libpcap  1.10.1
About: libpcap is a packet filter library used by tools like tcpdump.
  Fossies Dox: libpcap-1.10.1.tar.gz  ("unofficial" and yet experimental doxygen-generated source code documentation)  

pcap-int.h
Go to the documentation of this file.
1 /*
2  * Copyright (c) 1994, 1995, 1996
3  * The Regents of the University of California. All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  * notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  * notice, this list of conditions and the following disclaimer in the
12  * documentation and/or other materials provided with the distribution.
13  * 3. All advertising materials mentioning features or use of this software
14  * must display the following acknowledgement:
15  * This product includes software developed by the Computer Systems
16  * Engineering Group at Lawrence Berkeley Laboratory.
17  * 4. Neither the name of the University nor of the Laboratory may be used
18  * to endorse or promote products derived from this software without
19  * specific prior written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24  * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  */
33 
34 #ifndef pcap_int_h
35 #define pcap_int_h
36 
37 #include <stddef.h>
38 
39 #include <signal.h>
40 
41 #include <pcap/pcap.h>
42 
43 #ifdef MSDOS
44  #include <fcntl.h>
45  #include <io.h>
46 #endif
47 
48 #include "varattrs.h"
49 #include "fmtutils.h"
50 
51 #include <stdarg.h>
52 
53 #include "portability.h"
54 
55 /*
56  * Version string.
57  * Uses PACKAGE_VERSION from config.h.
58  */
59 #define PCAP_VERSION_STRING "libpcap version " PACKAGE_VERSION
60 
61 #ifdef __cplusplus
62 extern "C" {
63 #endif
64 
65 /*
66  * If pcap_new_api is set, we disable pcap_lookupdev(), because:
67  *
68  * it's not thread-safe, and is marked as deprecated, on all
69  * platforms;
70  *
71  * on Windows, it may return UTF-16LE strings, which the program
72  * might then pass to pcap_create() (or to pcap_open_live(), which
73  * then passes them to pcap_create()), requiring pcap_create() to
74  * check for UTF-16LE strings using a hack, and that hack 1)
75  * *cannot* be 100% reliable and 2) runs the risk of going past the
76  * end of the string.
77  *
78  * We keep it around in legacy mode for compatibility.
79  *
80  * We also disable the aforementioned hack in pcap_create().
81  */
82 extern int pcap_new_api;
83 
84 /*
85  * If pcap_utf_8_mode is set, on Windows we treat strings as UTF-8.
86  *
87  * On UN*Xes, we assume all strings are and should be in UTF-8, regardless
88  * of the setting of this flag.
89  */
90 extern int pcap_utf_8_mode;
91 
92 /*
93  * Swap byte ordering of unsigned long long timestamp on a big endian
94  * machine.
95  */
96 #define SWAPLL(ull) ((ull & 0xff00000000000000ULL) >> 56) | \
97  ((ull & 0x00ff000000000000ULL) >> 40) | \
98  ((ull & 0x0000ff0000000000ULL) >> 24) | \
99  ((ull & 0x000000ff00000000ULL) >> 8) | \
100  ((ull & 0x00000000ff000000ULL) << 8) | \
101  ((ull & 0x0000000000ff0000ULL) << 24) | \
102  ((ull & 0x000000000000ff00ULL) << 40) | \
103  ((ull & 0x00000000000000ffULL) << 56)
104 
105 /*
106  * Maximum snapshot length.
107  *
108  * Somewhat arbitrary, but chosen to be:
109  *
110  * 1) big enough for maximum-size Linux loopback packets (65549)
111  * and some USB packets captured with USBPcap:
112  *
113  * https://desowin.org/usbpcap/
114  *
115  * (> 131072, < 262144)
116  *
117  * and
118  *
119  * 2) small enough not to cause attempts to allocate huge amounts of
120  * memory; some applications might use the snapshot length in a
121  * savefile header to control the size of the buffer they allocate,
122  * so a size of, say, 2^31-1 might not work well. (libpcap uses it
123  * as a hint, but doesn't start out allocating a buffer bigger than
124  * 2 KiB, and grows the buffer as necessary, but not beyond the
125  * per-linktype maximum snapshot length. Other code might naively
126  * use it; we want to avoid writing a too-large snapshot length,
127  * in order not to cause that code problems.)
