1 /*
2 * This code is derived from code formerly in pcap-dlpi.c, originally
3 * contributed by Atanu Ghosh (atanu@cs.ucl.ac.uk), University College
4 * London, and subsequently modified by Guy Harris (guy@alum.mit.edu),
5 * Mark Pizzolato <List-tcpdump-workers@subscriptions.pizzolato.net>,
6 * Mark C. Brown (mbrown@hp.com), and Sagun Shakya <Sagun.Shakya@Sun.COM>.
7 */
8
9 /*
10 * This file contains dlpi/libdlpi related common functions used
11 * by pcap-[dlpi,libdlpi].c.
12 */
13
14 #ifdef HAVE_CONFIG_H
15 #include <config.h>
16 #endif
17
18 #ifndef DL_IPATM
19 #define DL_IPATM 0x12 /* ATM Classical IP interface */
20 #endif
21
22 #ifdef HAVE_SYS_BUFMOD_H
23 /*
24 * Size of a bufmod chunk to pass upstream; that appears to be the
25 * biggest value to which you can set it, and setting it to that value
26 * (which is bigger than what appears to be the Solaris default of 8192)
27 * reduces the number of packet drops.
28 */
29 #define CHUNKSIZE 65536
30
31 /*
32 * Size of the buffer to allocate for packet data we read; it must be
33 * large enough to hold a chunk.
34 */
35 #define PKTBUFSIZE CHUNKSIZE
36
37 #else /* HAVE_SYS_BUFMOD_H */
38
39 /*
40 * Size of the buffer to allocate for packet data we read; this is
41 * what the value used to be - there's no particular reason why it
42 * should be tied to MAXDLBUF, but we'll leave it as this for now.
43 */
44 #define MAXDLBUF 8192
45 #define PKTBUFSIZE (MAXDLBUF * sizeof(bpf_u_int32))
46
47 #endif
48
49 #include <sys/types.h>
50 #include <sys/time.h>
51 #ifdef HAVE_SYS_BUFMOD_H
52 #include <sys/bufmod.h>
53 #endif
54 #include <sys/dlpi.h>
55 #include <sys/stream.h>
56
57 #include <errno.h>
58 #include <memory.h>
59 #include <stdio.h>
60 #include <stdlib.h>
61 #include <string.h>
62 #include <stropts.h>
63 #include <unistd.h>
64
65 #ifdef HAVE_LIBDLPI
66 #include <libdlpi.h>
67 #endif
68
69 #include "pcap-int.h"
70 #include "dlpisubs.h"
71
72 #ifdef HAVE_SYS_BUFMOD_H
73 static void pcap_stream_err(const char *, int, char *);
74 #endif
75
76 /*
77 * Get the packet statistics.
78 */
79 int
pcap_stats_dlpi(pcap_t * p,struct pcap_stat * ps)80 pcap_stats_dlpi(pcap_t *p, struct pcap_stat *ps)
81 {
82 struct pcap_dlpi *pd = p->priv;
83
84 /*
85 * "ps_recv" counts packets handed to the filter, not packets
86 * that passed the filter. As filtering is done in userland,
87 * this would not include packets dropped because we ran out
88 * of buffer space; in order to make this more like other
89 * platforms (Linux 2.4 and later, BSDs with BPF), where the
90 * "packets received" count includes packets received but dropped
91 * due to running out of buffer space, and to keep from confusing
92 * applications that, for example, compute packet drop percentages,
93 * we also make it count packets dropped by "bufmod" (otherwise we
94 * might run the risk of the packet drop count being bigger than
95 * the received-packet count).
96 *
97 * "ps_drop" counts packets dropped by "bufmod" because of
98 * flow control requirements or resource exhaustion; it doesn't
99 * count packets dropped by the interface driver, or packets
100 * dropped upstream. As filtering is done in userland, it counts
101 * packets regardless of whether they would've passed the filter.
102 *
103 * These statistics don't include packets not yet read from
104 * the kernel by libpcap, but they may include packets not
105 * yet read from libpcap by the application.
106 */
107 *ps = pd->stat;
108
109 /*
110 * Add in the drop count, as per the above comment.
111 */
112 ps->ps_recv += ps->ps_drop;
113 return (0);
114 }
115
116 /*
117 * Loop through the packets and call the callback for each packet.
118 * Return the number of packets read.
