_config" from it.
  66  */
  67 #define PCAP_DONT_INCLUDE_PCAP_BPF_H
  68
  69 #include <sys/types.h>
  70
  71 /*
  72  * Prevent bpf.h from redefining the DLT_ values to their
  73  * IFT_ values, as we're going to return the standard libpcap
  74  * values, not IBM's non-standard IFT_ values.
  75  */
  76 #undef _AIX
  77 #include <net/bpf.h>
  78 #define _AIX
  79
  80 #include <net/if_types.h>               /* for IFT_ values */
  81 #include <sys/sysconfig.h>
  82 #include <sys/device.h>
  83 #include <sys/cfgodm.h>
  84 #include <cf.h>
  85
  86 #ifdef __64BIT__
  87 #define domakedev makedev64
  88 #define getmajor major64
  89 #define bpf_hdr bpf_hdr32
  90 #else /* __64BIT__ */
  91 #define domakedev makedev
  92 #define getmajor major
  93 #endif /* __64BIT__ */
  94
  95 #define BPF_NAME "bpf"
  96 #define BPF_MINORS 4
  97 #define DRIVER_PATH "/usr/lib/drivers"
  98 #define BPF_NODE "/dev/bpf"
  99 static int bpfloadedflag = 0;
 100 static int odmlockid = 0;
 101
 102 static int bpf_load(char *errbuf);
 103
 104 #else /* _AIX */
 105
 106 #include <net/bpf.h>
 107
 108 #endif /* _AIX */
 109
 110 #include <ctype.h>
 111 #include <fcntl.h>
 112 #include <errno.h>
 113 #include <netdb.h>
 114 #include <stdio.h>
 115 #include <stdlib.h>
 116 #include <string.h>
 117 #include <unistd.h>
 118
 119 #ifdef HAVE_NET_IF_MEDIA_H
 120 # include <net/if_media.h>
 121 #endif
 122
 123 #include "pcap-int.h"
 124
 125 #ifdef HAVE_DAG_API
 126 #include "pcap-dag.h"
 127 #endif /* HAVE_DAG_API */
 128
 129 #ifdef HAVE_SNF_API
 130 #include "pcap-snf.h"
 131 #endif /* HAVE_SNF_API */
 132
 133 #ifdef HAVE_OS_PROTO_H
 134 #include "os-proto.h"
 135 #endif
 136
 137 #ifdef BIOCGDLTLIST
 138 # if (defined(HAVE_NET_IF_MEDIA_H) && defined(IFM_IEEE80211)) && !defined(__APPLE__)
 139 #define HAVE_BSD_IEEE80211
 140 # endif
 141
 142 # if defined(__APPLE__) || defined(HAVE_BSD_IEEE80211)
 143 static int find_802_11(struct bpf_dltlist *);
 144
 145 #  ifdef HAVE_BSD_IEEE80211
 146 static int monitor_mode(pcap_t *, int);
 147 #  endif
 148
 149 #  if defined(__APPLE__)
 150 static void remove_en(pcap_t *);
 151 static void remove_802_11(pcap_t *);
 152 #  endif
 153
 154 # endif /* defined(__APPLE__) || defined(HAVE_BSD_IEEE80211) */
 155
 156 #endif /* BIOCGDLTLIST */
 157
 158 #if defined(sun) && defined(LIFNAMSIZ) && defined(lifr_zoneid)
 159 #include <zone.h>
 160 #endif
 161
 162 /*
 163  * We include the OS's <net/bpf.h>, not our "pcap/bpf.h", so we probably
 164  * don't get DLT_DOCSIS defined.
 165  */
 166 #ifndef DLT_DOCSIS
 167 #define DLT_DOCSIS      143
 168 #endif
 169
 170 /*
 171  * On OS X, we don't even get any of the 802.11-plus-radio-header DLT_'s
 172  * defined, even though some of them are used by various Airport drivers.
 173  */
 174 #ifndef DLT_PRISM_HEADER
 175 #define DLT_PRISM_HEADER        119
 176 #endif
 177 #ifndef DLT_AIRONET_HEADER
 178 #define DLT_AIRONET_HEADER      120
 179 #endif
 180 #ifndef DLT_IEEE802_11_RADIO
 181 #define DLT_IEEE802_11_RADIO    127
 182 #endif
 183 #ifndef DLT_IEEE802_11_RADIO_AVS
 184 #define DLT_IEEE802_11_RADIO_AVS 163
 185 #endif
 186
 187 static int pcap_can_set_rfmon_bpf(pcap_t *p);
 188 static int pcap_activate_bpf(pcap_t *p);
 189 static int pcap_setfilter_bpf(pcap_t *p, struct bpf_program *fp);
 190 static int pcap_setdirection_bpf(pcap_t *, pcap_direction_t);
 191 static int pcap_set_datalink_bpf(pcap_t *p, int dlt);
 192
 193 /*
 194  * For zerocopy bpf, the setnonblock/getnonblock routines need to modify
 195  * p->md.timeout so we don't call select(2) if the pcap handle is in non-
 196  * blocking mode.  We preserve the timeout supplied by pcap_open functions
 197  * to make sure it does not get clobbered if the pcap handle moves between
 198  * blocking and non-blocking mode.
 199  */
 200 static int
 201 pcap_getnonblock_bpf(pcap_t *p, char *errbuf)
 202 {
 203 #ifdef HAVE_ZEROCOPY_BPF
 204         if (p->md.zerocopy) {
 205                 /*
 206                  * Use a negative value for the timeout to represent that the
 207                  * pcap handle is in non-blocking mode.
 208                  */
 209                 return (p->md.timeout < 0);
 210         }
 211 #endif
 212         return (pcap_getnonblock_fd(p, errbuf));
 213 }
 214
 215 static int
 216 pcap_setnonblock_bpf(pcap_t *p, int nonblock, char *errbuf)
 217 {
 218 #ifdef HAVE_ZEROCOPY_BPF
 219         if (p->md.zerocopy) {
 220                 /*
 221                  * Map each value to the corresponding 2's complement, to
 222                  * preserve the timeout value provided with pcap_set_timeout.
 223                  * (from pcap-linux.c).
 224                  */
 225                 if (nonblock) {
 226                         if (p->md.timeout >= 0) {
 227                                 /*
 228                                  * Timeout is non-negative, so we're not
 229                                  * currently in non-blocking mode; set it
 230                                  * to the 2's complement, to make it
 231                                  * negative, as an indication that we're
 232                                  * in non-blocking mode.
 233                                  */
 234                                 p->md.timeout = p->md.timeout * -1 - 1;
 235                         }
 236                 } else {
 237                         if (p->md.timeout < 0) {
 238                                 /*
 239                                  * Timeout is negative, so we're currently
 240                                  * in blocking mode; reverse the previous
 241                                  * operation, to make the timeout non-negative
 242                                  * again.
 243                                  */
 244                                 p->md.timeout = (p->md.timeout + 1) * -1;
 245                         }
 246                 }
 247                 return (0);
 248         }
 249 #endif
 250         return (pcap_setnonblock_fd(p, nonblock, errbuf));
 251 }
 252
 253 #ifdef HAVE_ZEROCOPY_BPF
 254 /*
 255  * Zero-copy BPF buffer routines to check for and acknowledge BPF data in
 256  * shared memory buffers.
 257  *
 258  * pcap_next_zbuf_shm(): Check for a newly available shared memory buffer,
 259  * and set up p->buffer and cc to reflect one if available.  Notice that if
 260  * there was no prior buffer, we select zbuf1 as this will be the first
 261  * buffer filled for a fresh BPF session.
 262  */
 263 static int
 264 pcap_next_zbuf_shm(pcap_t *p, int *cc)
 265 {
 266         struct bpf_zbuf_header *bzh;
 267
 268         if (p->md.zbuffer == p->md.zbuf2 || p->md.zbuffer == NULL) {
 269                 bzh = (struct bpf_zbuf_header *)p->md.zbuf1;
 270                 if (bzh->bzh_user_gen !=
 271                     atomic_load_acq_int(&bzh->bzh_kernel_gen)) {
 272                         p->md.bzh = bzh;
 273                         p->md.zbuffer = (u_char *)p->md.zbuf1;
 274                         p->buffer = p->md.zbuffer + sizeof(*bzh);
 275                         *cc = bzh->bzh_kernel_len;
 276                         return (1);
 277                 }
 278         } else if (p->md.zbuffer == p->md.zbuf1) {
 279                 bzh = (struct bpf_zbuf_header *)p->md.zbuf2;
 280                 if (bzh->bzh_user_gen !=
 281                     atomic_load_acq_int(&bzh->bzh_kernel_gen)) {
 282                         p->md.bzh = bzh;
 283                         p->md.zbuffer = (u_char *)p->md.zbuf2;
 284                         p->buffer = p->md.zbuffer + sizeof(*bzh);
 285                         *cc = bzh->bzh_kernel_len;
 286                         return (1);
 287                 }
 288         }
 289         *cc = 0;
 290         return (0);
 291 }
 292
 293 /*
 294  * pcap_next_zbuf() -- Similar to pcap_next_zbuf_shm(), except wait using
 295  * select() for data or a timeout, and possibly force rotation of the buffer
 296  * in the event we time out or are in immediate mode.  Invoke the shared
 297  * memory check before doing system calls in order to avoid doing avoidable
 298  * work.
 299  */
 300 static int
 301 pcap_next_zbuf(pcap_t *p, int *cc)
 302 {
 303         struct bpf_zbuf bz;
 304         struct timeval tv;
 305         struct timespec cur;
 306         fd_set r_set;
 307         int data, r;
 308         int expire, tmout;
 309
 310 #define TSTOMILLI(ts) (((ts)->tv_sec * 1000) + ((ts)->tv_nsec / 1000000))
 311         /*
 312          * Start out by seeing whether anything is waiting by checking the
 313          * next shared memory buffer for data.
 314          */
 315         data = pcap_next_zbuf_shm(p, cc);
 316         if (data)
 317                 return (data);
 318         /*
 319          * If a previous sleep was interrupted due to signal delivery, make
 320          * sure that the timeout gets adjusted accordingly.  This requires
 321          * that we analyze when the timeout should be been expired, and
 322          * subtract the current time from that.  If after this operation,
 323          * our timeout is less then or equal to zero, handle it like a
 324          * regular timeout.
 325          */
 326         tmout = p->md.timeout;
 327         if (tmout)
 328                 (void) clock_gettime(CLOCK_MONOTONIC, &cur);
 329         if (p->md.interrupted && p->md.timeout) {
 330                 expire = TSTOMILLI(&p->md.firstsel) + p->md.timeout;
 331                 tmout = expire - TSTOMILLI(&cur);
 332 #undef TSTOMILLI
 333                 if (tmout <= 0) {
 334                         p->md.interrupted = 0;
 335                         data = pcap_next_zbuf_shm(p, cc);
 336                         if (data)
 337                                 return (data);
 338                         if (ioctl(p->fd, BIOCROTZBUF, &bz) < 0) {
 339                                 (void) snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 340                                     "BIOCROTZBUF: %s", strerror(errno));
 341                                 return (PCAP_ERROR);
 342                         }
 343                         return (pcap_next_zbuf_shm(p, cc));
 344                 }
 345         }
 346         /*
 347          * No data in the buffer, so must use select() to wait for data or
 348          * the next timeout.  Note that we only call select if the handle
 349          * is in blocking mode.
 350          */
 351         if (p->md.timeout >= 0) {
 352                 FD_ZERO(&r_set);
 353                 FD_SET(p->fd, &r_set);
 354                 if (tmout != 0) {
 355                         tv.tv_sec = tmout / 1000;
 356                         tv.tv_usec = (tmout * 1000) % 1000000;
 357                 }
 358                 r = select(p->fd + 1, &r_set, NULL, NULL,
 359                     p->md.timeout != 0 ? &tv : NULL);
 360                 if (r < 0 && errno == EINTR) {
 361                         if (!p->md.interrupted && p->md.timeout) {
 362                                 p->md.interrupted = 1;
 363                                 p->md.firstsel = cur;
 364                         }
 365                         return (0);
 366                 } else if (r < 0) {
 367                         (void) snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 368                             "select: %s", strerror(errno));
 369                         return (PCAP_ERROR);
 370                 }
 371         }
 372         p->md.interrupted = 0;
 373         /*
 374          * Check again for data, which may exist now that we've either been
 375          * woken up as a result of data or timed out.  Try the "there's data"
 376          * case first since it doesn't require a system call.
 377          */
 378         data = pcap_next_zbuf_shm(p, cc);
 379         if (data)
 380                 return (data);
 381         /*
 382          * Try forcing a buffer rotation to dislodge timed out or immediate
 383          * data.