128  *
129  * We don't enforce this in pcap_set_snaplen(), but we use it internally.
130  */
131 #define MAXIMUM_SNAPLEN 262144
132 
133 /*
134  * Locale-independent macros for testing character types.
135  * These can be passed any integral value, without worrying about, for
136  * example, sign-extending char values, unlike the C macros.
137  */
138 #define PCAP_ISDIGIT(c) \
139  ((c) >= '0' && (c) <= '9')
140 #define PCAP_ISXDIGIT(c) \
141  (((c) >= '0' && (c) <= '9') || \
142  ((c) >= 'A' && (c) <= 'F') || \
143  ((c) >= 'a' && (c) <= 'f'))
144 
145 struct pcap_opt {
146  char *device;
147  int timeout; /* timeout for buffering */
148  u_int buffer_size;
149  int promisc;
150  int rfmon; /* monitor mode */
151  int immediate; /* immediate mode - deliver packets as soon as they arrive */
152  int nonblock; /* non-blocking mode - don't wait for packets to be delivered, return "no packets available" */
155 
156  /*
157  * Platform-dependent options.
158  */
159 #ifdef __linux__
160  int protocol; /* protocol to use when creating PF_PACKET socket */
161 #endif
162 #ifdef _WIN32
163  int nocapture_local;/* disable NPF loopback */
164 #endif
165 };
166 
167 typedef int (*activate_op_t)(pcap_t *);
168 typedef int (*can_set_rfmon_op_t)(pcap_t *);
169 typedef int (*read_op_t)(pcap_t *, int cnt, pcap_handler, u_char *);
170 typedef int (*next_packet_op_t)(pcap_t *, struct pcap_pkthdr *, u_char **);
171 typedef int (*inject_op_t)(pcap_t *, const void *, int);
172 typedef void (*save_current_filter_op_t)(pcap_t *, const char *);
173 typedef int (*setfilter_op_t)(pcap_t *, struct bpf_program *);
175 typedef int (*set_datalink_op_t)(pcap_t *, int);
176 typedef int (*getnonblock_op_t)(pcap_t *);
177 typedef int (*setnonblock_op_t)(pcap_t *, int);
178 typedef int (*stats_op_t)(pcap_t *, struct pcap_stat *);
179 typedef void (*breakloop_op_t)(pcap_t *);
180 #ifdef _WIN32
181 typedef struct pcap_stat *(*stats_ex_op_t)(pcap_t *, int *);
182 typedef int (*setbuff_op_t)(pcap_t *, int);
183 typedef int (*setmode_op_t)(pcap_t *, int);
184 typedef int (*setmintocopy_op_t)(pcap_t *, int);
185 typedef HANDLE (*getevent_op_t)(pcap_t *);
186 typedef int (*oid_get_request_op_t)(pcap_t *, bpf_u_int32, void *, size_t *);
187 typedef int (*oid_set_request_op_t)(pcap_t *, bpf_u_int32, const void *, size_t *);
188 typedef u_int (*sendqueue_transmit_op_t)(pcap_t *, pcap_send_queue *, int);
189 typedef int (*setuserbuffer_op_t)(pcap_t *, int);
190 typedef int (*live_dump_op_t)(pcap_t *, char *, int, int);
191 typedef int (*live_dump_ended_op_t)(pcap_t *, int);
192 typedef PAirpcapHandle (*get_airpcap_handle_op_t)(pcap_t *);
193 #endif
194 typedef void (*cleanup_op_t)(pcap_t *);
195 
196 /*
197  * We put all the stuff used in the read code path at the beginning,
198  * to try to keep it together in the same cache line or lines.
199  */
200 struct pcap {
201  /*
202  * Method to call to read packets on a live capture.
203  */
205 
206  /*
207  * Method to call to read the next packet from a savefile.
208  */
210 
211 #ifdef _WIN32
212  HANDLE handle;
213 #else
214  int fd;
215 #endif /* _WIN32 */
216 
217  /*
218  * Read buffer.
