1 /* 2 * Copyright (c) 1999 - 2005 NetGroup, Politecnico di Torino (Italy) 3 * Copyright (c) 2005 - 2010 CACE Technologies, Davis (California) 4 * All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 3. Neither the name of the Politecnico di Torino, CACE Technologies 16 * nor the names of its contributors may be used to endorse or promote 17 * products derived from this software without specific prior written 18 * permission. 19 * 20 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 21 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 22 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR 23 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT 24 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 25 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT 26 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 27 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 28 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 29 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE 30 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 31 * 32 */ 33 34 #define PCAP_DONT_INCLUDE_PCAP_BPF_H 35 #include <Packet32.h> 36 #include <pcap-int.h> 37 #include <pcap/dlt.h> 38 #ifdef __MINGW32__ 39 #ifdef __MINGW64__ 40 #include <ntddndis.h> 41 #else /*__MINGW64__*/ 42 #include <ddk/ntddndis.h> 43 #include <ddk/ndis.h> 44 #endif /*__MINGW64__*/ 45 #else /*__MINGW32__*/ 46 #include <ntddndis.h> 47 #endif /*__MINGW32__*/ 48 #ifdef HAVE_DAG_API 49 #include <dagnew.h> 50 #include <dagapi.h> 51 #endif /* HAVE_DAG_API */ 52 #ifdef __MINGW32__ 53 int* _errno(); 54 #define errno (*_errno()) 55 #endif /* __MINGW32__ */ 56 #ifdef HAVE_REMOTE 57 #include "pcap-rpcap.h" 58 #endif /* HAVE_REMOTE */ 59 60 static int pcap_setfilter_win32_npf(pcap_t *, struct bpf_program *); 61 static int pcap_setfilter_win32_dag(pcap_t *, struct bpf_program *); 62 static int pcap_getnonblock_win32(pcap_t *, char *); 63 static int pcap_setnonblock_win32(pcap_t *, int, char *); 64 65 /*dimension of the buffer in the pcap_t structure*/ 66 #define WIN32_DEFAULT_USER_BUFFER_SIZE 256000 67 68 /*dimension of the buffer in the kernel driver NPF */ 69 #define WIN32_DEFAULT_KERNEL_BUFFER_SIZE 1000000 70 71 /* Equivalent to ntohs(), but a lot faster under Windows */ 72 #define SWAPS(_X) ((_X & 0xff) << 8) | (_X >> 8) 73 74 /* 75 * Private data for capturing on WinPcap devices. 76 */ 77 struct pcap_win { 78 int nonblock; 79 int rfmon_selfstart; /* a flag tells whether the monitor mode is set by itself */ 80 int filtering_in_kernel; /* using kernel filter */ 81 82 #ifdef HAVE_DAG_API 83 int dag_fcs_bits; /* Number of checksum bits from link layer */ 84 #endif 85 }; 86 87 BOOL WINAPI DllMain( 88 HANDLE hinstDLL, 89 DWORD dwReason, 90 LPVOID lpvReserved 91 ) 92 { 93 return (TRUE); 94 } 95 96 /* 97 * Define stub versions of the monitor-mode support routines if this 98 * isn't Npcap. HAVE_NPCAP_PACKET_API is defined by Npcap but not 99 * WinPcap. 100 */ 101 #ifndef HAVE_NPCAP_PACKET_API 102 static int 103 PacketIsMonitorModeSupported(PCHAR AdapterName _U_) 104 { 105 /* 106 * We don't support monitor mode. 107 */ 108 return (0); 109 } 110 111 static int 112 PacketSetMonitorMode(PCHAR AdapterName _U_, int mode _U_) 113 { 114 /* 115 * This should never be called, as PacketIsMonitorModeSupported() 116 * will return 0, meaning "we don't support monitor mode, so 117 * don't try to turn it on or off". 118 */ 119 return (0); 120 } 121 122 static int 123 PacketGetMonitorMode(PCHAR AdapterName _U_) 124 { 125 /* 126 * This should fail, so that pcap_activate_win32() returns 127 * PCAP_ERROR_RFMON_NOTSUP if our caller requested monitor 128 * mode. 129 */ 130 return (-1); 131 } 132 #endif 133 134 /* Start winsock */ 135 int 136 wsockinit(void) 137 { 138 WORD wVersionRequested; 139 WSADATA wsaData; 140 static int err = -1; 141 static int done = 0; 142 143 if (done) 144 return (err); 145 146 wVersionRequested = MAKEWORD( 1, 1); 147 err = WSAStartup( wVersionRequested, &wsaData ); 148 atexit ((void(*)(void))WSACleanup); 149 done = 1; 150 151 if ( err != 0 ) 152 err = -1; 153 return (err); 154 } 155 156 int 157 pcap_wsockinit(void) 158 { 159 return (wsockinit()); 160 } 161 162 static int 163 pcap_stats_win32(pcap_t *p, struct pcap_stat *ps) 164 { 165 struct bpf_stat bstats; 166 char errbuf[PCAP_ERRBUF_SIZE+1]; 167 168 /* 169 * Try to get statistics. 170 * 171 * (Please note - "struct pcap_stat" is *not* the same as 172 * WinPcap's "struct bpf_stat". It might currently have the 173 * same layout, but let's not cheat. 174 * 175 * Note also that we don't fill in ps_capt, as we might have 176 * been called by code compiled against an earlier version of 177 * WinPcap that didn't have ps_capt, in which case filling it 178 * in would stomp on whatever comes after the structure passed 179 * to us. 180 */ 181 if (!PacketGetStats(p->adapter, &bstats)) { 182 pcap_win32_err_to_str(GetLastError(), errbuf); 183 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE, 184 "PacketGetStats error: %s", errbuf); 185 return (-1); 186 } 187 ps->ps_recv = bstats.bs_recv; 188 ps->ps_drop = bstats.bs_drop; 189 190 /* 191 * XXX - PacketGetStats() doesn't fill this in, so we just 192 * return 0. 