summaryrefslogtreecommitdiff
path: root/pcap-int.h
Commit message (Collapse)AuthorAgeFilesLines
* Add an option to force memory-mapped buffers to be mapped as accessible to ↵Hans Leidekker2022-12-201-0/+5
| | | | 32-bit code.
* Fix some typosFrancois-Xavier Le Bail2022-08-011-2/+2
| | | | [skip ci]
* support user/pass in rpcap:// and rpcaps:// source URIsRyan Castellucci2022-03-071-2/+2
|
* Don't require VS 2015 or later when building applications with pcap.Guy Harris2021-07-081-0/+18
| | | | | | | | | Some Npcap customers are using older versions of VS, so define the relevant integer types ourselves in that case, so that the headers we provide that use them can be used. However, when building libpcap *itself*, require VS 2015 or later, as we assume a level of C99 support found only in VS 2015 or later.
* Move NPF_SURFACE_MOBILE_NONPROMISC to pcap-npf.c.Guy Harris2021-04-291-11/+0
| | | | | | | It's an error code seen only for NPF devices, so move it there. While we're at it, make only one GetLastError() call for the case that can get that error.
* Add check to suppress spurious error generated by noncompiant MS Surface ↵Joel2021-04-291-0/+11
| | | | mobile adaptors when attempting to set non-promiscuous mode
* Move #includes to the top of header files.Guy Harris2021-03-171-9/+9
| | | | | | That makes sure they're not inside extern "C" { ... }, and thus don't get their external linkage language changed. It also makes it easier to see what a given header file pulls in.
* Revert "Don't wrap chunks of headers with extern "C" { ... }."Guy Harris2021-03-171-40/+44
| | | | | | | This reverts commit 8b6b13d4cbb685db047af04c49817ed81fff7c35. That solution allowed you to intermix declarations/definitions and before the extern "C", so you can see what's being imported.
* Don't wrap chunks of headers with extern "C" { ... }.Guy Harris2021-03-171-44/+40
| | | | | | | | | | | Instead, explictly flag individual functions with extern "C" by adding it to the tag we're already using for exported functions, and creating a new tag to use for non-exported functions. Rename those tags, and the tags used for exported data, to say what they do, rather than saying "this is an API" (we may export things we don't want to be treated as part of the API, but that we have to export because some programs use them).
* Rename struct bpf_aux_data to avoid NetBSD compile errors.Guy Harris2021-01-011-2/+2
| | | | | NetBSD 9.0 defines struct bpf_aux_data in net/bpf.h; that gets included by pcap-bpf.c, along with pcap-int.h, which causes a collision.
* Fixup some URLs in the comments.Denis Ovsienko2020-08-021-1/+1
| | | | [skip ci]
* Remove test code.Guy Harris2020-07-031-10/+0
| | | | | | | | The code that should have given a warning wasn't compiled in AppVeyor, because we were building libpcap on its own rather than as part of a WinPcap or Npcap build. [skip ci]
* Spell _WIN32 correctly.Guy Harris2020-07-031-1/+1
| | | | [skip ci]
* OK, see if *this* fixes the link error.Guy Harris2020-07-031-0/+10
| | | | [skip ci]
* Handle the pcap_t+private data in a fashion that makes fewer assumptions.Guy Harris2020-07-011-2/+29
| | | | | | | | | | | | | | | The sizeof operator and alignof macro can be given a type "name" that's anonymous, e.g. sizeof(struct { int a; char *b; }). Have pcap_create_common() and pcap_open_offline_common() take, as arguments, the total size of a structure containing both the pcap_t and the private data as members, and the offset of the private data in that structure, and define macros that calculate those given, as an argument, the data type of the private data. This avoids making assumptions about the alignment of those two items within the structure; that *might* fix GitHub issue #940 if the issue is that the ARM compiler being used does 16-byte alignment of the private structure, rather than the 8-byte alignment we were wiring in.
* Fix typos in some commentsFrancois-Xavier Le Bail2020-05-241-2/+2
| | | | [skip ci]
* Support AirPcap devices with a pcap module.Guy Harris2020-05-071-0/+11
| | | | | | | | This allows us to update the support for newer APIs in the future - and in the present, with pcap_set_datalink() - and would allow Npcap to remove its AirPcap support. Add another test program, while we're at it.