219  */
220  u_int bufsize;
221  void *buffer;
222  u_char *bp;
223  int cc;
224 
225  sig_atomic_t break_loop; /* flag set to force break from packet-reading loop */
226 
227  void *priv; /* private data for methods */
228 
229 #ifdef ENABLE_REMOTE
230  struct pcap_samp rmt_samp; /* parameters related to the sampling process. */
231 #endif
232 
233  int swapped;
234  FILE *rfile; /* null if live capture, non-null if savefile */
235  u_int fddipad;
236  struct pcap *next; /* list of open pcaps that need stuff cleared on close */
237 
238  /*
239  * File version number; meaningful only for a savefile, but we
240  * keep it here so that apps that (mistakenly) ask for the
241  * version numbers will get the same zero values that they
242  * always did.
243  */
246 
247  int snapshot;
248  int linktype; /* Network linktype */
249  int linktype_ext; /* Extended information stored in the linktype field of a file */
250  int offset; /* offset for proper alignment */
251  int activated; /* true if the capture is really started */
252  int oldstyle; /* if we're opening with pcap_open_live() */
253 
254  struct pcap_opt opt;
255 
256  /*
257  * Place holder for pcap_next().
258  */
259  u_char *pkt;
260 
261 #ifdef _WIN32
262  struct pcap_stat stat; /* used for pcap_stats_ex() */
263 #endif
264 
265  /* We're accepting only packets in this direction/these directions. */
267 
268  /*
269  * Flags to affect BPF code generation.
270  */
272 
273 #if !defined(_WIN32) && !defined(MSDOS)
274  int selectable_fd; /* FD on which select()/poll()/epoll_wait()/kevent()/etc. can be done */
275 
276  /*
277  * In case there either is no selectable FD, or there is but
278  * it doesn't necessarily work (e.g., if it doesn't get notified
279  * if the packet capture timeout expires before the buffer
280  * fills up), this points to a timeout that should be used
281  * in select()/poll()/epoll_wait()/kevent() call. The pcap_t should
282  * be put into non-blocking mode, and, if the timeout expires on
283  * the call, an attempt should be made to read packets from all
284  * pcap_t's with a required timeout, and the code must be
285  * prepared not to see any packets from the attempt.
286  */
287  const struct timeval *required_select_timeout;
288 #endif
289 
290  /*
291  * Placeholder for filter code if bpf not in kernel.
292  */
293  struct bpf_program fcode;
294 
296 #ifdef _WIN32
297  char acp_errbuf[PCAP_ERRBUF_SIZE + 1]; /* buffer for local code page error strings */
298 #endif
300  u_int *dlt_list;
305 
306  struct pcap_pkthdr pcap_header; /* This is needed for the pcap_next_ex() to work */
307 
308  /*
309  * More methods.
310  */
322 
323  /*
324  * Routine to use as callback for pcap_next()/pcap_next_ex().
325  */
327 
328 #ifdef _WIN32
329  /*
330  * These are, at least currently, specific to the Win32 NPF
331  * driver.
332  */
333  stats_ex_op_t stats_ex_op;
334  setbuff_op_t setbuff_op;
335  setmode_op_t setmode_op;
336  setmintocopy_op_t setmintocopy_op;
337  getevent_op_t getevent_op;
338  oid_get_request_op_t oid_get_request_op;
339  oid_set_request_op_t oid_set_request_op;
340  sendqueue_transmit_op_t sendqueue_transmit_op;
341  setuserbuffer_op_t setuserbuffer_op;
342  live_dump_op_t live_dump_op;
343  live_dump_ended_op_t live_dump_ended_op;
344  get_airpcap_handle_op_t get_airpcap_handle_op;
345 #endif
347 };
348 
349 /*
350  * BPF code generation flags.
351  */
352 #define BPF_SPECIAL_VLAN_HANDLING 0x00000001 /* special VLAN handling for Linux */
353 
354 /*
355  * This is a timeval as stored in a savefile.
356  * It has to use the same types everywhere, independent of the actual
357  * `struct timeval'; `struct timeval' has 32-bit tv_sec values on some
358  * platforms and 64-bit tv_sec values on other platforms, and writing
359  * out native `struct timeval' values would mean files could only be
360  * read on systems with the same tv_sec size as the system on which
361  * the file was written.
