GPLv2 -> GPLv2+
[metze/wireshark/wip.git] / capture-pcap-util.c
index e19ff4c59010304fb1d6bb6bf9efda5806c535f3..87d49cf958c5590976aab9b5ef5cb77ea6d14cad 100644 (file)
  *
  * You should have received a copy of the GNU General Public License
  * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  */
 
-#ifdef HAVE_CONFIG_H
-# include "config.h"
-#endif
+#include "config.h"
 
 #ifdef HAVE_LIBPCAP
 
-#include <pcap.h>
-
 #include <glib.h>
 
 #include <stdlib.h>
+#include <stdio.h>
 #include <limits.h>
 #include <string.h>
 
 #endif
 
 #include <wtap.h>
-#include <wtap-capture.h>
+#include <libpcap.h>
 
+#include "capture_ifinfo.h"
 #include "capture-pcap-util.h"
 #include "capture-pcap-util-int.h"
 
+#include "wsutil/file_util.h"
+
 #ifndef _WIN32
 #include <netinet/in.h>
 #endif
 
+#ifdef _WIN32
+#include "capture_win_ifnames.h" /* windows friendly interface names */
+#endif
 
 /*
- * Get the data-link type for a libpcap device.
- * This works around AIX 5.x's non-standard and incompatible-with-the-
- * rest-of-the-universe libpcap.
+ * Given an interface name, find the "friendly name" and interface
+ * type for the interface.
  */
-int
-get_pcap_linktype(pcap_t *pch, const char *devname
-#ifndef _AIX
-       _U_
-#endif
-)
-{
-       int linktype;
-#ifdef _AIX
-       const char *ifacename;
-#endif
 
-       linktype = pcap_datalink(pch);
-#ifdef _AIX
+#if defined(__APPLE__)
 
-       /*
-        * The libpcap that comes with AIX 5.x uses RFC 1573 ifType values
-        * rather than DLT_ values for link-layer types; the ifType values
-        * for LAN devices are:
-        *
-        *      Ethernet        6
-        *      802.3           7
-        *      Token Ring      9
-        *      FDDI            15
-        *
-        * and the ifType value for a loopback device is 24.
-        *
-        * The AIX names for LAN devices begin with:
-        *
-        *      Ethernet                en
-        *      802.3                   et
-        *      Token Ring              tr
-        *      FDDI                    fi
-        *
-        * and the AIX names for loopback devices begin with "lo".
-        *
-        * (The difference between "Ethernet" and "802.3" is presumably
-        * whether packets have an Ethernet header, with a packet type,
-        * or an 802.3 header, with a packet length, followed by an 802.2
-        * header and possibly a SNAP header.)
-        *
-        * If the device name matches "linktype" interpreted as an ifType
-        * value, rather than as a DLT_ value, we will assume this is AIX's
-        * non-standard, incompatible libpcap, rather than a standard libpcap,
-        * and will map the link-layer type to the standard DLT_ value for
-        * that link-layer type, as that's what the rest of Wireshark expects.
-        *
-        * (This means the capture files won't be readable by a tcpdump
-        * linked with AIX's non-standard libpcap, but so it goes.  They
-        * *will* be readable by standard versions of tcpdump, Wireshark,
-        * and so on.)
-        *
-        * XXX - if we conclude we're using AIX libpcap, should we also
-        * set a flag to cause us to assume the time stamps are in
-        * seconds-and-nanoseconds form, and to convert them to
-        * seconds-and-microseconds form before processing them and
-        * writing them out?
-        */
+#include <CoreFoundation/CoreFoundation.h>
+#include <SystemConfiguration/SystemConfiguration.h>
 
-       /*
-        * Find the last component of the device name, which is the
-        * interface name.
-        */
-       ifacename = strchr(devname, '/');
-       if (ifacename == NULL)
-               ifacename = devname;
+#include "cfutils.h"
 
