2 * Copyright (c) 2002 - 2005 NetGroup, Politecnico di Torino (Italy)
3 * Copyright (c) 2005 - 2008 CACE Technologies, Davis (California)
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 * 3. Neither the name of the Politecnico di Torino, CACE Technologies
16 * nor the names of its contributors may be used to endorse or promote
17 * products derived from this software without specific prior written
20 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
21 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
22 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
23 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
24 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
25 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
26 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
27 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
28 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
29 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
30 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
38 #include "pcap-int.h" // for the details of the pcap_t structure
39 #include "pcap-rpcap.h"
40 #include "sockutils.h"
41 #include <errno.h> // for the errno variable
42 #include <stdlib.h> // for malloc(), free(), ...
43 #include <string.h> // for strstr, etc
46 #include <dirent.h> // for readdir
49 /* Keeps a list of all the opened connections in the active mode. */
50 extern struct activehosts
*activeHosts
;
53 * \brief Keeps the main socket identifier when we want to accept a new remote connection (active mode only).
54 * See the documentation of pcap_remoteact_accept() and pcap_remoteact_cleanup() for more details.
58 /* String identifier to be used in the pcap_findalldevs_ex() */
59 #define PCAP_TEXT_SOURCE_FILE "File"
60 /* String identifier to be used in the pcap_findalldevs_ex() */
61 #define PCAP_TEXT_SOURCE_ADAPTER "Network adapter"
63 /* String identifier to be used in the pcap_findalldevs_ex() */
64 #define PCAP_TEXT_SOURCE_ON_LOCAL_HOST "on local host"
65 /* String identifier to be used in the pcap_findalldevs_ex() */
66 #define PCAP_TEXT_SOURCE_ON_REMOTE_HOST "on remote node"
69 * Private data for capturing on WinPcap devices.
73 int rfmon_selfstart
; /* a flag tells whether the monitor mode is set by itself */
74 int filtering_in_kernel
; /* using kernel filter */
77 int dag_fcs_bits
; /* Number of checksum bits from link layer */
81 /****************************************************
85 ****************************************************/
87 int pcap_findalldevs_ex(char *source
, struct pcap_rmtauth
*auth
, pcap_if_t
**alldevs
, char *errbuf
)
89 SOCKET sockctrl
; /* socket descriptor of the control connection */
90 uint32 totread
= 0; /* number of bytes of the payload read from the socket */
92 struct addrinfo hints
; /* temp variable needed to resolve hostnames into to socket representation */
93 struct addrinfo
*addrinfo
; /* temp variable needed to resolve hostnames into to socket representation */
94 struct rpcap_header header
; /* structure that keeps the general header of the rpcap protocol */
95 int i
, j
; /* temp variables */
96 int naddr
; /* temp var needed to avoid problems with IPv6 addresses */
97 struct pcap_addr
*addr
; /* another such temp */
98 int retval
; /* store the return value of the functions */
99 int nif
; /* Number of interfaces listed */
100 int active
= 0; /* 'true' if we the other end-party is in active mode */
101 char host
[PCAP_BUF_SIZE
], port
[PCAP_BUF_SIZE
], name
[PCAP_BUF_SIZE
], path
[PCAP_BUF_SIZE
], filename
[PCAP_BUF_SIZE
];
104 char tmpstring
[PCAP_BUF_SIZE
+ 1]; /* Needed to convert names and descriptions from 'old' syntax to the 'new' one */
105 pcap_if_t
*dev
; /* Previous device into the pcap_if_t chain */
108 if (strlen(source
) > PCAP_BUF_SIZE
)
110 pcap_snprintf(errbuf
, PCAP_ERRBUF_SIZE
, "The source string is too long. Cannot handle it correctly.");
115 * Determine the type of the source (file, local, remote)
116 * There are some differences if pcap_findalldevs_ex() is called to list files and remote adapters.
117 * In the first case, the name of the directory we have to look into must be present (therefore
118 * the 'name' parameter of the pcap_parsesrcstr() is present).
119 * In the second case, the name of the adapter is not required (we need just the host). So, we have
120 * to use a first time this function to get the source type, and a second time to get the appropriate
121 * info, which depends on the source type.