362  */
363 
364 struct pcap_timeval {
365  bpf_int32 tv_sec; /* seconds */
366  bpf_int32 tv_usec; /* microseconds */
367 };
368 
369 /*
370  * This is a `pcap_pkthdr' as actually stored in a savefile.
371  *
372  * Do not change the format of this structure, in any way (this includes
373  * changes that only affect the length of fields in this structure),
374  * and do not make the time stamp anything other than seconds and
375  * microseconds (e.g., seconds and nanoseconds). Instead:
376  *
377  * introduce a new structure for the new format;
378  *
379  * send mail to "tcpdump-workers@lists.tcpdump.org", requesting
380  * a new magic number for your new capture file format, and, when
381  * you get the new magic number, put it in "savefile.c";
382  *
383  * use that magic number for save files with the changed record
384  * header;
385  *
386  * make the code in "savefile.c" capable of reading files with
387  * the old record header as well as files with the new record header
388  * (using the magic number to determine the header format).
389  *
390  * Then supply the changes by forking the branch at
391  *
392  * https://github.com/the-tcpdump-group/libpcap/tree/master
393  *
394  * and issuing a pull request, so that future versions of libpcap and
395  * programs that use it (such as tcpdump) will be able to read your new
396  * capture file format.
397  */
398 
400  struct pcap_timeval ts; /* time stamp */
401  bpf_u_int32 caplen; /* length of portion present */
402  bpf_u_int32 len; /* length of this packet (off wire) */
403 };
404 
405 /*
406  * How a `pcap_pkthdr' is actually stored in savefiles written
407  * by some patched versions of libpcap (e.g. the ones in Red
408  * Hat Linux 6.1 and 6.2).
409  *
410  * Do not change the format of this structure, in any way (this includes
411  * changes that only affect the length of fields in this structure).
412  * Instead, introduce a new structure, as per the above.
413  */
414 
416  struct pcap_timeval ts; /* time stamp */
417  bpf_u_int32 caplen; /* length of portion present */
418  bpf_u_int32 len; /* length of this packet (off wire) */
419  int index;
420  unsigned short protocol;
421  unsigned char pkt_type;
422 };
423 
424 /*
425  * User data structure for the one-shot callback used for pcap_next()
426  * and pcap_next_ex().
427  */
429  struct pcap_pkthdr *hdr;
430  const u_char **pkt;
432 };
433 
434 #ifndef min
435 #define min(a, b) ((a) > (b) ? (b) : (a))
436 #endif
437 
438 int pcap_offline_read(pcap_t *, int, pcap_handler, u_char *);
439 
440 /*
441  * Does the packet count argument to a module's read routine say
442  * "supply packets until you run out of packets"?
443  */
444 #define PACKET_COUNT_IS_UNLIMITED(count) ((count) <= 0)
445 
446 /*
447  * Routines that most pcap implementations can use for non-blocking mode.
448  */
449 #if !defined(_WIN32) && !defined(MSDOS)
451 int pcap_setnonblock_fd(pcap_t *p, int);
452 #endif
453 
454 /*
455  * Internal interfaces for "pcap_create()".
456  *
457  * "pcap_create_interface()" is the routine to do a pcap_create on
458  * a regular network interface. There are multiple implementations
459  * of this, one for each platform type (Linux, BPF, DLPI, etc.),
460  * with the one used chosen by the configure script.
461  *
462  * "pcap_create_common()" allocates and fills in a pcap_t, for use
463  * by pcap_create routines.
464  */
465 pcap_t *pcap_create_interface(const char *, char *);
466 
467 /*
468  * This wrapper takes an error buffer pointer and a type to use for the
469  * private data, and calls pcap_create_common(), passing it the error
470  * buffer pointer, the size fo the private data type, in bytes, and the
471  * offset of the private data from the beginning of the structure, in
472  * bytes.
473  */
474 #define PCAP_CREATE_COMMON(ebuf, type) \
475  pcap_create_common(ebuf, \
476  sizeof (struct { pcap_t __common; type __private; }), \
477  offsetof (struct { pcap_t __common; type __private; }, __private))
478 pcap_t *pcap_create_common(char *, size_t, size_t);
479 int pcap_do_addexit(pcap_t *);
485 
486 /*
487  * Internal interfaces for "pcap_findalldevs()".