-       /* See if it matches any of the LAN device names. */
-       if (strncmp(ifacename, "en", 2) == 0) {
-               if (linktype == 6) {
-                       /*
-                        * That's the RFC 1573 value for Ethernet; map it
-                        * to DLT_EN10MB.
-                        */
-                       linktype = 1;
-               }
-       } else if (strncmp(ifacename, "et", 2) == 0) {
-               if (linktype == 7) {
+/*
+ * On OS X, we get the "friendly name" and interface type for the interface
+ * from the System Configuration framework.
+ *
+ * To find the System Configuration framework information for the
+ * interface, we get all the interfaces that the System Configuration
+ * framework knows about and look for the one with a "BSD name" matching
+ * the interface name.
+ *
+ * If we find it, we use its "localized display name", if it has one, as
+ * the "friendly name".
+ *
+ * As for the interface type:
+ *
+ * Yes, fetching all the network addresses for an interface gets you an
+ * AF_LINK address, of type "struct sockaddr_dl", and, yes, that includes
+ * an SNMP MIB-II ifType value.
+ *
+ * However, it's IFT_ETHER, i.e. Ethernet, for AirPort interfaces,
+ * not IFT_IEEE80211 (which isn't defined in OS X in any case).
+ *
+ * Perhaps some other BSD-flavored OSes won't make this mistake;
+ * however, FreeBSD 7.0 and OpenBSD 4.2, at least, appear to have
+ * made the same mistake, at least for my Belkin ZyDAS stick.
+ *
+ * SCNetworkInterfaceGetInterfaceType() will get the interface
+ * type.  The interface type is a CFString, and:
+ *
+ *    kSCNetworkInterfaceTypeIEEE80211 means IF_WIRELESS;
+ *    kSCNetworkInterfaceTypeBluetooth means IF_BLUETOOTH;
+ *    kSCNetworkInterfaceTypeModem or
+ *    kSCNetworkInterfaceTypePPP or
+ *    maybe kSCNetworkInterfaceTypeWWAN means IF_DIALUP
+ */
+static void
+add_unix_interface_ifinfo(if_info_t *if_info, const char *name,
+    const char *description _U_)
+{
+       CFStringRef name_CFString;
+       CFArrayRef interfaces;
+       CFIndex num_interfaces;
+       CFIndex i;
+       SCNetworkInterfaceRef interface;
+       CFStringRef bsdname_CFString;
+       CFStringRef friendly_name_CFString;
+       CFStringRef interface_type_CFString;
+
+       interfaces = SCNetworkInterfaceCopyAll();
+       if (interfaces == NULL) {
+               /*
+                * Couldn't get a list of interfaces.
+                */
+               return;
+       }
+
+       name_CFString = CFStringCreateWithCString(kCFAllocatorDefault,
+           name, kCFStringEncodingUTF8);
+       if (name_CFString == NULL) {
+               /*
+                * Couldn't convert the interface name to a CFString.
+                */
+               CFRelease(interfaces);
+               return;
+       }
+
+       num_interfaces = CFArrayGetCount(interfaces);
+       for (i = 0; i < num_interfaces; i++) {
+               interface = (SCNetworkInterfaceRef)CFArrayGetValueAtIndex(interfaces, i);
+               bsdname_CFString = SCNetworkInterfaceGetBSDName(interface);
+               if (bsdname_CFString == NULL) {
                        /*
-                        * That's the RFC 1573 value for 802.3; map it to
-                        * DLT_EN10MB.
-                        * (libpcap, tcpdump, Wireshark, etc. don't care if
-                        * it's Ethernet or 802.3.)
+                        * This interface has no BSD name, so it's not
+                        * a regular network interface.
                         */
-                       linktype = 1;
+                       continue;
                }
-       } else if (strncmp(ifacename, "tr", 2) == 0) {
-               if (linktype == 9) {
+               if (CFStringCompare(name_CFString, bsdname_CFString, 0) == 0) {
                        /*
-                        * That's the RFC 1573 value for 802.5 (Token Ring);
-                        * map it to DLT_IEEE802, which is what's used for
-                        * Token Ring.
+                        * This is the interface.
+                        * First, get the friendly name.
                         */