193 */ 194 #if 0 195 ps->ps_ifdrop = bstats.ps_ifdrop; 196 #else 197 ps->ps_ifdrop = 0; 198 #endif 199 200 return (0); 201 } 202 203 /* 204 * Win32-only routine for getting statistics. 205 * 206 * This way is definitely safer than passing the pcap_stat * from the userland. 207 * In fact, there could happen than the user allocates a variable which is not 208 * big enough for the new structure, and the library will write in a zone 209 * which is not allocated to this variable. 210 * 211 * In this way, we're pretty sure we are writing on memory allocated to this 212 * variable. 213 * 214 * XXX - but this is the wrong way to handle statistics. Instead, we should 215 * have an API that returns data in a form like the Options section of a 216 * pcapng Interface Statistics Block: 217 * 218 * http://xml2rfc.tools.ietf.org/cgi-bin/xml2rfc.cgi?url=https://raw.githubusercontent.com/pcapng/pcapng/master/draft-tuexen-opsawg-pcapng.xml&modeAsFormat=html/ascii&type=ascii#rfc.section.4.6 219 * 220 * which would let us add new statistics straightforwardly and indicate which 221 * statistics we are and are *not* providing, rather than having to provide 222 * possibly-bogus values for statistics we can't provide. 223 */ 224 struct pcap_stat * 225 pcap_stats_ex_win32(pcap_t *p, int *pcap_stat_size) 226 { 227 struct bpf_stat bstats; 228 char errbuf[PCAP_ERRBUF_SIZE+1]; 229 230 *pcap_stat_size = sizeof (p->stat); 231 232 /* 233 * Try to get statistics. 234 * 235 * (Please note - "struct pcap_stat" is *not* the same as 236 * WinPcap's "struct bpf_stat". It might currently have the 237 * same layout, but let's not cheat.) 238 */ 239 if (!PacketGetStatsEx(p->adapter, &bstats)) { 240 pcap_win32_err_to_str(GetLastError(), errbuf); 241 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE, 242 "PacketGetStatsEx error: %s", errbuf); 243 return (NULL); 244 } 245 p->stat.ps_recv = bstats.bs_recv; 246 p->stat.ps_drop = bstats.bs_drop; 247 p->stat.ps_ifdrop = bstats.ps_ifdrop; 248 #ifdef HAVE_REMOTE 249 p->stat.ps_capt = bstats.bs_capt; 250 #endif 251 return (&p->stat); 252 } 253 254 /* Set the dimension of the kernel-level capture buffer */ 255 static int 256 pcap_setbuff_win32(pcap_t *p, int dim) 257 { 258 if(PacketSetBuff(p->adapter,dim)==FALSE) 259 { 260 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "driver error: not enough memory to allocate the kernel buffer"); 261 return (-1); 262 } 263 return (0); 264 } 265 266 /* Set the driver working mode */ 267 static int 268 pcap_setmode_win32(pcap_t *p, int mode) 269 { 270 if(PacketSetMode(p->adapter,mode)==FALSE) 271 { 272 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "driver error: working mode not recognized"); 273 return (-1); 274 } 275 276 return (0); 277 } 278 279 /*set the minimum amount of data that will release a read call*/ 280 static int 281 pcap_setmintocopy_win32(pcap_t *p, int size) 282 { 283 if(PacketSetMinToCopy(p->adapter, size)==FALSE) 284 { 285 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "driver error: unable to set the requested mintocopy size"); 286 return (-1); 287 } 288 return (0); 289 } 290 291 static HANDLE 292 pcap_getevent_win32(pcap_t *p) 293 { 294 return (PacketGetReadEvent(p->adapter)); 295 } 296 297 static int 298 pcap_oid_get_request_win32(pcap_t *p, bpf_u_int32 oid, void *data, size_t *lenp) 299 { 300 PACKET_OID_DATA *oid_data_arg; 301 char errbuf[PCAP_ERRBUF_SIZE+1]; 302 303 /* 304 * Allocate a PACKET_OID_DATA structure to hand to PacketRequest(). 305 * It should be big enough to hold "*lenp" bytes of data; it 306 * will actually be slightly larger, as PACKET_OID_DATA has a 307 * 1-byte data array at the end, standing in for the variable-length 308 * data that's actually there. 309 */ 310 oid_data_arg = malloc(sizeof (PACKET_OID_DATA) + *lenp); 311 if (oid_data_arg == NULL) { 312 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE, 313 "Couldn't allocate argument buffer for PacketRequest"); 314 return (PCAP_ERROR); 315 } 316 317 /* 318 * No need to copy the data - we're doing a fetch. 319 */ 320 oid_data_arg->Oid = oid; 321 oid_data_arg->Length = (ULONG)(*lenp); /* XXX - check for ridiculously large value? */ 322 if (!PacketRequest(p->adapter, FALSE, oid_data_arg)) { 323 pcap_win32_err_to_str(GetLastError(), errbuf); 324 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE, 325 "Error calling PacketRequest: %s", errbuf); 326 free(oid_data_arg); 327 return (PCAP_ERROR); 328 } 329 330 /* 331 * Get the length actually supplied. 332 */ 333 *lenp = oid_data_arg->Length; 334 335 /* 336 * Copy back the data we fetched. 337 */ 338 memcpy(data, oid_data_arg->Data, *lenp); 339 free(oid_data_arg); 340 return (0); 341 } 342 343 static int 344 pcap_oid_set_request_win32(pcap_t *p, bpf_u_int32 oid, const void *data, 345 size_t *lenp) 346 { 347 PACKET_OID_DATA *oid_data_arg; 348 char errbuf[PCAP_ERRBUF_SIZE+1]; 349 350 /* 351 * Allocate a PACKET_OID_DATA structure to hand to PacketRequest(). 352 * It should be big enough to hold "*lenp" bytes of data; it 353 * will actually be slightly larger, as PACKET_OID_DATA has a 354 * 1-byte data array at the end, standing in for the variable-length 355 * data that's actually there. 