 384          */
 385         if (ioctl(p->fd, BIOCROTZBUF, &bz) < 0) {
 386                 (void) snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 387                     "BIOCROTZBUF: %s", strerror(errno));
 388                 return (PCAP_ERROR);
 389         }
 390         return (pcap_next_zbuf_shm(p, cc));
 391 }
 392
 393 /*
 394  * Notify kernel that we are done with the buffer.  We don't reset zbuffer so
 395  * that we know which buffer to use next time around.
 396  */
 397 static int
 398 pcap_ack_zbuf(pcap_t *p)
 399 {
 400
 401         atomic_store_rel_int(&p->md.bzh->bzh_user_gen,
 402             p->md.bzh->bzh_kernel_gen);
 403         p->md.bzh = NULL;
 404         p->buffer = NULL;
 405         return (0);
 406 }
 407 #endif /* HAVE_ZEROCOPY_BPF */
 408
 409 pcap_t *
 410 pcap_create(const char *device, char *ebuf)
 411 {
 412         pcap_t *p;
 413
 414 #ifdef HAVE_DAG_API
 415         if (strstr(device, "dag"))
 416                 return (dag_create(device, ebuf));
 417 #endif /* HAVE_DAG_API */
 418 #ifdef HAVE_SNF_API
 419         if (strstr(device, "snf"))
 420                 return (snf_create(device, ebuf));
 421 #endif /* HAVE_SNF_API */
 422
 423         p = pcap_create_common(device, ebuf);
 424         if (p == NULL)
 425                 return (NULL);
 426
 427         p->activate_op = pcap_activate_bpf;
 428         p->can_set_rfmon_op = pcap_can_set_rfmon_bpf;
 429         return (p);
 430 }
 431
 432 /*
 433  * On success, returns a file descriptor for a BPF device.
 434  * On failure, returns a PCAP_ERROR_ value, and sets p->errbuf.
 435  */
 436 static int
 437 bpf_open(pcap_t *p)
 438 {
 439         int fd;
 440 #ifdef HAVE_CLONING_BPF
 441         static const char device[] = "/dev/bpf";
 442 #else
 443         int n = 0;
 444         char device[sizeof "/dev/bpf0000000000"];
 445 #endif
 446
 447 #ifdef _AIX
 448         /*
 449          * Load the bpf driver, if it isn't already loaded,
 450          * and create the BPF device entries, if they don't
 451          * already exist.
 452          */
 453         if (bpf_load(p->errbuf) == PCAP_ERROR)
 454                 return (PCAP_ERROR);
 455 #endif
 456
 457 #ifdef HAVE_CLONING_BPF
 458         if ((fd = open(device, O_RDWR)) == -1 &&
 459             (errno != EACCES || (fd = open(device, O_RDONLY)) == -1)) {
 460                 if (errno == EACCES)
 461                         fd = PCAP_ERROR_PERM_DENIED;
 462                 else
 463                         fd = PCAP_ERROR;
 464                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 465                   "(cannot open device) %s: %s", device, pcap_strerror(errno));
 466         }
 467 #else
 468         /*
 469          * Go through all the minors and find one that isn't in use.
 470          */
 471         do {
 472                 (void)snprintf(device, sizeof(device), "/dev/bpf%d", n++);
 473                 /*
 474                  * Initially try a read/write open (to allow the inject
 475                  * method to work).  If that fails due to permission
 476                  * issues, fall back to read-only.  This allows a
 477                  * non-root user to be granted specific access to pcap
 478                  * capabilities via file permissions.
 479                  *
 480                  * XXX - we should have an API that has a flag that
 481                  * controls whether to open read-only or read-write,
 482                  * so that denial of permission to send (or inability
 483                  * to send, if sending packets isn't supported on
 484                  * the device in question) can be indicated at open
 485                  * time.
 486                  */
 487                 fd = open(device, O_RDWR);
 488                 if (fd == -1 && errno == EACCES)
 489                         fd = open(device, O_RDONLY);
 490         } while (fd < 0 && errno == EBUSY);
 491
 492         /*
 493          * XXX better message for all minors used
 494          */
 495         if (fd < 0) {
 496                 switch (errno) {
 497
 498                 case ENOENT:
 499                         fd = PCAP_ERROR;
 500                         if (n == 1) {
 501                                 /*
 502                                  * /dev/bpf0 doesn't exist, which
 503                                  * means we probably have no BPF
 504                                  * devices.
 505                                  */
 506                                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 507                                     "(there are no BPF devices)");
 508                         } else {
 509                                 /*
 510                                  * We got EBUSY on at least one
 511                                  * BPF device, so we have BPF
 512                                  * devices, but all the ones
 513                                  * that exist are busy.
 514                                  */
 515                                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 516                                     "(all BPF devices are busy)");
 517                         }
 518                         break;
 519
 520                 case EACCES:
 521                         /*
 522                          * Got EACCES on the last device we tried,
 523                          * and EBUSY on all devices before that,
 524                          * if any.
 525                          */
 526                         fd = PCAP_ERROR_PERM_DENIED;
 527                         snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 528                             "(cannot open BPF device) %s: %s", device,
 529                             pcap_strerror(errno));
 530                         break;
 531
 532                 default:
 533                         /*
 534                          * Some other problem.
 535                          */
 536                         fd = PCAP_ERROR;
 537                         snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 538                             "(cannot open BPF device) %s: %s", device,
 539                             pcap_strerror(errno));
 540                         break;
 541                 }
 542         }
 543 #endif
 544
 545         return (fd);
 546 }
 547
 548 #ifdef BIOCGDLTLIST
 549 static int
 550 get_dlt_list(int fd, int v, struct bpf_dltlist *bdlp, char *ebuf)
 551 {
 552         memset(bdlp, 0, sizeof(*bdlp));
 553         if (ioctl(fd, BIOCGDLTLIST, (caddr_t)bdlp) == 0) {
 554                 u_int i;
 555                 int is_ethernet;
 556
 557                 bdlp->bfl_list = (u_int *) malloc(sizeof(u_int) * (bdlp->bfl_len + 1));
 558                 if (bdlp->bfl_list == NULL) {
 559                         (void)snprintf(ebuf, PCAP_ERRBUF_SIZE, "malloc: %s",
 560                             pcap_strerror(errno));
 561                         return (PCAP_ERROR);
 562                 }
 563
 564                 if (ioctl(fd, BIOCGDLTLIST, (caddr_t)bdlp) < 0) {
 565                         (void)snprintf(ebuf, PCAP_ERRBUF_SIZE,
 566                             "BIOCGDLTLIST: %s", pcap_strerror(errno));
 567                         free(bdlp->bfl_list);
 568                         return (PCAP_ERROR);
 569                 }
 570
 571                 /*
 572                  * OK, for real Ethernet devices, add DLT_DOCSIS to the
 573                  * list, so that an application can let you choose it,
 574                  * in case you're capturing DOCSIS traffic that a Cisco
 575                  * Cable Modem Termination System is putting out onto
 576                  * an Ethernet (it doesn't put an Ethernet header onto
 577                  * the wire, it puts raw DOCSIS frames out on the wire
 578                  * inside the low-level Ethernet framing).
 579                  *
 580                  * A "real Ethernet device" is defined here as a device
 581                  * that has a link-layer type of DLT_EN10MB and that has
 582                  * no alternate link-layer types; that's done to exclude
 583                  * 802.11 interfaces (which might or might not be the
 584                  * right thing to do, but I suspect it is - Ethernet <->
 585                  * 802.11 bridges would probably badly mishandle frames
 586                  * that don't have Ethernet headers).
 587                  *
 588                  * On Solaris with BPF, Ethernet devices also offer
 589                  * DLT_IPNET, so we, if DLT_IPNET is defined, we don't
 590                  * treat it as an indication that the device isn't an
 591                  * Ethernet.
 592                  */
 593                 if (v == DLT_EN10MB) {
 594                         is_ethernet = 1;
 595                         for (i = 0; i < bdlp->bfl_len; i++) {
 596                                 if (bdlp->bfl_list[i] != DLT_EN10MB
 597 #ifdef DLT_IPNET
 598                                     && bdlp->bfl_list[i] != DLT_IPNET
 599 #endif
 600                                     ) {
 601                                         is_ethernet = 0;
 602                                         break;
 603                                 }
 604                         }
 605                         if (is_ethernet) {
 606                                 /*
 607                                  * We reserved one more slot at the end of
 608                                  * the list.
 609                                  */
 610                                 bdlp->bfl_list[bdlp->bfl_len] = DLT_DOCSIS;
 611                                 bdlp->bfl_len++;
 612                         }
 613                 }
 614         } else {
 615                 /*
 616                  * EINVAL just means "we don't support this ioctl on
 617                  * this device"; don't treat it as an error.
 618                  */
 619                 if (errno != EINVAL) {
 620                         (void)snprintf(ebuf, PCAP_ERRBUF_SIZE,
 621                             "BIOCGDLTLIST: %s", pcap_strerror(errno));
 622                         return (PCAP_ERROR);
 623                 }
 624         }
 625         return (0);
 626 }
 627 #endif
 628
 629 static int
 630 pcap_can_set_rfmon_bpf(pcap_t *p)
 631 {
 632 #if defined(__APPLE__)
 633         struct utsname osinfo;
 634         struct ifreq ifr;
 635         int fd;
 636 #ifdef BIOCGDLTLIST
 637         struct bpf_dltlist bdl;
 638 #endif
 639
 640         /*
 641          * The joys of monitor mode on OS X.
 642          *
 643          * Prior to 10.4, it's not supported at all.
 644          *
 645          * In 10.4, if adapter enN supports monitor mode, there's a
 646          * wltN adapter corresponding to it; you open it, instead of
 647          * enN, to get monitor mode.  You get whatever link-layer
 648          * headers it supplies.
 649          *
 650          * In 10.5, and, we assume, later releases, if adapter enN
 651          * supports monitor mode, it offers, among its selectable
 652          * DLT_ values, values that let you get the 802.11 header;
 653          * selecting one of those values puts the adapter into monitor
 654          * mode (i.e., you can't get 802.11 headers except in monitor
 655          * mode, and you can't get Ethernet headers in monitor mode).
 656          */
 657         if (uname(&osinfo) == -1) {
 658                 /*
 659                  * Can't get the OS version; just say "no".
 660                  */
 661                 return (0);
 662         }
 663         /*
 664          * We assume osinfo.sysname is "Darwin", because
 665          * __APPLE__ is defined.  We just check the version.
 666          */
 667         if (osinfo.release[0] < '8' && osinfo.release[1] == '.') {
 668                 /*
 669                  * 10.3 (Darwin 7.x) or earlier.
 670                  * Monitor mode not supported.
 671                  */
 672                 return (0);
 673         }
 674         if (osinfo.release[0] == '8' && osinfo.release[1] == '.') {
 675                 /*
 676                  * 10.4 (Darwin 8.x).  s/en/wlt/, and check
 677                  * whether the device exists.
 678                  */
 679                 if (strncmp(p->opt.source, "en", 2) != 0) {
 680                         /*
 681                          * Not an enN device; no monitor mode.
 682                          */
 683                         return (0);
 684                 }
 685                 fd = socket(AF_INET, SOCK_DGRAM, 0);
 686                 if (fd == -1) {
 687                         (void)snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 688                             "socket: %s", pcap_strerror(errno));
 689                         return (PCAP_ERROR);
 690                 }
 691                 strlcpy(ifr.ifr_name, "wlt", sizeof(ifr.ifr_name));
 692                 strlcat(ifr.ifr_name, p->opt.source + 2, sizeof(ifr.ifr_name));
 693                 if (ioctl(fd, SIOCGIFFLAGS, (char *)&ifr) < 0) {
 694                         /*
 695                          * No such device?
 696                          */
 697                         close(fd);
 698                         return (0);
 699                 }
 700                 close(fd);
 701                 return (1);
 702         }
 703
 704 #ifdef BIOCGDLTLIST
 705         /*
 706          * Everything else is 10.5 or later; for those,
 707          * we just open the enN device, and check whether
 708          * we have any 802.11 devices.
 709          *
 710          * First, open a BPF device.
 711          */
 712         fd = bpf_open(p);
 713         if (fd < 0)
 714                 return (fd);    /* fd is the appropriate error code */
 715
 716         /*
 717          * Now bind to the device.
 718          */
 719         (void)strncpy(ifr.ifr_name, p->opt.source, sizeof(ifr.ifr_name));
 720         if (ioctl(fd, BIOCSETIF, (caddr_t)&ifr) < 0) {
 721                 switch (errno) {
 722
 723                 case ENXIO:
 724                         /*
 725                          * There's no such device.
 726                          */
 727                         close(fd);
 728                         return (PCAP_ERROR_NO_SUCH_DEVICE);
 729
 730                 case ENETDOWN:
 731                         /*
 732                          * Return a "network down" indication, so that
 733                          * the application can report that rather than
 734                          * saying we had a mysterious failure and
 735                          * suggest that they report a problem to the
 736                          * libpcap developers.