488  *
489  * A pcap_if_list_t * is a reference to a list of devices.
490  *
491  * A get_if_flags_func is a platform-dependent function called to get
492  * additional interface flags.
493  *
494  * "pcap_platform_finddevs()" is the platform-dependent routine to
495  * find local network interfaces.
496  *
497  * "pcap_findalldevs_interfaces()" is a helper to find those interfaces
498  * using the "standard" mechanisms (SIOCGIFCONF, "getifaddrs()", etc.).
499  *
500  * "add_dev()" adds an entry to a pcap_if_list_t.
501  *
502  * "find_dev()" tries to find a device, by name, in a pcap_if_list_t.
503  *
504  * "find_or_add_dev()" checks whether a device is already in a pcap_if_list_t
505  * and, if not, adds an entry for it.
506  */
507 struct pcap_if_list;
508 typedef struct pcap_if_list pcap_if_list_t;
509 typedef int (*get_if_flags_func)(const char *, bpf_u_int32 *, char *);
511 #if !defined(_WIN32) && !defined(MSDOS)
513  int (*)(const char *), get_if_flags_func);
514 #endif
516  get_if_flags_func, const char *, char *);
517 pcap_if_t *find_dev(pcap_if_list_t *, const char *);
518 pcap_if_t *add_dev(pcap_if_list_t *, const char *, bpf_u_int32, const char *,
519  char *);
520 int add_addr_to_dev(pcap_if_t *, struct sockaddr *, size_t,
521  struct sockaddr *, size_t, struct sockaddr *, size_t,
522  struct sockaddr *dstaddr, size_t, char *errbuf);
523 #ifndef _WIN32
525  get_if_flags_func, char *);
526 int add_addr_to_if(pcap_if_list_t *, const char *, bpf_u_int32,
528  struct sockaddr *, size_t, struct sockaddr *, size_t,
529  struct sockaddr *, size_t, struct sockaddr *, size_t, char *);
530 #endif
531 
532 /*
533  * Internal interfaces for "pcap_open_offline()" and other savefile
534  * I/O routines.
535  *
536  * "pcap_open_offline_common()" allocates and fills in a pcap_t, for use
537  * by pcap_open_offline routines.
538  *
539  * "pcap_adjust_snapshot()" adjusts the snapshot to be non-zero and
540  * fit within an int.
541  *
542  * "sf_cleanup()" closes the file handle associated with a pcap_t, if
543  * appropriate, and frees all data common to all modules for handling
544  * savefile types.
545  *
546  * "charset_fopen()", in UTF-8 mode on Windows, does an fopen() that
547  * treats the pathname as being in UTF-8, rather than the local
548  * code page, on Windows.
549  */
550 
551 /*
552  * This wrapper takes an error buffer pointer and a type to use for the
553  * private data, and calls pcap_create_common(), passing it the error
554  * buffer pointer, the size fo the private data type, in bytes, and the
555  * offset of the private data from the beginning of the structure, in
556  * bytes.
557  */
558 #define PCAP_OPEN_OFFLINE_COMMON(ebuf, type) \
559  pcap_open_offline_common(ebuf, \
560  sizeof (struct { pcap_t __common; type __private; }), \
561  offsetof (struct { pcap_t __common; type __private; }, __private))
562 pcap_t *pcap_open_offline_common(char *ebuf, size_t total_size,
563  size_t private_data);
565 void sf_cleanup(pcap_t *p);
566 #ifdef _WIN32
567 FILE *charset_fopen(const char *path, const char *mode);
568 #else
569 /*
570  * On other OSes, just use Boring Old fopen().
571  */
572 #define charset_fopen(path, mode) fopen((path), (mode))
573 #endif
574 
575 /*
576  * Internal interfaces for loading code at run time.
577  */
578 #ifdef _WIN32
579 #define pcap_code_handle_t HMODULE
580 #define pcap_funcptr_t FARPROC
581 
582 pcap_code_handle_t pcap_load_code(const char *);
583 pcap_funcptr_t pcap_find_function(pcap_code_handle_t, const char *);
584 #endif
585 
586 /*
587  * Internal interfaces for doing user-mode filtering of packets and
588  * validating filter programs.
