17c478bd9Sstevel@tonic-gate /*
27c478bd9Sstevel@tonic-gate * CDDL HEADER START
37c478bd9Sstevel@tonic-gate *
47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the
545916cd2Sjpk * Common Development and Distribution License (the "License").
645916cd2Sjpk * You may not use this file except in compliance with the License.
77c478bd9Sstevel@tonic-gate *
87c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
97c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing.
107c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions
117c478bd9Sstevel@tonic-gate * and limitations under the License.
127c478bd9Sstevel@tonic-gate *
137c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each
147c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
157c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the
167c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying
177c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner]
187c478bd9Sstevel@tonic-gate *
197c478bd9Sstevel@tonic-gate * CDDL HEADER END
207c478bd9Sstevel@tonic-gate */
217c478bd9Sstevel@tonic-gate /*
22e11c3f44Smeem * Copyright 2009 Sun Microsystems, Inc. All rights reserved.
237c478bd9Sstevel@tonic-gate * Use is subject to license terms.
247d897698SMilan Jurik * Copyright 2012 Milan Jurik. All rights reserved.
25a7792e7bSJason King * Copyright 2021 Joyent, Inc.
26*a04d7b7bSToomas Soome * Copyright 2023 RackTop Systems, Inc.
277c478bd9Sstevel@tonic-gate */
287c478bd9Sstevel@tonic-gate
297c478bd9Sstevel@tonic-gate #include <stdio.h>
307c478bd9Sstevel@tonic-gate #include <string.h>
31b78ff649Smeem #include <strings.h>
327c478bd9Sstevel@tonic-gate #include <errno.h>
337c478bd9Sstevel@tonic-gate #include <fcntl.h>
347c478bd9Sstevel@tonic-gate #include <setjmp.h>
357c478bd9Sstevel@tonic-gate #include <sys/types.h>
367c478bd9Sstevel@tonic-gate #include <sys/signal.h>
377c478bd9Sstevel@tonic-gate #include <sys/time.h>
387c478bd9Sstevel@tonic-gate #include <sys/socket.h>
397c478bd9Sstevel@tonic-gate #include <sys/sockio.h>
407c478bd9Sstevel@tonic-gate #include <netinet/in.h>
417c478bd9Sstevel@tonic-gate #include <netinet/ip.h>
427c478bd9Sstevel@tonic-gate #include <sys/pfmod.h>
437c478bd9Sstevel@tonic-gate #include <sys/mman.h>
447c478bd9Sstevel@tonic-gate #include <sys/stat.h>
457c478bd9Sstevel@tonic-gate #include <sys/bufmod.h>
467c478bd9Sstevel@tonic-gate
477c478bd9Sstevel@tonic-gate #include <unistd.h>
487c478bd9Sstevel@tonic-gate #include <stropts.h>
497c478bd9Sstevel@tonic-gate #include <stdlib.h>
507c478bd9Sstevel@tonic-gate #include <ctype.h>
517c478bd9Sstevel@tonic-gate #include <values.h>
527c478bd9Sstevel@tonic-gate #include <libdlpi.h>
537c478bd9Sstevel@tonic-gate
547c478bd9Sstevel@tonic-gate #include "snoop.h"
557c478bd9Sstevel@tonic-gate
5645916cd2Sjpk /*
5745916cd2Sjpk * Old header format.