356 */ 357 oid_data_arg = malloc(sizeof (PACKET_OID_DATA) + *lenp); 358 if (oid_data_arg == NULL) { 359 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE, 360 "Couldn't allocate argument buffer for PacketRequest"); 361 return (PCAP_ERROR); 362 } 363 364 oid_data_arg->Oid = oid; 365 oid_data_arg->Length = (ULONG)(*lenp); /* XXX - check for ridiculously large value? */ 366 memcpy(oid_data_arg->Data, data, *lenp); 367 if (!PacketRequest(p->adapter, TRUE, oid_data_arg)) { 368 pcap_win32_err_to_str(GetLastError(), errbuf); 369 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE, 370 "Error calling PacketRequest: %s", errbuf); 371 free(oid_data_arg); 372 return (PCAP_ERROR); 373 } 374 375 /* 376 * Get the length actually copied. 377 */ 378 *lenp = oid_data_arg->Length; 379 380 /* 381 * No need to copy the data - we're doing a set. 382 */ 383 free(oid_data_arg); 384 return (0); 385 } 386 387 static u_int 388 pcap_sendqueue_transmit_win32(pcap_t *p, pcap_send_queue *queue, int sync) 389 { 390 u_int res; 391 char errbuf[PCAP_ERRBUF_SIZE+1]; 392 393 if (p->adapter==NULL) { 394 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE, 395 "Cannot transmit a queue to an offline capture or to a TurboCap port"); 396 return (0); 397 } 398 399 res = PacketSendPackets(p->adapter, 400 queue->buffer, 401 queue->len, 402 (BOOLEAN)sync); 403 404 if(res != queue->len){ 405 pcap_win32_err_to_str(GetLastError(), errbuf); 406 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE, 407 "Error opening adapter: %s", errbuf); 408 } 409 410 return (res); 411 } 412 413 static int 414 pcap_setuserbuffer_win32(pcap_t *p, int size) 415 { 416 unsigned char *new_buff; 417 418 if (size<=0) { 419 /* Bogus parameter */ 420 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE, 421 "Error: invalid size %d",size); 422 return (-1); 423 } 424 425 /* Allocate the buffer */ 426 new_buff=(unsigned char*)malloc(sizeof(char)*size); 427 428 if (!new_buff) { 429 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE, 430 "Error: not enough memory"); 431 return (-1); 432 } 433 434 free(p->buffer); 435 436 p->buffer=new_buff; 437 p->bufsize=size; 438 439 return (0); 440 } 441 442 static int 443 pcap_live_dump_win32(pcap_t *p, char *filename, int maxsize, int maxpacks) 444 { 445 BOOLEAN res; 446 447 /* Set the packet driver in dump mode */ 448 res = PacketSetMode(p->adapter, PACKET_MODE_DUMP); 449 if(res == FALSE){ 450 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE, 451 "Error setting dump mode"); 452 return (-1); 453 } 454 455 /* Set the name of the dump file */ 456 res = PacketSetDumpName(p->adapter, filename, (int)strlen(filename)); 457 if(res == FALSE){ 458 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE, 459 "Error setting kernel dump file name"); 460 return (-1); 461 } 462 463 /* Set the limits of the dump file */ 464 res = PacketSetDumpLimits(p->adapter, maxsize, maxpacks); 465 466 return (0); 467 } 468 469 static int 470 pcap_live_dump_ended_win32(pcap_t *p, int sync) 471 { 472 return (PacketIsDumpEnded(p->adapter, (BOOLEAN)sync)); 473 } 474 475 static PAirpcapHandle 476 pcap_get_airpcap_handle_win32(pcap_t *p) 477 { 478 #ifdef HAVE_AIRPCAP_API 479 return (PacketGetAirPcapHandle(p->adapter)); 480 #else 481 return (NULL); 482 #endif /* HAVE_AIRPCAP_API */ 483 } 484 485 static int 486 pcap_read_win32_npf(pcap_t *p, int cnt, pcap_handler callback, u_char *user) 487 { 488 PACKET Packet; 489 int cc; 490 int n = 0; 491 register u_char *bp, *ep; 492 u_char *datap; 493 struct pcap_win *pw = p->priv; 494 495 cc = p->cc; 496 if (p->cc == 0) { 497 /* 498 * Has "pcap_breakloop()" been called? 499 */ 500 if (p->break_loop) { 501 /* 502 * Yes - clear the flag that indicates that it 503 * has, and return PCAP_ERROR_BREAK to indicate 504 * that we were told to break out of the loop. 505 */ 506 p->break_loop = 0; 507 return (PCAP_ERROR_BREAK); 508 } 509 510 /* 511 * Capture the packets. 512 * 513 * The PACKET structure had a bunch of extra stuff for 514 * Windows 9x/Me, but the only interesting data in it 515 * in the versions of Windows that we support is just 516 * a copy of p->buffer, a copy of p->buflen, and the 517 * actual number of bytes read returned from 518 * PacketReceivePacket(), none of which has to be 519 * retained from call to call, so we just keep one on 520 * the stack. 521 */ 522 PacketInitPacket(&Packet, (BYTE *)p->buffer, p->bufsize); 523 if (!PacketReceivePacket(p->adapter, &Packet, TRUE)) { 524 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "read error: PacketReceivePacket failed"); 525 return (PCAP_ERROR); 526 } 527 528 cc = Packet.ulBytesReceived; 529 530 bp = p->buffer; 531 } 532 else 533 bp = p->bp; 534 535 /* 536 * Loop through each packet. 537 */ 538 #define bhp ((struct bpf_hdr *)bp) 539 ep = bp + cc; 540 while (1) { 541 register int caplen, hdrlen; 542 543 /* 544 * Has "pcap_breakloop()" been called? 545 * If so, return immediately - if we haven't read any 546 * packets, clear the flag and return PCAP_ERROR_BREAK 547 * to indicate that we were told to break out of the loop, 548 * otherwise leave the flag set, so that the *next* call 549 * will break out of the loop without having read any 550 * packets, and return the number of packets we've 551 * processed so far. 552 */ 553 if (p->break_loop) { 554 if (n == 0) { 555 p->break_loop = 0; 556 return (PCAP_ERROR_BREAK); 557 } else { 558 p->bp = bp; 559 p->cc = (int) (ep - bp); 560 return (n); 561 } 562 } 563 if (bp >= ep) 564 break; 565 566 caplen = bhp->bh_caplen; 567 hdrlen = bhp->bh_hdrlen; 568 datap = bp + hdrlen; 569 570 /* 571 * Short-circuit evaluation: if using BPF filter 572 * in kernel, no need to do it now - we already know 573 * the packet passed the filter. 