589  */
590 /*
591  * Auxiliary data, for use when interpreting a filter intended for the
592  * Linux kernel when the kernel rejects the filter (requiring us to
593  * run it in userland). It contains VLAN tag information.
594  */
597  u_short vlan_tag;
598 };
599 
600 /*
601  * Filtering routine that takes the auxiliary data as an additional
602  * argument.
603  */
604 u_int pcap_filter_with_aux_data(const struct bpf_insn *,
605  const u_char *, u_int, u_int, const struct pcap_bpf_aux_data *);
606 
607 /*
608  * Filtering routine that doesn't.
609  */
610 u_int pcap_filter(const struct bpf_insn *, const u_char *, u_int, u_int);
611 
612 /*
613  * Routine to validate a BPF program.
614  */
615 int pcap_validate_filter(const struct bpf_insn *, int);
616 
617 /*
618  * Internal interfaces for both "pcap_create()" and routines that
619  * open savefiles.
620  *
621  * "pcap_oneshot()" is the standard one-shot callback for "pcap_next()"
622  * and "pcap_next_ex()".
623  */
624 void pcap_oneshot(u_char *, const struct pcap_pkthdr *, const u_char *);
625 
626 int install_bpf_program(pcap_t *, struct bpf_program *);
627 
628 int pcap_strcasecmp(const char *, const char *);
629 
630 /*
631  * Internal interfaces for pcap_createsrcstr and pcap_parsesrcstr with
632  * the additional bit of information regarding SSL support (rpcap:// vs.
633  * rpcaps://).
634  */
635 int pcap_createsrcstr_ex(char *, int, const char *, const char *,
636  const char *, unsigned char, char *);
637 int pcap_parsesrcstr_ex(const char *, int *, char *, char *,
638  char *, unsigned char *, char *);
639 
640 #ifdef YYDEBUG
641 extern int pcap_debug;
642 #endif
643 
644 #ifdef __cplusplus
645 }
646 #endif
647 
648 #endif
u_int bpf_u_int32
Definition: bpf.h:98
int bpf_int32
Definition: bpf.h:97
int add_addr_to_if(pcap_if_list_t *, const char *, bpf_u_int32, get_if_flags_func, struct sockaddr *, size_t, struct sockaddr *, size_t, struct sockaddr *, size_t, struct sockaddr *, size_t, char *)
Definition: pcap.c:1072
void sf_cleanup(pcap_t *p)
Definition: savefile.c:241
u_int pcap_filter(const struct bpf_insn *, const u_char *, u_int, u_int)
Definition: bpf_filter.c:391
void(* breakloop_op_t)(pcap_t *)
Definition: pcap-int.h:179
int pcap_new_api
Definition: pcap.c:51
pcap_t * pcap_create_interface(const char *, char *)
Definition: pcap-bpf.c:443
void pcap_add_to_pcaps_to_close(pcap_t *)
Definition: pcap.c:3946
bpf_u_int32 pcap_adjust_snapshot(bpf_u_int32 linktype, bpf_u_int32 snaplen)
Definition: savefile.c:444
int pcap_strcasecmp(const char *, const char *)
Definition: pcap.c:3130
int pcap_do_addexit(pcap_t *)
Definition: pcap.c:3926
int pcap_offline_read(pcap_t *, int, pcap_handler, u_char *)
Definition: savefile.c:618
int(* getnonblock_op_t)(pcap_t *)
Definition: pcap-int.h:176
int(* inject_op_t)(pcap_t *, const void *, int)
Definition: pcap-int.h:171
int pcap_check_activated(pcap_t *)
Definition: pcap.c:2537
void pcap_breakloop_common(pcap_t *)
Definition: pcap.c:3980
pcap_if_t * find_dev(pcap_if_list_t *, const char *)
Definition: pcap.c:1274
pcap_if_t * add_dev(pcap_if_list_t *, const char *, bpf_u_int32, const char *, char *)
Definition: pcap.c:1308
int pcap_validate_filter(const struct bpf_insn *, int)