123 if (pcap_parsesrcstr(source
, &type
, NULL
, NULL
, NULL
, errbuf
) == -1)
126 if (type
== PCAP_SRC_IFLOCAL
)
128 if (pcap_parsesrcstr(source
, &type
, host
, NULL
, NULL
, errbuf
) == -1)
131 /* Initialize temporary string */
132 tmpstring
[PCAP_BUF_SIZE
] = 0;
134 /* The user wants to retrieve adapters from a local host */
135 if (pcap_findalldevs(alldevs
, errbuf
) == -1)
138 if ((alldevs
== NULL
) || (*alldevs
== NULL
))
140 pcap_snprintf(errbuf
, PCAP_ERRBUF_SIZE
,
141 "No interfaces found! Make sure libpcap/WinPcap is properly installed"
142 " on the local machine.");
146 /* Scan all the interfaces and modify name and description */
147 /* This is a trick in order to avoid the re-implementation of the pcap_findalldevs here */
151 /* Create the new device identifier */
152 if (pcap_createsrcstr(tmpstring
, PCAP_SRC_IFLOCAL
, NULL
, NULL
, dev
->name
, errbuf
) == -1)
155 /* Delete the old pointer */
158 /* Make a copy of the new device identifier */
159 dev
->name
= strdup(tmpstring
);
160 if (dev
->name
== NULL
)
162 pcap_snprintf(errbuf
, PCAP_ERRBUF_SIZE
, "malloc() failed: %s", pcap_strerror(errno
));
166 /* Create the new device description */
167 if ((dev
->description
== NULL
) || (dev
->description
[0] == 0))
168 pcap_snprintf(tmpstring
, sizeof(tmpstring
) - 1, "%s '%s' %s", PCAP_TEXT_SOURCE_ADAPTER
,
169 dev
->name
, PCAP_TEXT_SOURCE_ON_LOCAL_HOST
);
171 pcap_snprintf(tmpstring
, sizeof(tmpstring
) - 1, "%s '%s' %s", PCAP_TEXT_SOURCE_ADAPTER
,
172 dev
->description
, PCAP_TEXT_SOURCE_ON_LOCAL_HOST
);
174 /* Delete the old pointer */
175 free(dev
->description
);
177 /* Make a copy of the description */
178 dev
->description
= strdup(tmpstring
);
179 if (dev
->description
== NULL
)
181 pcap_snprintf(errbuf
, PCAP_ERRBUF_SIZE
, "malloc() failed: %s", pcap_strerror(errno
));
193 if (type
== PCAP_SRC_FILE
)
197 WIN32_FIND_DATA filedata
;
200 struct dirent
*filedata
;
204 if (pcap_parsesrcstr(source
, &type
, host
, port
, name
, errbuf
) == -1)
207 /* Check that the filename is correct */
208 stringlen
= strlen(name
);
210 /* The directory must end with '\' in Win32 and '/' in UNIX */
212 #define ENDING_CHAR '\\'
214 #define ENDING_CHAR '/'
217 if (name
[stringlen
- 1] != ENDING_CHAR
)
219 name
[stringlen
] = ENDING_CHAR
;
220 name
[stringlen
+ 1] = 0;
225 /* Save the path for future reference */
226 pcap_snprintf(path
, sizeof(path
), "%s", name
);
229 /* To perform directory listing, Win32 must have an 'asterisk' as ending char */
230 if (name
[stringlen
- 1] != '*')
232 name
[stringlen
] = '*';
233 name
[stringlen
+ 1] = 0;
236 filehandle
= FindFirstFile(name
, &filedata
);
238 if (filehandle
== INVALID_HANDLE_VALUE
)
240 pcap_snprintf(errbuf
, PCAP_ERRBUF_SIZE
, "Error when listing files: does folder '%s' exist?", path
);
245 /* opening the folder */
246 unixdir
= opendir(path
);
248 /* get the first file into it */
249 filedata
= readdir(unixdir
);
251 if (filedata
== NULL
)
253 pcap_snprintf(errbuf
, PCAP_ERRBUF_SIZE
, "Error when listing files: does folder '%s' exist?", path
);
262 pcap_snprintf(filename
, sizeof(filename
), "%s%s", path
, filedata
.cFileName
);
264 pcap_snprintf(filename
, sizeof(filename
), "%s%s", path
, filedata
->d_name
);
267 fp
= pcap_open_offline(filename
, errbuf
);
271 /* allocate the main structure */
272 if (*alldevs
== NULL
) /* This is in case it is the first file */
274 (*alldevs
) = (pcap_if_t
*)malloc(sizeof(pcap_if_t
));
279 dev
->next
= (pcap_if_t
*)malloc(sizeof(pcap_if_t