5845916cd2Sjpk * Actually two concatenated structs: nit_bufhdr + nit_head
5945916cd2Sjpk */
6045916cd2Sjpk struct ohdr {
6145916cd2Sjpk /* nit_bufhdr */
6245916cd2Sjpk int o_msglen;
6345916cd2Sjpk int o_totlen;
6445916cd2Sjpk /* nit_head */
6545916cd2Sjpk struct timeval o_time;
6645916cd2Sjpk int o_drops;
6745916cd2Sjpk int o_len;
6845916cd2Sjpk };
6945916cd2Sjpk
7045916cd2Sjpk static void scan(char *, int, int, int, int, void (*)(), int, int, int);
717c478bd9Sstevel@tonic-gate void convert_to_network();
727c478bd9Sstevel@tonic-gate void convert_from_network();
7345916cd2Sjpk static void convert_old(struct ohdr *);
747c478bd9Sstevel@tonic-gate extern sigjmp_buf jmp_env, ojmp_env;
7545916cd2Sjpk static char *bufp; /* pointer to read buffer */
767c478bd9Sstevel@tonic-gate
7745916cd2Sjpk static int strioctl(int, int, int, int, void *);
782e3b6467Skcpoon
79b78ff649Smeem enum { DWA_NONE, DWA_EXISTS, DWA_PLUMBED };
80b78ff649Smeem
81b78ff649Smeem typedef struct dlpi_walk_arg {
82b78ff649Smeem char dwa_linkname[MAXLINKNAMELEN];
83b78ff649Smeem int dwa_type; /* preference type above */
84b78ff649Smeem int dwa_s4; /* IPv4 socket */
85b78ff649Smeem int dwa_s6; /* IPv6 socket */
86b78ff649Smeem } dlpi_walk_arg_t;
87b78ff649Smeem
88b78ff649Smeem static boolean_t
select_datalink(const char * linkname,void * arg)89b78ff649Smeem select_datalink(const char *linkname, void *arg)
90b78ff649Smeem {
91b78ff649Smeem struct lifreq lifr;
92b78ff649Smeem dlpi_walk_arg_t *dwap = arg;
93b78ff649Smeem int s4 = dwap->dwa_s4;
94b78ff649Smeem int s6 = dwap->dwa_s6;
95b78ff649Smeem
96b78ff649Smeem (void) strlcpy(dwap->dwa_linkname, linkname, MAXLINKNAMELEN);
97b78ff649Smeem dwap->dwa_type = DWA_EXISTS;
98b78ff649Smeem
997c478bd9Sstevel@tonic-gate /*
100b78ff649Smeem * See if it's plumbed by IP. We prefer such links because they're
101b78ff649Smeem * more likely to have interesting traffic.
102b78ff649Smeem */
103b78ff649Smeem bzero(&lifr, sizeof (lifr));
104b78ff649Smeem (void) strlcpy(lifr.lifr_name, linkname, LIFNAMSIZ);
105b78ff649Smeem if ((s4 != -1 && ioctl(s4, SIOCGLIFFLAGS, &lifr) != -1) ||
106b78ff649Smeem (s6 != -1 && ioctl(s6, SIOCGLIFFLAGS, &lifr) != -1)) {
107b78ff649Smeem dwap->dwa_type = DWA_PLUMBED;
108b78ff649Smeem return (B_TRUE);
109b78ff649Smeem }
110b78ff649Smeem return (B_FALSE);
111b78ff649Smeem }
112b78ff649Smeem
113b78ff649Smeem /*
114b78ff649Smeem * Open `linkname' in raw/passive mode (see dlpi_open(3DLPI)). If `linkname'
115bbf21555SRichard Lowe * is NULL, pick a datalink as per snoop(8). Also gather some information
116b78ff649Smeem * about the datalink useful for building the proper packet filters.
1177c478bd9Sstevel@tonic-gate */
1182e3b6467Skcpoon boolean_t
open_datalink(dlpi_handle_t * dhp,const char * linkname)119b78ff649Smeem open_datalink(dlpi_handle_t *dhp, const char *linkname)
1207c478bd9Sstevel@tonic-gate {
121c7e4935fSss150715 int retval;
122b127ac41SPhilip Kirk int flags = DLPI_PASSIVE | DLPI_RAW;
123b78ff649Smeem dlpi_walk_arg_t dwa;
1245fead0e0SRoamer dlpi_info_t dlinfo;
125c7e4935fSss150715
126b78ff649Smeem if (linkname == NULL) {
1277c478bd9Sstevel@tonic-gate /*
128b78ff649Smeem * Select a datalink to use by default. Prefer datalinks that
129b78ff649Smeem * are plumbed by IP.