574 * 575 * XXX - bpf_filter() should always return TRUE if 576 * handed a null pointer for the program, but it might 577 * just try to "run" the filter, so we check here. 578 */ 579 if (pw->filtering_in_kernel || 580 p->fcode.bf_insns == NULL || 581 bpf_filter(p->fcode.bf_insns, datap, bhp->bh_datalen, caplen)) { 582 /* 583 * XXX A bpf_hdr matches a pcap_pkthdr. 584 */ 585 (*callback)(user, (struct pcap_pkthdr*)bp, datap); 586 bp += Packet_WORDALIGN(caplen + hdrlen); 587 if (++n >= cnt && !PACKET_COUNT_IS_UNLIMITED(cnt)) { 588 p->bp = bp; 589 p->cc = (int) (ep - bp); 590 return (n); 591 } 592 } else { 593 /* 594 * Skip this packet. 595 */ 596 bp += Packet_WORDALIGN(caplen + hdrlen); 597 } 598 } 599 #undef bhp 600 p->cc = 0; 601 return (n); 602 } 603 604 #ifdef HAVE_DAG_API 605 static int 606 pcap_read_win32_dag(pcap_t *p, int cnt, pcap_handler callback, u_char *user) 607 { 608 struct pcap_win *pw = p->priv; 609 PACKET Packet; 610 u_char *dp = NULL; 611 int packet_len = 0, caplen = 0; 612 struct pcap_pkthdr pcap_header; 613 u_char *endofbuf; 614 int n = 0; 615 dag_record_t *header; 616 unsigned erf_record_len; 617 ULONGLONG ts; 618 int cc; 619 unsigned swt; 620 unsigned dfp = p->adapter->DagFastProcess; 621 622 cc = p->cc; 623 if (cc == 0) /* Get new packets only if we have processed all the ones of the previous read */ 624 { 625 /* 626 * Get new packets from the network. 627 * 628 * The PACKET structure had a bunch of extra stuff for 629 * Windows 9x/Me, but the only interesting data in it 630 * in the versions of Windows that we support is just 631 * a copy of p->buffer, a copy of p->buflen, and the 632 * actual number of bytes read returned from 633 * PacketReceivePacket(), none of which has to be 634 * retained from call to call, so we just keep one on 635 * the stack. 636 */ 637 PacketInitPacket(&Packet, (BYTE *)p->buffer, p->bufsize); 638 if (!PacketReceivePacket(p->adapter, &Packet, TRUE)) { 639 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "read error: PacketReceivePacket failed"); 640 return (-1); 641 } 642 643 cc = Packet.ulBytesReceived; 644 if(cc == 0) 645 /* The timeout has expired but we no packets arrived */ 646 return (0); 647 header = (dag_record_t*)p->adapter->DagBuffer; 648 } 649 else 650 header = (dag_record_t*)p->bp; 651 652 endofbuf = (char*)header + cc; 653 654 /* 655 * Cycle through the packets 656 */ 657 do 658 { 659 erf_record_len = SWAPS(header->rlen); 660 if((char*)header + erf_record_len > endofbuf) 661 break; 662 663 /* Increase the number of captured packets */ 664 p->stat.ps_recv++; 665 666 /* Find the beginning of the packet */ 667 dp = ((u_char *)header) + dag_record_size; 668 669 /* Determine actual packet len */ 670 switch(header->type) 671 { 672 case TYPE_ATM: 673 packet_len = ATM_SNAPLEN; 674 caplen = ATM_SNAPLEN; 675 dp += 4; 676 677 break; 678 679 case TYPE_ETH: 680 swt = SWAPS(header->wlen); 681 packet_len = swt - (pw->dag_fcs_bits); 682 caplen = erf_record_len - dag_record_size - 2; 683 if (caplen > packet_len) 684 { 685 caplen = packet_len; 686 } 687 dp += 2; 688 689 break; 690 691 case TYPE_HDLC_POS: 692 swt = SWAPS(header->wlen); 693 packet_len = swt - (pw->dag_fcs_bits); 694 caplen = erf_record_len - dag_record_size; 695 if (caplen > packet_len) 696 { 697 caplen = packet_len; 698 } 699 700 break; 701 } 702 703 if(caplen > p->snapshot) 704 caplen = p->snapshot; 705 706 /* 707 * Has "pcap_breakloop()" been called? 708 * If so, return immediately - if we haven't read any 709 * packets, clear the flag and return -2 to indicate 710 * that we were told to break out of the loop, otherwise 711 * leave the flag set, so that the *next* call will break 712 * out of the loop without having read any packets, and 713 * return the number of packets we've processed so far. 714 */ 715 if (p->break_loop) 716 { 717 if (n == 0) 718 { 719 p->break_loop = 0; 720 return (-2); 721 } 722 else 723 { 724 p->bp = (char*)header; 725 p->cc = endofbuf - (char*)header; 726 return (n); 727 } 728 } 729 730 if(!dfp) 731 { 732 /* convert between timestamp formats */ 733 ts = header->ts; 734 pcap_header.ts.tv_sec = (int)(ts >> 32); 735 ts = (ts & 0xffffffffi64) * 1000000; 736 ts += 0x80000000; /* rounding */ 737 pcap_header.ts.tv_usec = (int)(ts >> 32); 738 if (pcap_header.ts.tv_usec >= 1000000) { 739 pcap_header.ts.tv_usec -= 1000000; 740 pcap_header.ts.tv_sec++; 741 } 742 } 743 744 /* No underlaying filtering system. We need to filter on our own */ 745 if (p->fcode.bf_insns) 746 { 747 if (bpf_filter(p->fcode.bf_insns, dp, packet_len, caplen) == 0) 748 { 749 /* Move to next packet */ 750 header = (dag_record_t*)((char*)header + erf_record_len); 751 continue; 752 } 753 } 754 755 /* Fill the header for the user suppplied callback function */ 756 pcap_header.caplen = caplen; 757 pcap_header.len = packet_len; 758 759 /* Call the callback function */ 760 (*callback)(user, &pcap_header, dp); 761 762 /* Move to next packet */ 763 header = (dag_record_t*)((char*)header + erf_record_len); 764 765 /* Stop if the number of packets requested by user has been reached*/ 766 if (++n >= cnt && !PACKET_COUNT_IS_UNLIMITED(cnt)) 767 { 768 p->bp = (char*)header; 769 p->cc = endofbuf - (char*)header; 770 return (n); 771 } 772 } 773 while((u_char*)header < endofbuf); 774 775 return (1); 776 } 777 #endif /* HAVE_DAG_API */ 778 779 /* Send a packet to the network */ 780 static int 781 pcap_inject_win32(pcap_t *p, const void *buf, size_t size){ 782 LPPACKET PacketToSend; 783 784 PacketToSend=PacketAllocatePacket(); 785 786 if (PacketToSend == NULL) 787 { 788 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "send error: PacketAllocatePacket failed"); 789 return (-1); 790 } 791 792 PacketInitPacket(PacketToSend, (PVOID)buf, (UINT)size); 793 if(PacketSendPacket(p->adapter,PacketToSend,TRUE) == FALSE){ 794 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "send error: PacketSendPacket failed"); 795 PacketFreePacket(PacketToSend); 796 return (-1); 797 } 798 799 PacketFreePacket(PacketToSend); 800 801 /* 802 * We assume it all got sent if "PacketSendPacket()" succeeded. 803 * "pcap_inject()" is expected to return the number of bytes 804 * sent. 805 */ 806 return ((int)size); 807 } 808 809 static void 810 pcap_cleanup_win32(pcap_t *p) 811 { 812 struct pcap_win *pw = p->priv; 813 if (p->adapter != NULL) { 814 PacketCloseAdapter(p->adapter); 815 p->adapter = NULL; 816 } 817 if (pw->rfmon_selfstart) 818 { 819 PacketSetMonitorMode(p->opt.device, 0); 820 } 821 pcap_cleanup_live_common(p); 822 } 823 824 static int 825 pcap_activate_win32(pcap_t *p) 826 { 827 struct pcap_win *pw = p->priv; 828 NetType type; 829 int res; 830 char errbuf[PCAP_ERRBUF_SIZE+1]; 831 832 #ifdef HAVE_REMOTE 833 char host[PCAP_BUF_SIZE + 1]; 834 char port[PCAP_BUF_SIZE + 1]; 835 char name[PCAP_BUF_SIZE + 1]; 836 int srctype; 837 int opensource_remote_result; 838 839 struct pcap_md *md; /* structure used when doing a remote live capture */ 840 md = (struct pcap_md *) ((u_char*)p->priv + sizeof(struct pcap_win)); 841 842 /* 843 Retrofit; we have to make older applications compatible with the remote capture 844 So, we're calling the pcap_open_remote() from here, that is a very dirty thing. 845 Obviously, we cannot exploit all the new features; for instance, we cannot 846 send authentication, we cannot use a UDP data connection, and so on. 847 */ 848 if (pcap_parsesrcstr(p->opt.device, &srctype, host, port, name, p->errbuf)) 849 return PCAP_ERROR; 850 851 if (srctype == PCAP_SRC_IFREMOTE) 852 { 853 opensource_remote_result = pcap_opensource_remote(p, NULL); 854 855 if (opensource_remote_result != 0) 856 return opensource_remote_result; 857 858 md->rmt_flags = (p->opt.promisc) ? PCAP_OPENFLAG_PROMISCUOUS : 0; 859 860 return 0; 861 } 862 863 if (srctype == PCAP_SRC_IFLOCAL) 864 { 865 /* 866 * If it starts with rpcap://, cut down the string 867 */ 868 if (strncmp(p->opt.device, PCAP_SRC_IF_STRING, strlen(PCAP_SRC_IF_STRING)) == 0) 869 { 870 size_t len = strlen(p->opt.device) - strlen(PCAP_SRC_IF_STRING) + 1; 871 char *new_string; 872 /* 873 * allocate a new string and free the old one 874 */ 875 if (len > 0) 876 { 877 new_string = (char*)malloc(len); 878 if (new_string != NULL) 879 { 880 char *tmp; 881 strcpy_s(new_string, len, p->opt.device + strlen(PCAP_SRC_IF_STRING)); 882 tmp = p->opt.device; 883 p->opt.device = new_string; 884 free(tmp); 885 } 886 } 887 } 888 } 889 890 #endif /* HAVE_REMOTE */ 891 892 if (p->opt.rfmon) { 893 /* 894 * Monitor mode is supported on Windows Vista and later. 895 */ 896 if (PacketGetMonitorMode(p->opt.device) == 1) 897 { 898 pw->rfmon_selfstart = 0; 899 } 900 else 901 { 902 if ((res = PacketSetMonitorMode(p->opt.device, 1)) != 1) 903 { 904 pw->rfmon_selfstart = 0; 905 // Monitor mode is not supported. 906 if (res == 0) 907 { 908 return PCAP_ERROR_RFMON_NOTSUP; 909 } 910 else 911 { 912 return PCAP_ERROR; 913 } 914 } 915 else 916 { 917 pw->rfmon_selfstart = 1; 918 } 919 } 920 } 921 922 /* Init WinSock */ 923 wsockinit(); 924 925 p->adapter = PacketOpenAdapter(p->opt.device); 926 927 if (p->adapter == NULL) 928 { 929 /* Adapter detected but we are not able to open it. Return failure. */ 930 pcap_win32_err_to_str(GetLastError(), errbuf); 931 if (pw->rfmon_selfstart) 932 { 933 PacketSetMonitorMode(p->opt.device, 0); 934 } 935 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE, 936 "Error opening adapter: %s", errbuf); 937 return (PCAP_ERROR); 938 } 939 940 /*get network type*/ 941 if(PacketGetNetType (p->adapter,&type) == FALSE) 942 { 943 pcap_win32_err_to_str(GetLastError(), errbuf); 944 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE, 945 "Cannot determine the network type: %s", errbuf); 946 goto bad; 947 } 948 949 /*Set the linktype*/ 950 switch (type.LinkType) 951 { 952 case NdisMediumWan: 953 p->linktype = DLT_EN10MB; 954 break; 955 956 case NdisMedium802_3: 957 p->linktype = DLT_EN10MB; 958 /* 959 * This is (presumably) a real Ethernet capture; give it a 960 * link-layer-type list with DLT_EN10MB and DLT_DOCSIS, so 961 * that an application can let you choose it, in case you're 962 * capturing DOCSIS traffic that a Cisco Cable Modem 963 * Termination System is putting out onto an Ethernet (it 964 * doesn't put an Ethernet header onto the wire, it puts raw 965 * DOCSIS frames out on the wire inside the low-level 966 * Ethernet framing). 