-                       linktype = 6;
-               }
-       } else if (strncmp(ifacename, "fi", 2) == 0) {
-               if (linktype == 15) {
+                       friendly_name_CFString = SCNetworkInterfaceGetLocalizedDisplayName(interface);
+                       if (friendly_name_CFString != NULL)
+                               if_info->friendly_name = CFString_to_C_string(friendly_name_CFString);
+
                        /*
-                        * That's the RFC 1573 value for FDDI; map it to
-                        * DLT_FDDI.
+                        * Now get the interface type.
                         */
-                       linktype = 10;
+                       interface_type_CFString = SCNetworkInterfaceGetInterfaceType(interface);
+                       if (CFStringCompare(interface_type_CFString,
+                           kSCNetworkInterfaceTypeIEEE80211, 0) == kCFCompareEqualTo)
+                               if_info->type = IF_WIRELESS;
+                       else if (CFStringCompare(interface_type_CFString,
+                           kSCNetworkInterfaceTypeBluetooth, 0) == kCFCompareEqualTo)
+                               if_info->type = IF_BLUETOOTH;
+                       else if (CFStringCompare(interface_type_CFString,
+                           kSCNetworkInterfaceTypeModem, 0) == kCFCompareEqualTo)
+                               if_info->type = IF_DIALUP;
+                       else if (CFStringCompare(interface_type_CFString,
+                           kSCNetworkInterfaceTypePPP, 0) == kCFCompareEqualTo)
+                               if_info->type = IF_DIALUP;
+                       else if (CFStringCompare(interface_type_CFString,
+                           kSCNetworkInterfaceTypeWWAN, 0) == kCFCompareEqualTo)
+                               if_info->type = IF_DIALUP;
+                       else
+                               if_info->type = IF_WIRED;
+                       break;
                }
-       } else if (strncmp(ifacename, "lo", 2) == 0) {
-               if (linktype == 24) {
+       }
+
+       CFRelease(interfaces);
+       CFRelease(name_CFString);
+}
+#elif defined(__linux__)
+/*
+ * Linux doesn't offer any form of "friendly name", but you can
+ * determine an interface type to some degree.
+ */
+static void
+add_unix_interface_ifinfo(if_info_t *if_info, const char *name,
+    const char *description _U_)
+{
+       char *wireless_path;
+       ws_statb64 statb;
+
+       /*
+        * Look for /sys/class/net/{device}/wireless.  If it exists,
+        * it's a wireless interface.
+        */
+       wireless_path = g_strdup_printf("/sys/class/net/%s/wireless", name);
+       if (wireless_path != NULL) {
+               if (ws_stat64(wireless_path, &statb) == 0)
+                       if_info->type = IF_WIRELESS;
+               g_free(wireless_path);
+       }
+       if (if_info->type == IF_WIRED) {
+               /*
+                * We still don't know what it is.  Check for
+                * Bluetooth and USB devices.
+                */
+               if (strstr(name, "bluetooth") != NULL) {
                        /*
-                        * That's the RFC 1573 value for "software loopback"
-                        * devices; map it to DLT_NULL, which is what's used
-                        * for loopback devices on BSD.
+                        * XXX - this is for raw Bluetooth capture; what
+                        * about IP-over-Bluetooth devices?
                         */
-                       linktype = 0;
-               }
+                       if_info->type = IF_BLUETOOTH;
+               } else if (strstr(name, "usbmon") != NULL)
+                       if_info->type = IF_USB;
        }
-#endif
-
-       return linktype;
 }
+#else
+/*
+ * On other UN*Xes, if there is a description, it's a friendly
+ * name, and there is no vendor description.  ("Other UN*Xes"
+ * currently means "FreeBSD and OpenBSD".)
+ */
+void
+add_unix_interface_ifinfo(if_info_t *if_info, const char *name _U_,
+    const char *description)
+{
+       if_info->friendly_name = g_strdup(description);
+}
+#endif
 
