1 /* $NetBSD: pcap-win32.c,v 1.3 2015/03/31 21:39:42 christos Exp $ */
2
3 /*
4 * Copyright (c) 1999 - 2005 NetGroup, Politecnico di Torino (Italy)
5 * Copyright (c) 2005 - 2008 CACE Technologies, Davis (California)
6 * All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 *
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in the
16 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the Politecnico di Torino, CACE Technologies
18 * nor the names of its contributors may be used to endorse or promote
19 * products derived from this software without specific prior written
20 * permission.
21 *
22 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
23 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
24 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
25 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
26 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
27 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
28 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
29 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
30 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
31 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
32 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
33 *
34 */
35
36 #include <pcap-int.h>
37 #include <Packet32.h>
38 #ifdef __MINGW32__
39 #ifdef __MINGW64__
40 #include <ntddndis.h>
41 #else /*__MINGW64__*/
42 #include <ddk/ntddndis.h>
43 #include <ddk/ndis.h>
44 #endif /*__MINGW64__*/
45 #else /*__MINGW32__*/
46 #include <ntddndis.h>
47 #endif /*__MINGW32__*/
48 #ifdef HAVE_DAG_API
49 #include <dagnew.h>
50 #include <dagapi.h>
51 #endif /* HAVE_DAG_API */
52 #ifdef __MINGW32__
53 int* _errno();
54 #define errno (*_errno())
55 #endif /* __MINGW32__ */
56
57 static int pcap_setfilter_win32_npf(pcap_t *, struct bpf_program *);
58 static int pcap_setfilter_win32_dag(pcap_t *, struct bpf_program *);
59 static int pcap_getnonblock_win32(pcap_t *, char *);
60 static int pcap_setnonblock_win32(pcap_t *, int, char *);
61
62 /*dimension of the buffer in the pcap_t structure*/
63 #define WIN32_DEFAULT_USER_BUFFER_SIZE 256000
64
65 /*dimension of the buffer in the kernel driver NPF */
66 #define WIN32_DEFAULT_KERNEL_BUFFER_SIZE 1000000
67
68 /* Equivalent to ntohs(), but a lot faster under Windows */
69 #define SWAPS(_X) ((_X & 0xff) << 8) | (_X >> 8)
70
71 /*
72 * Private data for capturing on WinPcap devices.
73 */
74 struct pcap_win {
75 int nonblock;
76
77 int filtering_in_kernel; /* using kernel filter */
78
79 #ifdef HAVE_DAG_API
80 int dag_fcs_bits; /* Number of checksum bits from link layer */
81 #endif
82 };
83
84 /*
85 * Header that the WinPcap driver associates to the packets.
86 * Once was in bpf.h
87 */
88 struct bpf_hdr {
89 struct timeval bh_tstamp; /* time stamp */
90 bpf_u_int32 bh_caplen; /* length of captured portion */
91 bpf_u_int32 bh_datalen; /* original length of packet */
92 u_short bh_hdrlen; /* length of bpf header (this struct
93 plus alignment padding) */
94 };
95
96 CRITICAL_SECTION g_PcapCompileCriticalSection;
97
DllMain(HANDLE hinstDLL,DWORD dwReason,LPVOID lpvReserved)98 BOOL WINAPI DllMain(
99 HANDLE hinstDLL,
100 DWORD dwReason,
101 LPVOID lpvReserved
102 )
103 {
104 if (dwReason == DLL_PROCESS_ATTACH)
105 {
106 InitializeCriticalSection(&g_PcapCompileCriticalSection);
107 }
108
109 return TRUE;
110 }
111
112 /* Start winsock */
113 int
wsockinit()114 wsockinit()
115 {
116 WORD wVersionRequested;
117 WSADATA wsaData;
118 static int err = -1;
119 static int done = 0;
120
121 if (done)
122 return err;
123
124 wVersionRequested = MAKEWORD( 1, 1);
125 err = WSAStartup( wVersionRequested, &wsaData );
126 atexit ((void(*)(void))WSACleanup);
127 InitializeCriticalSection(&g_PcapCompileCriticalSection);
128 done = 1;
129
130 if ( err != 0 )
131 err = -1;
132 return err;
133 }
134
pcap_wsockinit()135 int pcap_wsockinit()