 737                          */
 738                         close(fd);
 739                         return (PCAP_ERROR_IFACE_NOT_UP);
 740
 741                 default:
 742                         snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 743                             "BIOCSETIF: %s: %s",
 744                             p->opt.source, pcap_strerror(errno));
 745                         close(fd);
 746                         return (PCAP_ERROR);
 747                 }
 748         }
 749
 750         /*
 751          * We know the default link type -- now determine all the DLTs
 752          * this interface supports.  If this fails with EINVAL, it's
 753          * not fatal; we just don't get to use the feature later.
 754          * (We don't care about DLT_DOCSIS, so we pass DLT_NULL
 755          * as the default DLT for this adapter.)
 756          */
 757         if (get_dlt_list(fd, DLT_NULL, &bdl, p->errbuf) == PCAP_ERROR) {
 758                 close(fd);
 759                 return (PCAP_ERROR);
 760         }
 761         if (find_802_11(&bdl) != -1) {
 762                 /*
 763                  * We have an 802.11 DLT, so we can set monitor mode.
 764                  */
 765                 free(bdl.bfl_list);
 766                 close(fd);
 767                 return (1);
 768         }
 769         free(bdl.bfl_list);
 770 #endif /* BIOCGDLTLIST */
 771         return (0);
 772 #elif defined(HAVE_BSD_IEEE80211)
 773         int ret;
 774
 775         ret = monitor_mode(p, 0);
 776         if (ret == PCAP_ERROR_RFMON_NOTSUP)
 777                 return (0);     /* not an error, just a "can't do" */
 778         if (ret == 0)
 779                 return (1);     /* success */
 780         return (ret);
 781 #else
 782         return (0);
 783 #endif
 784 }
 785
 786 static int
 787 pcap_stats_bpf(pcap_t *p, struct pcap_stat *ps)
 788 {
 789         struct bpf_stat s;
 790
 791         /*
 792          * "ps_recv" counts packets handed to the filter, not packets
 793          * that passed the filter.  This includes packets later dropped
 794          * because we ran out of buffer space.
 795          *
 796          * "ps_drop" counts packets dropped inside the BPF device
 797          * because we ran out of buffer space.  It doesn't count
 798          * packets dropped by the interface driver.  It counts
 799          * only packets that passed the filter.
 800          *
 801          * Both statistics include packets not yet read from the kernel
 802          * by libpcap, and thus not yet seen by the application.
 803          */
 804         if (ioctl(p->fd, BIOCGSTATS, (caddr_t)&s) < 0) {
 805                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "BIOCGSTATS: %s",
 806                     pcap_strerror(errno));
 807                 return (PCAP_ERROR);
 808         }
 809
 810         ps->ps_recv = s.bs_recv;
 811         ps->ps_drop = s.bs_drop;
 812         ps->ps_ifdrop = 0;
 813         return (0);
 814 }
 815
 816 static int
 817 pcap_read_bpf(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
 818 {
 819         int cc;
 820         int n = 0;
 821         register u_char *bp, *ep;
 822         u_char *datap;
 823 #ifdef PCAP_FDDIPAD
 824         register int pad;
 825 #endif
 826 #ifdef HAVE_ZEROCOPY_BPF
 827         int i;
 828 #endif
 829
 830  again:
 831         /*
 832          * Has "pcap_breakloop()" been called?
 833          */
 834         if (p->break_loop) {
 835                 /*
 836                  * Yes - clear the flag that indicates that it
 837                  * has, and return PCAP_ERROR_BREAK to indicate
 838                  * that we were told to break out of the loop.
 839                  */
 840                 p->break_loop = 0;
 841                 return (PCAP_ERROR_BREAK);
 842         }
 843         cc = p->cc;
 844         if (p->cc == 0) {
 845                 /*
 846                  * When reading without zero-copy from a file descriptor, we
 847                  * use a single buffer and return a length of data in the
 848                  * buffer.  With zero-copy, we update the p->buffer pointer
 849                  * to point at whatever underlying buffer contains the next
 850                  * data and update cc to reflect the data found in the
 851                  * buffer.
 852                  */
 853 #ifdef HAVE_ZEROCOPY_BPF
 854                 if (p->md.zerocopy) {
 855                         if (p->buffer != NULL)
 856                                 pcap_ack_zbuf(p);
 857                         i = pcap_next_zbuf(p, &cc);
 858                         if (i == 0)
 859                                 goto again;
 860                         if (i < 0)
 861                                 return (PCAP_ERROR);
 862                 } else
 863 #endif
 864                 {
 865                         cc = read(p->fd, (char *)p->buffer, p->bufsize);
 866                 }
 867                 if (cc < 0) {
 868                         /* Don't choke when we get ptraced */
 869                         switch (errno) {
 870
 871                         case EINTR:
 872                                 goto again;
 873
 874 #ifdef _AIX
 875                         case EFAULT:
 876                                 /*
 877                                  * Sigh.  More AIX wonderfulness.
 878                                  *
 879                                  * For some unknown reason the uiomove()
 880                                  * operation in the bpf kernel extension
 881                                  * used to copy the buffer into user
 882                                  * space sometimes returns EFAULT. I have
 883                                  * no idea why this is the case given that
 884                                  * a kernel debugger shows the user buffer
 885                                  * is correct. This problem appears to
 886                                  * be mostly mitigated by the memset of
 887                                  * the buffer before it is first used.
 888                                  * Very strange.... Shaun Clowes
 889                                  *
 890                                  * In any case this means that we shouldn't
 891                                  * treat EFAULT as a fatal error; as we
 892                                  * don't have an API for returning
 893                                  * a "some packets were dropped since
 894                                  * the last packet you saw" indication,
 895                                  * we just ignore EFAULT and keep reading.
 896                                  */
 897                                 goto again;
 898 #endif
 899
 900                         case EWOULDBLOCK:
 901                                 return (0);
 902
 903                         case ENXIO:
 904                                 /*
 905                                  * The device on which we're capturing
 906                                  * went away.
 907                                  *
 908                                  * XXX - we should really return
 909                                  * PCAP_ERROR_IFACE_NOT_UP, but
 910                                  * pcap_dispatch() etc. aren't
 911                                  * defined to retur that.
 912                                  */
 913                                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
 914                                     "The interface went down");
 915                                 return (PCAP_ERROR);
 916
 917 #if defined(sun) && !defined(BSD) && !defined(__svr4__) && !defined(__SVR4)
 918                         /*
 919                          * Due to a SunOS bug, after 2^31 bytes, the kernel
 920                          * file offset overflows and read fails with EINVAL.
 921                          * The lseek() to 0 will fix things.
 922                          */
 923                         case EINVAL:
 924                                 if (lseek(p->fd, 0L, SEEK_CUR) +
 925                                     p->bufsize < 0) {
 926                                         (void)lseek(p->fd, 0L, SEEK_SET);
 927                                         goto again;
 928                                 }
 929                                 /* fall through */
 930 #endif
 931                         }
 932                         snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "read: %s",
 933                             pcap_strerror(errno));
 934                         return (PCAP_ERROR);
 935                 }
 936                 bp = p->buffer;
 937         } else
 938                 bp = p->bp;
 939
 940         /*
 941          * Loop through each packet.
 942          */
 943 #define bhp ((struct bpf_hdr *)bp)
 944         ep = bp + cc;
 945 #ifdef PCAP_FDDIPAD
 946         pad = p->fddipad;
 947 #endif
 948         while (bp < ep) {
 949                 register int caplen, hdrlen;
 950
 951                 /*
 952                  * Has "pcap_breakloop()" been called?
 953                  * If so, return immediately - if we haven't read any
 954                  * packets, clear the flag and return PCAP_ERROR_BREAK
 955                  * to indicate that we were told to break out of the loop,
 956                  * otherwise leave the flag set, so that the *next* call
 957                  * will break out of the loop without having read any
 958                  * packets, and return the number of packets we've
 959                  * processed so far.
 960                  */
 961                 if (p->break_loop) {
 962                         p->bp = bp;
 963                         p->cc = ep - bp;
 964                         /*
 965                          * ep is set based on the return value of read(),
 966                          * but read() from a BPF device doesn't necessarily
 967                          * return a value that's a multiple of the alignment
 968                          * value for BPF_WORDALIGN().  However, whenever we
 969                          * increment bp, we round up the increment value by
 970                          * a value rounded up by BPF_WORDALIGN(), so we
 971                          * could increment bp past ep after processing the
 972                          * last packet in the buffer.
 973                          *
 974                          * We treat ep < bp as an indication that this
 975                          * happened, and just set p->cc to 0.
 976                          */
 977                         if (p->cc < 0)
 978                                 p->cc = 0;
 979                         if (n == 0) {
 980                                 p->break_loop = 0;
 981                                 return (PCAP_ERROR_BREAK);
 982                         } else
 983                                 return (n);
 984                 }
 985
 986                 caplen = bhp->bh_caplen;
 987                 hdrlen = bhp->bh_hdrlen;
 988                 datap = bp + hdrlen;
 989                 /*
 990                  * Short-circuit evaluation: if using BPF filter
 991                  * in kernel, no need to do it now - we already know
 992                  * the packet passed the filter.
 993                  *
 994 #ifdef PCAP_FDDIPAD
 995                  * Note: the filter code was generated assuming
 996                  * that p->fddipad was the amount of padding
 997                  * before the header, as that's what's required
 998                  * in the kernel, so we run the filter before
 999                  * skipping that padding.
1000 #endif
1001                  */
1002                 if (p->md.use_bpf ||
1003                     bpf_filter(p->fcode.bf_insns, datap, bhp->bh_datalen, caplen)) {
1004                         struct pcap_pkthdr pkthdr;
1005
1006                         pkthdr.ts.tv_sec = bhp->bh_tstamp.tv_sec;
1007 #ifdef _AIX
1008                         /*
1009                          * AIX's BPF returns seconds/nanoseconds time
1010                          * stamps, not seconds/microseconds time stamps.
1011                          */
1012                         pkthdr.ts.tv_usec = bhp->bh_tstamp.tv_usec/1000;
1013 #else
1014                         pkthdr.ts.tv_usec = bhp->bh_tstamp.tv_usec;
1015 #endif
1016 #ifdef PCAP_FDDIPAD
1017                         if (caplen > pad)
1018                                 pkthdr.caplen = caplen - pad;
1019                         else
1020                                 pkthdr.caplen = 0;
1021                         if (bhp->bh_datalen > pad)
1022                                 pkthdr.len = bhp->bh_datalen - pad;
1023                         else
1024                                 pkthdr.len = 0;
1025                         datap += pad;
1026 #else
1027                         pkthdr.caplen = caplen;
1028                         pkthdr.len = bhp->bh_datalen;
1029 #endif
1030                         (*callback)(user, &pkthdr, datap);
1031                         bp += BPF_WORDALIGN(caplen + hdrlen);
1032                         if (++n >= cnt && cnt > 0) {
1033                                 p->bp = bp;
1034                                 p->cc = ep - bp;
1035                                 /*
1036                                  * See comment above about p->cc < 0.
1037                                  */
1038                                 if (p->cc < 0)
1039                                         p->cc = 0;
1040                                 return (n);
1041                         }
1042                 } else {
1043                         /*
1044                          * Skip this packet.
1045                          */
1046                         bp += BPF_WORDALIGN(caplen + hdrlen);
1047                 }
1048         }
1049 #undef bhp
1050         p->cc = 0;
1051         return (n);
1052 }
1053
1054 static int
1055 pcap_inject_bpf(pcap_t *p, const void *buf, size_t size)
1056 {
1057         int ret;
1058
1059         ret = write(p->fd, buf, size);
1060 #ifdef __APPLE__
1061         if (ret == -1 && errno == EAFNOSUPPORT) {
1062                 /*
1063                  * In Mac OS X, there's a bug wherein setting the
1064                  * BIOCSHDRCMPLT flag causes writes to fail; see,
1065                  * for example:
1066                  *
1067                  *      http://cerberus.sourcefire.com/~jeff/archives/patches/macosx/BIOCSHDRCMPLT-10.3.3.patch
1068                  *
1069                  * So, if, on OS X, we get EAFNOSUPPORT from the write, we
1070                  * assume it's due to that bug, and turn off that flag
1071                  * and try again.  If we succeed, it either means that
1072                  * somebody applied the fix from that URL, or other patches
1073                  * for that bug from
1074                  *
1075                  *      http://cerberus.sourcefire.com/~jeff/archives/patches/macosx/
1076                  *
1077                  * and are running a Darwin kernel with those fixes, or
1078                  * that Apple fixed the problem in some OS X release.