));
283 /* check that the malloc() didn't fail */
286 pcap_snprintf(errbuf
, PCAP_ERRBUF_SIZE
, "malloc() failed: %s", pcap_strerror(errno
));
290 /* Initialize the structure to 'zero' */
291 memset(dev
, 0, sizeof(pcap_if_t
));
293 /* Create the new source identifier */
294 if (pcap_createsrcstr(tmpstring
, PCAP_SRC_FILE
, NULL
, NULL
, filename
, errbuf
) == -1)
297 stringlen
= strlen(tmpstring
);
299 dev
->name
= (char *)malloc(stringlen
+ 1);
300 if (dev
->name
== NULL
)
302 pcap_snprintf(errbuf
, PCAP_ERRBUF_SIZE
, "malloc() failed: %s", pcap_strerror(errno
));
306 strlcpy(dev
->name
, tmpstring
, stringlen
);
308 dev
->name
[stringlen
] = 0;
310 /* Create the description */
311 pcap_snprintf(tmpstring
, sizeof(tmpstring
) - 1, "%s '%s' %s", PCAP_TEXT_SOURCE_FILE
,
312 filename
, PCAP_TEXT_SOURCE_ON_LOCAL_HOST
);
314 stringlen
= strlen(tmpstring
);
316 dev
->description
= (char *)malloc(stringlen
+ 1);
318 if (dev
->description
== NULL
)
320 pcap_snprintf(errbuf
, PCAP_ERRBUF_SIZE
, "malloc() failed: %s", pcap_strerror(errno
));
324 /* Copy the new device description into the correct memory location */
325 strlcpy(dev
->description
, tmpstring
, stringlen
+ 1);
331 while (FindNextFile(filehandle
, &filedata
) != 0);
333 while ( (filedata
= readdir(unixdir
)) != NULL
);
338 /* Close the search handle. */
339 FindClose(filehandle
);
345 /* If we come here, it is a remote host */
347 /* Retrieve the needed data for getting adapter list */
348 if (pcap_parsesrcstr(source
, &type
, host
, port
, NULL
, errbuf
) == -1)
351 /* Warning: this call can be the first one called by the user. */
352 /* For this reason, we have to initialize the WinSock support. */
353 if (sock_init(errbuf
, PCAP_ERRBUF_SIZE
) == -1)
356 /* Check for active mode */
357 sockctrl
= rpcap_remoteact_getsock(host
, &active
, errbuf
);
358 if (sockctrl
== INVALID_SOCKET
)
363 * We're not in active mode; let's try to open a new
364 * control connection.
368 memset(&hints
, 0, sizeof(struct addrinfo
));
369 hints
.ai_family
= PF_UNSPEC
;
370 hints
.ai_socktype
= SOCK_STREAM
;
374 /* the user chose not to specify the port */
375 if (sock_initaddress(host
, RPCAP_DEFAULT_NETPORT
, &hints
, &addrinfo
, errbuf
, PCAP_ERRBUF_SIZE
) == -1)
380 if (sock_initaddress(host
, port
, &hints
, &addrinfo
, errbuf
, PCAP_ERRBUF_SIZE
) == -1)
384 if ((sockctrl
= sock_open(addrinfo
, SOCKOPEN_CLIENT
, 0, errbuf
, PCAP_ERRBUF_SIZE
)) == -1)
387 /* addrinfo is no longer used */
388 freeaddrinfo(addrinfo
);
391 if (rpcap_sendauth(sockctrl
, auth
, errbuf
) == -1)
393 sock_close(sockctrl
, NULL
, 0);
398 /* RPCAP findalldevs command */
399 rpcap_createhdr(&header
, RPCAP_MSG_FINDALLIF_REQ
, 0, 0);
401 if (sock_send(sockctrl
, (char *)&header
, sizeof(struct rpcap_header
), errbuf
, PCAP_ERRBUF_SIZE
) == -1)
404 if (sock_recv(sockctrl
, (char *)&header
, sizeof(struct rpcap_header
), SOCK_RECEIVEALL_YES
, errbuf
, PCAP_ERRBUF_SIZE
) == -1)
407 /* Checks if the message is correct */
408 retval
= rpcap_checkmsg(errbuf
, sockctrl
, &header
, RPCAP_MSG_FINDALLIF_REPLY
, RPCAP_MSG_ERROR
, 0);
410 if (retval
!= RPCAP_MSG_FINDALLIF_REPLY
) /* the message is not the one expected */
414 case -3: /* Unrecoverable network error */
415 case -2: /* The other endpoint send a message that is not allowed here */
416 case -1: /* The other endpoint has a version number that is not compatible with our */
419 case RPCAP_MSG_ERROR
: /* The other endpoint reported an error */
424 pcap_snprintf(errbuf