119 */
120 int
pcap_process_pkts(pcap_t * p,pcap_handler callback,u_char * user,int count,u_char * bufp,int len)121 pcap_process_pkts(pcap_t *p, pcap_handler callback, u_char *user,
122 int count, u_char *bufp, int len)
123 {
124 struct pcap_dlpi *pd = p->priv;
125 int n, caplen, origlen;
126 u_char *ep, *pk;
127 struct pcap_pkthdr pkthdr;
128 #ifdef HAVE_SYS_BUFMOD_H
129 struct sb_hdr *sbp;
130 #ifdef LBL_ALIGN
131 struct sb_hdr sbhdr;
132 #endif
133 #endif
134
135 /* Loop through packets */
136 ep = bufp + len;
137 n = 0;
138
139 #ifdef HAVE_SYS_BUFMOD_H
140 while (bufp < ep) {
141 /*
142 * Has "pcap_breakloop()" been called?
143 * If so, return immediately - if we haven't read any
144 * packets, clear the flag and return -2 to indicate
145 * that we were told to break out of the loop, otherwise
146 * leave the flag set, so that the *next* call will break
147 * out of the loop without having read any packets, and
148 * return the number of packets we've processed so far.
149 */
150 if (p->break_loop) {
151 if (n == 0) {
152 p->break_loop = 0;
153 return (-2);
154 } else {
155 p->bp = bufp;
156 p->cc = ep - bufp;
157 return (n);
158 }
159 }
160 #ifdef LBL_ALIGN
161 if ((long)bufp & 3) {
162 sbp = &sbhdr;
163 memcpy(sbp, bufp, sizeof(*sbp));
164 } else
165 #endif
166 sbp = (struct sb_hdr *)bufp;
167 pd->stat.ps_drop = sbp->sbh_drops;
168 pk = bufp + sizeof(*sbp);
169 bufp += sbp->sbh_totlen;
170 origlen = sbp->sbh_origlen;
171 caplen = sbp->sbh_msglen;
172 #else
173 origlen = len;
174 caplen = min(p->snapshot, len);
175 pk = bufp;
176 bufp += caplen;
177 #endif
178 ++pd->stat.ps_recv;
179 if (bpf_filter(p->fcode.bf_insns, pk, origlen, caplen)) {
180 #ifdef HAVE_SYS_BUFMOD_H
181 pkthdr.ts.tv_sec = sbp->sbh_timestamp.tv_sec;
182 pkthdr.ts.tv_usec = sbp->sbh_timestamp.tv_usec;
183 #else
184 (void) gettimeofday(&pkthdr.ts, NULL);
185 #endif
186 pkthdr.len = origlen;
187 pkthdr.caplen = caplen;
188 /* Insure caplen does not exceed snapshot */
189 if (pkthdr.caplen > (bpf_u_int32)p->snapshot)
190 pkthdr.caplen = (bpf_u_int32)p->snapshot;
191 (*callback)(user, &pkthdr, pk);
192 if (++n >= count && !PACKET_COUNT_IS_UNLIMITED(count)) {
193 p->cc = ep - bufp;
194 p->bp = bufp;
195 return (n);
196 }
197 }
198 #ifdef HAVE_SYS_BUFMOD_H
199 }
200 #endif
201 p->cc = 0;
202 return (n);
203 }
204
205 /*
206 * Process the mac type. Returns -1 if no matching mac type found, otherwise 0.
207 */
208 int
pcap_process_mactype(pcap_t * p,u_int mactype)209 pcap_process_mactype(pcap_t *p, u_int mactype)
210 {
211 int retv = 0;
212
213 switch (mactype) {
214
215 case DL_CSMACD:
216 case DL_ETHER:
217 p->linktype = DLT_EN10MB;
218 p->offset = 2;
219 /*
220 * This is (presumably) a real Ethernet capture; give it a
221 * link-layer-type list with DLT_EN10MB and DLT_DOCSIS, so
222 * that an application can let you choose it, in case you're
223 * capturing DOCSIS traffic that a Cisco Cable Modem
224 * Termination System is putting out onto an Ethernet (it
225 * doesn't put an Ethernet header onto the wire, it puts raw
226 * DOCSIS frames out on the wire inside the low-level
227 * Ethernet framing).
228 */
229 p->dlt_list = (u_int *)malloc(sizeof(u_int) * 2);
230 /*
231 * If that fails, just leave the list empty.
232 */
233 if (p->dlt_list != NULL) {
234 p->dlt_list[0] = DLT_EN10MB;
235 p->dlt_list[1] = DLT_DOCSIS;
236 p->dlt_count = 2;
237 }
238 break;
239
240 case DL_FDDI:
241 p->linktype = DLT_FDDI;
242 p->offset = 3;
243 break;
244
245 case DL_TPR:
246 /* XXX - what about DL_TPB? Is that Token Bus? */
247 p->linktype = DLT_IEEE802;
248 p->offset = 2;
249 break;
250
251 #ifdef HAVE_SOLARIS
252 case DL_IPATM:
253 p->linktype = DLT_SUNATM;
254 p->offset = 0; /* works for LANE and LLC encapsulation */
255 break;
256 #endif
257
258 #ifdef DL_IPV4
259 case DL_IPV4:
260 p->linktype = DLT_IPV4;
261 p->offset = 0;
262 break;
263 #endif
264
265 #ifdef DL_IPV6
266 case DL_IPV6:
267 p->linktype = DLT_IPV6;
268 p->offset = 0;
269 break;
270 #endif
271
272 #ifdef DL_IPNET
273 case DL_IPNET:
274 /*
275 * XXX - DL_IPNET devices default to "raw IP" rather than
276 * "IPNET header"; see
277 *
278 * http://seclists.org/tcpdump/2009/q1/202
279 *
280 * We'd have to do DL_IOC_IPNET_INFO to enable getting
281 * the IPNET header.