967 */ 968 p->dlt_list = (u_int *) malloc(sizeof(u_int) * 2); 969 /* 970 * If that fails, just leave the list empty. 971 */ 972 if (p->dlt_list != NULL) { 973 p->dlt_list[0] = DLT_EN10MB; 974 p->dlt_list[1] = DLT_DOCSIS; 975 p->dlt_count = 2; 976 } 977 break; 978 979 case NdisMediumFddi: 980 p->linktype = DLT_FDDI; 981 break; 982 983 case NdisMedium802_5: 984 p->linktype = DLT_IEEE802; 985 break; 986 987 case NdisMediumArcnetRaw: 988 p->linktype = DLT_ARCNET; 989 break; 990 991 case NdisMediumArcnet878_2: 992 p->linktype = DLT_ARCNET; 993 break; 994 995 case NdisMediumAtm: 996 p->linktype = DLT_ATM_RFC1483; 997 break; 998 999 case NdisMediumCHDLC: 1000 p->linktype = DLT_CHDLC; 1001 break; 1002 1003 case NdisMediumPPPSerial: 1004 p->linktype = DLT_PPP_SERIAL; 1005 break; 1006 1007 case NdisMediumNull: 1008 p->linktype = DLT_NULL; 1009 break; 1010 1011 case NdisMediumBare80211: 1012 p->linktype = DLT_IEEE802_11; 1013 break; 1014 1015 case NdisMediumRadio80211: 1016 p->linktype = DLT_IEEE802_11_RADIO; 1017 break; 1018 1019 case NdisMediumPpi: 1020 p->linktype = DLT_PPI; 1021 break; 1022 1023 default: 1024 p->linktype = DLT_EN10MB; /*an unknown adapter is assumed to be ethernet*/ 1025 break; 1026 } 1027 1028 /* Set promiscuous mode */ 1029 if (p->opt.promisc) 1030 { 1031 1032 if (PacketSetHwFilter(p->adapter,NDIS_PACKET_TYPE_PROMISCUOUS) == FALSE) 1033 { 1034 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "failed to set hardware filter to promiscuous mode"); 1035 goto bad; 1036 } 1037 } 1038 else 1039 { 1040 if (PacketSetHwFilter(p->adapter,NDIS_PACKET_TYPE_ALL_LOCAL) == FALSE) 1041 { 1042 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "failed to set hardware filter to non-promiscuous mode"); 1043 goto bad; 1044 } 1045 } 1046 1047 /* Set the buffer size */ 1048 p->bufsize = WIN32_DEFAULT_USER_BUFFER_SIZE; 1049 1050 if(!(p->adapter->Flags & INFO_FLAG_DAG_CARD)) 1051 { 1052 /* 1053 * Traditional Adapter 1054 */ 1055 /* 1056 * If the buffer size wasn't explicitly set, default to 1057 * WIN32_DEFAULT_KERNEL_BUFFER_SIZE. 1058 */ 1059 if (p->opt.buffer_size == 0) 1060 p->opt.buffer_size = WIN32_DEFAULT_KERNEL_BUFFER_SIZE; 1061 1062 if(PacketSetBuff(p->adapter,p->opt.buffer_size)==FALSE) 1063 { 1064 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "driver error: not enough memory to allocate the kernel buffer"); 1065 goto bad; 1066 } 1067 1068 p->buffer = malloc(p->bufsize); 1069 if (p->buffer == NULL) 1070 { 1071 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "malloc: %s", pcap_strerror(errno)); 1072 goto bad; 1073 } 1074 1075 if (p->opt.immediate) 1076 { 1077 /* tell the driver to copy the buffer as soon as data arrives */ 1078 if(PacketSetMinToCopy(p->adapter,0)==FALSE) 1079 { 1080 pcap_win32_err_to_str(GetLastError(), errbuf); 1081 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE, 1082 "Error calling PacketSetMinToCopy: %s", 1083 errbuf); 1084 goto bad; 1085 } 1086 } 1087 else 1088 { 1089 /* tell the driver to copy the buffer only if it contains at least 16K */ 1090 if(PacketSetMinToCopy(p->adapter,16000)==FALSE) 1091 { 1092 pcap_win32_err_to_str(GetLastError(), errbuf); 1093 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE, 1094 "Error calling PacketSetMinToCopy: %s", 1095 errbuf); 1096 goto bad; 1097 } 1098 } 1099 } 1100 else 1101 #ifdef HAVE_DAG_API 1102 { 1103 /* 1104 * Dag Card 1105 */ 1106 LONG status; 1107 HKEY dagkey; 1108 DWORD lptype; 1109 DWORD lpcbdata; 1110 int postype = 0; 1111 char keyname[512]; 1112 1113 pcap_snprintf(keyname, sizeof(keyname), "%s\\CardParams\\%s", 1114 "SYSTEM\\CurrentControlSet\\Services\\DAG", 1115 strstr(_strlwr(p->opt.device), "dag")); 1116 do 1117 { 1118 status = RegOpenKeyEx(HKEY_LOCAL_MACHINE, keyname, 0, KEY_READ, &dagkey); 1119 if(status != ERROR_SUCCESS) 1120 break; 1121 1122 status = RegQueryValueEx(dagkey, 1123 "PosType", 1124 NULL, 1125 &lptype, 1126 (char*)&postype, 1127 &lpcbdata); 1128 1129 if(status != ERROR_SUCCESS) 1130 { 1131 postype = 0; 1132 } 1133 1134 RegCloseKey(dagkey); 1135 } 1136 while(FALSE); 1137 1138 1139 p->snapshot = PacketSetSnapLen(p->adapter, snaplen); 1140 1141 /* Set the length of the FCS associated to any packet. This value 1142 * will be subtracted to the packet length */ 1143 pw->dag_fcs_bits = p->adapter->DagFcsLen; 1144 } 1145 #else 1146 goto bad; 1147 #endif /* HAVE_DAG_API */ 1148 1149 PacketSetReadTimeout(p->adapter, p->opt.timeout); 1150 1151 #ifdef HAVE_DAG_API 1152 if(p->adapter->Flags & INFO_FLAG_DAG_CARD) 1153 { 1154 /* install dag specific handlers for read and setfilter */ 1155 p->read_op = pcap_read_win32_dag; 1156 p->setfilter_op = pcap_setfilter_win32_dag; 1157 } 1158 else 1159 { 1160 #endif /* HAVE_DAG_API */ 1161 /* install traditional npf handlers for read and setfilter */ 1162 p->read_op = pcap_read_win32_npf; 1163 p->setfilter_op = pcap_setfilter_win32_npf; 1164 #ifdef HAVE_DAG_API 1165 } 1166 #endif /* HAVE_DAG_API */ 1167 p->setdirection_op = NULL; /* Not implemented. */ 1168 /* XXX - can this be implemented on some versions of Windows? */ 1169 p->inject_op = pcap_inject_win32; 1170 p->set_datalink_op = NULL; /* can't change data link type */ 1171 