Definition: bpf_filter.c:409
u_int pcap_filter_with_aux_data(const struct bpf_insn *, const u_char *, u_int, u_int, const struct pcap_bpf_aux_data *)
Definition: bpf_filter.c:93
void pcap_cleanup_live_common(pcap_t *)
Definition: pcap.c:3987
pcap_if_t * find_or_add_dev(pcap_if_list_t *, const char *, bpf_u_int32, get_if_flags_func, const char *, char *)
Definition: pcap.c:1233
int pcap_findalldevs_interfaces(pcap_if_list_t *, char *, int(*)(const char *), get_if_flags_func)
Definition: fad-getad.c:146
int pcap_createsrcstr_ex(char *, int, const char *, const char *, const char *, unsigned char, char *)
int pcap_getnonblock_fd(pcap_t *)
Definition: pcap.c:3537
int(* setfilter_op_t)(pcap_t *, struct bpf_program *)
Definition: pcap-int.h:173
int(* can_set_rfmon_op_t)(pcap_t *)
Definition: pcap-int.h:168
int install_bpf_program(pcap_t *, struct bpf_program *)
Definition: optimize.c:2939
int(* set_datalink_op_t)(pcap_t *, int)
Definition: pcap-int.h:175
int(* setnonblock_op_t)(pcap_t *, int)
Definition: pcap-int.h:177
int(* next_packet_op_t)(pcap_t *, struct pcap_pkthdr *, u_char **)
Definition: pcap-int.h:170
int(* read_op_t)(pcap_t *, int cnt, pcap_handler, u_char *)
Definition: pcap-int.h:169
int(* get_if_flags_func)(const char *, bpf_u_int32 *, char *)
Definition: pcap-int.h:509
void(* cleanup_op_t)(pcap_t *)
Definition: pcap-int.h:194
void pcap_remove_from_pcaps_to_close(pcap_t *)
Definition: pcap.c:3953
void(* save_current_filter_op_t)(pcap_t *, const char *)
Definition: pcap-int.h:172
pcap_if_t * find_or_add_if(pcap_if_list_t *, const char *, bpf_u_int32, get_if_flags_func, char *)
Definition: pcap.c:1015
int pcap_setnonblock_fd(pcap_t *p, int)
Definition: pcap.c:3583
pcap_t * pcap_create_common(char *, size_t, size_t)
Definition: pcap.c:2484
int pcap_platform_finddevs(pcap_if_list_t *, char *)
Definition: pcap-bpf.c:2995
int(* stats_op_t)(pcap_t *, struct pcap_stat *)
Definition: pcap-int.h:178
int add_addr_to_dev(pcap_if_t *, struct sockaddr *, size_t, struct sockaddr *, size_t, struct sockaddr *, size_t, struct sockaddr *dstaddr, size_t, char *errbuf)
Definition: pcap.c:1118
pcap_t * pcap_open_offline_common(char *ebuf, size_t total_size, size_t private_data)
Definition: pcap.c:2868
int(* setdirection_op_t)(pcap_t *, pcap_direction_t)
Definition: pcap-int.h:174
int pcap_parsesrcstr_ex(const char *, int *, char *, char *, char *, unsigned char *, char *)
int pcap_utf_8_mode
Definition: pcap.c:241
void pcap_oneshot(u_char *, const struct pcap_pkthdr *, const u_char *)
Definition: pcap.c:579
int(* activate_op_t)(pcap_t *)
Definition: pcap-int.h:167
#define charset_fopen(path, mode)
Definition: pcap-int.h:572
struct pcap_stat stat
Definition: pcap-septel.c:51
void(* pcap_handler)(u_char *, const struct pcap_pkthdr *, const u_char *)
Definition: pcap.h:330
pcap_direction_t
Definition: pcap.h:227
#define PCAP_ERRBUF_SIZE
Definition: pcap.h:152
Definition: bpf.h:245
pcap_t * pd
Definition: pcap-int.h:431
const u_char ** pkt
Definition: pcap-int.h:430
struct pcap_pkthdr * hdr
Definition: pcap-int.h:429
u_short vlan_tag
Definition: pcap-int.h:597
u_short vlan_tag_present
Definition: pcap-int.h:596
Definition: pcap.h:301