136 {
137 return wsockinit();
138 }
139
140 static int
pcap_stats_win32(pcap_t * p,struct pcap_stat * ps)141 pcap_stats_win32(pcap_t *p, struct pcap_stat *ps)
142 {
143
144 if(PacketGetStats(p->adapter, (struct bpf_stat*)ps) != TRUE){
145 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "PacketGetStats error: %s", pcap_win32strerror());
146 return -1;
147 }
148
149 return 0;
150 }
151
152 /* Set the dimension of the kernel-level capture buffer */
153 static int
pcap_setbuff_win32(pcap_t * p,int dim)154 pcap_setbuff_win32(pcap_t *p, int dim)
155 {
156 if(PacketSetBuff(p->adapter,dim)==FALSE)
157 {
158 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "driver error: not enough memory to allocate the kernel buffer");
159 return -1;
160 }
161 return 0;
162 }
163
164 /* Set the driver working mode */
165 static int
pcap_setmode_win32(pcap_t * p,int mode)166 pcap_setmode_win32(pcap_t *p, int mode)
167 {
168 if(PacketSetMode(p->adapter,mode)==FALSE)
169 {
170 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "driver error: working mode not recognized");
171 return -1;
172 }
173
174 return 0;
175 }
176
177 /*set the minimum amount of data that will release a read call*/
178 static int
pcap_setmintocopy_win32(pcap_t * p,int size)179 pcap_setmintocopy_win32(pcap_t *p, int size)
180 {
181 if(PacketSetMinToCopy(p->adapter, size)==FALSE)
182 {
183 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "driver error: unable to set the requested mintocopy size");
184 return -1;
185 }
186 return 0;
187 }
188
189 /*return the Adapter for a pcap_t*/
190 static Adapter *
pcap_getadapter_win32(pcap_t * p)191 pcap_getadapter_win32(pcap_t *p)
192 {
193 return p->adapter;
194 }
195
196 static int
pcap_read_win32_npf(pcap_t * p,int cnt,pcap_handler callback,u_char * user)197 pcap_read_win32_npf(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
198 {
199 int cc;
200 int n = 0;
201 register u_char *bp, *ep;
202 u_char *datap;
203 struct pcap_win *pw = p->priv;
204
205 cc = p->cc;
206 if (p->cc == 0) {
207 /*
208 * Has "pcap_breakloop()" been called?
209 */
210 if (p->break_loop) {
211 /*
212 * Yes - clear the flag that indicates that it
213 * has, and return PCAP_ERROR_BREAK to indicate
214 * that we were told to break out of the loop.
215 */
216 p->break_loop = 0;
217 return (PCAP_ERROR_BREAK);
218 }
219
220 /* capture the packets */
221 if(PacketReceivePacket(p->adapter,p->Packet,TRUE)==FALSE){
222 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "read error: PacketReceivePacket failed");
223 return (PCAP_ERROR);
224 }
225
226 cc = p->Packet->ulBytesReceived;
227
228 bp = p->Packet->Buffer;
229 }
230 else
231 bp = p->bp;
232
233 /*
234 * Loop through each packet.
235 */
236 #define bhp ((struct bpf_hdr *)bp)
237 ep = bp + cc;
238 while (1) {
239 register int caplen, hdrlen;
240
241 /*
242 * Has "pcap_breakloop()" been called?
243 * If so, return immediately - if we haven't read any
244 * packets, clear the flag and return PCAP_ERROR_BREAK
245 * to indicate that we were told to break out of the loop,
246 * otherwise leave the flag set, so that the *next* call
247 * will break out of the loop without having read any
248 * packets, and return the number of packets we've
249 * processed so far.
250 */
251 if (p->break_loop) {
252 if (n == 0) {
253 p->break_loop = 0;
254 return (PCAP_ERROR_BREAK);
255 } else {
256 p->bp = bp;
257 p->cc = ep - bp;
258 return (n);
259 }
260 }
261 if (bp >= ep)
262 break;
263
264 caplen = bhp->bh_caplen;
265 hdrlen = bhp->bh_hdrlen;
266 datap = bp + hdrlen;
267
268 /*
269 * Short-circuit evaluation: if using BPF filter
270 * in kernel, no need to do it now - we already know
271 * the packet passed the filter.
272 *
273 * XXX - bpf_filter() should always return TRUE if
274 * handed a null pointer for the program, but it might
275 * just try to "run" the filter, so we check here.