1079                  */
1080                 u_int spoof_eth_src = 0;
1081
1082                 if (ioctl(p->fd, BIOCSHDRCMPLT, &spoof_eth_src) == -1) {
1083                         (void)snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1084                             "send: can't turn off BIOCSHDRCMPLT: %s",
1085                             pcap_strerror(errno));
1086                         return (PCAP_ERROR);
1087                 }
1088
1089                 /*
1090                  * Now try the write again.
1091                  */
1092                 ret = write(p->fd, buf, size);
1093         }
1094 #endif /* __APPLE__ */
1095         if (ret == -1) {
1096                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "send: %s",
1097                     pcap_strerror(errno));
1098                 return (PCAP_ERROR);
1099         }
1100         return (ret);
1101 }
1102
1103 #ifdef _AIX
1104 static int
1105 bpf_odminit(char *errbuf)
1106 {
1107         char *errstr;
1108
1109         if (odm_initialize() == -1) {
1110                 if (odm_err_msg(odmerrno, &errstr) == -1)
1111                         errstr = "Unknown error";
1112                 snprintf(errbuf, PCAP_ERRBUF_SIZE,
1113                     "bpf_load: odm_initialize failed: %s",
1114                     errstr);
1115                 return (PCAP_ERROR);
1116         }
1117
1118         if ((odmlockid = odm_lock("/etc/objrepos/config_lock", ODM_WAIT)) == -1) {
1119                 if (odm_err_msg(odmerrno, &errstr) == -1)
1120                         errstr = "Unknown error";
1121                 snprintf(errbuf, PCAP_ERRBUF_SIZE,
1122                     "bpf_load: odm_lock of /etc/objrepos/config_lock failed: %s",
1123                     errstr);
1124                 (void)odm_terminate();
1125                 return (PCAP_ERROR);
1126         }
1127
1128         return (0);
1129 }
1130
1131 static int
1132 bpf_odmcleanup(char *errbuf)
1133 {
1134         char *errstr;
1135
1136         if (odm_unlock(odmlockid) == -1) {
1137                 if (errbuf != NULL) {
1138                         if (odm_err_msg(odmerrno, &errstr) == -1)
1139                                 errstr = "Unknown error";
1140                         snprintf(errbuf, PCAP_ERRBUF_SIZE,
1141                             "bpf_load: odm_unlock failed: %s",
1142                             errstr);
1143                 }
1144                 return (PCAP_ERROR);
1145         }
1146
1147         if (odm_terminate() == -1) {
1148                 if (errbuf != NULL) {
1149                         if (odm_err_msg(odmerrno, &errstr) == -1)
1150                                 errstr = "Unknown error";
1151                         snprintf(errbuf, PCAP_ERRBUF_SIZE,
1152                             "bpf_load: odm_terminate failed: %s",
1153                             errstr);
1154                 }
1155                 return (PCAP_ERROR);
1156         }
1157
1158         return (0);
1159 }
1160
1161 static int
1162 bpf_load(char *errbuf)
1163 {
1164         long major;
1165         int *minors;
1166         int numminors, i, rc;
1167         char buf[1024];
1168         struct stat sbuf;
1169         struct bpf_config cfg_bpf;
1170         struct cfg_load cfg_ld;
1171         struct cfg_kmod cfg_km;
1172
1173         /*
1174          * This is very very close to what happens in the real implementation
1175          * but I've fixed some (unlikely) bug situations.
1176          */
1177         if (bpfloadedflag)
1178                 return (0);
1179
1180         if (bpf_odminit(errbuf) == PCAP_ERROR)
1181                 return (PCAP_ERROR);
1182
1183         major = genmajor(BPF_NAME);
1184         if (major == -1) {
1185                 snprintf(errbuf, PCAP_ERRBUF_SIZE,
1186                     "bpf_load: genmajor failed: %s", pcap_strerror(errno));
1187                 (void)bpf_odmcleanup(NULL);
1188                 return (PCAP_ERROR);
1189         }
1190
1191         minors = getminor(major, &numminors, BPF_NAME);
1192         if (!minors) {
1193                 minors = genminor("bpf", major, 0, BPF_MINORS, 1, 1);
1194                 if (!minors) {
1195                         snprintf(errbuf, PCAP_ERRBUF_SIZE,
1196                             "bpf_load: genminor failed: %s",
1197                             pcap_strerror(errno));
1198                         (void)bpf_odmcleanup(NULL);
1199                         return (PCAP_ERROR);
1200                 }
1201         }
1202
1203         if (bpf_odmcleanup(errbuf) == PCAP_ERROR)
1204                 return (PCAP_ERROR);
1205
1206         rc = stat(BPF_NODE "0", &sbuf);
1207         if (rc == -1 && errno != ENOENT) {
1208                 snprintf(errbuf, PCAP_ERRBUF_SIZE,
1209                     "bpf_load: can't stat %s: %s",
1210                     BPF_NODE "0", pcap_strerror(errno));
1211                 return (PCAP_ERROR);
1212         }
1213
1214         if (rc == -1 || getmajor(sbuf.st_rdev) != major) {
1215                 for (i = 0; i < BPF_MINORS; i++) {
1216                         sprintf(buf, "%s%d", BPF_NODE, i);
1217                         unlink(buf);
1218                         if (mknod(buf, S_IRUSR | S_IFCHR, domakedev(major, i)) == -1) {
1219                                 snprintf(errbuf, PCAP_ERRBUF_SIZE,
1220                                     "bpf_load: can't mknod %s: %s",
1221                                     buf, pcap_strerror(errno));
1222                                 return (PCAP_ERROR);
1223                         }
1224                 }
1225         }
1226
1227         /* Check if the driver is loaded */
1228         memset(&cfg_ld, 0x0, sizeof(cfg_ld));
1229         cfg_ld.path = buf;
1230         sprintf(cfg_ld.path, "%s/%s", DRIVER_PATH, BPF_NAME);
1231         if ((sysconfig(SYS_QUERYLOAD, (void *)&cfg_ld, sizeof(cfg_ld)) == -1) ||
1232             (cfg_ld.kmid == 0)) {
1233                 /* Driver isn't loaded, load it now */
1234                 if (sysconfig(SYS_SINGLELOAD, (void *)&cfg_ld, sizeof(cfg_ld)) == -1) {
1235                         snprintf(errbuf, PCAP_ERRBUF_SIZE,
1236                             "bpf_load: could not load driver: %s",
1237                             strerror(errno));
1238                         return (PCAP_ERROR);
1239                 }
1240         }
1241
1242         /* Configure the driver */
1243         cfg_km.cmd = CFG_INIT;
1244         cfg_km.kmid = cfg_ld.kmid;
1245         cfg_km.mdilen = sizeof(cfg_bpf);
1246         cfg_km.mdiptr = (void *)&cfg_bpf;
1247         for (i = 0; i < BPF_MINORS; i++) {
1248                 cfg_bpf.devno = domakedev(major, i);
1249                 if (sysconfig(SYS_CFGKMOD, (void *)&cfg_km, sizeof(cfg_km)) == -1) {
1250                         snprintf(errbuf, PCAP_ERRBUF_SIZE,
1251                             "bpf_load: could not configure driver: %s",
1252                             strerror(errno));
1253                         return (PCAP_ERROR);
1254                 }
1255         }
1256
1257         bpfloadedflag = 1;
1258
1259         return (0);
1260 }
1261 #endif
1262
1263 /*
1264  * Turn off rfmon mode if necessary.
1265  */
1266 static void
1267 pcap_cleanup_bpf(pcap_t *p)
1268 {
1269 #ifdef HAVE_BSD_IEEE80211
1270         int sock;
1271         struct ifmediareq req;
1272         struct ifreq ifr;
1273 #endif
1274
1275         if (p->md.must_do_on_close != 0) {
1276                 /*
1277                  * There's something we have to do when closing this
1278                  * pcap_t.
1279                  */
1280 #ifdef HAVE_BSD_IEEE80211
1281                 if (p->md.must_do_on_close & MUST_CLEAR_RFMON) {
1282                         /*
1283                          * We put the interface into rfmon mode;
1284                          * take it out of rfmon mode.
1285                          *
1286                          * XXX - if somebody else wants it in rfmon
1287                          * mode, this code cannot know that, so it'll take
1288                          * it out of rfmon mode.
1289                          */
1290                         sock = socket(AF_INET, SOCK_DGRAM, 0);
1291                         if (sock == -1) {
1292                                 fprintf(stderr,
1293                                     "Can't restore interface flags (socket() failed: %s).\n"
1294                                     "Please adjust manually.\n",
1295                                     strerror(errno));
1296                         } else {
1297                                 memset(&req, 0, sizeof(req));
1298                                 strncpy(req.ifm_name, p->md.device,
1299                                     sizeof(req.ifm_name));
1300                                 if (ioctl(sock, SIOCGIFMEDIA, &req) < 0) {
1301                                         fprintf(stderr,
1302                                             "Can't restore interface flags (SIOCGIFMEDIA failed: %s).\n"
1303                                             "Please adjust manually.\n",
1304                                             strerror(errno));
1305                                 } else {
1306                                         if (req.ifm_current & IFM_IEEE80211_MONITOR) {
1307                                                 /*
1308                                                  * Rfmon mode is currently on;
1309                                                  * turn it off.
1310                                                  */
1311                                                 memset(&ifr, 0, sizeof(ifr));
1312                                                 (void)strncpy(ifr.ifr_name,
1313                                                     p->md.device,
1314                                                     sizeof(ifr.ifr_name));
1315                                                 ifr.ifr_media =
1316                                                     req.ifm_current & ~IFM_IEEE80211_MONITOR;
1317                                                 if (ioctl(sock, SIOCSIFMEDIA,
1318                                                     &ifr) == -1) {
1319                                                         fprintf(stderr,
1320                                                             "Can't restore interface flags (SIOCSIFMEDIA failed: %s).\n"
1321                                                             "Please adjust manually.\n",
1322                                                             strerror(errno));
1323                                                 }
1324                                         }
1325                                 }
1326                                 close(sock);
1327                         }
1328                 }
1329 #endif /* HAVE_BSD_IEEE80211 */
1330
1331                 /*
1332                  * Take this pcap out of the list of pcaps for which we
1333                  * have to take the interface out of some mode.
1334                  */
1335                 pcap_remove_from_pcaps_to_close(p);
1336                 p->md.must_do_on_close = 0;
1337         }
1338
1339 #ifdef HAVE_ZEROCOPY_BPF
1340         if (p->md.zerocopy) {
1341                 /*
1342                  * Delete the mappings.  Note that p->buffer gets
1343                  * initialized to one of the mmapped regions in
1344                  * this case, so do not try and free it directly;
1345                  * null it out so that pcap_cleanup_live_common()
1346                  * doesn't try to free it.
1347                  */
1348                 if (p->md.zbuf1 != MAP_FAILED && p->md.zbuf1 != NULL)
1349                         (void) munmap(p->md.zbuf1, p->md.zbufsize);
1350                 if (p->md.zbuf2 != MAP_FAILED && p->md.zbuf2 != NULL)
1351                         (void) munmap(p->md.zbuf2, p->md.zbufsize);
1352                 p->buffer = NULL;
1353         }
1354 #endif
1355         if (p->md.device != NULL) {
1356                 free(p->md.device);
1357                 p->md.device = NULL;
1358         }
1359         pcap_cleanup_live_common(p);
1360 }
1361
1362 static int
1363 check_setif_failure(pcap_t *p, int error)
1364 {
1365 #ifdef __APPLE__
1366         int fd;
1367         struct ifreq ifr;
1368         int err;
1369 #endif
1370
1371         if (error == ENXIO) {
1372                 /*
1373                  * No such device exists.
1374                  */
1375 #ifdef __APPLE__
1376                 if (p->opt.rfmon && strncmp(p->opt.source, "wlt", 3) == 0) {
1377                         /*
1378                          * Monitor mode was requested, and we're trying
1379                          * to open a "wltN" device.  Assume that this
1380                          * is 10.4 and that we were asked to open an
1381                          * "enN" device; if that device exists, return
1382                          * "monitor mode not supported on the device".
1383                          */
1384                         fd = socket(AF_INET, SOCK_DGRAM, 0);
1385                         if (fd != -1) {
1386                                 strlcpy(ifr.ifr_name, "en",
1387                                     sizeof(ifr.ifr_name));
1388                                 strlcat(ifr.ifr_name, p->opt.source + 3,
1389                                     sizeof(ifr.ifr_name));
1390                                 if (ioctl(fd, SIOCGIFFLAGS, (char *)&ifr) < 0) {
1391                                         /*
1392                                          * We assume this failed because
1393                                          * the underlying device doesn't
1394                                          * exist.
