Lines Matching full:we
108 * We require TPACKET_V2 support.
114 /* check for memory mapped access availability. We assume every needed
175 * When capturing on all interfaces we use this as the buffer size.
191 int must_do_on_close; /* stuff we must do when we close */
194 int ifindex; /* interface index of device we're bound to */
196 int netdown; /* we got an ENETDOWN and haven't resolved it */
198 char *mondevice; /* mac80211 monitor device we created */
214 * Stuff to do when we close.
270 * With a pre-3.0 kernel, we cannot distinguish between packets with no
271 * VLAN tag and packets on VLAN 0, so we will mishandle some packets, and
272 * there's nothing we can do about that.
274 * So, on those systems, which never set the TP_STATUS_VLAN_VALID flag, we
275 * continue the behavior of earlier libpcaps, wherein we treated packets
277 * on VLAN 0. We do this by treating packets with a tp_vlan_tci of 0 and
282 * If TP_STATUS_VLAN_VALID isn't defined, we test it as the 0x10 bit; it
290 * so we test with the value it has in the 3.0 and later kernels, so
291 * we can test it if we're running on a system that has it. (If we're
294 * we behave the way we did before we introduced this macro.)
306 * Required select timeout if we're polling for an "interface disappeared"
351 * See what time stamp types we support. in pcapint_create_interface()
359 * We claim that we support microsecond and nanosecond time in pcapint_create_interface()
362 * XXX - with adapter-supplied time stamps, can we choose in pcapint_create_interface()
378 * Start out with the breakloop handle not open; we don't in pcapint_create_interface()
379 * need it until we're activated and ready to capture. in pcapint_create_interface()
430 * value of -ENFILE. (Return values are negative errnos.) We
573 * to that, but there's not much we can do in add_mon_if()
597 * to that, but there's not much we can do in add_mon_if()
728 * we'll just check whether the device appears to be a in pcap_can_set_rfmon_linux()
781 * Monitor mode is kind of interesting because we have to reset the
783 * some daemon taking care of managing usage counts. If we put the
784 * interface into monitor mode, we set a flag indicating that we must
786 * closing the interface, if that flag is set we take it out of monitor
800 * There's something we have to do when closing this in pcap_cleanup_linux()
821 * Take this pcap out of the list of pcaps for which we in pcap_cleanup_linux()
829 * Destroy the ring buffer (assuming we've set it up), in pcap_cleanup_linux()
859 * around which we have to work. Determine if we have those
862 * TPACKET_V3. We treat anything before that as
914 * so we grab the frames handed to us, and return them to in set_poll_timeout()
926 * so block forever; that way, we don't get extra timeouts. in set_poll_timeout()
927 * Don't do that if we have a broken TPACKET_V3, though. in set_poll_timeout()
936 * Non-blocking mode; we call poll() to pick up error in set_poll_timeout()
937 * indications, but we don't want it to wait for in set_poll_timeout()
954 * so we can't indicate an error. in pcap_breakloop_linux()
1021 * Make sure the name we were handed will fit into the ioctls we in pcap_activate_linux()
1029 * we'll be copying it, that won't fit. in pcap_activate_linux()
1047 * length, we should just increase MAXIMUM_SNAPLEN. in pcap_activate_linux()
1080 * If we're in promiscuous mode, then we probably want in pcap_activate_linux()
1104 * We got a warning; return that, as handle->errbuf in pcap_activate_linux()
1114 * we're not going to start in non-blocking mode. in pcap_activate_linux()
1136 * We failed to set up to use it, or the in pcap_activate_linux()
1137 * kernel supports it, but we failed to in pcap_activate_linux()
1148 * We got a warning; return that, as handle->errbuf in pcap_activate_linux()
1155 * We succeeded. status has been set to the status to return, in pcap_activate_linux()
1159 * Now that we have activated the mmap ring, we can in pcap_activate_linux()
1227 * we'll see the packet as an incoming packet as well, in linux_check_direction()
1228 * and we don't want to see it twice. in linux_check_direction()
1239 * We don't want duplicate packets, and we can't in linux_check_direction()
1241 * layer than those received by the CAN layer, so we in linux_check_direction()
1244 * We check whether this is a CAN or CAN FD frame in linux_check_direction()