 if_info_t *
-if_info_new(char *name, char *description)
+if_info_new(const char *name, const char *description, gboolean loopback)
 {
        if_info_t *if_info;
+#ifdef _WIN32
+       const char *guid_text;
+       GUID guid;
+#endif
 
-       if_info = g_malloc(sizeof (if_info_t));
+       if_info = (if_info_t *)g_malloc(sizeof (if_info_t));
        if_info->name = g_strdup(name);
-       if (description == NULL)
-               if_info->description = NULL;
+       if_info->friendly_name = NULL;  /* default - unknown */
+       if_info->vendor_description = NULL;
+       if_info->type = IF_WIRED;       /* default */
+#ifdef _WIN32
+       /*
+        * Get the interface type.
+        *
+        * Much digging failed to reveal any obvious way to get something
+        * such as the SNMP MIB-II ifType value for an interface:
+        *
+        *    http://www.iana.org/assignments/ianaiftype-mib
+        *
+        * by making some NDIS request.  And even if there were such
+        * a way, there's no guarantee that the ifType reflects an
+        * interface type that a user would view as correct (for
+        * example, some systems report Wi-Fi interfaces as
+        * Ethernet interfaces).
+        *
+        * So we look for keywords in the vendor's interface
+        * description.
+        */
+       if (description && (strstr(description, "generic dialup") != NULL ||
+           strstr(description, "PPP/SLIP") != NULL)) {
+               if_info->type = IF_DIALUP;
+       } else if (description && (strstr(description, "Wireless") != NULL ||
+           strstr(description,"802.11") != NULL)) {
+               if_info->type = IF_WIRELESS;
+       } else if (description && strstr(description, "AirPcap") != NULL ||
+           strstr(name, "airpcap") != NULL) {
+               if_info->type = IF_AIRPCAP;
+       } else if (description && strstr(description, "Bluetooth") != NULL ) {
+               if_info->type = IF_BLUETOOTH;
+       } else if (description && strstr(description, "VMware") != NULL) {
+               /*
+                * Bridge, NAT, or host-only interface on a VMware host.
+                *
+                * XXX - what about guest interfaces?
+                */
+               if_info->type = IF_VIRTUAL;
+       }
+
+       /*
+        * On Windows, the "description" is a vendor description,
+        * and the friendly name isn't returned by WinPcap.
+        * Fetch it ourselves.
+        */
+
+       /*
+        * Skip over the "\Device\NPF_" prefix in the device name,
+        * if present.
+        */
+       if (strncmp("\\Device\\NPF_", name, 12) == 0)
+               guid_text = name + 12;
        else
-               if_info->description = g_strdup(description);
-       if_info->ip_addr = NULL;
-       if_info->loopback = FALSE;
+               guid_text = name;
+
+       /* Now try to parse what remains as a GUID. */
+       if (parse_as_guid(guid_text, &guid)) {
+               /*
+                * Success. Try to get a friendly name using the GUID.
+                * As this is a regular interface, the description is a
+                * vendor description.
+                */
+               if_info->friendly_name = get_interface_friendly_name_from_device_guid(&guid);
+               if_info->vendor_description = g_strdup(description);
+       } else {
+               /*
+                * This is probably not a regular interface; we only
+                * support NT 5 (W2K) and later, so all regular interfaces
+                * should have GUIDs at the end of the name.  Therefore,
+                * the description, if supplied, is a friendly name
+                * provided by WinPcap, and there is no vendor
+                * description.
+                */
+               if_info->friendly_name = g_strdup(description);
+               if_info->vendor_description = NULL;
+       }
+#else
+       /*
+        * On UN*X, if there is a description, it's a friendly
+        * name, and there is no vendor description.
+        *
+        * Try the platform's way of getting a friendly name and
+        * interface type first.
+        *
+        * If that fails, then, for a loopback interface, give it the
+        * friendly name "Loopback" and, for VMware interfaces,
+        * give them the type IF_VIRTUAL.
+        */
+       add_unix_interface_ifinfo(if_info, name, description);
+       if (if_info->type == IF_WIRED) {
+               /*
+                * This is the default interface type.
+                *
+                * Bridge, NAT, or host-only interfaces on VMWare hosts
+                * have the name vmnet[0-9]+. Guests might use a native
+                * (LANCE or E1000) driver or the vmxnet driver.  Check
+                * the name.
+                */
+               if (g_ascii_strncasecmp(name, "vmnet", 5) == 0)
+                       if_info->type = IF_VIRTUAL;
+               else if (g_ascii_strncasecmp(name, "vmxnet", 6) == 0)
+                       if_info->type = IF_VIRTUAL;
+       }
+       if (if_info->friendly_name == NULL) {
+               /*
+                * We couldn't get interface information using platform-
+                * dependent calls.
+                *
+                * If this is a loopback interface, give it a
+                * "friendly name" of "Loopback".
+                */
+               if (loopback)
+                       if_info->friendly_name = g_strdup("Loopback");
+       }
+       if_info->vendor_description = NULL;
+#endif
+       if_info->loopback = loopback;
+       if_info->addrs = NULL;
        return if_info;
 }
 