276 */
277 if (pw->filtering_in_kernel ||
278 p->fcode.bf_insns == NULL ||
279 bpf_filter(p->fcode.bf_insns, datap, bhp->bh_datalen, caplen)) {
280 /*
281 * XXX A bpf_hdr matches a pcap_pkthdr.
282 */
283 (*callback)(user, (struct pcap_pkthdr*)bp, datap);
284 bp += Packet_WORDALIGN(caplen + hdrlen);
285 if (++n >= cnt && !PACKET_COUNT_IS_UNLIMITED(cnt)) {
286 p->bp = bp;
287 p->cc = ep - bp;
288 return (n);
289 }
290 } else {
291 /*
292 * Skip this packet.
293 */
294 bp += Packet_WORDALIGN(caplen + hdrlen);
295 }
296 }
297 #undef bhp
298 p->cc = 0;
299 return (n);
300 }
301
302 #ifdef HAVE_DAG_API
303 static int
pcap_read_win32_dag(pcap_t * p,int cnt,pcap_handler callback,u_char * user)304 pcap_read_win32_dag(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
305 {
306 struct pcap_win *pw = p->priv;
307 u_char *dp = NULL;
308 int packet_len = 0, caplen = 0;
309 struct pcap_pkthdr pcap_header;
310 u_char *endofbuf;
311 int n = 0;
312 dag_record_t *header;
313 unsigned erf_record_len;
314 ULONGLONG ts;
315 int cc;
316 unsigned swt;
317 unsigned dfp = p->adapter->DagFastProcess;
318
319 cc = p->cc;
320 if (cc == 0) /* Get new packets only if we have processed all the ones of the previous read */
321 {
322 /* Get new packets from the network */
323 if(PacketReceivePacket(p->adapter, p->Packet, TRUE)==FALSE){
324 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "read error: PacketReceivePacket failed");
325 return (-1);
326 }
327
328 cc = p->Packet->ulBytesReceived;
329 if(cc == 0)
330 /* The timeout has expired but we no packets arrived */
331 return 0;
332 header = (dag_record_t*)p->adapter->DagBuffer;
333 }
334 else
335 header = (dag_record_t*)p->bp;
336
337 endofbuf = (char*)header + cc;
338
339 /*
340 * Cycle through the packets
341 */
342 do
343 {
344 erf_record_len = SWAPS(header->rlen);
345 if((char*)header + erf_record_len > endofbuf)
346 break;
347
348 /* Increase the number of captured packets */
349 pw->stat.ps_recv++;
350
351 /* Find the beginning of the packet */
352 dp = ((u_char *)header) + dag_record_size;
353
354 /* Determine actual packet len */
355 switch(header->type)
356 {
357 case TYPE_ATM:
358 packet_len = ATM_SNAPLEN;
359 caplen = ATM_SNAPLEN;
360 dp += 4;
361
362 break;
363
364 case TYPE_ETH:
365 swt = SWAPS(header->wlen);
366 packet_len = swt - (pw->dag_fcs_bits);
367 caplen = erf_record_len - dag_record_size - 2;
368 if (caplen > packet_len)
369 {
370 caplen = packet_len;
371 }
372 dp += 2;
373
374 break;
375
376 case TYPE_HDLC_POS:
377 swt = SWAPS(header->wlen);
378 packet_len = swt - (pw->dag_fcs_bits);
379 caplen = erf_record_len - dag_record_size;
380 if (caplen > packet_len)
381 {
382 caplen = packet_len;
383 }
384
385 break;
386 }
387
388 if(caplen > p->snapshot)
389 caplen = p->snapshot;
390
391 /*
392 * Has "pcap_breakloop()" been called?
393 * If so, return immediately - if we haven't read any
394 * packets, clear the flag and return -2 to indicate
395 * that we were told to break out of the loop, otherwise
396 * leave the flag set, so that the *next* call will break
397 * out of the loop without having read any packets, and
398 * return the number of packets we've processed so far.