1270 * We do so by asking what address the socket is bound to, and checking
1283 * we're capturing on the "any" device; that device never in device_still_exists()
1285 * we shouldn't even get here, but let's make sure.) in device_still_exists()
1323 * We don't support sending on the "any" device. in pcap_inject_linux()
1333 * We don't support sending on cooked-mode sockets. in pcap_inject_linux()
1365 * we don't look at it so this is OK even for those sockets. in pcap_stats_linux()
1372 * struct tpacket_stats for V3 sockets, as we don't in pcap_stats_linux()
1384 * To fill in ps_ifdrop, we parse in pcap_stats_linux()
1404 * (We maintain the count as a long long int so that, in pcap_stats_linux()
1406 * on 32-bit platforms, we can handle the real count. in pcap_stats_linux()
1408 * Unfortunately, we can't report 64-bit counts; we in pcap_stats_linux()
1431 * This includes packets later dropped because we in pcap_stats_linux()
1434 * "ps_drop" counts packets dropped because we ran in pcap_stats_linux()
1463 * We can't make "pcap_stats()" work the same on both in pcap_stats_linux()
1508 * kernel, but not all the kernels we support are sufficiently in get_if_ioctl_socket()
1541 * we first try an AF_NETLINK socket, where "try" includes in get_if_ioctl_socket()
1546 * if that fails, we try an AF_UNIX socket, as that's less in get_if_ioctl_socket()
1550 * if that fails, we try an AF_INET6 socket; in get_if_ioctl_socket()
1552 * if that fails, we try an AF_INET socket. in get_if_ioctl_socket()
1557 * OK, let's make sure we can do an SIOCGIFNAME in get_if_ioctl_socket()
1588 * OK, we got it! in get_if_ioctl_socket()
1604 * XXX - if that fails, is there anything else we should try? in get_if_ioctl_socket()
1653 * (We don't use that for Wi-Fi, as it'll report in get_if_flags()
1670 * OK, we got an ARPHRD_ type; what is it? in get_if_flags()
1724 * For now, we zero it out to squelch warnings; if the bug in get_if_flags()
1725 * in question is fixed, we can remove this. in get_if_flags()
1812 * Set direction flag: Which packets do we accept on a forwarding
1863 * If "cooked_ok" is non-zero, we can use DLT_LINUX_SLL and capture
1864 * in cooked mode; otherwise, we can't use cooked mode, so we have
1910 * as we fall back on cooked mode there, and we use in map_arphrd_to_dlt()
2035 * that support PF_PACKET sockets, we don't have to put in map_arphrd_to_dlt()
2036 * up with those nuisances; instead, we can just capture in map_arphrd_to_dlt()
2037 * in cooked mode. That's what we'll do, if we can. in map_arphrd_to_dlt()
2038 * Otherwise, we'll just fail. in map_arphrd_to_dlt()
2079 * As such, we just punt, and run all PPP interfaces in map_arphrd_to_dlt()
2080 * in cooked mode, if we can; otherwise, we just treat in map_arphrd_to_dlt()
2091 * XXX - handle ISDN types here? We can't fall in map_arphrd_to_dlt()
2092 * back on cooked sockets, so we'd have to in map_arphrd_to_dlt()
2096 * we'd map "isdnN" devices to DLT_RAW (they in map_arphrd_to_dlt()
2102 * But sometimes we seem to get random crap in map_arphrd_to_dlt()
2139 * instead? Should we just map all of them to DLT_LINUX_SLL? in map_arphrd_to_dlt()
2166 * For now, we map it to DLT_IP_OVER_FC, in the hopes in map_arphrd_to_dlt()
2229 * For now, we map them to DLT_FC_2, and provide an in map_arphrd_to_dlt()
2255 /* We need to save packet direction for IrDA decoding, in map_arphrd_to_dlt()
2296 * We need to use cooked mode, so that in sll_protocol we in map_arphrd_to_dlt()
2341 * we open a SOCK_DGRAM socket for the cooked interface, otherwise in setup_socket()
2342 * we open a SOCK_RAW socket for the raw interface. in setup_socket()
2344 * The protocol is set to 0. This means we will receive no in setup_socket()
2345 * packets until we "bind" the socket with a non-zero in setup_socket()
2365 * Perhaps we're running on the WSL1 module in setup_socket()
2390 * we'd need to find them all, and have an array of in setup_socket()
2403 * What kind of frames do we have to deal with? Fall back in setup_socket()
2404 * to cooked mode if we have an unknown interface type in setup_socket()
2405 * or a type we know doesn't work well in raw mode. in setup_socket()
2408 /* Assume for now we don't need cooked mode. */ in setup_socket()
2413 * We were asked to turn on monitor mode. in setup_socket()
2414 * Do so before we get the link-layer type, in setup_socket()