 void
 if_info_add_address(if_info_t *if_info, struct sockaddr *addr)
 {
-       if_addr_t *ip_addr;
+       if_addr_t *if_addr;
        struct sockaddr_in *ai;
 #ifdef INET6
        struct sockaddr_in6 *ai6;
@@ -206,23 +379,23 @@ if_info_add_address(if_info_t *if_info, struct sockaddr *addr)
        switch (addr->sa_family) {
 
        case AF_INET:
-               ai = (struct sockaddr_in *)addr;
-               ip_addr = g_malloc(sizeof(*ip_addr));
-               ip_addr->type = AT_IPv4;
-               ip_addr->ip_addr.ip4_addr =
+               ai = (struct sockaddr_in *)(void *)addr;
+               if_addr = (if_addr_t *)g_malloc(sizeof(*if_addr));
+               if_addr->ifat_type = IF_AT_IPv4;
+               if_addr->addr.ip4_addr =
                    *((guint32 *)&(ai->sin_addr.s_addr));
-               if_info->ip_addr = g_slist_append(if_info->ip_addr, ip_addr);
+               if_info->addrs = g_slist_append(if_info->addrs, if_addr);
                break;
 
 #ifdef INET6
        case AF_INET6:
-               ai6 = (struct sockaddr_in6 *)addr;
-               ip_addr = g_malloc(sizeof(*ip_addr));
-               ip_addr->type = AT_IPv6;
-               memcpy((void *)&ip_addr->ip_addr.ip6_addr,
+               ai6 = (struct sockaddr_in6 *)(void *)addr;
+               if_addr = (if_addr_t *)g_malloc(sizeof(*if_addr));
+               if_addr->ifat_type = IF_AT_IPv6;
+               memcpy((void *)&if_addr->addr.ip6_addr,
                    (void *)&ai6->sin6_addr.s6_addr,
-                   sizeof ip_addr->ip_addr.ip6_addr);
-               if_info->ip_addr = g_slist_append(if_info->ip_addr, ip_addr);
+                   sizeof if_addr->addr.ip6_addr);
+               if_info->addrs = g_slist_append(if_info->addrs, if_addr);
                break;
 #endif
        }
@@ -230,17 +403,13 @@ if_info_add_address(if_info_t *if_info, struct sockaddr *addr)
 
 #ifdef HAVE_PCAP_FINDALLDEVS
 /*
- * Get all IP address information, and the loopback flag, for the given
- * interface.
+ * Get all IP address information for the given interface.
  */
 static void
 if_info_ip(if_info_t *if_info, pcap_if_t *d)
 {
        pcap_addr_t *a;
 
-       /* Loopback flag */
-       if_info->loopback = (d->flags & PCAP_IF_LOOPBACK) ? TRUE : FALSE;
-
        /* All addresses */
        for (a = d->addresses; a != NULL; a = a->next) {
                if (a->addr != NULL)
@@ -248,6 +417,46 @@ if_info_ip(if_info_t *if_info, pcap_if_t *d)
        }
 }
 