399 */
400 if (p->break_loop)
401 {
402 if (n == 0)
403 {
404 p->break_loop = 0;
405 return (-2);
406 }
407 else
408 {
409 p->bp = (char*)header;
410 p->cc = endofbuf - (char*)header;
411 return (n);
412 }
413 }
414
415 if(!dfp)
416 {
417 /* convert between timestamp formats */
418 ts = header->ts;
419 pcap_header.ts.tv_sec = (int)(ts >> 32);
420 ts = (ts & 0xffffffffi64) * 1000000;
421 ts += 0x80000000; /* rounding */
422 pcap_header.ts.tv_usec = (int)(ts >> 32);
423 if (pcap_header.ts.tv_usec >= 1000000) {
424 pcap_header.ts.tv_usec -= 1000000;
425 pcap_header.ts.tv_sec++;
426 }
427 }
428
429 /* No underlaying filtering system. We need to filter on our own */
430 if (p->fcode.bf_insns)
431 {
432 if (bpf_filter(p->fcode.bf_insns, dp, packet_len, caplen) == 0)
433 {
434 /* Move to next packet */
435 header = (dag_record_t*)((char*)header + erf_record_len);
436 continue;
437 }
438 }
439
440 /* Fill the header for the user suppplied callback function */
441 pcap_header.caplen = caplen;
442 pcap_header.len = packet_len;
443
444 /* Call the callback function */
445 (*callback)(user, &pcap_header, dp);
446
447 /* Move to next packet */
448 header = (dag_record_t*)((char*)header + erf_record_len);
449
450 /* Stop if the number of packets requested by user has been reached*/
451 if (++n >= cnt && !PACKET_COUNT_IS_UNLIMITED(cnt))
452 {
453 p->bp = (char*)header;
454 p->cc = endofbuf - (char*)header;
455 return (n);
456 }
457 }
458 while((u_char*)header < endofbuf);
459
460 return 1;
461 }
462 #endif /* HAVE_DAG_API */
463
464 /* Send a packet to the network */
465 static int
pcap_inject_win32(pcap_t * p,const void * buf,size_t size)466 pcap_inject_win32(pcap_t *p, const void *buf, size_t size){
467 LPPACKET PacketToSend;
468
469 PacketToSend=PacketAllocatePacket();
470
471 if (PacketToSend == NULL)
472 {
473 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "send error: PacketAllocatePacket failed");
474 return -1;
475 }
476
477 PacketInitPacket(PacketToSend,(PVOID)buf,size);
478 if(PacketSendPacket(p->adapter,PacketToSend,TRUE) == FALSE){
479 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "send error: PacketSendPacket failed");
480 PacketFreePacket(PacketToSend);
481 return -1;
482 }
483
484 PacketFreePacket(PacketToSend);
485
486 /*
487 * We assume it all got sent if "PacketSendPacket()" succeeded.
488 * "pcap_inject()" is expected to return the number of bytes
489 * sent.
490 */
491 return size;
492 }
493
494 static void
pcap_cleanup_win32(pcap_t * p)495 pcap_cleanup_win32(pcap_t *p)
496 {
497 if (p->adapter != NULL) {
498 PacketCloseAdapter(p->adapter);
499 p->adapter = NULL;
500 }
501 if (p->Packet) {
502 PacketFreePacket(p->Packet);
503 p->Packet = NULL;
504 }
505 pcap_cleanup_live_common(p);
506 }
507
508 static int
pcap_activate_win32(pcap_t * p)509 pcap_activate_win32(pcap_t *p)
510 {
511 struct pcap_win *pw = p->priv;
512 NetType type;
513
514 if (p->opt.rfmon) {
515 /*
516 * No monitor mode on Windows. It could be done on
517 * Vista with drivers that support the native 802.11
518 * mechanism and monitor mode.
519 */
520 return (PCAP_ERROR_RFMON_NOTSUP);
521 }
522
523 /* Init WinSock */
524 wsockinit();
525
526 p->adapter = PacketOpenAdapter(p->opt.source);
527
528 if (p->adapter == NULL)
529 {
530 /* Adapter detected but we are not able to open it. Return failure. */
531 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "Error opening adapter: %s", pcap_win32strerror());
532 return PCAP_ERROR;
533 }
534
535 /*get network type*/
536 if(PacketGetNetType (p->adapter,&type) == FALSE)
537 {
538 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "Cannot determine the network type: %s", pcap_win32strerror());
539 goto bad;
540 }
541
542 /*Set the linktype*/
543 switch (type.LinkType)
544 {
545 case NdisMediumWan:
546 p->linktype = DLT_EN10MB;
547 break;
548
549 case NdisMedium802_3:
550 p->linktype = DLT_EN10MB;
551 /*
552 * This is (presumably) a real Ethernet capture; give it a
553 * link-layer-type list with DLT_EN10MB and DLT_DOCSIS, so
554 * that an application can let you choose it, in case you're
555 * capturing DOCSIS traffic that a Cisco Cable Modem
556 * Termination System is putting out onto an Ethernet (it
557 * doesn't put an Ethernet header onto the wire, it puts raw
558 * DOCSIS frames out on the wire inside the low-level
559 * Ethernet framing).