282 */
283 p->linktype = DLT_RAW;
284 p->offset = 0;
285 break;
286 #endif
287
288 default:
289 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "unknown mactype 0x%x",
290 mactype);
291 retv = -1;
292 }
293
294 return (retv);
295 }
296
297 #ifdef HAVE_SYS_BUFMOD_H
298 /*
299 * Push and configure the buffer module. Returns -1 for error, otherwise 0.
300 */
301 int
pcap_conf_bufmod(pcap_t * p,int snaplen)302 pcap_conf_bufmod(pcap_t *p, int snaplen)
303 {
304 struct timeval to;
305 bpf_u_int32 ss, chunksize;
306
307 /* Non-standard call to get the data nicely buffered. */
308 if (ioctl(p->fd, I_PUSH, "bufmod") != 0) {
309 pcap_stream_err("I_PUSH bufmod", errno, p->errbuf);
310 return (-1);
311 }
312
313 ss = snaplen;
314 if (ss > 0 &&
315 strioctl(p->fd, SBIOCSSNAP, sizeof(ss), (char *)&ss) != 0) {
316 pcap_stream_err("SBIOCSSNAP", errno, p->errbuf);
317 return (-1);
318 }
319
320 if (p->opt.immediate) {
321 /* Set the timeout to zero, for immediate delivery. */
322 to.tv_sec = 0;
323 to.tv_usec = 0;
324 if (strioctl(p->fd, SBIOCSTIME, sizeof(to), (char *)&to) != 0) {
325 pcap_stream_err("SBIOCSTIME", errno, p->errbuf);
326 return (-1);
327 }
328 } else {
329 /* Set up the bufmod timeout. */
330 if (p->opt.timeout != 0) {
331 to.tv_sec = p->opt.timeout / 1000;
332 to.tv_usec = (p->opt.timeout * 1000) % 1000000;
333 if (strioctl(p->fd, SBIOCSTIME, sizeof(to), (char *)&to) != 0) {
334 pcap_stream_err("SBIOCSTIME", errno, p->errbuf);
335 return (-1);
336 }
337 }
338
339 /* Set the chunk length. */
340 chunksize = CHUNKSIZE;
341 if (strioctl(p->fd, SBIOCSCHUNK, sizeof(chunksize), (char *)&chunksize)
342 != 0) {
343 pcap_stream_err("SBIOCSCHUNKP", errno, p->errbuf);
344 return (-1);
345 }
346 }
347
348 return (0);
349 }
350 #endif /* HAVE_SYS_BUFMOD_H */
351
352 /*
353 * Allocate data buffer. Returns -1 if memory allocation fails, else 0.
354 */
355 int
pcap_alloc_databuf(pcap_t * p)356 pcap_alloc_databuf(pcap_t *p)
357 {
358 p->bufsize = PKTBUFSIZE;
359 p->buffer = malloc(p->bufsize + p->offset);
360 if (p->buffer == NULL) {
361 pcap_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE,
362 errno, "malloc");
363 return (-1);
364 }
365
366 return (0);
367 }
368
369 /*
370 * Issue a STREAMS I_STR ioctl. Returns -1 on error, otherwise
371 * length of returned data on success.
372 */
373 int
strioctl(int fd,int cmd,int len,char * dp)374 strioctl(int fd, int cmd, int len, char *dp)
375 {
376 struct strioctl str;
377 int retv;
378
379 str.ic_cmd = cmd;
380 str.ic_timout = -1;
381 str.ic_len = len;
382 str.ic_dp = dp;
383 if ((retv = ioctl(fd, I_STR, &str)) < 0)
384 return (retv);
385
386 return (str.ic_len);
387 }
388
389 #ifdef HAVE_SYS_BUFMOD_H
390 /*
391 * Write stream error message to errbuf.
392 */
393 static void
pcap_stream_err(const char * func,int err,char * errbuf)394 pcap_stream_err(const char *func, int err, char *errbuf)
395 {
396 pcap_fmt_errmsg_for_errno(errbuf, PCAP_ERRBUF_SIZE, err, "%s", func);
397 }
398 #endif
399