, PCAP_ERRBUF_SIZE
, "Internal error");
430 sock_close(sockctrl
, NULL
, 0);
435 /* read the number of interfaces */
436 nif
= ntohs(header
.value
);
438 /* loop until all interfaces have been received */
439 for (i
= 0; i
< nif
; i
++)
441 struct rpcap_findalldevs_if findalldevs_if
;
442 char tmpstring2
[PCAP_BUF_SIZE
+ 1]; /* Needed to convert names and descriptions from 'old' syntax to the 'new' one */
445 tmpstring2
[PCAP_BUF_SIZE
] = 0;
447 /* receive the findalldevs structure from remote host */
448 nread
= sock_recv(sockctrl
, (char *)&findalldevs_if
,
449 sizeof(struct rpcap_findalldevs_if
), SOCK_RECEIVEALL_YES
,
450 errbuf
, PCAP_ERRBUF_SIZE
);
455 findalldevs_if
.namelen
= ntohs(findalldevs_if
.namelen
);
456 findalldevs_if
.desclen
= ntohs(findalldevs_if
.desclen
);
457 findalldevs_if
.naddr
= ntohs(findalldevs_if
.naddr
);
459 /* allocate the main structure */
462 (*alldevs
) = (pcap_if_t
*)malloc(sizeof(pcap_if_t
));
467 dev
->next
= (pcap_if_t
*)malloc(sizeof(pcap_if_t
));
471 /* check that the malloc() didn't fail */
474 pcap_snprintf(errbuf
, PCAP_ERRBUF_SIZE
, "malloc() failed: %s", pcap_strerror(errno
));
478 /* Initialize the structure to 'zero' */
479 memset(dev
, 0, sizeof(pcap_if_t
));
481 /* allocate mem for name and description */
482 if (findalldevs_if
.namelen
)
485 if (findalldevs_if
.namelen
>= sizeof(tmpstring
))
487 pcap_snprintf(errbuf
, PCAP_ERRBUF_SIZE
, "Interface name too long");
491 /* Retrieve adapter name */
492 nread
= sock_recv(sockctrl
, tmpstring
,
493 findalldevs_if
.namelen
, SOCK_RECEIVEALL_YES
,
494 errbuf
, PCAP_ERRBUF_SIZE
);
499 tmpstring
[findalldevs_if
.namelen
] = 0;
501 /* Create the new device identifier */
502 if (pcap_createsrcstr(tmpstring2
, PCAP_SRC_IFREMOTE
, host
, port
, tmpstring
, errbuf
) == -1)
505 stringlen
= strlen(tmpstring2
);
507 dev
->name
= (char *)malloc(stringlen
+ 1);
508 if (dev
->name
== NULL
)
510 pcap_snprintf(errbuf
, PCAP_ERRBUF_SIZE
, "malloc() failed: %s", pcap_strerror(errno
));
514 /* Copy the new device name into the correct memory location */
515 strlcpy(dev
->name
, tmpstring2
, stringlen
+ 1);
518 if (findalldevs_if
.desclen
)
520 if (findalldevs_if
.desclen
>= sizeof(tmpstring
))
522 pcap_snprintf(errbuf
, PCAP_ERRBUF_SIZE
, "Interface description too long");
526 /* Retrieve adapter description */
527 nread
= sock_recv(sockctrl
, tmpstring
,
528 findalldevs_if
.desclen
, SOCK_RECEIVEALL_YES
,
529 errbuf
, PCAP_ERRBUF_SIZE
);
534 tmpstring
[findalldevs_if
.desclen
] = 0;
536 pcap_snprintf(tmpstring2
, sizeof(tmpstring2
) - 1, "%s '%s' %s %s", PCAP_TEXT_SOURCE_ADAPTER
,
537 tmpstring
, PCAP_TEXT_SOURCE_ON_REMOTE_HOST
, host
);
539 stringlen
= strlen(tmpstring2
);
541 dev
->description
= (char *)malloc(stringlen
+ 1);
543 if (dev
->description
== NULL
)
545 pcap_snprintf(errbuf
, PCAP_ERRBUF_SIZE
, "malloc() failed: %s", pcap_strerror(errno
));
549 /* Copy the new device description into the correct memory location */
550 strlcpy(dev
->description
, tmpstring2
, stringlen
+ 1);
553 dev
->flags
= ntohl(findalldevs_if
.flags
);
557 /* loop until all addresses have been received */
558 for (j
= 0; j
< findalldevs_if
.naddr
; j
++)
560 struct rpcap_findalldevs_ifaddr ifaddr
;
562 /* Retrieve the interface addresses */
563 nread
= sock_recv(sockctrl
, (char *)&ifaddr
,
564 sizeof(struct rpcap_findalldevs_ifaddr
),
565 SOCK_RECEIVEALL_YES
, errbuf
, PCAP_ERRBUF_SIZE
);
571 * WARNING libpcap bug: the address listing is
572 * available only for AF_INET.