560 */
561 p->dlt_list = (u_int *) malloc(sizeof(u_int) * 2);
562 /*
563 * If that fails, just leave the list empty.
564 */
565 if (p->dlt_list != NULL) {
566 p->dlt_list[0] = DLT_EN10MB;
567 p->dlt_list[1] = DLT_DOCSIS;
568 p->dlt_count = 2;
569 }
570 break;
571
572 case NdisMediumFddi:
573 p->linktype = DLT_FDDI;
574 break;
575
576 case NdisMedium802_5:
577 p->linktype = DLT_IEEE802;
578 break;
579
580 case NdisMediumArcnetRaw:
581 p->linktype = DLT_ARCNET;
582 break;
583
584 case NdisMediumArcnet878_2:
585 p->linktype = DLT_ARCNET;
586 break;
587
588 case NdisMediumAtm:
589 p->linktype = DLT_ATM_RFC1483;
590 break;
591
592 case NdisMediumCHDLC:
593 p->linktype = DLT_CHDLC;
594 break;
595
596 case NdisMediumPPPSerial:
597 p->linktype = DLT_PPP_SERIAL;
598 break;
599
600 case NdisMediumNull:
601 p->linktype = DLT_NULL;
602 break;
603
604 case NdisMediumBare80211:
605 p->linktype = DLT_IEEE802_11;
606 break;
607
608 case NdisMediumRadio80211:
609 p->linktype = DLT_IEEE802_11_RADIO;
610 break;
611
612 case NdisMediumPpi:
613 p->linktype = DLT_PPI;
614 break;
615
616 default:
617 p->linktype = DLT_EN10MB; /*an unknown adapter is assumed to be ethernet*/
618 break;
619 }
620
621 /* Set promiscuous mode */
622 if (p->opt.promisc)
623 {
624
625 if (PacketSetHwFilter(p->adapter,NDIS_PACKET_TYPE_PROMISCUOUS) == FALSE)
626 {
627 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "failed to set hardware filter to promiscuous mode");
628 goto bad;
629 }
630 }
631 else
632 {
633 if (PacketSetHwFilter(p->adapter,NDIS_PACKET_TYPE_ALL_LOCAL) == FALSE)
634 {
635 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "failed to set hardware filter to non-promiscuous mode");
636 goto bad;
637 }
638 }
639
640 /* Set the buffer size */
641 p->bufsize = WIN32_DEFAULT_USER_BUFFER_SIZE;
642
643 /* allocate Packet structure used during the capture */
644 if((p->Packet = PacketAllocatePacket())==NULL)
645 {
646 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "failed to allocate the PACKET structure");
647 goto bad;
648 }
649
650 if(!(p->adapter->Flags & INFO_FLAG_DAG_CARD))
651 {
652 /*
653 * Traditional Adapter
654 */
655 /*
656 * If the buffer size wasn't explicitly set, default to
657 * WIN32_DEFAULT_USER_BUFFER_SIZE.