1395                                          */
1396                                         err = PCAP_ERROR_NO_SUCH_DEVICE;
1397                                         snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1398                                             "SIOCGIFFLAGS on %s failed: %s",
1399                                             ifr.ifr_name, pcap_strerror(errno));
1400                                 } else {
1401                                         /*
1402                                          * The underlying "enN" device
1403                                          * exists, but there's no
1404                                          * corresponding "wltN" device;
1405                                          * that means that the "enN"
1406                                          * device doesn't support
1407                                          * monitor mode, probably because
1408                                          * it's an Ethernet device rather
1409                                          * than a wireless device.
1410                                          */
1411                                         err = PCAP_ERROR_RFMON_NOTSUP;
1412                                 }
1413                                 close(fd);
1414                         } else {
1415                                 /*
1416                                  * We can't find out whether there's
1417                                  * an underlying "enN" device, so
1418                                  * just report "no such device".
1419                                  */
1420                                 err = PCAP_ERROR_NO_SUCH_DEVICE;
1421                                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1422                                     "socket() failed: %s",
1423                                     pcap_strerror(errno));
1424                         }
1425                         return (err);
1426                 }
1427 #endif
1428                 /*
1429                  * No such device.
1430                  */
1431                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "BIOCSETIF failed: %s",
1432                     pcap_strerror(errno));
1433                 return (PCAP_ERROR_NO_SUCH_DEVICE);
1434         } else if (errno == ENETDOWN) {
1435                 /*
1436                  * Return a "network down" indication, so that
1437                  * the application can report that rather than
1438                  * saying we had a mysterious failure and
1439                  * suggest that they report a problem to the
1440                  * libpcap developers.
1441                  */
1442                 return (PCAP_ERROR_IFACE_NOT_UP);
1443         } else {
1444                 /*
1445                  * Some other error; fill in the error string, and
1446                  * return PCAP_ERROR.
1447                  */
1448                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "BIOCSETIF: %s: %s",
1449                     p->opt.source, pcap_strerror(errno));
1450                 return (PCAP_ERROR);
1451         }
1452 }
1453
1454 /*
1455  * Default capture buffer size.
1456  * 32K isn't very much for modern machines with fast networks; we
1457  * pick .5M, as that's the maximum on at least some systems with BPF.
1458  *
1459  * However, on AIX 3.5, the larger buffer sized caused unrecoverable
1460  * read failures under stress, so we leave it as 32K; yet another
1461  * place where AIX's BPF is broken.
1462  */
1463 #ifdef _AIX
1464 #define DEFAULT_BUFSIZE 32768
1465 #else
1466 #define DEFAULT_BUFSIZE 524288
1467 #endif
1468
1469 static int
1470 pcap_activate_bpf(pcap_t *p)
1471 {
1472         int status = 0;
1473         int fd;
1474 #ifdef LIFNAMSIZ
1475         char *zonesep;
1476         struct lifreq ifr;
1477         char *ifrname = ifr.lifr_name;
1478         const size_t ifnamsiz = sizeof(ifr.lifr_name);
1479 #else
1480         struct ifreq ifr;
1481         char *ifrname = ifr.ifr_name;
1482         const size_t ifnamsiz = sizeof(ifr.ifr_name);
1483 #endif
1484         struct bpf_version bv;
1485 #ifdef __APPLE__
1486         int sockfd;
1487         char *wltdev = NULL;
1488 #endif
1489 #ifdef BIOCGDLTLIST
1490         struct bpf_dltlist bdl;
1491 #if defined(__APPLE__) || defined(HAVE_BSD_IEEE80211)
1492         int new_dlt;
1493 #endif
1494 #endif /* BIOCGDLTLIST */
1495 #if defined(BIOCGHDRCMPLT) && defined(BIOCSHDRCMPLT)
1496         u_int spoof_eth_src = 1;
1497 #endif
1498         u_int v;
1499         struct bpf_insn total_insn;
1500         struct bpf_program total_prog;
1501         struct utsname osinfo;
1502         int have_osinfo = 0;
1503 #ifdef HAVE_ZEROCOPY_BPF
1504         struct bpf_zbuf bz;
1505         u_int bufmode, zbufmax;
1506 #endif
1507
1508         fd = bpf_open(p);
1509         if (fd < 0) {
1510                 status = fd;
1511                 goto bad;
1512         }
1513
1514         p->fd = fd;
1515
1516         if (ioctl(fd, BIOCVERSION, (caddr_t)&bv) < 0) {
1517                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "BIOCVERSION: %s",
1518                     pcap_strerror(errno));
1519                 status = PCAP_ERROR;
1520                 goto bad;
1521         }
1522         if (bv.bv_major != BPF_MAJOR_VERSION ||
1523             bv.bv_minor < BPF_MINOR_VERSION) {
1524                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1525                     "kernel bpf filter out of date");
1526                 status = PCAP_ERROR;
1527                 goto bad;
1528         }
1529
1530 #if defined(LIFNAMSIZ) && defined(ZONENAME_MAX) && defined(lifr_zoneid)
1531         /*
1532          * Check if the given source network device has a '/' separated
1533          * zonename prefix string. The zonename prefixed source device
1534          * can be used by libpcap consumers to capture network traffic
1535          * in non-global zones from the global zone on Solaris 11 and
1536          * above. If the zonename prefix is present then we strip the
1537          * prefix and pass the zone ID as part of lifr_zoneid.
1538          */
1539         if ((zonesep = strchr(p->opt.source, '/')) != NULL) {
1540                 char zonename[ZONENAME_MAX];
1541                 int  znamelen;
1542                 char *lnamep;
1543
1544                 znamelen = zonesep - p->opt.source;
1545                 (void) strlcpy(zonename, p->opt.source, znamelen + 1);
1546                 lnamep = strdup(zonesep + 1);
1547                 ifr.lifr_zoneid = getzoneidbyname(zonename);
1548                 free(p->opt.source);
1549                 p->opt.source = lnamep;
1550         }
1551 #endif
1552
1553         p->md.device = strdup(p->opt.source);
1554         if (p->md.device == NULL) {
1555                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "strdup: %s",
1556                      pcap_strerror(errno));
1557                 status = PCAP_ERROR;
1558                 goto bad;
1559         }
1560
1561         /*
1562          * Attempt to find out the version of the OS on which we're running.
1563          */
1564         if (uname(&osinfo) == 0)
1565                 have_osinfo = 1;
1566
1567 #ifdef __APPLE__
1568         /*
1569          * See comment in pcap_can_set_rfmon_bpf() for an explanation
1570          * of why we check the version number.
1571          */
1572         if (p->opt.rfmon) {
1573                 if (have_osinfo) {
1574                         /*
1575                          * We assume osinfo.sysname is "Darwin", because
1576                          * __APPLE__ is defined.  We just check the version.
1577                          */
1578                         if (osinfo.release[0] < '8' &&
1579                             osinfo.release[1] == '.') {
1580                                 /*
1581                                  * 10.3 (Darwin 7.x) or earlier.
1582                                  */
1583                                 status = PCAP_ERROR_RFMON_NOTSUP;
1584                                 goto bad;
1585                         }
1586                         if (osinfo.release[0] == '8' &&
1587                             osinfo.release[1] == '.') {
1588                                 /*
1589                                  * 10.4 (Darwin 8.x).  s/en/wlt/
1590                                  */
1591                                 if (strncmp(p->opt.source, "en", 2) != 0) {
1592                                         /*
1593                                          * Not an enN device; check
1594                                          * whether the device even exists.
1595                                          */
1596                                         sockfd = socket(AF_INET, SOCK_DGRAM, 0);
1597                                         if (sockfd != -1) {
1598                                                 strlcpy(ifrname,
1599                                                     p->opt.source, ifnamsiz);
1600                                                 if (ioctl(sockfd, SIOCGIFFLAGS,
1601                                                     (char *)&ifr) < 0) {
1602                                                         /*
1603                                                          * We assume this
1604                                                          * failed because
1605                                                          * the underlying
1606                                                          * device doesn't
1607                                                          * exist.
1608                                                          */
1609                                                         status = PCAP_ERROR_NO_SUCH_DEVICE;
1610                                                         snprintf(p->errbuf,
1611                                                             PCAP_ERRBUF_SIZE,
1612                                                             "SIOCGIFFLAGS failed: %s",
1613                                                             pcap_strerror(errno));
1614                                                 } else
1615                                                         status = PCAP_ERROR_RFMON_NOTSUP;
1616                                                 close(sockfd);
1617                                         } else {
1618                                                 /*
1619                                                  * We can't find out whether
1620                                                  * the device exists, so just
1621                                                  * report "no such device".
1622                                                  */
1623                                                 status = PCAP_ERROR_NO_SUCH_DEVICE;
1624                                                 snprintf(p->errbuf,
1625                                                     PCAP_ERRBUF_SIZE,
1626                                                     "socket() failed: %s",
1627                                                     pcap_strerror(errno));
1628                                         }
1629                                         goto bad;
1630                                 }
1631                                 wltdev = malloc(strlen(p->opt.source) + 2);
1632                                 if (wltdev == NULL) {
1633                                         (void)snprintf(p->errbuf,
1634                                             PCAP_ERRBUF_SIZE, "malloc: %s",
1635                                             pcap_strerror(errno));
1636                                         status = PCAP_ERROR;
1637                                         goto bad;
1638                                 }
1639                                 strcpy(wltdev, "wlt");
1640                                 strcat(wltdev, p->opt.source + 2);
1641                                 free(p->opt.source);
1642                                 p->opt.source = wltdev;
1643                         }
1644                         /*
1645                          * Everything else is 10.5 or later; for those,
1646                          * we just open the enN device, and set the DLT.
1647                          */
1648                 }
1649         }
1650 #endif /* __APPLE__ */
1651 #ifdef HAVE_ZEROCOPY_BPF
1652         /*
1653          * If the BPF extension to set buffer mode is present, try setting
1654          * the mode to zero-copy.  If that fails, use regular buffering.  If
1655          * it succeeds but other setup fails, return an error to the user.
1656          */
1657         bufmode = BPF_BUFMODE_ZBUF;
1658         if (ioctl(fd, BIOCSETBUFMODE, (caddr_t)&bufmode) == 0) {
1659                 /*
1660                  * We have zerocopy BPF; use it.
1661                  */
1662                 p->md.zerocopy = 1;
1663
1664                 /*
1665                  * How to pick a buffer size: first, query the maximum buffer
1666                  * size supported by zero-copy.  This also lets us quickly
1667                  * determine whether the kernel generally supports zero-copy.
1668                  * Then, if a buffer size was specified, use that, otherwise
1669                  * query the default buffer size, which reflects kernel
1670                  * policy for a desired default.  Round to the nearest page
1671                  * size.
1672                  */
1673                 if (ioctl(fd, BIOCGETZMAX, (caddr_t)&zbufmax) < 0) {
1674                         snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "BIOCGETZMAX: %s",
1675                             pcap_strerror(errno));
1676                         goto bad;
1677                 }
1678
1679                 if (p->opt.buffer_size != 0) {
1680                         /*
1681                          * A buffer size was explicitly specified; use it.
1682                          */
1683                         v = p->opt.buffer_size;
1684                 } else {
1685                         if ((ioctl(fd, BIOCGBLEN, (caddr_t)&v) < 0) ||
1686                             v < DEFAULT_BUFSIZE)
1687                                 v = DEFAULT_BUFSIZE;
1688                 }
1689 #ifndef roundup
1690 #define roundup(x, y)   ((((x)+((y)-1))/(y))*(y))  /* to any y */
1691 #endif
1692                 p->md.zbufsize = roundup(v, getpagesize());
1693                 if (p->md.zbufsize > zbufmax)
1694                         p->md.zbufsize = zbufmax;
1695                 p->md.zbuf1 = mmap(NULL, p->md.zbufsize, PROT_READ | PROT_WRITE,
1696                     MAP_ANON, -1, 0);
1697                 p->md.zbuf2 = mmap(NULL, p->md.zbufsize, PROT_READ | PROT_WRITE,
1698                     MAP_ANON, -1, 0);
1699                 if (p->md.zbuf1 == MAP_FAILED || p->md.zbuf2 == MAP_FAILED) {
1700                         snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "mmap: %s",
1701                             pcap_strerror(errno));
1702                         goto bad;
1703                 }
1704                 bzero(&bz, sizeof(bz));
1705                 bz.bz_bufa = p->md.zbuf1;
1706                 bz.bz_bufb = p->md.zbuf2;
1707                 bz.bz_buflen = p->md.zbufsize;
1708                 if (ioctl(fd, BIOCSETZBUF, (caddr_t)&bz) < 0) {
1709                         snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "BIOCSETZBUF: %s",
1710                             pcap_strerror(errno));
1711                         goto bad;
1712                 }
1713                 (void)strncpy(ifrname, p->opt.source, ifnamsiz);
1714                 if (ioctl(fd, BIOCSETIF, (caddr_t)&ifr) < 0) {
1715                         snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "BIOCSETIF: %s: %s",
1716                             p->opt.source, pcap_strerror(errno));
1717                         goto bad;
1718                 }
1719                 v = p->md.zbufsize - sizeof(struct bpf_zbuf_header);
1720         } else
1721 #endif
1722         {
1723                 /*
1724                  * We don't have zerocopy BPF.