576 if (ntohs(ifaddr
.addr
.ss_family
) == AF_INET
)
580 dev
->addresses
= (struct pcap_addr
*) malloc(sizeof(struct pcap_addr
));
581 addr
= dev
->addresses
;
585 addr
->next
= (struct pcap_addr
*) malloc(sizeof(struct pcap_addr
));
592 pcap_snprintf(errbuf
, PCAP_ERRBUF_SIZE
, "malloc() failed: %s", pcap_strerror(errno
));
597 if (rpcap_deseraddr((struct sockaddr_storage
*) &ifaddr
.addr
,
598 (struct sockaddr_storage
**) &addr
->addr
, errbuf
) == -1)
600 if (rpcap_deseraddr((struct sockaddr_storage
*) &ifaddr
.netmask
,
601 (struct sockaddr_storage
**) &addr
->netmask
, errbuf
) == -1)
603 if (rpcap_deseraddr((struct sockaddr_storage
*) &ifaddr
.broadaddr
,
604 (struct sockaddr_storage
**) &addr
->broadaddr
, errbuf
) == -1)
606 if (rpcap_deseraddr((struct sockaddr_storage
*) &ifaddr
.dstaddr
,
607 (struct sockaddr_storage
**) &addr
->dstaddr
, errbuf
) == -1)
610 if ((addr
->addr
== NULL
) && (addr
->netmask
== NULL
) &&
611 (addr
->broadaddr
== NULL
) && (addr
->dstaddr
== NULL
))
616 naddr
= 0; /* the first item of the list had NULL addresses */
622 /* Checks if all the data has been read; if not, discard the data in excess */
623 if (totread
!= ntohl(header
.plen
))
625 if (sock_discard(sockctrl
, ntohl(header
.plen
) - totread
, errbuf
, PCAP_ERRBUF_SIZE
) == 1)
629 /* Control connection has to be closed only in case the remote machine is in passive mode */
632 /* DO not send RPCAP_CLOSE, since we did not open a pcap_t; no need to free resources */
633 if (sock_close(sockctrl
, errbuf
, PCAP_ERRBUF_SIZE
))
637 /* To avoid inconsistencies in the number of sock_init() */
644 * In case there has been an error, I don't want to overwrite it with a new one
645 * if the following call fails. I want to return always the original error.
647 * Take care: this connection can already be closed when we try to close it.
648 * This happens because a previous error in the rpcapd, which requested to
649 * closed the connection. In that case, we already recognized that into the
650 * rpspck_isheaderok() and we already acknowledged the closing.
651 * In that sense, this call is useless here (however it is needed in case
652 * the client generates the error).
654 * Checks if all the data has been read; if not, discard the data in excess
656 if (totread
!= ntohl(header
.plen
))
658 if (sock_discard(sockctrl
, ntohl(header
.plen
) - totread
, NULL
, 0) == 1)
662 /* Control connection has to be closed only in case the remote machine is in passive mode */
664 sock_close(sockctrl
, NULL
, 0);
666 /* To avoid inconsistencies in the number of sock_init() */
672 int pcap_createsrcstr(char *source
, int type
, const char *host
, const char *port
, const char *name
, char *errbuf
)
678 strlcpy(source
, PCAP_SRC_FILE_STRING
, PCAP_BUF_SIZE
);
679 if ((name
) && (*name
))
681 strlcat(source
, name
, PCAP_BUF_SIZE
);
686 pcap_snprintf(errbuf
, PCAP_ERRBUF_SIZE
, "The file name cannot be NULL.");
691 case PCAP_SRC_IFREMOTE
:
693 strlcpy(source
, PCAP_SRC_IF_STRING
, PCAP_BUF_SIZE
);
694 if ((host
) && (*host
))
696 if ((strcspn(host
, "aAbBcCdDeEfFgGhHjJkKlLmMnNoOpPqQrRsStTuUvVwWxXyYzZ")) == strlen(host
))
698 /* the host name does not contains alphabetic chars. So, it is a numeric address */
699 /* In this case we have to include it between square brackets */
700 strlcat(source
, "[", PCAP_BUF_SIZE
);
701 strlcat(source
, host
, PCAP_BUF_SIZE
);
702 strlcat(source
, "]", PCAP_BUF_SIZE
);
705 strlcat(source
, host
, PCAP_BUF_SIZE
);
707 if ((port
) && (*port
))
709 strlcat(source
, ":", PCAP_BUF_SIZE
);
710 strlcat(source
, port
, PCAP_BUF_SIZE
);
713 strlcat(source
, "/", PCAP_BUF_SIZE
);
717 pcap_snprintf(errbuf
, PCAP_ERRBUF_SIZE
, "The host name cannot be NULL.");
721 if ((name
) && (*name
))
722 strlcat(source
, name
, PCAP_BUF_SIZE
);
727 case PCAP_SRC_IFLOCAL
:
729 strlcpy(source