1307c478bd9Sstevel@tonic-gate */
131b78ff649Smeem bzero(&dwa, sizeof (dwa));
132b78ff649Smeem dwa.dwa_s4 = socket(AF_INET, SOCK_DGRAM, 0);
133b78ff649Smeem dwa.dwa_s6 = socket(AF_INET6, SOCK_DGRAM, 0);
134b78ff649Smeem dlpi_walk(select_datalink, &dwa, 0);
135b78ff649Smeem (void) close(dwa.dwa_s4);
136b78ff649Smeem (void) close(dwa.dwa_s6);
1377c478bd9Sstevel@tonic-gate
138b78ff649Smeem if (dwa.dwa_type == DWA_NONE)
139b78ff649Smeem pr_err("no datalinks found");
140b78ff649Smeem if (dwa.dwa_type == DWA_EXISTS) {
141b78ff649Smeem (void) fprintf(stderr, "snoop: WARNING: "
142b78ff649Smeem "no datalinks plumbed for IP traffic\n");
1437c478bd9Sstevel@tonic-gate }
144b78ff649Smeem linkname = dwa.dwa_linkname;
1457c478bd9Sstevel@tonic-gate }
146b127ac41SPhilip Kirk if (Iflg)
147b127ac41SPhilip Kirk flags |= DLPI_DEVIPNET;
148b78ff649Smeem if (Iflg || strcmp(linkname, "lo0") == 0)
149b127ac41SPhilip Kirk flags |= DLPI_IPNETINFO;
150b78ff649Smeem if ((retval = dlpi_open(linkname, dhp, flags)) != DLPI_SUCCESS) {
151b78ff649Smeem pr_err("cannot open \"%s\": %s", linkname,
152c7e4935fSss150715 dlpi_strerror(retval));
1537c478bd9Sstevel@tonic-gate }
1547c478bd9Sstevel@tonic-gate
155c7e4935fSss150715 if ((retval = dlpi_info(*dhp, &dlinfo, 0)) != DLPI_SUCCESS)
156c7e4935fSss150715 pr_errdlpi(*dhp, "dlpi_info failed", retval);
1577c478bd9Sstevel@tonic-gate
1587c478bd9Sstevel@tonic-gate for (interface = &INTERFACES[0]; interface->mac_type != -1; interface++)
159c7e4935fSss150715 if (interface->mac_type == dlinfo.di_mactype)
1607c478bd9Sstevel@tonic-gate break;
1617c478bd9Sstevel@tonic-gate
162c7e4935fSss150715 /* allow limited functionality even if interface isn't known */
1637c478bd9Sstevel@tonic-gate if (interface->mac_type == -1) {
164c7e4935fSss150715 (void) fprintf(stderr, "snoop: WARNING: Mac Type = %x "
165c7e4935fSss150715 "not supported\n", dlinfo.di_mactype);
1667c478bd9Sstevel@tonic-gate }
1677c478bd9Sstevel@tonic-gate
168605445d5Sdg199075 return (interface->try_kernel_filter);
1697c478bd9Sstevel@tonic-gate }
1707c478bd9Sstevel@tonic-gate
1717c478bd9Sstevel@tonic-gate /*
172b78ff649Smeem * Initialize `dh' for packet capture using the provided arguments.
1737c478bd9Sstevel@tonic-gate */
1747c478bd9Sstevel@tonic-gate void
init_datalink(dlpi_handle_t dh,ulong_t snaplen,ulong_t chunksize,struct timeval * timeout,struct Pf_ext_packetfilt * fp)175b78ff649Smeem init_datalink(dlpi_handle_t dh, ulong_t snaplen, ulong_t chunksize,
176c7e4935fSss150715 struct timeval *timeout, struct Pf_ext_packetfilt *fp)
1777c478bd9Sstevel@tonic-gate {
178c7e4935fSss150715 int retv;
179c7e4935fSss150715 int netfd;
1807c478bd9Sstevel@tonic-gate
181c7e4935fSss150715 retv = dlpi_bind(dh, DLPI_ANY_SAP, NULL);
182c7e4935fSss150715 if (retv != DLPI_SUCCESS)
183c7e4935fSss150715 pr_errdlpi(dh, "cannot bind on", retv);
1847c478bd9Sstevel@tonic-gate
185b127ac41SPhilip Kirk if (Iflg) {
186b127ac41SPhilip Kirk (void) fprintf(stderr, "Using device ipnet/%s ",
187b127ac41SPhilip Kirk dlpi_linkname(dh));
188b127ac41SPhilip Kirk } else {
189c7e4935fSss150715 (void) fprintf(stderr, "Using device %s ", dlpi_linkname(dh));
190b127ac41SPhilip Kirk }
1917c478bd9Sstevel@tonic-gate
1927c478bd9Sstevel@tonic-gate /*
1937c478bd9Sstevel@tonic-gate * If Pflg not set - use physical level
1947c478bd9Sstevel@tonic-gate * promiscuous mode. Otherwise - just SAP level.