2436 * the device, or we've been given a different in setup_socket()
2437 * device to open for monitor mode. If we've in setup_socket()
2463 * device we explicitly chose to run in setup_socket()
2466 * type we can only determine by using in setup_socket()
2482 * Fatal error. We treat this as in setup_socket()
2483 * a generic error; we already know in setup_socket()
2484 * that we were able to open a in setup_socket()
2497 * we allocated - this only supports cooked in setup_socket()
2508 * Warn that we're falling back on in setup_socket()
2509 * cooked mode; we may want to in setup_socket()
2574 * We're not bound to a device. in setup_socket()
2575 * For now, we're using this as an indication in setup_socket()
2576 * that we can't transmit; stop doing that only in setup_socket()
2577 * if we figure out how to transmit in cooked in setup_socket()
2586 * Do not turn allmulti mode on if we don't select in setup_socket()
2598 * Hmm, how can we set promiscuous mode on all interfaces? in setup_socket()
2599 * I am not sure if that is possible at all. For now, we in setup_socket()
2622 * XXX - is enabling auxiliary data necessary, now that we in setup_socket()
2638 * If we're in cooked mode, make the snapshot length in setup_socket()
2640 * 1 byte of packet data (so we don't pass a byte in setup_socket()
2642 * XXX - we don't know whether this will be DLT_LINUX_SLL in setup_socket()
2669 * We've succeeded. Save the socket FD in the pcap structure. in setup_socket()
2675 * Can we generate special code for VLAN checks? in setup_socket()
2676 * (XXX - what if we need the special code but it's not supported in setup_socket()
2683 * Yes, we can. Request that we do so. in setup_socket()
2760 * Return 0 if we succeed; return 1 if we fail because that version isn't
2829 * Return 0 if we succeed and -1 on any other error, and set handle->errbuf.
2845 * if the user has requested immediate mode, we don't in prepare_tpacket_socket()
2858 * We failed for some reason other than "the in prepare_tpacket_socket()
2892 * We failed. in prepare_tpacket_socket()
2939 * If we're capturing in cooked mode, reserve space for in create_ring()
2940 * a DLT_LINUX_SLL2 header; we don't know yet whether in create_ring()
2941 * we'll be using DLT_LINUX_SLL or DLT_LINUX_SLL2, as in create_ring()
2942 * that can be changed on an open device, so we reserve in create_ring()
2945 * XXX - we assume that the kernel is still adding in create_ring()
2946 * 16 bytes of extra space, so we subtract 16 from in create_ring()
2951 * XXX - should we use TPACKET_ALIGN(SLL2_HDR_LEN - 16)? in create_ring()
2975 * a long time with tcpdump), if we use the snapshot in create_ring()
2980 * Ideally, we should choose a frame length based on the in create_ring()
2987 * So, for now, we just do this for Ethernet devices, where in create_ring()
2989 * fixed length. We can get the maximum packet size by in create_ring()
2991 * (just in case we happen to get the CRC in the packet), to in create_ring()
2992 * the MTU of the interface; we fetch the MTU in the hopes in create_ring()
2997 * of packets that we can receive.) in create_ring()
3000 * enabled, we can get reassembled/aggregated packets larger in create_ring()
3081 * We pick a "frame" size of MAXIMUM_SNAPLEN to leave in create_ring()
3114 * so we check for PACKET_TIMESTAMP. We check for in create_ring()
3120 * linux/net_tstamp.h, so we don't bother checking whether in create_ring()
3127 * If we were told to do so, ask the kernel and the driver in create_ring()
3176 * (ERANGE means "we support hardware in create_ring()
3179 * "we don't support hardware time stamps in create_ring()
3182 * We'll just fall back on the standard in create_ring()
3197 * hardware time stamp we want for this in create_ring()
3242 * timeout is 0, and we haven't yet seen any packets, in create_ring()
3243 * and we block and still don't have any packets, we in create_ring()
3244 * keep blocking until we do. in create_ring()
3267 * We used to reduce this by half -- do 5% instead. in create_ring()
3330 * We don't check for setsockopt failure, as 1) we can't recover in destroy_ring()
3331 * from an error and 2) we might not yet have set it up in the in destroy_ring()
3341 /* do not test for mmap failure, as we can't recover from any error */ in destroy_ring()
3357 * in the callback, we have to make a copy of the packet.