1725                  * Set the buffer size.
1726                  */
1727                 if (p->opt.buffer_size != 0) {
1728                         /*
1729                          * A buffer size was explicitly specified; use it.
1730                          */
1731                         if (ioctl(fd, BIOCSBLEN,
1732                             (caddr_t)&p->opt.buffer_size) < 0) {
1733                                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1734                                     "BIOCSBLEN: %s: %s", p->opt.source,
1735                                     pcap_strerror(errno));
1736                                 status = PCAP_ERROR;
1737                                 goto bad;
1738                         }
1739
1740                         /*
1741                          * Now bind to the device.
1742                          */
1743                         (void)strncpy(ifrname, p->opt.source, ifnamsiz);
1744 #ifdef BIOCSETLIF
1745                         if (ioctl(fd, BIOCSETLIF, (caddr_t)&ifr) < 0)
1746 #else
1747                         if (ioctl(fd, BIOCSETIF, (caddr_t)&ifr) < 0)
1748 #endif
1749                         {
1750                                 status = check_setif_failure(p, errno);
1751                                 goto bad;
1752                         }
1753                 } else {
1754                         /*
1755                          * No buffer size was explicitly specified.
1756                          *
1757                          * Try finding a good size for the buffer;
1758                          * DEFAULT_BUFSIZE may be too big, so keep
1759                          * cutting it in half until we find a size
1760                          * that works, or run out of sizes to try.
1761                          * If the default is larger, don't make it smaller.
1762                          */
1763                         if ((ioctl(fd, BIOCGBLEN, (caddr_t)&v) < 0) ||
1764                             v < DEFAULT_BUFSIZE)
1765                                 v = DEFAULT_BUFSIZE;
1766                         for ( ; v != 0; v >>= 1) {
1767                                 /*
1768                                  * Ignore the return value - this is because the
1769                                  * call fails on BPF systems that don't have
1770                                  * kernel malloc.  And if the call fails, it's
1771                                  * no big deal, we just continue to use the
1772                                  * standard buffer size.
1773                                  */
1774                                 (void) ioctl(fd, BIOCSBLEN, (caddr_t)&v);
1775
1776                                 (void)strncpy(ifrname, p->opt.source, ifnamsiz);
1777 #ifdef BIOCSETLIF
1778                                 if (ioctl(fd, BIOCSETLIF, (caddr_t)&ifr) >= 0)
1779 #else
1780                                 if (ioctl(fd, BIOCSETIF, (caddr_t)&ifr) >= 0)
1781 #endif
1782                                         break;  /* that size worked; we're done */
1783
1784                                 if (errno != ENOBUFS) {
1785                                         status = check_setif_failure(p, errno);
1786                                         goto bad;
1787                                 }
1788                         }
1789
1790                         if (v == 0) {
1791                                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1792                                     "BIOCSBLEN: %s: No buffer size worked",
1793                                     p->opt.source);
1794                                 status = PCAP_ERROR;
1795                                 goto bad;
1796                         }
1797                 }
1798         }
1799
1800         /* Get the data link layer type. */
1801         if (ioctl(fd, BIOCGDLT, (caddr_t)&v) < 0) {
1802                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "BIOCGDLT: %s",
1803                     pcap_strerror(errno));
1804                 status = PCAP_ERROR;
1805                 goto bad;
1806         }
1807
1808 #ifdef _AIX
1809         /*
1810          * AIX's BPF returns IFF_ types, not DLT_ types, in BIOCGDLT.
1811          */
1812         switch (v) {
1813
1814         case IFT_ETHER:
1815         case IFT_ISO88023:
1816                 v = DLT_EN10MB;
1817                 break;
1818
1819         case IFT_FDDI:
1820                 v = DLT_FDDI;
1821                 break;
1822
1823         case IFT_ISO88025:
1824                 v = DLT_IEEE802;
1825                 break;
1826
1827         case IFT_LOOP:
1828                 v = DLT_NULL;
1829                 break;
1830
1831         default:
1832                 /*
1833                  * We don't know what to map this to yet.
1834                  */
1835                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "unknown interface type %u",
1836                     v);
1837                 status = PCAP_ERROR;
1838                 goto bad;
1839         }
1840 #endif
1841 #if _BSDI_VERSION - 0 >= 199510
1842         /* The SLIP and PPP link layer header changed in BSD/OS 2.1 */
1843         switch (v) {
1844
1845         case DLT_SLIP:
1846                 v = DLT_SLIP_BSDOS;
1847                 break;
1848
1849         case DLT_PPP:
1850                 v = DLT_PPP_BSDOS;
1851                 break;
1852
1853         case 11:        /*DLT_FR*/
1854                 v = DLT_FRELAY;
1855                 break;
1856
1857         case 12:        /*DLT_C_HDLC*/
1858                 v = DLT_CHDLC;
1859                 break;
1860         }
1861 #endif
1862
1863 #ifdef BIOCGDLTLIST
1864         /*
1865          * We know the default link type -- now determine all the DLTs
1866          * this interface supports.  If this fails with EINVAL, it's
1867          * not fatal; we just don't get to use the feature later.
1868          */
1869         if (get_dlt_list(fd, v, &bdl, p->errbuf) == -1) {
1870                 status = PCAP_ERROR;
1871                 goto bad;
1872         }
1873         p->dlt_count = bdl.bfl_len;
1874         p->dlt_list = bdl.bfl_list;
1875
1876 #ifdef __APPLE__
1877         /*
1878          * Monitor mode fun, continued.
1879          *
1880          * For 10.5 and, we're assuming, later releases, as noted above,
1881          * 802.1 adapters that support monitor mode offer both DLT_EN10MB,
1882          * DLT_IEEE802_11, and possibly some 802.11-plus-radio-information
1883          * DLT_ value.  Choosing one of the 802.11 DLT_ values will turn
1884          * monitor mode on.
1885          *
1886          * Therefore, if the user asked for monitor mode, we filter out
1887          * the DLT_EN10MB value, as you can't get that in monitor mode,
1888          * and, if the user didn't ask for monitor mode, we filter out
1889          * the 802.11 DLT_ values, because selecting those will turn
1890          * monitor mode on.  Then, for monitor mode, if an 802.11-plus-
1891          * radio DLT_ value is offered, we try to select that, otherwise
1892          * we try to select DLT_IEEE802_11.
1893          */
1894         if (have_osinfo) {
1895                 if (isdigit((unsigned)osinfo.release[0]) &&
1896                      (osinfo.release[0] == '9' ||
1897                      isdigit((unsigned)osinfo.release[1]))) {
1898                         /*
1899                          * 10.5 (Darwin 9.x), or later.
1900                          */
1901                         new_dlt = find_802_11(&bdl);
1902                         if (new_dlt != -1) {
1903                                 /*
1904                                  * We have at least one 802.11 DLT_ value,
1905                                  * so this is an 802.11 interface.
1906                                  * new_dlt is the best of the 802.11
1907                                  * DLT_ values in the list.
1908                                  */
1909                                 if (p->opt.rfmon) {
1910                                         /*
1911                                          * Our caller wants monitor mode.
1912                                          * Purge DLT_EN10MB from the list
1913                                          * of link-layer types, as selecting
1914                                          * it will keep monitor mode off.
1915                                          */
1916                                         remove_en(p);
1917
1918                                         /*
1919                                          * If the new mode we want isn't
1920                                          * the default mode, attempt to
1921                                          * select the new mode.
1922                                          */
1923                                         if (new_dlt != v) {
1924                                                 if (ioctl(p->fd, BIOCSDLT,
1925                                                     &new_dlt) != -1) {
1926                                                         /*
1927                                                          * We succeeded;
1928                                                          * make this the
1929                                                          * new DLT_ value.
1930                                                          */
1931                                                         v = new_dlt;
1932                                                 }
1933                                         }
1934                                 } else {
1935                                         /*
1936                                          * Our caller doesn't want
1937                                          * monitor mode.  Unless this
1938                                          * is being done by pcap_open_live(),
1939                                          * purge the 802.11 link-layer types
1940                                          * from the list, as selecting
1941                                          * one of them will turn monitor
1942                                          * mode on.
1943                                          */
1944                                         if (!p->oldstyle)
1945                                                 remove_802_11(p);
1946                                 }
1947                         } else {
1948                                 if (p->opt.rfmon) {
1949                                         /*
1950                                          * The caller requested monitor
1951                                          * mode, but we have no 802.11
1952                                          * link-layer types, so they
1953                                          * can't have it.
1954                                          */
1955                                         status = PCAP_ERROR_RFMON_NOTSUP;
1956                                         goto bad;
1957                                 }
1958                         }
1959                 }
1960         }
1961 #elif defined(HAVE_BSD_IEEE80211)
1962         /*
1963          * *BSD with the new 802.11 ioctls.
1964          * Do we want monitor mode?
1965          */
1966         if (p->opt.rfmon) {
1967                 /*
1968                  * Try to put the interface into monitor mode.
1969                  */
1970                 status = monitor_mode(p, 1);
1971                 if (status != 0) {
1972                         /*
1973                          * We failed.
1974                          */
1975                         goto bad;
1976                 }
1977
1978                 /*
1979                  * We're in monitor mode.
1980                  * Try to find the best 802.11 DLT_ value and, if we
1981                  * succeed, try to switch to that mode if we're not
1982                  * already in that mode.
1983                  */
1984                 new_dlt = find_802_11(&bdl);
1985                 if (new_dlt != -1) {
1986                         /*
1987                          * We have at least one 802.11 DLT_ value.
1988                          * new_dlt is the best of the 802.11
1989                          * DLT_ values in the list.
1990                          *
1991                          * If the new mode we want isn't the default mode,
1992                          * attempt to select the new mode.
1993                          */
1994                         if (new_dlt != v) {
1995                                 if (ioctl(p->fd, BIOCSDLT, &new_dlt) != -1) {
1996                                         /*
1997                                          * We succeeded; make this the
1998                                          * new DLT_ value.
1999                                          */
2000                                         v = new_dlt;
2001                                 }
2002                         }
2003                 }
2004         }
2005 #endif /* various platforms */
2006 #endif /* BIOCGDLTLIST */
2007
2008         /*
2009          * If this is an Ethernet device, and we don't have a DLT_ list,
2010          * give it a list with DLT_EN10MB and DLT_DOCSIS.  (That'd give
2011          * 802.11 interfaces DLT_DOCSIS, which isn't the right thing to
2012          * do, but there's not much we can do about that without finding
2013          * some other way of determining whether it's an Ethernet or 802.11
2014          * device.)
2015          */
2016         if (v == DLT_EN10MB && p->dlt_count == 0) {
2017                 p->dlt_list = (u_int *) malloc(sizeof(u_int) * 2);
2018                 /*
2019                  * If that fails, just leave the list empty.
2020                  */
2021                 if (p->dlt_list != NULL) {
2022                         p->dlt_list[0] = DLT_EN10MB;
2023                         p->dlt_list[1] = DLT_DOCSIS;
2024                         p->dlt_count = 2;
2025                 }
2026         }
2027 #ifdef PCAP_FDDIPAD
2028         if (v == DLT_FDDI)
2029                 p->fddipad = PCAP_FDDIPAD;
2030         else
2031                 p->fddipad = 0;
2032 #endif
2033         p->linktype = v;
2034
2035 #if defined(BIOCGHDRCMPLT) && defined(BIOCSHDRCMPLT)
2036         /*
2037          * Do a BIOCSHDRCMPLT, if defined, to turn that flag on, so
2038          * the link-layer source address isn't forcibly overwritten.
2039          * (Should we ignore errors?  Should we do this only if
2040          * we're open for writing?)
2041          *
2042          * XXX - I seem to remember some packet-sending bug in some
2043          * BSDs - check CVS log for "bpf.c"?
2044          */
2045         if (ioctl(fd, BIOCSHDRCMPLT, &spoof_eth_src) == -1) {
2046                 (void)snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
2047                     "BIOCSHDRCMPLT: %s", pcap_strerror(errno));
2048                 status = PCAP_ERROR;
2049                 goto bad;
2050         }
2051 #endif
2052         /* set timeout */
2053 #ifdef HAVE_ZEROCOPY_BPF
2054         if (p->md.timeout != 0 && !p->md.zerocopy) {
2055 #else
2056         if (p->md.timeout) {
2057 #endif
2058                 /*
2059                  * XXX - is this seconds/nanoseconds in AIX?