1957c478bd9Sstevel@tonic-gate */
1967c478bd9Sstevel@tonic-gate if (!Pflg) {
1977c478bd9Sstevel@tonic-gate (void) fprintf(stderr, "(promiscuous mode)\n");
198c7e4935fSss150715 retv = dlpi_promiscon(dh, DL_PROMISC_PHYS);
199c7e4935fSss150715 if (retv != DLPI_SUCCESS) {
200a7792e7bSJason King if (fflg) {
201a7792e7bSJason King (void) fprintf(stderr, "Note: enabling "
202a7792e7bSJason King "promiscuous mode (physical) failed; "
203a7792e7bSJason King "packet capture may not be complete\n");
204a7792e7bSJason King } else {
205a7792e7bSJason King pr_errdlpi(dh,
206a7792e7bSJason King "promiscuous mode (physical) failed; "
207a7792e7bSJason King "use -f to ignore", retv);
208a7792e7bSJason King }
209c7e4935fSss150715 }
2107c478bd9Sstevel@tonic-gate } else {
2117c478bd9Sstevel@tonic-gate (void) fprintf(stderr, "(non promiscuous)\n");
212c7e4935fSss150715 retv = dlpi_promiscon(dh, DL_PROMISC_MULTI);
213c7e4935fSss150715 if (retv != DLPI_SUCCESS) {
214a7792e7bSJason King if (fflg) {
215a7792e7bSJason King (void) fprintf(stderr, "Note: enabling "
216a7792e7bSJason King "promiscuous mode (multicast) failed; "
217a7792e7bSJason King "packet capture may not be complete\n");
218a7792e7bSJason King } else {
219a7792e7bSJason King pr_errdlpi(dh,
220a7792e7bSJason King "promiscuous mode (multicast) failed; "
221a7792e7bSJason King "use -f to ignore", retv);
222a7792e7bSJason King }
223c7e4935fSss150715 }
2247c478bd9Sstevel@tonic-gate }
2257c478bd9Sstevel@tonic-gate
226c7e4935fSss150715 retv = dlpi_promiscon(dh, DL_PROMISC_SAP);
227a7792e7bSJason King if (retv != DLPI_SUCCESS) {
228a7792e7bSJason King if (fflg) {
229a7792e7bSJason King (void) fprintf(stderr, "Note: enabling promiscuous "
230a7792e7bSJason King "mode (SAP) failed; packet capture may not be "
231a7792e7bSJason King "complete\n");
232a7792e7bSJason King } else {
233a7792e7bSJason King pr_errdlpi(dh, "promiscuous mode (SAP) failed; "
234a7792e7bSJason King "use -f to ignore", retv);
235a7792e7bSJason King }
236a7792e7bSJason King }
237c7e4935fSss150715 netfd = dlpi_fd(dh);
2387c478bd9Sstevel@tonic-gate
2397c478bd9Sstevel@tonic-gate if (fp) {
2407c478bd9Sstevel@tonic-gate /*
2417c478bd9Sstevel@tonic-gate * push and configure the packet filtering module
2427c478bd9Sstevel@tonic-gate */
243c7e4935fSss150715 if (ioctl(netfd, I_PUSH, "pfmod") < 0)
244c7e4935fSss150715 pr_errdlpi(dh, "cannot push \"pfmod\"", DL_SYSERR);
2457c478bd9Sstevel@tonic-gate
2462e3b6467Skcpoon if (strioctl(netfd, PFIOCSETF, -1, sizeof (*fp),
247c7e4935fSss150715 (char *)fp) < 0)
248c7e4935fSss150715 pr_errdlpi(dh, "PFIOCSETF", DL_SYSERR);
2497c478bd9Sstevel@tonic-gate }
2507c478bd9Sstevel@tonic-gate
251c7e4935fSss150715 if (ioctl(netfd, I_PUSH, "bufmod") < 0)
252c7e4935fSss150715 pr_errdlpi(dh, "cannot push \"bufmod\"", DL_SYSERR);
2537c478bd9Sstevel@tonic-gate
2547c478bd9Sstevel@tonic-gate if (strioctl(netfd, SBIOCSTIME, -1, sizeof (struct timeval),
255c7e4935fSss150715 (char *)timeout) < 0)
256c7e4935fSss150715 pr_errdlpi(dh, "SBIOCSTIME", DL_SYSERR);
2577c478bd9Sstevel@tonic-gate
2587c478bd9Sstevel@tonic-gate if (strioctl(netfd, SBIOCSCHUNK, -1, sizeof (uint_t),