, PCAP_SRC_IF_STRING
, PCAP_BUF_SIZE
);
731 if ((name
) && (*name
))
732 strlcat(source
, name
, PCAP_BUF_SIZE
);
739 pcap_snprintf(errbuf
, PCAP_ERRBUF_SIZE
, "The interface type is not valid.");
745 int pcap_parsesrcstr(const char *source
, int *type
, char *host
, char *port
, char *name
, char *errbuf
)
749 char tmpname
[PCAP_BUF_SIZE
];
750 char tmphost
[PCAP_BUF_SIZE
];
751 char tmpport
[PCAP_BUF_SIZE
];
754 /* Initialization stuff */
766 /* Look for a 'rpcap://' identifier */
767 if ((ptr
= strstr(source
, PCAP_SRC_IF_STRING
)) != NULL
)
769 if (strlen(PCAP_SRC_IF_STRING
) == strlen(source
))
771 /* The source identifier contains only the 'rpcap://' string. */
772 /* So, this is a local capture. */
773 *type
= PCAP_SRC_IFLOCAL
;
777 ptr
+= strlen(PCAP_SRC_IF_STRING
);
779 if (strchr(ptr
, '[')) /* This is probably a numeric address */
781 ntoken
= sscanf(ptr
, "[%[1234567890:.]]:%[^/]/%s", tmphost
, tmpport
, tmpname
);
783 if (ntoken
== 1) /* probably the port is missing */
784 ntoken
= sscanf(ptr
, "[%[1234567890:.]]/%s", tmphost
, tmpname
);
786 tmptype
= PCAP_SRC_IFREMOTE
;
790 ntoken
= sscanf(ptr
, "%[^/:]:%[^/]/%s", tmphost
, tmpport
, tmpname
);
795 * This can be due to two reasons:
796 * - we want a remote capture, but the network port is missing
797 * - we want to do a local capture
798 * To distinguish between the two, we look for the '/' char
800 if (strchr(ptr
, '/'))
802 /* We're on a remote capture */
803 sscanf(ptr
, "%[^/]/%s", tmphost
, tmpname
);
804 tmptype
= PCAP_SRC_IFREMOTE
;
808 /* We're on a local capture */
810 strlcpy(tmpname
, ptr
, PCAP_BUF_SIZE
);
812 /* Clean the host name, since it is a remote capture */
813 /* NOTE: the host name has been assigned in the previous "ntoken= sscanf(...)" line */
816 tmptype
= PCAP_SRC_IFLOCAL
;
820 tmptype
= PCAP_SRC_IFREMOTE
;
824 strlcpy(host
, tmphost
, PCAP_BUF_SIZE
);
826 strlcpy(port
, tmpport
, PCAP_BUF_SIZE
);
833 * If the user wants the host name, but it cannot be located into the source string, return error
834 * However, if the user is not interested in the interface name (e.g. if we're called by
835 * pcap_findalldevs_ex(), which does not have interface name, do not return error
839 strlcpy(name
, tmpname
, PCAP_BUF_SIZE
);
844 pcap_snprintf(errbuf
, PCAP_ERRBUF_SIZE
, "The interface name has not been specified in the source string.");
853 /* Look for a 'file://' identifier */
854 if ((ptr
= strstr(source
, PCAP_SRC_FILE_STRING
)) != NULL
)
856 ptr
+= strlen(PCAP_SRC_FILE_STRING
);
860 strlcpy(name
, ptr
, PCAP_BUF_SIZE
);
863 *type
= PCAP_SRC_FILE
;
870 pcap_snprintf(errbuf
, PCAP_ERRBUF_SIZE
, "The file name has not been specified in the source string.");
877 /* Backward compatibility; the user didn't use the 'rpcap://, file://' specifiers */
878 if ((source
) && (*source
))
881 strlcpy(name
, source
, PCAP_BUF_SIZE
);
884 *type
= PCAP_SRC_IFLOCAL
;
891 pcap_snprintf(errbuf
, PCAP_ERRBUF_SIZE
, "The interface name has not been specified in the source string.");
897 pcap_t
*pcap_open(const char *source
, int snaplen
, int flags
, int read_timeout
, struct pcap_rmtauth
*auth
, char *errbuf
)
899 char host
[PCAP_BUF_SIZE
], port
[PCAP_BUF_SIZE
], name
[PCAP_BUF_SIZE
];
904 if (strlen(source
) > PCAP_BUF_SIZE
)
906 pcap_snprintf(errbuf
, PCAP_ERRBUF_SIZE
, "The source string is too long. Cannot handle it correctly.");
910 /* determine the type of the source (file, local, remote) */
911 if (pcap_parsesrcstr(source
, &type
, host
, port
, name
, errbuf
) == -1)
918 fp
= pcap_open_offline(name
, errbuf
);
921 case PCAP_SRC_IFREMOTE
:
922 fp
= pcap_create(source
, errbuf
);
929 * Although we already have host, port and iface, we prefer TO PASS only 'pars' to the
930 * pcap_open_remote() so that it has to call the pcap_parsesrcstr() again.
931 * This is less optimized, but much clearer.