3392 * Set the file descriptor to the requested mode, as we use in pcap_setnonblock_linux()
3404 * We're setting the mode to non-blocking mode. in pcap_setnonblock_linux()
3408 * Indicate that we're switching to in pcap_setnonblock_linux()
3414 /* Close the eventfd; we do not need it in nonblock mode. */ in pcap_setnonblock_linux()
3420 * We're setting the mode to blocking mode. in pcap_setnonblock_linux()
3423 /* If we did not have an eventfd, open one now that we are blocking. */ in pcap_setnonblock_linux()
3481 * We set pollinfo[1].revents to zero, even though in pcap_wait_for_frames_mmap()
3483 * pollinfo[1], so that we do not have to add a in pcap_wait_for_frames_mmap()
3484 * conditional of numpollinfo > 1 below when we in pcap_wait_for_frames_mmap()
3494 * Keep polling until we either get some packets to read, see in pcap_wait_for_frames_mmap()
3495 * that we got told to break out of the loop, get a fatal error, in pcap_wait_for_frames_mmap()
3498 * In non-blocking mode, we must still do one poll() to catch in pcap_wait_for_frames_mmap()
3500 * of 0, so that it doesn't block, and we quit after that one in pcap_wait_for_frames_mmap()
3503 * If we've seen an ENETDOWN, it might be the first indication in pcap_wait_for_frames_mmap()
3525 * Therefore, if we got an ENETDOWN and haven't seen a packet in pcap_wait_for_frames_mmap()
3526 * since then, we assume that we might be waiting for the interface in pcap_wait_for_frames_mmap()
3528 * period of time. If we *do* see a packet, the interface has in pcap_wait_for_frames_mmap()
3529 * come back up again, and is *definitely* still there, so we in pcap_wait_for_frames_mmap()
3534 * Yes, we do this even in non-blocking mode, as it's in pcap_wait_for_frames_mmap()
3544 * If we got an ENETDOWN and haven't gotten an indication in pcap_wait_for_frames_mmap()
3546 * we don't yet know for certain whether the device has in pcap_wait_for_frames_mmap()
3548 * as we have to poll indefinitely for "device went away" in pcap_wait_for_frames_mmap()
3549 * indications until we either get one or see that the in pcap_wait_for_frames_mmap()
3569 * It's EINTR; if we were told to break out of in pcap_wait_for_frames_mmap()
3586 * OK, we may have packets to in pcap_wait_for_frames_mmap()
3628 * OK, we have the error. in pcap_wait_for_frames_mmap()
3632 * The device on which we're in pcap_wait_for_frames_mmap()
3636 * We don't know for certain in pcap_wait_for_frames_mmap()
3648 * they can call us and we in pcap_wait_for_frames_mmap()
3719 * pcap_breakloop() call; if we were told in pcap_wait_for_frames_mmap()
3732 * 1) we got neither an error from poll() nor any in pcap_wait_for_frames_mmap()
3738 * 2) We got readable descriptors but the PF_PACKET in pcap_wait_for_frames_mmap()
3742 * so, if we got an ENETDOWN, we've drained whatever in pcap_wait_for_frames_mmap()
3746 * So, if we got an ENETDOWN and haven't gotten an indication in pcap_wait_for_frames_mmap()
3748 * we don't yet know for certain whether the device has in pcap_wait_for_frames_mmap()
3758 * XXX - we should really return an in pcap_wait_for_frames_mmap()
3797 * Cancel the ENETDOWN indication - we in pcap_wait_for_frames_mmap()
3809 * If we're in non-blocking mode, just quit now, rather in pcap_wait_for_frames_mmap()
3864 * If the kernel filtering is enabled we need to run the in pcap_handle_packet_mmap()
3868 * as a counter for the packet we need to filter. in pcap_handle_packet_mmap()
3884 * the beginning of the packet we pass to the in pcap_handle_packet_mmap()