658 */
659 if (p->opt.buffer_size == 0)
660 p->opt.buffer_size = WIN32_DEFAULT_KERNEL_BUFFER_SIZE;
661
662 if(PacketSetBuff(p->adapter,p->opt.buffer_size)==FALSE)
663 {
664 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "driver error: not enough memory to allocate the kernel buffer");
665 goto bad;
666 }
667
668 p->buffer = (u_char *)malloc(p->bufsize);
669 if (p->buffer == NULL)
670 {
671 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "malloc: %s", pcap_strerror(errno));
672 goto bad;
673 }
674
675 PacketInitPacket(p->Packet,(BYTE*)p->buffer,p->bufsize);
676
677 if (p->opt.immediate)
678 {
679 /* tell the driver to copy the buffer as soon as data arrives */
680 if(PacketSetMinToCopy(p->adapter,0)==FALSE)
681 {
682 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,"Error calling PacketSetMinToCopy: %s", pcap_win32strerror());
683 goto bad;
684 }
685 }
686 else
687 {
688 /* tell the driver to copy the buffer only if it contains at least 16K */
689 if(PacketSetMinToCopy(p->adapter,16000)==FALSE)
690 {
691 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,"Error calling PacketSetMinToCopy: %s", pcap_win32strerror());
692 goto bad;
693 }
694 }
695 }
696 else
697 #ifdef HAVE_DAG_API
698 {
699 /*
700 * Dag Card
701 */
702 LONG status;
703 HKEY dagkey;
704 DWORD lptype;
705 DWORD lpcbdata;
706 int postype = 0;
707 char keyname[512];
708
709 snprintf(keyname, sizeof(keyname), "%s\\CardParams\\%s",
710 "SYSTEM\\CurrentControlSet\\Services\\DAG",
711 strstr(_strlwr(p->opt.source), "dag"));
712 do
713 {
714 status = RegOpenKeyEx(HKEY_LOCAL_MACHINE, keyname, 0, KEY_READ, &dagkey);
715 if(status != ERROR_SUCCESS)
716 break;
717
718 status = RegQueryValueEx(dagkey,
719 "PosType",
720 NULL,
721 &lptype,
722 (char*)&postype,
723 &lpcbdata);
724
725 if(status != ERROR_SUCCESS)
726 {
727 postype = 0;
728 }
729
730 RegCloseKey(dagkey);
731 }
732 while(FALSE);
733
734
735 p->snapshot = PacketSetSnapLen(p->adapter, snaplen);
736
737 /* Set the length of the FCS associated to any packet. This value
738 * will be subtracted to the packet length */
739 pw->dag_fcs_bits = p->adapter->DagFcsLen;
740 }
741 #else
742 goto bad;
743 #endif /* HAVE_DAG_API */
744
745 PacketSetReadTimeout(p->adapter, p->opt.timeout);
746
747 #ifdef HAVE_DAG_API
748 if(p->adapter->Flags & INFO_FLAG_DAG_CARD)
749 {
750 /* install dag specific handlers for read and setfilter */
751 p->read_op = pcap_read_win32_dag;
752 p->setfilter_op = pcap_setfilter_win32_dag;
753 }
754 else
755 {
756 #endif /* HAVE_DAG_API */
757 /* install traditional npf handlers for read and setfilter */
758 p->read_op = pcap_read_win32_npf;
759 p->setfilter_op = pcap_setfilter_win32_npf;
760 #ifdef HAVE_DAG_API
761 }
762 #endif /* HAVE_DAG_API */
763 p->setdirection_op = NULL; /* Not implemented. */
764 /* XXX - can this be implemented on some versions of Windows? */
765 p->inject_op = pcap_inject_win32;
766 p->set_datalink_op = NULL; /* can't change data link type */
767 p->getnonblock_op = pcap_getnonblock_win32;
768 p->setnonblock_op = pcap_setnonblock_win32;
769 p->stats_op = pcap_stats_win32;
770 p->setbuff_op = pcap_setbuff_win32;
771 p->setmode_op = pcap_setmode_win32;
772 p->setmintocopy_op = pcap_setmintocopy_win32;
773 p->getadapter_op = pcap_getadapter_win32;
774 p->cleanup_op = pcap_cleanup_win32;
775
776 return (0);
777 bad:
778 pcap_cleanup_win32(p);
779 return (PCAP_ERROR);
780 }
781
782 pcap_t *
pcap_create_interface(const char * device,char * ebuf)783 pcap_create_interface(const char *device, char *ebuf)
784 {
785 pcap_t *p;
786
787 if (strlen(device) == 1)
788 {
789 /*
790 * It's probably a unicode string
791 * Convert to ascii and pass it to pcap_create_common
792 *
793 * This wonderful hack is needed because pcap_lookupdev still returns
794 * unicode strings, and it's used by windump when no device is specified
795 * in the command line
796 */
797 size_t length;
798 char* deviceAscii;
799
800 length = wcslen((wchar_t*)device);
801
802 deviceAscii = (char*)malloc(length + 1);
803
804 if (deviceAscii == NULL)
805 {
806 snprintf(ebuf, PCAP_ERRBUF_SIZE, "Malloc failed");
807 return NULL;
808 }
809
810 snprintf(deviceAscii, length + 1, "%ws", (wchar_t*)device);
811 p = pcap_create_common(deviceAscii, ebuf, sizeof (struct pcap_win));
812 free(deviceAscii);
813 }
814 else
815 {
816 p = pcap_create_common(device, ebuf, sizeof (struct pcap_win));
817 }
818
819 if (p == NULL)
820 return (NULL);
821
822 p->activate_op = pcap_activate_win32;
823 return (p);
824 }
825
826 static int
pcap_setfilter_win32_npf(pcap_t * p,struct bpf_program * fp)827 pcap_setfilter_win32_npf(pcap_t *p, struct bpf_program *fp)
828 {
829 struct pcap_win *pw = p->priv;
830
831 if(PacketSetBpf(p->adapter,fp)==FALSE){
832 /*
833 * Kernel filter not installed.