259c7e4935fSss150715 (char *)&chunksize) < 0)
260c7e4935fSss150715 pr_errdlpi(dh, "SBIOCGCHUNK", DL_SYSERR);
2617c478bd9Sstevel@tonic-gate
2627c478bd9Sstevel@tonic-gate if (strioctl(netfd, SBIOCSSNAP, -1, sizeof (uint_t),
263c7e4935fSss150715 (char *)&snaplen) < 0)
264c7e4935fSss150715 pr_errdlpi(dh, "SBIOCSSNAP", DL_SYSERR);
2657c478bd9Sstevel@tonic-gate
2667c478bd9Sstevel@tonic-gate /*
2677c478bd9Sstevel@tonic-gate * Flush the read queue, to get rid of anything that
2687c478bd9Sstevel@tonic-gate * accumulated before the device reached its final configuration.
2697c478bd9Sstevel@tonic-gate */
270c7e4935fSss150715 if (ioctl(netfd, I_FLUSH, FLUSHR) < 0)
271c7e4935fSss150715 pr_errdlpi(dh, "cannot flush \"I_FLUSH\"", DL_SYSERR);
2727c478bd9Sstevel@tonic-gate }
2737c478bd9Sstevel@tonic-gate
2747c478bd9Sstevel@tonic-gate /*
275b78ff649Smeem * Read packets from the network. init_datalink() is called in
2767c478bd9Sstevel@tonic-gate * here to set up the network interface for reading of
2777c478bd9Sstevel@tonic-gate * raw ethernet packets in promiscuous mode into a buffer.
2787c478bd9Sstevel@tonic-gate * Packets are read and either written directly to a file
2797c478bd9Sstevel@tonic-gate * or interpreted for display on the fly.
2807c478bd9Sstevel@tonic-gate */
2817c478bd9Sstevel@tonic-gate void
net_read(dlpi_handle_t dh,size_t chunksize,int filter,void (* proc)(),int flags)282c7e4935fSss150715 net_read(dlpi_handle_t dh, size_t chunksize, int filter, void (*proc)(),
283c7e4935fSss150715 int flags)
2847c478bd9Sstevel@tonic-gate {
285c7e4935fSss150715 int retval;
2867c478bd9Sstevel@tonic-gate extern int count;
287c7e4935fSss150715 size_t msglen;
2887c478bd9Sstevel@tonic-gate
2897c478bd9Sstevel@tonic-gate count = 0;
2907c478bd9Sstevel@tonic-gate
2917c478bd9Sstevel@tonic-gate /* allocate a read buffer */
2927c478bd9Sstevel@tonic-gate bufp = malloc(chunksize);
2937c478bd9Sstevel@tonic-gate if (bufp == NULL)
294c7e4935fSss150715 pr_err("no memory for %d buffer", chunksize);
2957c478bd9Sstevel@tonic-gate
2967c478bd9Sstevel@tonic-gate /*
2977c478bd9Sstevel@tonic-gate * read frames
2987c478bd9Sstevel@tonic-gate */
2997c478bd9Sstevel@tonic-gate for (;;) {
300c7e4935fSss150715 msglen = chunksize;
301c7e4935fSss150715 retval = dlpi_recv(dh, NULL, NULL, bufp, &msglen, -1, NULL);
3027c478bd9Sstevel@tonic-gate
303c7e4935fSss150715 if (retval != DLPI_SUCCESS || quitting)
3047c478bd9Sstevel@tonic-gate break;
3057c478bd9Sstevel@tonic-gate
306c7e4935fSss150715 if (msglen != 0)
307c7e4935fSss150715 scan(bufp, msglen, filter, 0, 0, proc, 0, 0, flags);
3087c478bd9Sstevel@tonic-gate }
3097c478bd9Sstevel@tonic-gate
3107c478bd9Sstevel@tonic-gate free(bufp);
3117c478bd9Sstevel@tonic-gate
312c7e4935fSss150715 if (!quitting)
313c7e4935fSss150715 pr_errdlpi(dh, "network read failed", retval);
3147c478bd9Sstevel@tonic-gate }
3157c478bd9Sstevel@tonic-gate
3167c478bd9Sstevel@tonic-gate #ifdef DEBUG
3177c478bd9Sstevel@tonic-gate /*
3187c478bd9Sstevel@tonic-gate * corrupt: simulate packet corruption for debugging interpreters
3197c478bd9Sstevel@tonic-gate */
3207c478bd9Sstevel@tonic-gate void