+#ifdef HAVE_PCAP_REMOTE
+GList *
+get_interface_list_findalldevs_ex(const char *source,
+                                  struct pcap_rmtauth *auth,
+                                  int *err, char **err_str)
+{
+       GList  *il = NULL;
+       pcap_if_t *alldevs, *dev;
+       if_info_t *if_info;
+       char errbuf[PCAP_ERRBUF_SIZE];
+
+        if (pcap_findalldevs_ex((char *)source, auth, &alldevs, errbuf) == -1) {
+               *err = CANT_GET_INTERFACE_LIST;
+               if (err_str != NULL)
+                       *err_str = cant_get_if_list_error_message(errbuf);
+               return NULL;
+       }
+
+       if (alldevs == NULL) {
+               /*
+                * No interfaces found.
+                */
+               *err = NO_INTERFACES_FOUND;
+               if (err_str != NULL)
+                       *err_str = NULL;
+               return NULL;
+       }
+
+       for (dev = alldevs; dev != NULL; dev = dev->next) {
+               if_info = if_info_new(dev->name, dev->description,
+                   (dev->flags & PCAP_IF_LOOPBACK) ? TRUE : FALSE);
+               il = g_list_append(il, if_info);
+               if_info_ip(if_info, dev);
+       }
+       pcap_freealldevs(alldevs);
+
+       return il;
+}
+#endif
+
 GList *
 get_interface_list_findalldevs(int *err, char **err_str)
 {
@@ -274,7 +483,8 @@ get_interface_list_findalldevs(int *err, char **err_str)
        }
 
        for (dev = alldevs; dev != NULL; dev = dev->next) {
-               if_info = if_info_new(dev->name, dev->description);
+               if_info = if_info_new(dev->name, dev->description,
+                   (dev->flags & PCAP_IF_LOOPBACK) ? TRUE : FALSE);
                il = g_list_append(il, if_info);
                if_info_ip(if_info, dev);
        }
@@ -293,14 +503,14 @@ free_if_info_addr_cb(gpointer addr, gpointer user_data _U_)
 static void
 free_if_cb(gpointer data, gpointer user_data _U_)
 {
-       if_info_t *if_info = data;
+       if_info_t *if_info = (if_info_t *)data;
 
        g_free(if_info->name);
-       if (if_info->description != NULL)
-               g_free(if_info->description);
+       g_free(if_info->friendly_name);
+       g_free(if_info->vendor_description);
 
-       g_slist_foreach(if_info->ip_addr, free_if_info_addr_cb, NULL);
-       g_slist_free(if_info->ip_addr);
+       g_slist_foreach(if_info->addrs, free_if_info_addr_cb, NULL);
+       g_slist_free(if_info->addrs);
        g_free(if_info);
 }
 
@@ -311,152 +521,121 @@ free_interface_list(GList *if_list)
        g_list_free(if_list);
 }
 