3892 * ((u_char *)thdr + TPACKET_HDRLEN), so we in pcap_handle_packet_mmap()
3893 * don't step on the header when we construct in pcap_handle_packet_mmap()
3924 * the beginning of the packet we pass to the in pcap_handle_packet_mmap()
3932 * ((u_char *)thdr + TPACKET_HDRLEN), so we in pcap_handle_packet_mmap()
3933 * don't step on the header when we construct in pcap_handle_packet_mmap()
3959 * sll->sll_hatype is ARPHRD_CAN, then, as we're in pcap_handle_packet_mmap()
4023 * CANFD_FDF is set because we set it, not in pcap_handle_packet_mmap()
4071 * The reason we put the first field in pcap_handle_packet_mmap()
4076 * byte order, and we don't want to in pcap_handle_packet_mmap()
4093 * We're capturing on a little-endian in pcap_handle_packet_mmap()
4094 * machine, so we put the priority/VCID in pcap_handle_packet_mmap()
4103 * We're capturing on a big-endian in pcap_handle_packet_mmap()
4104 * machine, so we want to leave the in pcap_handle_packet_mmap()
4255 * Therefore, if the packet count is unlimited, we clip in pcap_read_linux_mmap_v2()
4291 * Hand this block back to the kernel, and, if we're in pcap_read_linux_mmap_v2()
4294 * the one we've just processed. in pcap_read_linux_mmap_v2()
4349 /* Block until we see a packet. */ in pcap_read_linux_mmap_v3()
4363 * Therefore, if the packet count is unlimited, we clip in pcap_read_linux_mmap_v3()
4386 * the number of packets we have left to in pcap_read_linux_mmap_v3()
4422 * we're counting blocks that need to be in pcap_read_linux_mmap_v3()
4424 * filtered by the kernel, count the one we've in pcap_read_linux_mmap_v3()
4453 /* Block until we see a packet. */ in pcap_read_linux_mmap_v3()
4516 * Oh, and we also need to fix it up so that all "ret" in pcap_setfilter_linux()
4518 * as the operand if we're not capturing in memory-mapped in pcap_setfilter_linux()
4519 * mode, and so that, if we're in cooked mode, all memory- in pcap_setfilter_linux()
4531 * (The "default" case shouldn't happen; we in pcap_setfilter_linux()
4538 * The program performed checks that we can't make in pcap_setfilter_linux()
4546 * We have a filter that'll work in the kernel. in pcap_setfilter_linux()
4554 * NOTE: at this point, we've set both the "len" and "filter" in pcap_setfilter_linux()
4557 * so we initialize every member of that structure. in pcap_setfilter_linux()
4572 * then if some tool complains that we're passing in pcap_setfilter_linux()
4589 * Print a warning if we weren't able to install in pcap_setfilter_linux()
4613 * If we're not using the kernel filter, get rid of any kernel in pcap_setfilter_linux()
4640 * If we're filtering in userland, there's nothing to do; in pcap_setfilter_linux()
4647 * We're filtering in the kernel; the packets present in in pcap_setfilter_linux()
4666 * If we found free blocks, decrement the count of free in pcap_setfilter_linux()
4667 * blocks by 1, just in case we lost a race with another in pcap_setfilter_linux()
4669 * we were counting and that had run the filter before in pcap_setfilter_linux()
4670 * we changed it. in pcap_setfilter_linux()
4685 * ring minus the number of free blocks we found, and in pcap_setfilter_linux()
4741 * saying we had a mysterious failure and in iface_bind()
4774 * saying we had a mysterious failure and in iface_bind()
4790 * If we have libnl, try to create a new monitor-mode device and
4815 * If so, we're done. in enter_rfmon_mode()
4835 * Success. We don't clean up the libnl state in enter_rfmon_mode()