834 *
835 * XXX - we don't know whether this failed because:
836 *
837 * the kernel rejected the filter program as invalid,
838 * in which case we should fall back on userland
839 * filtering;
840 *
841 * the kernel rejected the filter program as too big,
842 * in which case we should again fall back on
843 * userland filtering;
844 *
845 * there was some other problem, in which case we
846 * should probably report an error.
847 *
848 * For NPF devices, the Win32 status will be
849 * STATUS_INVALID_DEVICE_REQUEST for invalid
850 * filters, but I don't know what it'd be for
851 * other problems, and for some other devices
852 * it might not be set at all.
853 *
854 * So we just fall back on userland filtering in
855 * all cases.
856 */
857
858 /*
859 * install_bpf_program() validates the program.
860 *
861 * XXX - what if we already have a filter in the kernel?
862 */
863 if (install_bpf_program(p, fp) < 0)
864 return (-1);
865 pw->filtering_in_kernel = 0; /* filtering in userland */
866 return (0);
867 }
868
869 /*
870 * It worked.
871 */
872 pw->filtering_in_kernel = 1; /* filtering in the kernel */
873
874 /*
875 * Discard any previously-received packets, as they might have
876 * passed whatever filter was formerly in effect, but might
877 * not pass this filter (BIOCSETF discards packets buffered
878 * in the kernel, so you can lose packets in any case).
879 */
880 p->cc = 0;
881 return (0);
882 }
883
884 /*
885 * We filter at user level, since the kernel driver does't process the packets
886 */
887 static int
pcap_setfilter_win32_dag(pcap_t * p,struct bpf_program * fp)888 pcap_setfilter_win32_dag(pcap_t *p, struct bpf_program *fp) {
889
890 if(!fp)
891 {
892 strncpy(p->errbuf, "setfilter: No filter specified", sizeof(p->errbuf));
893 return -1;
894 }
895
896 /* Install a user level filter */
897 if (install_bpf_program(p, fp) < 0)
898 {
899 snprintf(p->errbuf, sizeof(p->errbuf),
900 "setfilter, unable to install the filter: %s", pcap_strerror(errno));
901 return -1;
902 }
903
904 return (0);
905 }
906
907 static int
pcap_getnonblock_win32(pcap_t * p,char * errbuf)908 pcap_getnonblock_win32(pcap_t *p, char *errbuf)
909 {
910 struct pcap_win *pw = p->priv;
911
912 /*
913 * XXX - if there were a PacketGetReadTimeout() call, we
914 * would use it, and return 1 if the timeout is -1
915 * and 0 otherwise.
916 */
917 return (pw->nonblock);
918 }
919
920 static int
pcap_setnonblock_win32(pcap_t * p,int nonblock,char * errbuf)921 pcap_setnonblock_win32(pcap_t *p, int nonblock, char *errbuf)
922 {
923 struct pcap_win *pw = p->priv;
924 int newtimeout;
925
926 if (nonblock) {
927 /*
928 * Set the read timeout to -1 for non-blocking mode.
929 */
930 newtimeout = -1;
931 } else {
932 /*
933 * Restore the timeout set when the device was opened.
934 * (Note that this may be -1, in which case we're not
935 * really leaving non-blocking mode.)
936 */
937 newtimeout = p->opt.timeout;
938 }
939 if (!PacketSetReadTimeout(p->adapter, newtimeout)) {
940 snprintf(errbuf, PCAP_ERRBUF_SIZE,
941 "PacketSetReadTimeout: %s", pcap_win32strerror());
942 return (-1);
943 }
944 pw->nonblock = (newtimeout == -1);
945 return (0);
946 }
947
948 /*platform-dependent routine to add devices other than NDIS interfaces*/
949 int
pcap_platform_finddevs(pcap_if_t ** alldevsp,char * errbuf)950 pcap_platform_finddevs(pcap_if_t **alldevsp, char *errbuf)
951 {
952 return (0);
953 }
954