* Get rid of unused charset_fopen_read().Guy Harris2020-04-111-1/+1
|
* Add support for UTF-8 strings on Windows.Guy Harris2020-04-111-1/+44
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add a routine pcap_init() that initializes pcap, specifying whether strings should be treated as being in UTF-8 or a local character encoding. On UN*Xes, we don't change our behavior based on that setting; if there is ever an issue with local character encodings *other* than UTF-8, we can use it. On Windows, the local character encoding is the local ANSI code page; if pcap_init() isn't called, or is called with PCAP_CHAR_ENC_LOCAL, strings are treated as being in the current ANSI code page, as before, otherwise they're treated as being in UTF-8. This includes file path names and error messages. In addition, if pcap_init() is called, regardless of the options, we disable pcap_lookupdev(), making it always return NULL, as it retunred *UTF-16LE* strings (plural!) on Windows NT, and pcap_create() had to check for UTF-16LE strings to work around that. That workaround is unsafe (it will read past the end of the input string if the string is one ASCII character), and is also disabled if pcap_init() is called. We also make rpcapd send UTF-8 error message strings over the wire; sending local code page strings is a Bad Idea, as the client has no idea what the server's code page is. (Do not assume the client and server are necessarily in the same location.) Fix the capitalization of "Winsock" while we're at it; Microsoft appears to spell it "Winsock", rather than "WinSock".
* Use tab instead of space in formatting pcap-int.hNan Xiao2020-03-161-1/+1
|
* On Linux, return error on interface going away, not just going down.Guy Harris2020-01-291-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is a pain to detect, because the PF_PACKET socket code appears to get separate "interface went down" and "interface went away" notifications in my "unplug a USB Wi-Fi adapter" tests on my VMware Fusion Ubuntu 18.04 virtual machine (5.3.0 kernel), and the first notification delivers a wakeup and returns ENETDOWN while the second notificaiton delivers *no* wakeup and sets the ifindex member of the struct packet_sock for the socket, so there's nothing we can test after the wakeup that's guaranteed to indicate that the interface has disappeared. So what we have to do is remember the ENETDOWN but not return it as an error, and then arrange to periodically check whether the interface is still there; if it isn't, we *then* return the "interface went away" error, and, if we see traffic or see that the interface is up, we clear the remembered ENETDOWN and stop doing the periodic checks. This is tricky, because it needs to work not only for blocking pcap_t's, where we're in a loop doing poll() calls, so we can keep checking within the loop, but also for non-blocking pcap_t's on which the caller is doing select()/poll()/epoll_wait(). In order to make *that* work, we need to tweak the semantics of pcap_get_required_select_timeout() so that it's not guaranteed that it will always return the same value, so that it should be called within event loops rather than called once outside the event loop. Normally, there is no timeout required for Linux PF_PACKET sockets, but when we're doing the periodic tests, the timeout is required. While we're doing that, we make the return value of pcap_get_required_select_timeout() a const pointer - there was no good reason for the caller to modify it (it doesn't belong to the caller). If poll() returns POLLERR, use getsockopt(SO_ERROR) to get the socket error, rather than a read(). Update the documentation to reflect this, and make various other cleanups (including documenting the error return value for pcap_get_selectable_fd() to -1 rather than PCAP_ERROR - it's not an error code, it's just a specific error value). Also note that, for kqueues on *BSD/macOS and for select/poll on Linux, the timeout needn't be used as a timeout for the call - you can have a timer, so that when that *particular* timer fires, you try calling pcap_dispatch() on the pcap_t to which it corresponds. Update selpolltest to add more capabilities needed when testing this on Linux. This should address GitHub issue #859 and pull request #858.
* Use more HTTPS in URLsFrancois-Xavier Le Bail2020-01-191-1/+1
| | | | [skip ci]
* Get rid of PCAP_ISLWSP and PCAP_ISSPACE.Guy Harris2019-08-311-7/+0
| | | | | | | Explicitly check for the characters we care about, to make it clearer what we're doing. Fix a bug introduced by an earlier change in the process.
* Don't use ctype.h macros.Guy Harris2019-08-311-0/+19
| | | | | | | | | | | | | | | Some of them are locale-dependent, and all of them run the risk of failing if you hand them a char with the 8th bit set. Define our own locale-independent macros that can be handed any integral value. Don't include <ctype.h>. This should address the issue in GitHub pull request #839, and should also catch any (highly unlikely) cases in which something other than Boring Old Space And Tab and, sometimes, CR and LF are treated as white space. (No, we don't want FF or VT treated as white space.)