int tstamp_type
Definition: pcap-int.h:153
int timeout
Definition: pcap-int.h:147
char * device
Definition: pcap-int.h:146
int rfmon
Definition: pcap-int.h:150
int tstamp_precision
Definition: pcap-int.h:154
int immediate
Definition: pcap-int.h:151
int promisc
Definition: pcap-int.h:149
int nonblock
Definition: pcap-int.h:152
u_int buffer_size
Definition: pcap-int.h:148
struct pcap_timeval ts
Definition: pcap-int.h:416
unsigned char pkt_type
Definition: pcap-int.h:421
bpf_u_int32 caplen
Definition: pcap-int.h:417
unsigned short protocol
Definition: pcap-int.h:420
struct pcap_timeval ts
Definition: pcap-int.h:400
bpf_u_int32 len
Definition: pcap-int.h:402
bpf_u_int32 caplen
Definition: pcap-int.h:401
bpf_int32 tv_sec
Definition: pcap-int.h:365
bpf_int32 tv_usec
Definition: pcap-int.h:366
Definition: pcap-int.h:200
int version_major
Definition: pcap-int.h:244
stats_op_t stats_op
Definition: pcap-int.h:320
activate_op_t activate_op
Definition: pcap-int.h:311
setnonblock_op_t setnonblock_op
Definition: pcap-int.h:319
int swapped
Definition: pcap-int.h:233
int bpf_codegen_flags
Definition: pcap-int.h:271
setfilter_op_t setfilter_op
Definition: pcap-int.h:315
u_int * tstamp_precision_list
Definition: pcap-int.h:304
sig_atomic_t break_loop
Definition: pcap-int.h:225
struct pcap_pkthdr pcap_header
Definition: pcap-int.h:306
int dlt_count
Definition: pcap-int.h:299
pcap_handler oneshot_callback
Definition: pcap-int.h:326
u_int fddipad
Definition: pcap-int.h:235
struct pcap * next
Definition: pcap-int.h:236
int linktype_ext
Definition: pcap-int.h:249
int tstamp_type_count
Definition: pcap-int.h:301
u_int bufsize
Definition: pcap-int.h:220
void * priv
Definition: pcap-int.h:227
getnonblock_op_t getnonblock_op
Definition: pcap-int.h:318
int offset
Definition: pcap-int.h:250
u_int * dlt_list
Definition: pcap-int.h:300
read_op_t read_op
Definition: pcap-int.h:204
void * buffer
Definition: pcap-int.h:221
u_char * pkt
Definition: pcap-int.h:259
u_char * bp
Definition: pcap-int.h:222
pcap_direction_t direction
Definition: pcap-int.h:266
next_packet_op_t next_packet_op
Definition: pcap-int.h:209
int snapshot
Definition: pcap-int.h:247
save_current_filter_op_t save_current_filter_op
Definition: pcap-int.h:314
cleanup_op_t cleanup_op
Definition: pcap-int.h:346
const struct timeval * required_select_timeout
Definition: pcap-int.h:287
setdirection_op_t setdirection_op
Definition: pcap-int.h:316
int tstamp_precision_count
Definition: pcap-int.h:303
inject_op_t inject_op
Definition: pcap-int.h:313
int cc
Definition: pcap-int.h:223
u_int * tstamp_type_list
Definition: pcap-int.h:302
struct bpf_program fcode
Definition: pcap-int.h:293
breakloop_op_t breakloop_op
Definition: pcap-int.h:321
int version_minor
Definition: pcap-int.h:245
set_datalink_op_t set_datalink_op
Definition: pcap-int.h:317
char errbuf[256+1]
Definition: pcap-int.h:295
int linktype
Definition: pcap-int.h:248
int selectable_fd
Definition: pcap-int.h:274
int activated
Definition: pcap-int.h:251
int fd
Definition: pcap-int.h:214
can_set_rfmon_op_t can_set_rfmon_op
Definition: pcap-int.h:312
struct pcap_opt opt
Definition: pcap-int.h:254
int oldstyle
Definition: pcap-int.h:252
FILE * rfile
Definition: pcap-int.h:234