2060                  * (Treating it as such doesn't fix the timeout
2061                  * problem described below.)
2062                  *
2063                  * XXX - Mac OS X 10.6 mishandles BIOCSRTIMEOUT in
2064                  * 64-bit userland - it takes, as an argument, a
2065                  * "struct BPF_TIMEVAL", which has 32-bit tv_sec
2066                  * and tv_usec, rather than a "struct timeval".
2067                  *
2068                  * If this platform defines "struct BPF_TIMEVAL",
2069                  * we check whether the structure size in BIOCSRTIMEOUT
2070                  * is that of a "struct timeval" and, if not, we use
2071                  * a "struct BPF_TIMEVAL" rather than a "struct timeval".
2072                  * (That way, if the bug is fixed in a future release,
2073                  * we will still do the right thing.)
2074                  */
2075                 struct timeval to;
2076 #ifdef HAVE_STRUCT_BPF_TIMEVAL
2077                 struct BPF_TIMEVAL bpf_to;
2078
2079                 if (IOCPARM_LEN(BIOCSRTIMEOUT) != sizeof(struct timeval)) {
2080                         bpf_to.tv_sec = p->md.timeout / 1000;
2081                         bpf_to.tv_usec = (p->md.timeout * 1000) % 1000000;
2082                         if (ioctl(p->fd, BIOCSRTIMEOUT, (caddr_t)&bpf_to) < 0) {
2083                                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
2084                                     "BIOCSRTIMEOUT: %s", pcap_strerror(errno));
2085                                 status = PCAP_ERROR;
2086                                 goto bad;
2087                         }
2088                 } else {
2089 #endif
2090                         to.tv_sec = p->md.timeout / 1000;
2091                         to.tv_usec = (p->md.timeout * 1000) % 1000000;
2092                         if (ioctl(p->fd, BIOCSRTIMEOUT, (caddr_t)&to) < 0) {
2093                                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
2094                                     "BIOCSRTIMEOUT: %s", pcap_strerror(errno));
2095                                 status = PCAP_ERROR;
2096                                 goto bad;
2097                         }
2098 #ifdef HAVE_STRUCT_BPF_TIMEVAL
2099                 }
2100 #endif
2101         }
2102
2103 #ifdef _AIX
2104 #ifdef  BIOCIMMEDIATE
2105         /*
2106          * Darren Reed notes that
2107          *
2108          *      On AIX (4.2 at least), if BIOCIMMEDIATE is not set, the
2109          *      timeout appears to be ignored and it waits until the buffer
2110          *      is filled before returning.  The result of not having it
2111          *      set is almost worse than useless if your BPF filter
2112          *      is reducing things to only a few packets (i.e. one every
2113          *      second or so).
2114          *
2115          * so we turn BIOCIMMEDIATE mode on if this is AIX.
2116          *
2117          * We don't turn it on for other platforms, as that means we
2118          * get woken up for every packet, which may not be what we want;
2119          * in the Winter 1993 USENIX paper on BPF, they say:
2120          *
2121          *      Since a process might want to look at every packet on a
2122          *      network and the time between packets can be only a few
2123          *      microseconds, it is not possible to do a read system call
2124          *      per packet and BPF must collect the data from several
2125          *      packets and return it as a unit when the monitoring
2126          *      application does a read.
2127          *
2128          * which I infer is the reason for the timeout - it means we
2129          * wait that amount of time, in the hopes that more packets
2130          * will arrive and we'll get them all with one read.
2131          *
2132          * Setting BIOCIMMEDIATE mode on FreeBSD (and probably other
2133          * BSDs) causes the timeout to be ignored.
2134          *
2135          * On the other hand, some platforms (e.g., Linux) don't support
2136          * timeouts, they just hand stuff to you as soon as it arrives;
2137          * if that doesn't cause a problem on those platforms, it may
2138          * be OK to have BIOCIMMEDIATE mode on BSD as well.
2139          *
2140          * (Note, though, that applications may depend on the read
2141          * completing, even if no packets have arrived, when the timeout
2142          * expires, e.g. GUI applications that have to check for input
2143          * while waiting for packets to arrive; a non-zero timeout
2144          * prevents "select()" from working right on FreeBSD and
2145          * possibly other BSDs, as the timer doesn't start until a
2146          * "read()" is done, so the timer isn't in effect if the
2147          * application is blocked on a "select()", and the "select()"
2148          * doesn't get woken up for a BPF device until the buffer
2149          * fills up.)
2150          */
2151         v = 1;
2152         if (ioctl(p->fd, BIOCIMMEDIATE, &v) < 0) {
2153                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "BIOCIMMEDIATE: %s",
2154                     pcap_strerror(errno));
2155                 status = PCAP_ERROR;
2156                 goto bad;
2157         }
2158 #endif  /* BIOCIMMEDIATE */
2159 #endif  /* _AIX */
2160
2161         if (p->opt.promisc) {
2162                 /* set promiscuous mode, just warn if it fails */
2163                 if (ioctl(p->fd, BIOCPROMISC, NULL) < 0) {
2164                         snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "BIOCPROMISC: %s",
2165                             pcap_strerror(errno));
2166                         status = PCAP_WARNING_PROMISC_NOTSUP;
2167                 }
2168         }
2169
2170         if (ioctl(fd, BIOCGBLEN, (caddr_t)&v) < 0) {
2171                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "BIOCGBLEN: %s",
2172                     pcap_strerror(errno));
2173                 status = PCAP_ERROR;
2174                 goto bad;
2175         }
2176         p->bufsize = v;
2177 #ifdef HAVE_ZEROCOPY_BPF
2178         if (!p->md.zerocopy) {
2179 #endif
2180         p->buffer = (u_char *)malloc(p->bufsize);
2181         if (p->buffer == NULL) {
2182                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "malloc: %s",
2183                     pcap_strerror(errno));
2184                 status = PCAP_ERROR;
2185                 goto bad;
2186         }
2187 #ifdef _AIX
2188         /* For some strange reason this seems to prevent the EFAULT
2189          * problems we have experienced from AIX BPF. */
2190         memset(p->buffer, 0x0, p->bufsize);
2191 #endif
2192 #ifdef HAVE_ZEROCOPY_BPF
2193         }
2194 #endif
2195
2196         /*
2197          * If there's no filter program installed, there's
2198          * no indication to the kernel of what the snapshot
2199          * length should be, so no snapshotting is done.
2200          *
2201          * Therefore, when we open the device, we install
2202          * an "accept everything" filter with the specified
2203          * snapshot length.
2204          */
2205         total_insn.code = (u_short)(BPF_RET | BPF_K);
2206         total_insn.jt = 0;
2207         total_insn.jf = 0;
2208         total_insn.k = p->snapshot;
2209
2210         total_prog.bf_len = 1;
2211         total_prog.bf_insns = &total_insn;
2212         if (ioctl(p->fd, BIOCSETF, (caddr_t)&total_prog) < 0) {
2213                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "BIOCSETF: %s",
2214                     pcap_strerror(errno));
2215                 status = PCAP_ERROR;
2216                 goto bad;
2217         }
2218
2219         /*
2220          * On most BPF platforms, either you can do a "select()" or
2221          * "poll()" on a BPF file descriptor and it works correctly,
2222          * or you can do it and it will return "readable" if the
2223          * hold buffer is full but not if the timeout expires *and*
2224          * a non-blocking read will, if the hold buffer is empty
2225          * but the store buffer isn't empty, rotate the buffers
2226          * and return what packets are available.
2227          *
2228          * In the latter case, the fact that a non-blocking read
2229          * will give you the available packets means you can work
2230          * around the failure of "select()" and "poll()" to wake up
2231          * and return "readable" when the timeout expires by using
2232          * the timeout as the "select()" or "poll()" timeout, putting
2233          * the BPF descriptor into non-blocking mode, and read from
2234          * it regardless of whether "select()" reports it as readable
2235          * or not.
2236          *
2237          * However, in FreeBSD 4.3 and 4.4, "select()" and "poll()"
2238          * won't wake up and return "readable" if the timer expires
2239          * and non-blocking reads return EWOULDBLOCK if the hold
2240          * buffer is empty, even if the store buffer is non-empty.
2241          *
2242          * This means the workaround in question won't work.
2243          *
2244          * Therefore, on FreeBSD 4.3 and 4.4, we set "p->selectable_fd"
2245          * to -1, which means "sorry, you can't use 'select()' or 'poll()'
2246          * here".  On all other BPF platforms, we set it to the FD for
2247          * the BPF device; in NetBSD, OpenBSD, and Darwin, a non-blocking
2248          * read will, if the hold buffer is empty and the store buffer
2249          * isn't empty, rotate the buffers and return what packets are
2250          * there (and in sufficiently recent versions of OpenBSD
2251          * "select()" and "poll()" should work correctly).
2252          *
2253          * XXX - what about AIX?
2254          */
2255         p->selectable_fd = p->fd;       /* assume select() works until we know otherwise */
2256         if (have_osinfo) {
2257                 /*
2258                  * We can check what OS this is.
2259                  */
2260                 if (strcmp(osinfo.sysname, "FreeBSD") == 0) {
2261                         if (strncmp(osinfo.release, "4.3-", 4) == 0 ||
2262                              strncmp(osinfo.release, "4.4-", 4) == 0)
2263                                 p->selectable_fd = -1;
2264                 }
2265         }
2266
2267         p->read_op = pcap_read_bpf;
2268         p->inject_op = pcap_inject_bpf;
2269         p->setfilter_op = pcap_setfilter_bpf;
2270         p->setdirection_op = pcap_setdirection_bpf;
2271         p->set_datalink_op = pcap_set_datalink_bpf;
2272         p->getnonblock_op = pcap_getnonblock_bpf;
2273         p->setnonblock_op = pcap_setnonblock_bpf;
2274         p->stats_op = pcap_stats_bpf;
2275         p->cleanup_op = pcap_cleanup_bpf;
2276
2277         return (status);
2278  bad:
2279         pcap_cleanup_bpf(p);
2280         return (status);
2281 }
2282
2283 int
2284 pcap_platform_finddevs(pcap_if_t **alldevsp, char *errbuf)
2285 {
2286 #ifdef HAVE_DAG_API
2287         if (dag_platform_finddevs(alldevsp, errbuf) < 0)
2288                 return (-1);
2289 #endif /* HAVE_DAG_API */
2290 #ifdef HAVE_SNF_API
2291         if (snf_platform_finddevs(alldevsp, errbuf) < 0)
2292                 return (-1);
2293 #endif /* HAVE_SNF_API */
2294
2295         return (0);
2296 }
2297
2298 #ifdef HAVE_BSD_IEEE80211
2299 static int
2300 monitor_mode(pcap_t *p, int set)
2301 {
2302         int sock;
2303         struct ifmediareq req;
2304         int *media_list;
2305         int i;
2306         int can_do;
2307         struct ifreq ifr;
2308
2309         sock = socket(AF_INET, SOCK_DGRAM, 0);
2310         if (sock == -1) {
2311                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "can't open socket: %s",
2312                     pcap_strerror(errno));
2313                 return (PCAP_ERROR);
2314         }
2315
2316         memset(&req, 0, sizeof req);
2317         strncpy(req.ifm_name, p->opt.source, sizeof req.ifm_name);
2318
2319         /*
2320          * Find out how many media types we have.
2321          */
2322         if (ioctl(sock, SIOCGIFMEDIA, &req) < 0) {
2323                 /*
2324                  * Can't get the media types.
2325                  */
2326                 switch (errno) {
2327
2328                 case ENXIO:
2329                         /*
2330                          * There's no such device.
2331                          */
2332                         close(sock);
2333                         return (PCAP_ERROR_NO_SUCH_DEVICE);
2334
2335                 case EINVAL:
2336                         /*
2337                          * Interface doesn't support SIOC{G,S}IFMEDIA.
2338                          */
2339                         close(sock);
2340                         return (PCAP_ERROR_RFMON_NOTSUP);
2341
2342                 default:
2343                         snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
2344                             "SIOCGIFMEDIA 1: %s", pcap_strerror(errno));
2345                         close(sock);
2346                         return (PCAP_ERROR);
2347                 }
2348         }
2349         if (req.ifm_count == 0) {
2350                 /*
2351                  * No media types.
2352                  */
2353                 close(sock);
2354                 return (PCAP_ERROR_RFMON_NOTSUP);
2355         }
2356
2357         /*
2358          * Allocate a buffer to hold all the media types, and
2359          * get the media types.