* Expand a comment to explain why we clamp the snaphot length.Guy Harris2019-08-191-1/+6
| | | | [skip ci]
* Make sure the *adjusted* snapshot length is the same for all IDBs.Guy Harris2019-08-041-0/+4
| | | | | | | | | | | | | | | | | If the snapshot length is 0, or doesn't fit in an int, we adjust it. If we see an IDB after the first IDB, perform the same adjustment on *its* snapshot length before comparing it with the adjusted snapshot length for the first IDB. (Yes, this means that if the IDBs have different snapshot lengths, but they both adjust to the same value, they will be treated as equal. That's not a bug, that's a feature - the only reason we insist that they be the same is so that the value that pcap_snapshot() returns, which, for pcapng files, is the adjusted snapshot length for the first IDB, applies to all IDBs, so the IDBs all just have to have the same adjusted snapshot length.) This should fix GitHub issue #832.
* When fetching interfaces over TLS, put rpcaps:// into the interface names.Guy Harris2019-02-061-4/+7
| | | | | | If we're fetching interfaces with pcap_findalldevs_ex() with an rpcaps:// URL, put rpcaps:// rather than rpcap:// into the URLs that we return.
* Put pcap_win32_err_to_str() into fmtutils.c, and use it for all Win32 errors.Guy Harris2019-01-081-4/+0
| | | | | | | | We don't need N different places all doing their own calls to FormatMessage(); centralize it in pcap_win32_err_to_str(), now in fmtutils.c for use in rpcapd as well as libpcap. Merge in some fixes from the code in sock_fmterror().
* Merge branch 'master' of https://github.com/rixed/libpcap into rixed-masterGuy Harris2019-01-061-0/+7
|\
| * TLS for rpcap: also encrypt the control socketCedric Cellier2018-09-131-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | This patch also encode the control sockets in adition to the data socket. Clients performs a TLS handshake when the scheme is rpcaps:// rather than rpcap://. Both active and passive modes are supported, but transfert via UDP is not (yet) supported (the lib returns an error in that case). I did some adaptation to the windows code but couldn't tested so for all I know it may not even compile. Also tried to fix the indentation.
* | Merge branch 'master' into breakloop_pollGuy Harris2018-09-141-1/+32
|\ \ | |/
| * Squelch more narrowing warnings.Guy Harris2018-09-121-1/+1
| |
| * Clean up the declaration of the packet-filtering routines.Guy Harris2018-08-311-1/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If net/bpf.h declares bpf_filter() one way and libpcap defines it another way, even pcap-bpf.c needs a declaration that matches how libpcap defines it, not how net/bpf.h (mistakenly) declares it. ("Mistakenly" because it should *not* be declaring the kernel's version of bpf_filter() unless it's being used in a *kernel* build; other *BSDs, and macOS, declare it only in kernel builds by testing for a #define such as KERNEL or KERNEL_PRIVATE, but NetBSD doesn't - it *should*, but it doesn't.) So we rename the internal-to-pcap filtering routine as pcap_filter(), which is not exported from libpcap, and have bpf_filter() be a wrapper around pcap_filter() that is exported. Use pcap_filter(), rather than bpf_filter(), for all filtering inside libpcap (except for filtering that uses bpf_filter_with_aux_data(), which we rename pcap_filter_with_aux_data()). Do the same for bpf_validate(), which is *also* declared in net/bpf.h, even for non-kernel builds, in NetBSD. As we're not exporting pcap_filter_with_aux_data(), don't even *declare* it in a public header; don't declare struct bpf_aux_data in a public header, either. That way we can change it without worrying about breaking APIs or ABIs; we may do that if, for example, we want to support the "inbound" and "outbound" filters when reading pcapng files, adding a direction indicator to that structure. Declare bpf_filter() in pcap/bpf.h even on NetBSD and QNX; pcap-bpf.c doesn't include pcap/bpf.h (it sets a #define to force pcap/pcap.h not to include it), so we won't get any collisions if net/bpf.h (which it does include) declares it. The only collisions will occur in programs that include *both* pcap/pcap.h or pcap/bpf.h *and* net/bpf.h, and that will occur only if net/bpf.h declares bpf_filter() even when building userland code, and the correct fix for *that* is to fix net/bpf.h not to declare them in non-kernel builds.
| * Match the style of other declarations in this file.Guy Harris2018-08-311-3/+2
| |
| * Don't put bpf_filter_with_aux_data() in a public header file.Guy Harris2018-08-311-0/+22
| | | | | | | | | | | | | | | | | | | | | | | | | | Don't put struct bpf_aux_data there, either. bpf_filter_with_aux_data() is an internal-only routine, and struct bpf_aux_data is a data structure subject to change in the future; don't make them public, so that we *can* change it in the future without having to worry about breaking APIs or ABIs. (Note to any upstream packager of libpcap: if you've made it public, so that it's exported by a shared libary, that was a mistake, so undo it.)