934 result
= pcap_opensource_remote(fp
, auth
);
942 struct pcap_md
*md
; /* structure used when doing a remote live capture */
943 md
= (struct pcap_md
*) ((u_char
*)fp
->priv
+ sizeof(struct pcap_win
));
945 fp
->snapshot
= snaplen
;
946 fp
->opt
.timeout
= read_timeout
;
947 md
->rmt_flags
= flags
;
950 case PCAP_SRC_IFLOCAL
:
952 fp
= pcap_open_live(name
, snaplen
, (flags
& PCAP_OPENFLAG_PROMISCUOUS
), read_timeout
, errbuf
);
956 * these flags are supported on Windows only
958 if (fp
!= NULL
&& fp
->adapter
!= NULL
)
960 /* disable loopback capture if requested */
961 if (flags
& PCAP_OPENFLAG_NOCAPTURE_LOCAL
)
963 if (!PacketSetLoopbackBehavior(fp
->adapter
, NPF_DISABLE_LOOPBACK
))
965 pcap_snprintf(errbuf
, PCAP_ERRBUF_SIZE
, "Unable to disable the capture of loopback packets.");
971 /* set mintocopy to zero if requested */
972 if (flags
& PCAP_OPENFLAG_MAX_RESPONSIVENESS
)
974 if (!PacketSetMinToCopy(fp
->adapter
, 0))
976 pcap_snprintf(errbuf
, PCAP_ERRBUF_SIZE
, "Unable to set max responsiveness.");
987 strlcpy(errbuf
, "Source type not supported", PCAP_ERRBUF_SIZE
);
993 struct pcap_samp
*pcap_setsampling(pcap_t
*p
)
995 struct pcap_md
*md
; /* structure used when doing a remote live capture */
997 md
= (struct pcap_md
*) ((u_char
*)p
->priv
+ sizeof(struct pcap_win
));
998 return &(md
->rmt_samp
);
1001 SOCKET
pcap_remoteact_accept(const char *address
, const char *port
, const char *hostlist
, char *connectinghost
, struct pcap_rmtauth
*auth
, char *errbuf
)
1003 /* socket-related variables */
1004 struct addrinfo hints
; /* temporary struct to keep settings needed to open the new socket */
1005 struct addrinfo
*addrinfo
; /* keeps the addrinfo chain; required to open a new socket */
1006 struct sockaddr_storage from
; /* generic sockaddr_storage variable */
1007 socklen_t fromlen
; /* keeps the length of the sockaddr_storage variable */
1008 SOCKET sockctrl
; /* keeps the main socket identifier */
1009 struct activehosts
*temp
, *prev
; /* temp var needed to scan he host list chain */
1011 *connectinghost
= 0; /* just in case */
1013 /* Prepare to open a new server socket */
1014 memset(&hints
, 0, sizeof(struct addrinfo
));
1015 /* WARNING Currently it supports only ONE socket family among ipv4 and IPv6 */
1016 hints
.ai_family
= AF_INET
; /* PF_UNSPEC to have both IPv4 and IPv6 server */
1017 hints
.ai_flags
= AI_PASSIVE
; /* Ready to a bind() socket */
1018 hints
.ai_socktype
= SOCK_STREAM
;
1020 /* Warning: this call can be the first one called by the user. */
1021 /* For this reason, we have to initialize the WinSock support. */
1022 if (sock_init(errbuf
, PCAP_ERRBUF_SIZE
) == -1)
1026 if ((port
== NULL
) || (port
[0] == 0))
1028 if (sock_initaddress(address
, RPCAP_DEFAULT_NETPORT_ACTIVE
, &hints
, &addrinfo
, errbuf
, PCAP_ERRBUF_SIZE
) == -1)
1030 SOCK_ASSERT(errbuf
, 1);
1036 if (sock_initaddress(address
, port
, &hints
, &addrinfo
, errbuf
, PCAP_ERRBUF_SIZE
) == -1)
1038 SOCK_ASSERT(errbuf
, 1);
1044 if ((sockmain
= sock_open(addrinfo
, SOCKOPEN_SERVER
, 1, errbuf
, PCAP_ERRBUF_SIZE
)) == -1)
1046 SOCK_ASSERT(errbuf
, 1);
1050 /* Connection creation */
1051 fromlen
= sizeof(struct sockaddr_storage
);
1053 sockctrl
= accept(sockmain
, (struct sockaddr
*) &from
, &fromlen
);
1055 /* We're not using sock_close, since we do not want to send a shutdown */
1056 /* (which is not allowed on a non-connected socket) */
1057 closesocket(sockmain
);
1062 sock_geterror("accept(): ", errbuf
, PCAP_ERRBUF_SIZE
);
1066 /* Get the numeric for of the name of the connecting host */
1067 if (getnameinfo((struct sockaddr
*) &from
, fromlen
, connectinghost
, RPCAP_HOSTLIST_SIZE
, NULL
, 0, NI_NUMERICHOST
))
1069 sock_geterror("getnameinfo(): ", errbuf
, PCAP_ERRBUF_SIZE
);
1070 rpcap_senderror(sockctrl
, errbuf
, PCAP_ERR_REMOTEACCEPT
, NULL
);
1071 sock_close(sockctrl
, NULL
, 0);
1075 /* checks if the connecting host is among the ones allowed */
1076 if (sock_check_hostlist((char *)hostlist
, RPCAP_HOSTLIST_SEP
, &from
, errbuf
, PCAP_ERRBUF_SIZE
) < 0)
