/* Convert new nsiod to pcap descriptor. Other parameters have the same meaning
* as for pcap_open_live in pcap(3).
* device : pcap-style device name
* snaplen : size of packet to be copied to hanler
* promisc : whether to open device in promiscuous mode
* bpf_fmt : berkeley filter
* return value: NULL if everything was okay, or error string if error occurred. */
char* nsock_pcap_open(nsock_pool nsp, nsock_iod nsiod, const char *pcap_device, int snaplen,
int promisc, const char *bpf_fmt, ...) {
msiod *nsi = (msiod *)nsiod;
mspool *ms = (mspool *)nsp;
mspcap *mp = (mspcap *)nsi->pcap;
static char errorbuf[128];
char err0r[PCAP_ERRBUF_SIZE];
/* packet filter string */
char bpf[4096];
va_list ap;
int failed, datalink;
char *e;
gettimeofday(&nsock_tod, NULL);
#ifdef PCAP_CAN_DO_SELECT
#if PCAP_BSD_SELECT_HACK
/* MacOsX reports error if to_ms is too big (like INT_MAX) with error
* FAILED. Reported error: BIOCSRTIMEOUT: Invalid argument
* INT_MAX/6 (=357913941) seems to be working... */
int to_ms = 357913941;
#else
int to_ms = 200;
#endif /* PCAP_BSD_SELECT_HACK */
#else
int to_ms = 1;
#endif
if (mp)
return "nsock-pcap: this nsi already has pcap device opened";
mp = (mspcap *)safe_zalloc(sizeof(mspcap));
nsi->pcap = (void *)mp;
va_start(ap, bpf_fmt);
if (Vsnprintf(bpf, sizeof(bpf), bpf_fmt, ap) >= (int)sizeof(bpf)) {
va_end(ap);
return "nsock-pcap: nsock_pcap_open called with too-large bpf filter arg";
}
va_end(ap);
if (ms->tracelevel > 0)
nsock_trace(ms,
"PCAP requested on device '%s' with berkeley filter '%s' (promisc=%i snaplen=%i to_ms=%i) (IOD #%li)",
pcap_device,bpf, promisc, snaplen, to_ms, nsi->id);
failed = 0;
do {
mp->pt = pcap_open_live((char* )pcap_device, snaplen, promisc, to_ms, err0r);
if (mp->pt) /* okay, opened!*/
break;
/* sorry, something failed*/
if (++failed >= 3) {
mp->pcap_device = strdup(pcap_device);
fprintf(stderr,
"Call to pcap_open_live(%s, %d, %d, %d) failed three times. Reported error: %s\n"
"There are several possible reasons for this, depending on your operating system:\n"
"LINUX: If you are getting Socket type not supported, try modprobe af_packet or recompile your kernel with PACKET enabled.\n"
"*BSD: If you are getting device not configured, you need to recompile your kernel with Berkeley Packet Filter support. If you are getting No such file or directory, try creating the device (eg cd /dev; MAKEDEV <device>; or use mknod).\n"
"*WINDOWS: Nmap only supports ethernet interfaces on Windows for most operations because Microsoft disabled raw sockets as of Windows XP SP2. Depending on the reason for this error, it is possible that the --unprivileged command-line argument will help.\n"
"SOLARIS: If you are trying to scan localhost and getting '/dev/lo0: No such file or directory', complain to Sun. I don't think Solaris can support advanced localhost scans. You can probably use \"-PN -sT localhost\" though.\n\n",
pcap_device, snaplen, promisc, to_ms, err0r);
return "nsock-pcap: can't open pcap! Are you root?";
}
fprintf(stderr,
"pcap_open_live(%s, %d, %d, %d) FAILED. Reported error: %s. Will wait %d seconds then retry.\n",