-/*
- * Get the data-link types available for a libpcap device.
- */
-static data_link_info_t *
-create_data_link_info(int dlt)
+#if !defined(HAVE_PCAP_DATALINK_NAME_TO_VAL) || !defined(HAVE_PCAP_DATALINK_VAL_TO_NAME) || !defined(HAVE_PCAP_DATALINK_VAL_TO_DESCRIPTION)
+struct dlt_choice {
+       const char *name;
+       const char *description;
+       int     dlt;
+};
+
+#define DLT_CHOICE(code, description) { #code, description, code }
+#define DLT_CHOICE_SENTINEL { NULL, NULL, 0 }
+
+static struct dlt_choice dlt_choices[] = {
+       DLT_CHOICE(DLT_NULL, "BSD loopback"),
+       DLT_CHOICE(DLT_EN10MB, "Ethernet"),
+       DLT_CHOICE(DLT_IEEE802, "Token ring"),
+       DLT_CHOICE(DLT_ARCNET, "ARCNET"),
+       DLT_CHOICE(DLT_SLIP, "SLIP"),
+       DLT_CHOICE(DLT_PPP, "PPP"),
+       DLT_CHOICE(DLT_FDDI, "FDDI"),
+       DLT_CHOICE(DLT_ATM_RFC1483, "RFC 1483 IP-over-ATM"),
+       DLT_CHOICE(DLT_RAW, "Raw IP"),
+       DLT_CHOICE(DLT_SLIP_BSDOS, "BSD/OS SLIP"),
+       DLT_CHOICE(DLT_PPP_BSDOS, "BSD/OS PPP"),
+       DLT_CHOICE(DLT_ATM_CLIP, "Linux Classical IP-over-ATM"),
+       DLT_CHOICE(DLT_PPP_SERIAL, "PPP over serial"),
+       DLT_CHOICE(DLT_PPP_ETHER, "PPPoE"),
+       DLT_CHOICE(DLT_C_HDLC, "Cisco HDLC"),
+       DLT_CHOICE(DLT_IEEE802_11, "802.11"),
+       DLT_CHOICE(DLT_FRELAY, "Frame Relay"),
+       DLT_CHOICE(DLT_LOOP, "OpenBSD loopback"),
+       DLT_CHOICE(DLT_ENC, "OpenBSD encapsulated IP"),
+       DLT_CHOICE(DLT_LINUX_SLL, "Linux cooked"),
+       DLT_CHOICE(DLT_LTALK, "Localtalk"),
+       DLT_CHOICE(DLT_PFLOG, "OpenBSD pflog file"),
+       DLT_CHOICE(DLT_PRISM_HEADER, "802.11 plus Prism header"),
+       DLT_CHOICE(DLT_IP_OVER_FC, "RFC 2625 IP-over-Fibre Channel"),
+       DLT_CHOICE(DLT_SUNATM, "Sun raw ATM"),
+       DLT_CHOICE(DLT_IEEE802_11_RADIO, "802.11 plus BSD radio information header"),
+       DLT_CHOICE(DLT_APPLE_IP_OVER_IEEE1394, "Apple IP-over-IEEE 1394"),
+       DLT_CHOICE(DLT_ARCNET_LINUX, "Linux ARCNET"),
+       DLT_CHOICE(DLT_LINUX_IRDA, "Linux IrDA"),
+       DLT_CHOICE(DLT_IEEE802_11_RADIO_AVS, "802.11 plus AVS radio information header"),
+       DLT_CHOICE_SENTINEL
+};
+
+#if !defined(HAVE_PCAP_DATALINK_NAME_TO_VAL)
+static int
+pcap_datalink_name_to_val(const char *name)
 {
-       data_link_info_t *data_link_info;
-#ifdef HAVE_PCAP_DATALINK_VAL_TO_NAME
-       const char *typename;
-#endif
-       int wtap_encap;
-
-       data_link_info = g_malloc(sizeof (data_link_info_t));
-       data_link_info->dlt = dlt;
-#ifdef HAVE_PCAP_DATALINK_VAL_TO_NAME
-       typename = pcap_datalink_val_to_name(dlt);
-       if (typename != NULL)
-               data_link_info->name = g_strdup(typename);
-       else
-#endif
-               data_link_info->name = g_strdup_printf("DLT %d", dlt);
-       wtap_encap = wtap_pcap_encap_to_wtap_encap(dlt);
-       if (wtap_encap == WTAP_ENCAP_UNKNOWN) {
-               /*
-                * We don't support this in Wiretap.
-                * However, we should, so you can capture on it.
-                * Put in an entry for it, with no description.
-                */
-               data_link_info->description = NULL;
-       } else {
-               /*
-                * If this is null, that's a bug in
-                * "wtap_pcap_encap_to_wtap_encap()" - it should always
-                * return a valid encapsulation type - so we assume it's
-                * not null.
-                */
-               data_link_info->description =
-                   g_strdup(wtap_encap_string(wtap_encap));
+       int i;
+
+       for (i = 0; dlt_choices[i].name != NULL; i++) {
+               if (g_ascii_strcasecmp(dlt_choices[i].name + sizeof("DLT_") - 1,
+                   name) == 0)
+                       return (dlt_choices[i].dlt);
        }
-       return data_link_info;
+       return (-1);
 }
+#endif /* defined(HAVE_PCAP_DATALINK_NAME_TO_VAL) */
 
-GList *
-get_pcap_linktype_list(char *devname, char **err_str)
+#if !defined(HAVE_PCAP_DATALINK_VAL_TO_NAME)
+static const char *
+pcap_datalink_val_to_name(int dlt)
 {
-       GList *linktype_list = NULL;
-       pcap_t *pch;
-       int deflt;
-       char errbuf[PCAP_ERRBUF_SIZE];
-#ifdef HAVE_PCAP_SET_DATALINK
-       int *linktypes;
-       int i, nlt;
-#endif
-       data_link_info_t *data_link_info;
+       int i;
 