corrupt(volatile char * pktp,volatile char * pstop,char * buf,volatile char * bufstop)3217c478bd9Sstevel@tonic-gate corrupt(volatile char *pktp, volatile char *pstop, char *buf,
3227c478bd9Sstevel@tonic-gate volatile char *bufstop)
3237c478bd9Sstevel@tonic-gate {
3247c478bd9Sstevel@tonic-gate int c;
3257c478bd9Sstevel@tonic-gate int i;
3267c478bd9Sstevel@tonic-gate int p;
3277c478bd9Sstevel@tonic-gate int li = rand() % (pstop - pktp - 1) + 1;
3287c478bd9Sstevel@tonic-gate volatile char *pp = pktp;
3297c478bd9Sstevel@tonic-gate volatile char *pe = bufstop < pstop ? bufstop : pstop;
3307c478bd9Sstevel@tonic-gate
3317c478bd9Sstevel@tonic-gate if (pktp < buf || pktp > bufstop)
3327c478bd9Sstevel@tonic-gate return;
3337c478bd9Sstevel@tonic-gate
3347c478bd9Sstevel@tonic-gate for (pp = pktp; pp < pe; pp += li) {
3357c478bd9Sstevel@tonic-gate c = ((pe - pp) < li ? pe - pp : li);
3367c478bd9Sstevel@tonic-gate i = (rand() % c)>>1;
3377c478bd9Sstevel@tonic-gate while (--i > 0) {
3387c478bd9Sstevel@tonic-gate p = (rand() % c);
3397c478bd9Sstevel@tonic-gate pp[p] = (unsigned char)(rand() & 0xFF);
3407c478bd9Sstevel@tonic-gate }
3417c478bd9Sstevel@tonic-gate }
3427c478bd9Sstevel@tonic-gate }
3437c478bd9Sstevel@tonic-gate #endif /* DEBUG */
3447c478bd9Sstevel@tonic-gate
34545916cd2Sjpk static void
scan(char * buf,int len,int filter,int cap,int old,void (* proc)(),int first,int last,int flags)34645916cd2Sjpk scan(char *buf, int len, int filter, int cap, int old, void (*proc)(),
34745916cd2Sjpk int first, int last, int flags)
3487c478bd9Sstevel@tonic-gate {
3497c478bd9Sstevel@tonic-gate volatile char *bp, *bufstop;
3507c478bd9Sstevel@tonic-gate volatile struct sb_hdr *hdrp;
3517c478bd9Sstevel@tonic-gate volatile struct sb_hdr nhdr, *nhdrp;
3527c478bd9Sstevel@tonic-gate volatile char *pktp;
3537c478bd9Sstevel@tonic-gate volatile struct timeval last_timestamp;
3547c478bd9Sstevel@tonic-gate volatile int header_okay;
3557c478bd9Sstevel@tonic-gate extern int count, maxcount;
3567c478bd9Sstevel@tonic-gate extern int snoop_nrecover;
3577c478bd9Sstevel@tonic-gate #ifdef DEBUG
3587c478bd9Sstevel@tonic-gate extern int zflg;
3597c478bd9Sstevel@tonic-gate #endif /* DEBUG */
3607c478bd9Sstevel@tonic-gate
3617c478bd9Sstevel@tonic-gate proc(0, 0, 0);
3627c478bd9Sstevel@tonic-gate bufstop = buf + len;
3637c478bd9Sstevel@tonic-gate
3647c478bd9Sstevel@tonic-gate /*
3657c478bd9Sstevel@tonic-gate *
3667c478bd9Sstevel@tonic-gate * Loop through each packet in the buffer
3677c478bd9Sstevel@tonic-gate */
3687c478bd9Sstevel@tonic-gate last_timestamp.tv_sec = 0;
3697c478bd9Sstevel@tonic-gate (void) memcpy((char *)ojmp_env, (char *)jmp_env, sizeof (jmp_env));
3707c478bd9Sstevel@tonic-gate for (bp = buf; bp < bufstop; bp += nhdrp->sbh_totlen) {
3717c478bd9Sstevel@tonic-gate /*
3727c478bd9Sstevel@tonic-gate * Gracefully exit if user terminates
3737c478bd9Sstevel@tonic-gate */
3747c478bd9Sstevel@tonic-gate if (quitting)
3757c478bd9Sstevel@tonic-gate break;
3767c478bd9Sstevel@tonic-gate /*
3777c478bd9Sstevel@tonic-gate * Global error recocery: Prepare to continue when a corrupt
3787c478bd9Sstevel@tonic-gate * packet or header is encountered.