1078 rpcap_senderror(sockctrl
, errbuf
, PCAP_ERR_REMOTEACCEPT
, NULL
);
1079 sock_close(sockctrl
, NULL
, 0);
1083 /* Send authentication to the remote machine */
1084 if (rpcap_sendauth(sockctrl
, auth
, errbuf
) == -1)
1086 rpcap_senderror(sockctrl
, errbuf
, PCAP_ERR_REMOTEACCEPT
, NULL
);
1087 sock_close(sockctrl
, NULL
, 0);
1091 /* Checks that this host does not already have a cntrl connection in place */
1093 /* Initialize pointers */
1099 /* This host already has an active connection in place, so I don't have to update the host list */
1100 if (sock_cmpaddr(&temp
->host
, &from
) == 0)
1107 /* The host does not exist in the list; so I have to update the list */
1110 prev
->next
= (struct activehosts
*) malloc(sizeof(struct activehosts
));
1115 activeHosts
= (struct activehosts
*) malloc(sizeof(struct activehosts
));
1121 pcap_snprintf(errbuf
, PCAP_ERRBUF_SIZE
, "malloc() failed: %s", pcap_strerror(errno
));
1122 rpcap_senderror(sockctrl
, errbuf
, PCAP_ERR_REMOTEACCEPT
, NULL
);
1123 sock_close(sockctrl
, NULL
, 0);
1127 memcpy(&temp
->host
, &from
, fromlen
);
1128 temp
->sockctrl
= sockctrl
;
1134 int pcap_remoteact_close(const char *host
, char *errbuf
)
1136 struct activehosts
*temp
, *prev
; /* temp var needed to scan the host list chain */
1137 struct addrinfo hints
, *addrinfo
, *ai_next
; /* temp var needed to translate between hostname to its address */
1143 /* retrieve the network address corresponding to 'host' */
1145 memset(&hints
, 0, sizeof(struct addrinfo
));
1146 hints
.ai_family
= PF_UNSPEC
;
1147 hints
.ai_socktype
= SOCK_STREAM
;
1149 retval
= getaddrinfo(host
, "0", &hints
, &addrinfo
);
1152 pcap_snprintf(errbuf
, PCAP_ERRBUF_SIZE
, "getaddrinfo() %s", gai_strerror(retval
));
1161 if (sock_cmpaddr(&temp
->host
, (struct sockaddr_storage
*) ai_next
->ai_addr
) == 0)
1163 struct rpcap_header header
;
1165 /* Close this connection */
1166 rpcap_createhdr(&header
, RPCAP_MSG_CLOSE
, 0, 0);
1168 /* I don't check for errors, since I'm going to close everything */
1169 sock_send(temp
->sockctrl
, (char *)&header
, sizeof(struct rpcap_header
), errbuf
, PCAP_ERRBUF_SIZE
);
1171 if (sock_close(temp
->sockctrl
, errbuf
, PCAP_ERRBUF_SIZE
))
1173 /* To avoid inconsistencies in the number of sock_init() */
1180 prev
->next
= temp
->next
;
1182 activeHosts
= temp
->next
;
1184 freeaddrinfo(addrinfo
);
1188 /* To avoid inconsistencies in the number of sock_init() */
1194 ai_next
= ai_next
->ai_next
;
1201 freeaddrinfo(addrinfo
);
1203 /* To avoid inconsistencies in the number of sock_init() */
1206 pcap_snprintf(errbuf
, PCAP_ERRBUF_SIZE
, "The host you want to close the active connection is not known");
1210 void pcap_remoteact_cleanup(void)
1212 /* Very dirty, but it works */
1215 closesocket(sockmain
);
1217 /* To avoid inconsistencies in the number of sock_init() */
1223 int pcap_remoteact_list(char *hostlist
, char sep
, int size
, char *errbuf
)
1225 struct activehosts
*temp
; /* temp var needed to scan the host list chain */
1227 char hoststr
[RPCAP_HOSTLIST_SIZE
+ 1];
1236 /*int sock_getascii_addrport(const struct sockaddr_storage *sockaddr, char *address, int addrlen, char *port, int portlen, int flags, char *errbuf, int errbuflen) */
1238 /* Get the numeric form of the name of the connecting host */
1239 if (sock_getascii_addrport((struct sockaddr_storage
*) &temp
->host
, hoststr
,
1240 RPCAP_HOSTLIST_SIZE
, NULL
, 0, NI_NUMERICHOST
, errbuf
, PCAP_ERRBUF_SIZE
) != -1)
1241 /* if (getnameinfo( (struct sockaddr *) &temp->host, sizeof (struct sockaddr_storage), hoststr, */
1242 /* RPCAP_HOSTLIST_SIZE, NULL, 0, NI_NUMERICHOST) ) */
1244 /* sock_geterror("getnameinfo(): ", errbuf, PCAP_ERRBUF_SIZE); */
1248 len
= len
+ strlen(hoststr
) + 1 /* the separator */;
1250 if ((size
< 0) || (len
>= (size_t)size
))
1252 pcap_snprintf(errbuf
, PCAP_ERRBUF_SIZE
, "The string you provided is not able to keep "
1253 "the hostnames for all the active connections");
1257 strlcat(hostlist
, hoststr
, PCAP_ERRBUF_SIZE
);
1258 hostlist
[len
- 1] = sep
;