4836 * yet, as we'll be using it later. in enter_rfmon_mode()
4867 * If we haven't already done so, arrange to have in enter_rfmon_mode()
4868 * "pcap_close_all()" called when we exit. in enter_rfmon_mode()
4912 * Note that we have to delete the monitor device when we close in enter_rfmon_mode()
4918 * Add this to the list of pcaps to close when we exit. in enter_rfmon_mode()
4929 * We don't have libnl, so we can't do monitor mode. in enter_rfmon_mode()
5050 * Do we support hardware time stamping of *all* packets? in iface_get_ts_types()
5109 * We don't have an ioctl to use to ask what's supported, in iface_get_ts_types()
5110 * so say we support everything. in iface_get_ts_types()
5129 * Find out if we have any form of fragmentation/reassembly offloading.
5131 * We do so using SIOCETHTOOL checking for various types of offloading;
5132 * if SIOCETHTOOL isn't defined, or we don't have any #defines for any
5133 * of the types of offloading, there's nothing we can do to check, so
5134 * we just say "no, we don't".
5136 * We treat EOPNOTSUPP, EINVAL and, if eperm_ok is true, EPERM as
5137 * indications that the operation isn't supported. We do EPERM
5144 * annoyance, we only treat EPERM as an error for the first feature,
5166 * case, either means "no, what we're asking in iface_ethtool_flag_ioctl()
5181 * XXX - it's annoying that we have to check for offloading at all, but,
5182 * given that we have to, it's still annoying that we have to check for
5263 * XXX - do we need to get this information if we don't in iface_get_offload()
5264 * have the ethtool ioctls? If so, how do we do that? in iface_get_offload()
5295 * the error message if we don't support the tag could in iface_dsa_get_proto_info()
5453 * Yes; are we in cooked mode? in fix_program()
5457 * Yes, so we need to fix this in fix_program()
5462 * We failed to do so. in fix_program()
5474 return 1; /* we succeeded */ in fix_program()
5484 * we use >= and cast SKF_AD_OFF to unsigned. in fix_offset()
5521 * those fields; we can't do that in the kernel, in fix_offset()
5553 * those fields; we can't do that in the kernel, in fix_offset()
5581 * We therefore discard all packets queued up on the socket in set_kernel_filter()
5586 * To flush those packets, we put the socket in read-only mode, in set_kernel_filter()
5591 * to keep more packets from arriving while we're draining in set_kernel_filter()
5592 * the queue - we put the "total filter", which is a filter in set_kernel_filter()
5606 * Note that we've put the total filter onto the socket. in set_kernel_filter()
5612 * non-blocking mode; we drain it by reading packets in set_kernel_filter()
5613 * until we get an error (which is normally a in set_kernel_filter()
5636 * If we can't restore the mode or reset the in set_kernel_filter()
5637 * kernel filter, there's nothing we can do. in set_kernel_filter()
5661 * Well, we couldn't set that filter on the socket, in set_kernel_filter()
5662 * but we could set the total filter on the socket. in set_kernel_filter()
5665 * too big to put into the kernel, so we'll have to in set_kernel_filter()
5666 * filter in userland; in any case, we'll be doing in set_kernel_filter()
5667 * filtering in userland, so we need to remove the in set_kernel_filter()
5668 * total filter so we see packets. in set_kernel_filter()
5673 * If this fails, we're really screwed; we have the in set_kernel_filter()
5704 * Ignore ENOENT - it means "we don't have a filter", so there in reset_kernel_filter()