3797c478bd9Sstevel@tonic-gate */
3807c478bd9Sstevel@tonic-gate if (sigsetjmp(jmp_env, 1)) {
3817c478bd9Sstevel@tonic-gate goto err;
3827c478bd9Sstevel@tonic-gate }
3837c478bd9Sstevel@tonic-gate
3847c478bd9Sstevel@tonic-gate header_okay = 0;
3857c478bd9Sstevel@tonic-gate hdrp = (struct sb_hdr *)bp;
3867c478bd9Sstevel@tonic-gate nhdrp = hdrp;
3877c478bd9Sstevel@tonic-gate pktp = (char *)hdrp + sizeof (*hdrp);
3887c478bd9Sstevel@tonic-gate
3897c478bd9Sstevel@tonic-gate /*
3907c478bd9Sstevel@tonic-gate * If reading a capture file
3917c478bd9Sstevel@tonic-gate * convert the headers from network
3927c478bd9Sstevel@tonic-gate * byte order (for little-endians like X86)
3937c478bd9Sstevel@tonic-gate */
3947c478bd9Sstevel@tonic-gate if (cap) {
3957c478bd9Sstevel@tonic-gate /*
3967c478bd9Sstevel@tonic-gate * If the packets come from an old
3977c478bd9Sstevel@tonic-gate * capture file, convert the header.
3987c478bd9Sstevel@tonic-gate */
3997c478bd9Sstevel@tonic-gate if (old) {
40045916cd2Sjpk convert_old((struct ohdr *)hdrp);
4017c478bd9Sstevel@tonic-gate }
4027c478bd9Sstevel@tonic-gate
4037c478bd9Sstevel@tonic-gate nhdrp = &nhdr;
4047c478bd9Sstevel@tonic-gate
4057c478bd9Sstevel@tonic-gate nhdrp->sbh_origlen = ntohl(hdrp->sbh_origlen);
4067c478bd9Sstevel@tonic-gate nhdrp->sbh_msglen = ntohl(hdrp->sbh_msglen);
4077c478bd9Sstevel@tonic-gate nhdrp->sbh_totlen = ntohl(hdrp->sbh_totlen);
4087c478bd9Sstevel@tonic-gate nhdrp->sbh_drops = ntohl(hdrp->sbh_drops);
4097c478bd9Sstevel@tonic-gate nhdrp->sbh_timestamp.tv_sec =
4107c478bd9Sstevel@tonic-gate ntohl(hdrp->sbh_timestamp.tv_sec);
4117c478bd9Sstevel@tonic-gate nhdrp->sbh_timestamp.tv_usec =
4127c478bd9Sstevel@tonic-gate ntohl(hdrp->sbh_timestamp.tv_usec);
4137c478bd9Sstevel@tonic-gate }
4147c478bd9Sstevel@tonic-gate
4157c478bd9Sstevel@tonic-gate /* Enhanced check for valid header */
4167c478bd9Sstevel@tonic-gate
4177c478bd9Sstevel@tonic-gate if ((nhdrp->sbh_totlen == 0) ||
4187c478bd9Sstevel@tonic-gate (bp + nhdrp->sbh_totlen) < bp ||
4197c478bd9Sstevel@tonic-gate (bp + nhdrp->sbh_totlen) > bufstop ||
4207c478bd9Sstevel@tonic-gate (nhdrp->sbh_origlen == 0) ||
4217c478bd9Sstevel@tonic-gate (bp + nhdrp->sbh_origlen) < bp ||
4227c478bd9Sstevel@tonic-gate (nhdrp->sbh_msglen == 0) ||
4237c478bd9Sstevel@tonic-gate (bp + nhdrp->sbh_msglen) < bp ||
4247c478bd9Sstevel@tonic-gate (bp + nhdrp->sbh_msglen) > bufstop ||
4257c478bd9Sstevel@tonic-gate (nhdrp->sbh_msglen > nhdrp->sbh_origlen) ||