p->getnonblock_op = pcap_getnonblock_win32; 1172 p->setnonblock_op = pcap_setnonblock_win32; 1173 p->stats_op = pcap_stats_win32; 1174 p->stats_ex_op = pcap_stats_ex_win32; 1175 p->setbuff_op = pcap_setbuff_win32; 1176 p->setmode_op = pcap_setmode_win32; 1177 p->setmintocopy_op = pcap_setmintocopy_win32; 1178 p->getevent_op = pcap_getevent_win32; 1179 p->oid_get_request_op = pcap_oid_get_request_win32; 1180 p->oid_set_request_op = pcap_oid_set_request_win32; 1181 p->sendqueue_transmit_op = pcap_sendqueue_transmit_win32; 1182 p->setuserbuffer_op = pcap_setuserbuffer_win32; 1183 p->live_dump_op = pcap_live_dump_win32; 1184 p->live_dump_ended_op = pcap_live_dump_ended_win32; 1185 p->get_airpcap_handle_op = pcap_get_airpcap_handle_win32; 1186 p->cleanup_op = pcap_cleanup_win32; 1187 1188 return (0); 1189 bad: 1190 pcap_cleanup_win32(p); 1191 return (PCAP_ERROR); 1192 } 1193 1194 /* 1195 * Check if rfmon mode is supported on the pcap_t for Windows systems. 1196 */ 1197 static int 1198 pcap_can_set_rfmon_win32(pcap_t *p) 1199 { 1200 return (PacketIsMonitorModeSupported(p->opt.device) == 1); 1201 } 1202 1203 pcap_t * 1204 pcap_create_interface(const char *device _U_, char *ebuf) 1205 { 1206 pcap_t *p; 1207 1208 #ifdef HAVE_REMOTE 1209 p = pcap_create_common(ebuf, sizeof(struct pcap_win) + sizeof(struct pcap_md)); 1210 #else 1211 p = pcap_create_common(ebuf, sizeof(struct pcap_win)); 1212 #endif /* HAVE_REMOTE */ 1213 if (p == NULL) 1214 return (NULL); 1215 1216 p->activate_op = pcap_activate_win32; 1217 p->can_set_rfmon_op = pcap_can_set_rfmon_win32; 1218 return (p); 1219 } 1220 1221 static int 1222 pcap_setfilter_win32_npf(pcap_t *p, struct bpf_program *fp) 1223 { 1224 struct pcap_win *pw = p->priv; 1225 1226 if(PacketSetBpf(p->adapter,fp)==FALSE){ 1227 /* 1228 * Kernel filter not installed. 1229 * 1230 * XXX - we don't know whether this failed because: 1231 * 1232 * the kernel rejected the filter program as invalid, 1233 * in which case we should fall back on userland 1234 * filtering; 1235 * 1236 * the kernel rejected the filter program as too big, 1237 * in which case we should again fall back on 1238 * userland filtering; 1239 * 1240 * there was some other problem, in which case we 1241 * should probably report an error. 1242 * 1243 * For NPF devices, the Win32 status will be 1244 * STATUS_INVALID_DEVICE_REQUEST for invalid 1245 * filters, but I don't know what it'd be for 1246 * other problems, and for some other devices 1247 * it might not be set at all. 1248 * 1249 * So we just fall back on userland filtering in 1250 * all cases. 1251 */ 1252 1253 /* 1254 * install_bpf_program() validates the program. 1255 * 1256 * XXX - what if we already have a filter in the kernel? 1257 */ 1258 if (install_bpf_program(p, fp) < 0) 1259 return (-1); 1260 pw->filtering_in_kernel = 0; /* filtering in userland */ 1261 return (0); 1262 } 1263 1264 /* 1265 * It worked. 1266 */ 1267 pw->filtering_in_kernel = 1; /* filtering in the kernel */ 1268 1269 /* 1270 * Discard any previously-received packets, as they might have 1271 * passed whatever filter was formerly in effect, but might 1272 * not pass this filter (BIOCSETF discards packets buffered 1273 * in the kernel, so you can lose packets in any case). 1274 */ 1275 p->cc = 0; 1276 return (0); 1277 } 1278 1279 /* 1280 * We filter at user level, since the kernel driver does't process the packets 1281 */ 1282 static int 1283 pcap_setfilter_win32_dag(pcap_t *p, struct bpf_program *fp) { 1284 1285 if(!fp) 1286 { 1287 strlcpy(p->errbuf, "setfilter: No filter specified", sizeof(p->errbuf)); 1288 return (-1); 1289 } 1290 1291 /* Install a user level filter */ 1292 if (install_bpf_program(p, fp) < 0) 1293 { 1294 pcap_snprintf(p->errbuf, sizeof(p->errbuf), 1295 "setfilter, unable to install the filter: %s", pcap_strerror(errno)); 1296 return (-1); 1297 } 1298 1299 return (0); 1300 } 1301 1302 static int 1303 pcap_getnonblock_win32(pcap_t *p, char *errbuf) 1304 { 1305 struct pcap_win *pw = p->priv; 1306 1307 /* 1308 * XXX - if there were a PacketGetReadTimeout() call, we 1309 * would use it, and return 1 if the timeout is -1 1310 * and 0 otherwise. 1311 */ 1312 return (pw->nonblock); 1313 } 1314 1315 static int 1316 pcap_setnonblock_win32(pcap_t *p, int nonblock, char *errbuf) 1317 { 1318 struct pcap_win *pw = p->priv; 1319 int newtimeout; 1320 char win_errbuf[PCAP_ERRBUF_SIZE+1]; 1321 1322 if (nonblock) { 1323 /* 1324 * Set the read timeout to -1 for non-blocking mode. 1325 */ 1326 newtimeout = -1; 1327 } else { 1328 /* 1329 * Restore the timeout set when the device was opened. 1330 * (Note that this may be -1, in which case we're not 1331 * really leaving non-blocking mode. However, although 1332 * the timeout argument to pcap_set_timeout() and 1333 * pcap_open_live() is an int, you're not supposed to 1334 * supply a negative value, so that "shouldn't happen".) 1335 */ 1336 newtimeout = p->opt.timeout; 1337 } 1338 if (!PacketSetReadTimeout(p->adapter, newtimeout)) { 1339 pcap_win32_err_to_str(GetLastError(), win_errbuf); 1340 pcap_snprintf(errbuf, PCAP_ERRBUF_SIZE, 1341 "PacketSetReadTimeout: %s", win_errbuf); 1342 return (-1); 1343 } 1344 pw->nonblock = (newtimeout == -1); 1345 return (0); 1346 } 1347 1348 static int 1349 pcap_add_if_win32(pcap_if_t **devlist, char *name, bpf_u_int32 flags, 1350 const char *description, char *errbuf) 1351 { 1352 pcap_if_t *curdev; 1353 npf_if_addr if_addrs[MAX_NETWORK_ADDRESSES]; 1354 LONG if_addr_size; 1355 int res = 0; 1356 1357 if_addr_size = MAX_NETWORK_ADDRESSES; 1358 1359 /* 1360 * Add an entry for this interface, with no addresses. 