pcap_device, snaplen, promisc, to_ms, err0r, 4*failed);
sleep(4* failed);
} while (1);
e = nsock_pcap_set_filter(mp->pt, pcap_device, bpf);
if (e)
return e;
#ifdef WIN32
/* We want any responses back ASAP */
pcap_setmintocopy(mp->pt, 1);
#endif
mp->l3_offset = nsock_pcap_get_l3_offset(mp->pt, &datalink);
mp->snaplen = snaplen;
mp->datalink = datalink;
mp->pcap_device = strdup(pcap_device);
#ifdef PCAP_CAN_DO_SELECT
mp->pcap_desc = pcap_get_selectable_fd(mp->pt);
#else
mp->pcap_desc = -1;
#endif
mp->readsd_count = 0;
/* Without setting this ioctl, some systems (BSDs, though it depends on the
* release) will buffer packets in non-blocking mode and only return them in a
* bunch when the buffer is full. Setting the ioctl makes each one be
* delivered immediately. This is how Linux works by default. See the comments
* surrounding the setting of BIOCIMMEDIATE in libpcap/pcap-bpf.c. */
#ifdef BIOCIMMEDIATE
if (mp->pcap_desc != -1) {
int immediate = 1;
if (ioctl(mp->pcap_desc, BIOCIMMEDIATE, &immediate) < 0)
fatal("Cannot set BIOCIMMEDIATE on pcap descriptor");
}
#endif
/* Set device non-blocking */
if (pcap_setnonblock(mp->pt, 1, err0r) < 0) {
/* I can't do select() on pcap! blocking + no_select is fatal */
if(mp->pcap_desc < 0){
Snprintf(errorbuf, sizeof(errorbuf),
"nsock-pcap: Failed to set pcap descriptor on device %s to nonblocking state: %s",
pcap_device, err0r);
return errorbuf;
}
/* When we use bsd hack we also need to set non-blocking */
#ifdef PCAP_BSD_SELECT_HACK
Snprintf(errorbuf, sizeof(errorbuf),
"nsock-pcap: Failed to set pcap descriptor on device %s to nonblocking state: %s",
pcap_device, err0r);
return errorbuf;
#endif
/* in other case, we can accept blocking pcap */
fprintf(stderr, "Failed to set pcap descriptor on device %s to nonblocking state: %s",
pcap_device, err0r);
}
if (ms->tracelevel > 0)
nsock_trace(ms, "PCAP created successfully on device '%s' (pcap_desc=%i bsd_hack=%i to_valid=%i l3_offset=%i) (IOD #%li)",
pcap_device,
mp->pcap_desc,
#if PCAP_BSD_SELECT_HACK
1,
#else
0,
#endif
#if PCAP_RECV_TIMEVAL_VALID
1,
#else
0,
#endif
mp->l3_offset,
nsi->id);
return NULL;
}
/* Convert new nsiod to pcap descriptor. Other parameters have
* the same meaning as for pcap_open_live in pcap(3).
* device : pcap-style device name
* snaplen : size of packet to be copied to handler
* promisc : whether to open device in promiscuous mode
* bpf_fmt : berkeley filter
* return value: NULL if everything was okay, or error string
* if error occurred. */
int nsock_pcap_open(nsock_pool nsp, nsock_iod nsiod, const char *pcap_device,
int snaplen, int promisc, const char *bpf_fmt, ...) {
struct niod *nsi = (struct niod *)nsiod;
struct npool *ms = (struct npool *)nsp;
mspcap *mp = (mspcap *)nsi->pcap;
char errbuf[PCAP_ERRBUF_SIZE];
char bpf[4096];
va_list ap;
int failed, datalink;
int rc;
#ifdef PCAP_CAN_DO_SELECT
#if PCAP_BSD_SELECT_HACK
/* MacOsX reports error if to_ms is too big (like INT_MAX) with error
* FAILED. Reported error: BIOCSRTIMEOUT: Invalid argument
* INT_MAX/6 (=357913941) seems to be working... */
int to_ms = 357913941;