2360          */
2361         media_list = malloc(req.ifm_count * sizeof(int));
2362         if (media_list == NULL) {
2363                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "malloc: %s",
2364                     pcap_strerror(errno));
2365                 close(sock);
2366                 return (PCAP_ERROR);
2367         }
2368         req.ifm_ulist = media_list;
2369         if (ioctl(sock, SIOCGIFMEDIA, &req) < 0) {
2370                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "SIOCGIFMEDIA: %s",
2371                     pcap_strerror(errno));
2372                 free(media_list);
2373                 close(sock);
2374                 return (PCAP_ERROR);
2375         }
2376
2377         /*
2378          * Look for an 802.11 "automatic" media type.
2379          * We assume that all 802.11 adapters have that media type,
2380          * and that it will carry the monitor mode supported flag.
2381          */
2382         can_do = 0;
2383         for (i = 0; i < req.ifm_count; i++) {
2384                 if (IFM_TYPE(media_list[i]) == IFM_IEEE80211
2385                     && IFM_SUBTYPE(media_list[i]) == IFM_AUTO) {
2386                         /* OK, does it do monitor mode? */
2387                         if (media_list[i] & IFM_IEEE80211_MONITOR) {
2388                                 can_do = 1;
2389                                 break;
2390                         }
2391                 }
2392         }
2393         free(media_list);
2394         if (!can_do) {
2395                 /*
2396                  * This adapter doesn't support monitor mode.
2397                  */
2398                 close(sock);
2399                 return (PCAP_ERROR_RFMON_NOTSUP);
2400         }
2401
2402         if (set) {
2403                 /*
2404                  * Don't just check whether we can enable monitor mode,
2405                  * do so, if it's not already enabled.
2406                  */
2407                 if ((req.ifm_current & IFM_IEEE80211_MONITOR) == 0) {
2408                         /*
2409                          * Monitor mode isn't currently on, so turn it on,
2410                          * and remember that we should turn it off when the
2411                          * pcap_t is closed.
2412                          */
2413
2414                         /*
2415                          * If we haven't already done so, arrange to have
2416                          * "pcap_close_all()" called when we exit.
2417                          */
2418                         if (!pcap_do_addexit(p)) {
2419                                 /*
2420                                  * "atexit()" failed; don't put the interface
2421                                  * in monitor mode, just give up.
2422                                  */
2423                                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
2424                                      "atexit failed");
2425                                 close(sock);
2426                                 return (PCAP_ERROR);
2427                         }
2428                         memset(&ifr, 0, sizeof(ifr));
2429                         (void)strncpy(ifr.ifr_name, p->opt.source,
2430                             sizeof(ifr.ifr_name));
2431                         ifr.ifr_media = req.ifm_current | IFM_IEEE80211_MONITOR;
2432                         if (ioctl(sock, SIOCSIFMEDIA, &ifr) == -1) {
2433                                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
2434                                      "SIOCSIFMEDIA: %s", pcap_strerror(errno));
2435                                 close(sock);
2436                                 return (PCAP_ERROR);
2437                         }
2438
2439                         p->md.must_do_on_close |= MUST_CLEAR_RFMON;
2440
2441                         /*
2442                          * Add this to the list of pcaps to close when we exit.
2443                          */
2444                         pcap_add_to_pcaps_to_close(p);
2445                 }
2446         }
2447         return (0);
2448 }
2449 #endif /* HAVE_BSD_IEEE80211 */
2450
2451 #if defined(BIOCGDLTLIST) && (defined(__APPLE__) || defined(HAVE_BSD_IEEE80211))
2452 /*
2453  * Check whether we have any 802.11 link-layer types; return the best
2454  * of the 802.11 link-layer types if we find one, and return -1
2455  * otherwise.
2456  *
2457  * DLT_IEEE802_11_RADIO, with the radiotap header, is considered the
2458  * best 802.11 link-layer type; any of the other 802.11-plus-radio
2459  * headers are second-best; 802.11 with no radio information is
2460  * the least good.
2461  */
2462 static int
2463 find_802_11(struct bpf_dltlist *bdlp)
2464 {
2465         int new_dlt;
2466         int i;
2467
2468         /*
2469          * Scan the list of DLT_ values, looking for 802.11 values,
2470          * and, if we find any, choose the best of them.
2471          */
2472         new_dlt = -1;
2473         for (i = 0; i < bdlp->bfl_len; i++) {
2474                 switch (bdlp->bfl_list[i]) {
2475
2476                 case DLT_IEEE802_11:
2477                         /*
2478                          * 802.11, but no radio.
2479                          *
2480                          * Offer this, and select it as the new mode
2481                          * unless we've already found an 802.11
2482                          * header with radio information.
2483                          */
2484                         if (new_dlt == -1)
2485                                 new_dlt = bdlp->bfl_list[i];
2486                         break;
2487
2488                 case DLT_PRISM_HEADER:
2489                 case DLT_AIRONET_HEADER:
2490                 case DLT_IEEE802_11_RADIO_AVS:
2491                         /*
2492                          * 802.11 with radio, but not radiotap.
2493                          *
2494                          * Offer this, and select it as the new mode
2495                          * unless we've already found the radiotap DLT_.
2496                          */
2497                         if (new_dlt != DLT_IEEE802_11_RADIO)
2498                                 new_dlt = bdlp->bfl_list[i];
2499                         break;
2500
2501                 case DLT_IEEE802_11_RADIO:
2502                         /*
2503                          * 802.11 with radiotap.
2504                          *
2505                          * Offer this, and select it as the new mode.
2506                          */
2507                         new_dlt = bdlp->bfl_list[i];
2508                         break;
2509
2510                 default:
2511                         /*
2512                          * Not 802.11.
2513                          */
2514                         break;
2515                 }
2516         }
2517
2518         return (new_dlt);
2519 }
2520 #endif /* defined(BIOCGDLTLIST) && (defined(__APPLE__) || defined(HAVE_BSD_IEEE80211)) */
2521
2522 #if defined(__APPLE__) && defined(BIOCGDLTLIST)
2523 /*
2524  * Remove DLT_EN10MB from the list of DLT_ values, as we're in monitor mode,
2525  * and DLT_EN10MB isn't supported in monitor mode.
2526  */
2527 static void
2528 remove_en(pcap_t *p)
2529 {
2530         int i, j;
2531
2532         /*
2533          * Scan the list of DLT_ values and discard DLT_EN10MB.
2534          */
2535         j = 0;
2536         for (i = 0; i < p->dlt_count; i++) {
2537                 switch (p->dlt_list[i]) {
2538
2539                 case DLT_EN10MB:
2540                         /*
2541                          * Don't offer this one.
2542                          */
2543                         continue;
2544
2545                 default:
2546                         /*
2547                          * Just copy this mode over.
2548                          */
2549                         break;
2550                 }
2551
2552                 /*
2553                  * Copy this DLT_ value to its new position.
2554                  */
2555                 p->dlt_list[j] = p->dlt_list[i];
2556                 j++;
2557         }
2558
2559         /*
2560          * Set the DLT_ count to the number of entries we copied.
2561          */
2562         p->dlt_count = j;
2563 }
2564
2565 /*
2566  * Remove 802.11 link-layer types from the list of DLT_ values, as
2567  * we're not in monitor mode, and those DLT_ values will switch us
2568  * to monitor mode.
2569  */
2570 static void
2571 remove_802_11(pcap_t *p)
2572 {
2573         int i, j;
2574
2575         /*
2576          * Scan the list of DLT_ values and discard 802.11 values.
2577          */
2578         j = 0;
2579         for (i = 0; i < p->dlt_count; i++) {
2580                 switch (p->dlt_list[i]) {
2581
2582                 case DLT_IEEE802_11:
2583                 case DLT_PRISM_HEADER:
2584                 case DLT_AIRONET_HEADER:
2585                 case DLT_IEEE802_11_RADIO:
2586                 case DLT_IEEE802_11_RADIO_AVS:
2587                         /*
2588                          * 802.11.  Don't offer this one.
2589                          */
2590                         continue;
2591
2592                 default:
2593                         /*
2594                          * Just copy this mode over.
2595                          */
2596                         break;
2597                 }
2598
2599                 /*
2600                  * Copy this DLT_ value to its new position.
2601                  */
2602                 p->dlt_list[j] = p->dlt_list[i];
2603                 j++;
2604         }
2605
2606         /*
2607          * Set the DLT_ count to the number of entries we copied.
2608          */
2609         p->dlt_count = j;
2610 }
2611 #endif /* defined(__APPLE__) && defined(BIOCGDLTLIST) */
2612
2613 static int
2614 pcap_setfilter_bpf(pcap_t *p, struct bpf_program *fp)
2615 {
2616         /*
2617          * Free any user-mode filter we might happen to have installed.
2618          */
2619         pcap_freecode(&p->fcode);
2620
2621         /*
2622          * Try to install the kernel filter.
2623          */
2624         if (ioctl(p->fd, BIOCSETF, (caddr_t)fp) == 0) {
2625                 /*
2626                  * It worked.
2627                  */
2628                 p->md.use_bpf = 1;      /* filtering in the kernel */
2629
2630                 /*
2631                  * Discard any previously-received packets, as they might
2632                  * have passed whatever filter was formerly in effect, but
2633                  * might not pass this filter (BIOCSETF discards packets
2634                  * buffered in the kernel, so you can lose packets in any
2635                  * case).
2636                  */
2637                 p->cc = 0;
2638                 return (0);
2639         }
2640
2641         /*
2642          * We failed.
2643          *
2644          * If it failed with EINVAL, that's probably because the program
2645          * is invalid or too big.  Validate it ourselves; if we like it
2646          * (we currently allow backward branches, to support protochain),
2647          * run it in userland.  (There's no notion of "too big" for
2648          * userland.)
2649          *
2650          * Otherwise, just give up.
2651          * XXX - if the copy of the program into the kernel failed,
2652          * we will get EINVAL rather than, say, EFAULT on at least
2653          * some kernels.
2654          */
2655         if (errno != EINVAL) {
2656                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "BIOCSETF: %s",
2657                     pcap_strerror(errno));
2658                 return (-1);
2659         }
2660
2661         /*
2662          * install_bpf_program() validates the program.
2663          *
2664          * XXX - what if we already have a filter in the kernel?
2665          */
2666         if (install_bpf_program(p, fp) < 0)
2667                 return (-1);
2668         p->md.use_bpf = 0;      /* filtering in userland */
2669         return (0);
2670 }
2671
2672 /*
2673  * Set direction flag: Which packets do we accept on a forwarding
2674  * single device? IN, OUT or both?
2675  */
2676 static int
2677 pcap_setdirection_bpf(pcap_t *p, pcap_direction_t d)
2678 {
2679 #if defined(BIOCSDIRECTION)
2680         u_int direction;
2681
2682         direction = (d == PCAP_D_IN) ? BPF_D_IN :
2683             ((d == PCAP_D_OUT) ? BPF_D_OUT : BPF_D_INOUT);
2684         if (ioctl(p->fd, BIOCSDIRECTION, &direction) == -1) {
2685                 (void) snprintf(p->errbuf, sizeof(p->errbuf),
2686                     "Cannot set direction to %s: %s",
2687                         (d == PCAP_D_IN) ? "PCAP_D_IN" :
2688                         ((d == PCAP_D_OUT) ? "PCAP_D_OUT" : "PCAP_D_INOUT"),
2689                         strerror(errno));
2690                 return (-1);
2691         }
2692         return (0);
2693 #elif defined(BIOCSSEESENT)
2694         u_int seesent;
2695
2696         /*
2697          * We don't support PCAP_D_OUT.
2698          */
2699         if (d == PCAP_D_OUT) {
2700                 snprintf(p->errbuf, sizeof(p->errbuf),
2701                     "Setting direction to PCAP_D_OUT is not supported on BPF");
2702                 return -1;
2703         }
2704
2705         seesent = (d == PCAP_D_INOUT);
2706         if (ioctl(p->fd, BIOCSSEESENT, &seesent) == -1) {
2707                 (void) snprintf(p->errbuf, sizeof(p->errbuf),
2708                     "Cannot set direction to %s: %s",
2709                         (d == PCAP_D_INOUT) ? "PCAP_D_INOUT" : "PCAP_D_IN",
2710                         strerror(errno));
2711                 return (-1);
2712         }
2713         return (0);
2714 #else
2715         (void) snprintf(p->errbuf, sizeof(p->errbuf),
2716             "This system doesn't support BIOCSSEESENT, so the direction can't be set");
2717         return (-1);
2718 #endif
2719 }
2720
2721 static int
2722 pcap_set_datalink_bpf(pcap_t *p, int dlt)
2723 {
2724 #ifdef BIOCSDLT
2725         if (ioctl(p->fd, BIOCSDLT, &dlt) == -1) {
2726                 (void) snprintf(p->errbuf, sizeof(p->errbuf),
2727                     "Cannot set DLT %d: %s", dlt, strerror(errno));
2728                 return (-1);
2729         }
2730 #endif
2731         return (0);
2732 }