1361 */ 1362 if (add_or_find_if(&curdev, devlist, name, flags, description, 1363 errbuf) == -1) { 1364 /* 1365 * Failure. 1366 */ 1367 return (-1); 1368 } 1369 1370 /* 1371 * Get the list of addresses for the interface. 1372 */ 1373 if (!PacketGetNetInfoEx((void *)name, if_addrs, &if_addr_size)) { 1374 /* 1375 * Failure. 1376 * 1377 * We don't return an error, because this can happen with 1378 * NdisWan interfaces, and we want to supply them even 1379 * if we can't supply their addresses. 1380 * 1381 * We return an entry with an empty address list. 1382 */ 1383 return (0); 1384 } 1385 1386 /* 1387 * Now add the addresses. 1388 */ 1389 while (if_addr_size-- > 0) { 1390 /* 1391 * "curdev" is an entry for this interface; add an entry for 1392 * this address to its list of addresses. 1393 */ 1394 if(curdev == NULL) 1395 break; 1396 res = add_addr_to_dev(curdev, 1397 (struct sockaddr *)&if_addrs[if_addr_size].IPAddress, 1398 sizeof (struct sockaddr_storage), 1399 (struct sockaddr *)&if_addrs[if_addr_size].SubnetMask, 1400 sizeof (struct sockaddr_storage), 1401 (struct sockaddr *)&if_addrs[if_addr_size].Broadcast, 1402 sizeof (struct sockaddr_storage), 1403 NULL, 1404 0, 1405 errbuf); 1406 if (res == -1) { 1407 /* 1408 * Failure. 1409 */ 1410 break; 1411 } 1412 } 1413 1414 return (res); 1415 } 1416 1417 int 1418 pcap_platform_finddevs(pcap_if_t **alldevsp, char *errbuf) 1419 { 1420 pcap_if_t *devlist = NULL; 1421 int ret = 0; 1422 const char *desc; 1423 char *AdaptersName; 1424 ULONG NameLength; 1425 char *name; 1426 char our_errbuf[PCAP_ERRBUF_SIZE+1]; 1427 1428 /* 1429 * Find out how big a buffer we need. 1430 * 1431 * This call should always return FALSE; if the error is 1432 * ERROR_INSUFFICIENT_BUFFER, NameLength will be set to 1433 * the size of the buffer we need, otherwise there's a 1434 * problem, and NameLength should be set to 0. 1435 * 1436 * It shouldn't require NameLength to be set, but, 1437 * at least as of WinPcap 4.1.3, it checks whether 1438 * NameLength is big enough before it checks for a 1439 * NULL buffer argument, so, while it'll still do 1440 * the right thing if NameLength is uninitialized and 1441 * whatever junk happens to be there is big enough 1442 * (because the pointer argument will be null), it's 1443 * still reading an uninitialized variable. 1444 */ 1445 NameLength = 0; 1446 if (!PacketGetAdapterNames(NULL, &NameLength)) 1447 { 1448 DWORD last_error = GetLastError(); 1449 1450 if (last_error != ERROR_INSUFFICIENT_BUFFER) 1451 { 1452 pcap_win32_err_to_str(last_error, our_errbuf); 1453 pcap_snprintf(errbuf, PCAP_ERRBUF_SIZE, 1454 "PacketGetAdapterNames: %s", our_errbuf); 1455 return (-1); 1456 } 1457 } 1458 1459 if (NameLength > 0) 1460 AdaptersName = (char*) malloc(NameLength); 1461 else 1462 { 1463 *alldevsp = NULL; 1464 return 0; 1465 } 1466 if (AdaptersName == NULL) 1467 { 1468 pcap_snprintf(errbuf, PCAP_ERRBUF_SIZE, "Cannot allocate enough memory to list the adapters."); 1469 return (-1); 1470 } 1471 1472 if (!PacketGetAdapterNames(AdaptersName, &NameLength)) { 1473 pcap_win32_err_to_str(GetLastError(), our_errbuf); 1474 pcap_snprintf(errbuf, PCAP_ERRBUF_SIZE, "PacketGetAdapterNames: %s", 1475 our_errbuf); 1476 free(AdaptersName); 1477 return (-1); 1478 } 1479 1480 /* 1481 * "PacketGetAdapterNames()" returned a list of 1482 * null-terminated ASCII interface name strings, 1483 * terminated by a null string, followed by a list 1484 * of null-terminated ASCII interface description 1485 * strings, terminated by a null string. 1486 * This means there are two ASCII nulls at the end 1487 * of the first list. 1488 * 1489 * Find the end of the first list; that's the 1490 * beginning of the second list. 1491 */ 1492 desc = &AdaptersName[0]; 1493 while (*desc != '\0' || *(desc + 1) != '\0') 1494 desc++; 1495 1496 /* 1497 * Found it - "desc" points to the first of the two 1498 * nulls at the end of the list of names, so the 1499 * first byte of the list of descriptions is two bytes 1500 * after it. 1501 */ 1502 desc += 2; 1503 1504 /* 1505 * Loop over the elements in the first list. 1506 */ 1507 name = &AdaptersName[0]; 1508 while (*name != '\0') { 1509 bpf_u_int32 flags = 0; 1510 #ifdef HAVE_PACKET_IS_LOOPBACK_ADAPTER 1511 /* 1512 * Is this a loopback interface? 1513 */ 1514 if (PacketIsLoopbackAdapter(name)) { 1515 /* Yes */ 1516 flags |= PCAP_IF_LOOPBACK; 1517 } 1518 #endif 1519 1520 /* 1521 * Add an entry for this interface. 1522 */ 1523 if (pcap_add_if_win32(&devlist, name, flags, desc, 1524 errbuf) == -1) { 1525 /* 1526 * Failure. 1527 */ 1528 ret = -1; 1529 break; 1530 } 1531 name += strlen(name) + 1; 1532 desc += strlen(desc) + 1; 1533 } 1534 1535 if (ret == -1) { 1536 /* 1537 * We had an error; free the list we've been constructing. 1538 */ 1539 if (devlist != NULL) { 1540 pcap_freealldevs(devlist); 1541 devlist = NULL; 1542 } 1543 } 1544 1545 *alldevsp = devlist; 1546 free(AdaptersName); 1547 return (ret); 1548 } 1549