#else
int to_ms = 200;
#endif /* PCAP_BSD_SELECT_HACK */
#else
int to_ms = 1;
#endif
gettimeofday(&nsock_tod, NULL);
if (mp) {
nsock_log_error(ms, "This nsi already has pcap device opened");
return -1;
}
mp = (mspcap *)safe_zalloc(sizeof(mspcap));
nsi->pcap = (void *)mp;
va_start(ap, bpf_fmt);
rc = Vsnprintf(bpf, sizeof(bpf), bpf_fmt, ap);
va_end(ap);
if (rc >= (int)sizeof(bpf)) {
nsock_log_error(ms, "Too-large bpf filter argument");
return -1;
}
nsock_log_info(ms, "PCAP requested on device '%s' with berkeley filter '%s' "
"(promisc=%i snaplen=%i to_ms=%i) (IOD #%li)",
pcap_device,bpf, promisc, snaplen, to_ms, nsi->id);
failed = 0;
do {
rc = nsock_pcap_try_open(ms, mp, pcap_device, snaplen, promisc, to_ms, errbuf);
if (rc) {
failed++;
nsock_log_error(ms, "Will wait %d seconds then retry.", 4 * failed);
sleep(4 * failed);
}
} while (rc && failed < PCAP_OPEN_MAX_RETRIES);
if (rc) {
nsock_log_error(ms, "pcap_open_live(%s, %d, %d, %d) failed %d times.",
pcap_device, snaplen, promisc, to_ms, failed);
nsock_log_error(ms, PCAP_FAILURE_EXPL_MESSAGE);
nsock_log_error(ms, "Can't open pcap! Are you root?");
return -1;
}
rc = nsock_pcap_set_filter(ms, mp->pt, pcap_device, bpf);
if (rc)
return rc;
#ifdef WIN32
/* We want any responses back ASAP */
pcap_setmintocopy(mp->pt, 1);
#endif
mp->l3_offset = nsock_pcap_get_l3_offset(mp->pt, &datalink);
mp->snaplen = snaplen;
mp->datalink = datalink;
mp->pcap_device = strdup(pcap_device);
#ifdef PCAP_CAN_DO_SELECT
mp->pcap_desc = pcap_get_selectable_fd(mp->pt);
#else
mp->pcap_desc = -1;
#endif
mp->readsd_count = 0;
/* Without setting this ioctl, some systems (BSDs, though it depends on the
* release) will buffer packets in non-blocking mode and only return them in a
* bunch when the buffer is full. Setting the ioctl makes each one be
* delivered immediately. This is how Linux works by default. See the comments
* surrounding the setting of BIOCIMMEDIATE in libpcap/pcap-bpf.c. */
#ifdef BIOCIMMEDIATE
if (mp->pcap_desc != -1) {
int immediate = 1;
if (ioctl(mp->pcap_desc, BIOCIMMEDIATE, &immediate) < 0)
fatal("Cannot set BIOCIMMEDIATE on pcap descriptor");
}
#endif
/* Set device non-blocking */
rc = pcap_setnonblock(mp->pt, 1, errbuf);
if (rc) {
/* I can't do select() on pcap!
* blocking + no_select is fatal */
#ifndef PCAP_BSD_SELECT_HACK
if (mp->pcap_desc < 0)
#endif
{
nsock_log_error(ms, "Failed to set pcap descriptor on device %s "
"to nonblocking mode: %s", pcap_device, errbuf);
return -1;
}
/* in other case, we can accept blocking pcap */
nsock_log_info(ms, "Failed to set pcap descriptor on device %s "
"to nonblocking state: %s", pcap_device, errbuf);
}
if (ms->loglevel <= NSOCK_LOG_INFO) {
#if PCAP_BSD_SELECT_HACK
int bsd_select_hack = 1;
#else
int bsd_select_hack = 0;
#endif
#if PCAP_RECV_TIMEVAL_VALID
int recv_timeval_valid = 1;
#else
int recv_timeval_valid = 0;
#endif
nsock_log_info(ms, "PCAP created successfully on device '%s' "
"(pcap_desc=%i bsd_hack=%i to_valid=%i l3_offset=%i) (IOD #%li)",
pcap_device, mp->pcap_desc, bsd_select_hack,
recv_timeval_valid, mp->l3_offset, nsi->id);
}
return 0;
}