-       pch = pcap_open_live(devname, MIN_PACKET_SIZE, 0, 0, errbuf);
-       if (pch == NULL) {
-               if (err_str != NULL)
-                       *err_str = g_strdup(errbuf);
-               return NULL;
-       }
-       deflt = get_pcap_linktype(pch, devname);
-#ifdef HAVE_PCAP_LIST_DATALINKS
-       nlt = pcap_list_datalinks(pch, &linktypes);
-       if (nlt == 0 || linktypes == NULL) {
-               pcap_close(pch);
-               if (err_str != NULL)
-                       *err_str = NULL;        /* an empty list doesn't mean an error */
-               return NULL;
+       for (i = 0; dlt_choices[i].name != NULL; i++) {
+               if (dlt_choices[i].dlt == dlt)
+                       return (dlt_choices[i].name + sizeof("DLT_") - 1);
        }
-       for (i = 0; i < nlt; i++) {
-               data_link_info = create_data_link_info(linktypes[i]);
+       return (NULL);
+}
+#endif /* defined(HAVE_PCAP_DATALINK_VAL_TO_NAME) */
 
-               /*
-                * XXX - for 802.11, make the most detailed 802.11
-                * version the default, rather than the one the
-                * device has as the default?
-                */
-               if (linktypes[i] == deflt)
-                       linktype_list = g_list_prepend(linktype_list,
-                           data_link_info);
-               else
-                       linktype_list = g_list_append(linktype_list,
-                           data_link_info);
-       }
-       free(linktypes);
-#else
-       data_link_info = create_data_link_info(deflt);
-       linktype_list = g_list_append(linktype_list, data_link_info);
-#endif
+#if !defined(HAVE_PCAP_DATALINK_VAL_TO_DESCRIPTION)
+const char *
+pcap_datalink_val_to_description(int dlt)
+{
+       int i;
 
-       pcap_close(pch);
-       return linktype_list;
+       for (i = 0; dlt_choices[i].name != NULL; i++) {
+               if (dlt_choices[i].dlt == dlt)
+                       return (dlt_choices[i].description);
+       }
+       return (NULL);
 }
+#endif /* defined(HAVE_PCAP_DATALINK_VAL_TO_DESCRIPTION) */
+
+#endif /* !defined(HAVE_PCAP_DATALINK_VAL_TO_NAME) || !defined(HAVE_PCAP_DATALINK_VAL_TO_DESCRIPTION) */
 
 static void
 free_linktype_cb(gpointer data, gpointer user_data _U_)
 {
-       data_link_info_t *linktype_info = data;
+       data_link_info_t *linktype_info = (data_link_info_t *)data;
 
        g_free(linktype_info->name);
-       if (linktype_info->description != NULL)
-               g_free(linktype_info->description);
+       g_free(linktype_info->description);
 }
 
 void
-free_pcap_linktype_list(GList *linktype_list)
+free_if_capabilities(if_capabilities_t *caps)
 {
-       g_list_foreach(linktype_list, free_linktype_cb, NULL);
-       g_list_free(linktype_list);
+       g_list_foreach(caps->data_link_types, free_linktype_cb, NULL);
+       g_list_free(caps->data_link_types);
+       g_free(caps);
 }
 
-/* Set the data link type on a pcap. */
-const char *
-set_pcap_linktype(pcap_t *pch, char *devname
-#ifdef HAVE_PCAP_SET_DATALINK
-       _U_
-#endif
-       , int dlt)
-{
-#ifdef HAVE_PCAP_SET_DATALINK
-       if (pcap_set_datalink(pch, dlt) == 0)
-               return NULL;    /* no error */
-       return pcap_geterr(pch);
-#else
-       /* Let them set it to the type it is; reject any other request. */
-       if (get_pcap_linktype(pch, devname) == dlt)
-               return NULL;    /* no error */
-       return "That DLT isn't one of the DLTs supported by this device";
-#endif
-}
-
-
-#ifdef HAVE_PCAP_DATALINK_VAL_TO_NAME
 const char *
 linktype_val_to_name(int dlt)
 {
     return pcap_datalink_val_to_name(dlt);
 }
-#endif
 
-#ifdef HAVE_PCAP_DATALINK_NAME_TO_VAL
 int linktype_name_to_val(const char *linktype)
 {
     return pcap_datalink_name_to_val(linktype);
 }
-#endif
 
 #endif /* HAVE_LIBPCAP */