* | Proper breakloop for linux on pcap_dispatchAdrian Budau2018-08-061-0/+3
|/ | | | On platforms that support it use an eventfd to exit any polling.
* Remove no more used field 'tzoff' in some structuresFrancois-Xavier Le Bail2018-08-031-1/+0
| | | | As a follow-up to comit 5f2a5c03e0f91bc2dc2ae33838db273dd6c7d8d9.
* Squelch a warning.Gisle Vanem2018-05-021-0/+4
|
* Shuffle the find_or_add_dev() arguments.Guy Harris2018-04-301-1/+1
| | | | | Put the "get more interface flags" routine pointer right after the "interface flags" pointer.
* Pass the "get additional flags" function to the findalldevs helpers.Guy Harris2018-04-301-7/+8
| | | | | This lets us make it a static function - or eliminate it entirely for pcap-null.c.
* Add more interface flags to pcap_findalldevs().Guy Harris2018-04-291-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | We add: PCAP_IF_WIRELESS, which indicates whether the interface is "wireless" or not. PCAP_IF_CONNECTION_STATUS, which is a bitmask for a two-bit field that can have one of the values: PCAP_IF_CONNECTION_STATUS_UNKNOWN if the status of whether the interface is "connected" or "disconnected" is unknown; PCAP_IF_CONNECTION_STATUS_CONNECTED if the interface is "connected"; PCAP_IF_CONNECTION_STATUS_DISCONNECTED if the interface is "disconnected"; PCAP_IF_CONNECTION_STATUS_NOT_APPLICABLE if the notion of "connected" or "disconnected" doesn't apply to this interface. Take that into account when sorting interfaces in the interface list, penalizing "disconnected" interfaces, as you won't see traffic on them if they're not wireless and you'd have to be in some form of "monitor mode" to see traffic on them if they're wireless. This should address GitHub issue #700.
* Don't do the selectable FD or required select timeout stuff on MS-DOS.Guy Harris2018-01-231-1/+1
|
* Use the right name for calls to wait for events.Guy Harris2018-01-201-2/+2
| | | | | | For the epoll mechanism, the call to wait for events is epoll_wait() (and epoll_pwait()); for the kqueue mechanism, the call to wait for events is kevent() (and additional calls in Darwin-based systems).
* Add a new API to handle some non-select()able devices.Guy Harris2018-01-191-2/+18
| | | | | | | | | | | DAG adapters don't support blocking until packets arrive; a program using select()/poll()/epoll()/kqueue-based event loop must periodically poll DAG pcap_t's to see if they have packets available. Add pcap_get_required_select_timeout(), which returns a pointer to a struct timeval containing the appropriate timeout interval if polling is required and NULL if polling isn't required or isn't supported. Clean up the pcap_get_selectable_fd() documentation while we're at it.
* Use compiler tests to determine how to define _U_.Guy Harris2017-11-151-0/+1
| | | | One less thing that has to be done in autotools and CMake.
* Add a routine to format error messages with an errno-based message at the end.Guy Harris2017-11-151-0/+2
| | | | | | | | | | | | | | That routine will use strerror_s() or strerror_r() if available, in a fashion that's thread-safe. Otherwise, it falls back on pcap_strerror(). Use it in both libpcap and rpcapd. Given that we check for errors in strerror_r(), hopefully this will squelch warnings with newer version of GCC and GNU libc; whilst the macOS (and other BSD-flavored?) strerror_r() always fills in a message, that's not required by the Single UNIX Specification, as far as I can tell, so we apparently really *do* need to check for errors.
* The break_loop flag should be a sig_atomic_t.Guy Harris2017-10-211-1/+3
| | | | | The idea is that pcap_breakloop() should be callable from a signal handler, so the variable it sets should be of type sig_atomic_t.
* No need to generate version.c or pcap_version.h.Guy Harris2017-10-031-0/+6
| | | | We can get the project version from config.h, so do so.
* Call the flag to enable remote capture ENABLE_REMOTE.Guy Harris2017-10-031-1/+1
| | | | | | HAVE_REMOTE implies that there's some feature in our build environment that we have, but this is a flag that controls what the user specified at configuration time.
* Don't bother supporting pre-2005 Visual Studio.Guy Harris2017-09-281-19/+0
| | | | 2003 (or earlier!) called; it wants its Microsoft C compiler back.
View Lorry Controller Status