4267c478bd9Sstevel@tonic-gate (nhdrp->sbh_totlen < nhdrp->sbh_msglen) ||
4277c478bd9Sstevel@tonic-gate (nhdrp->sbh_timestamp.tv_sec == 0)) {
428b127ac41SPhilip Kirk if (cap) {
429c7e4935fSss150715 (void) fprintf(stderr, "(warning) bad packet "
430c7e4935fSss150715 "header in capture file");
431b127ac41SPhilip Kirk } else {
432c7e4935fSss150715 (void) fprintf(stderr, "(warning) bad packet "
433c7e4935fSss150715 "header in buffer");
434b127ac41SPhilip Kirk }
4357c478bd9Sstevel@tonic-gate (void) fprintf(stderr, " offset %d: length=%d\n",
4367c478bd9Sstevel@tonic-gate bp - buf, nhdrp->sbh_totlen);
4377c478bd9Sstevel@tonic-gate goto err;
4387c478bd9Sstevel@tonic-gate }
4397c478bd9Sstevel@tonic-gate
4407c478bd9Sstevel@tonic-gate /*
4417c478bd9Sstevel@tonic-gate * Check for incomplete packet. We are conservative here,
4427c478bd9Sstevel@tonic-gate * since we don't know how good the checking is in other
4437c478bd9Sstevel@tonic-gate * parts of the code. We pass a partial packet, with
4447c478bd9Sstevel@tonic-gate * a warning.
4457c478bd9Sstevel@tonic-gate */
4467c478bd9Sstevel@tonic-gate if (pktp + nhdrp->sbh_msglen > bufstop) {
447c7e4935fSss150715 (void) fprintf(stderr, "truncated packet buffer\n");
4487c478bd9Sstevel@tonic-gate nhdrp->sbh_msglen = bufstop - pktp;
4497c478bd9Sstevel@tonic-gate }
4507c478bd9Sstevel@tonic-gate
4517c478bd9Sstevel@tonic-gate #ifdef DEBUG
4527c478bd9Sstevel@tonic-gate if (zflg)
4537c478bd9Sstevel@tonic-gate corrupt(pktp, pktp + nhdrp->sbh_msglen, buf, bufstop);
4547c478bd9Sstevel@tonic-gate #endif /* DEBUG */
4557c478bd9Sstevel@tonic-gate
4567c478bd9Sstevel@tonic-gate header_okay = 1;
4577c478bd9Sstevel@tonic-gate if (!filter ||
4582b24ab6bSSebastien Roy want_packet((uchar_t *)pktp,
4597c478bd9Sstevel@tonic-gate nhdrp->sbh_msglen,
4607c478bd9Sstevel@tonic-gate nhdrp->sbh_origlen)) {
4617c478bd9Sstevel@tonic-gate count++;
4627c478bd9Sstevel@tonic-gate
4637c478bd9Sstevel@tonic-gate /*
4647c478bd9Sstevel@tonic-gate * Start deadman timer for interpreter processing
4657c478bd9Sstevel@tonic-gate */
4667c478bd9Sstevel@tonic-gate (void) snoop_alarm(SNOOP_ALARM_GRAN*SNOOP_MAXRECOVER,
4677c478bd9Sstevel@tonic-gate NULL);
4687c478bd9Sstevel@tonic-gate
4697c478bd9Sstevel@tonic-gate encap_levels = 0;
4707c478bd9Sstevel@tonic-gate if (!cap || count >= first)
4717c478bd9Sstevel@tonic-gate proc(nhdrp, pktp, count, flags);
4727c478bd9Sstevel@tonic-gate
4737c478bd9Sstevel@tonic-gate if (cap && count >= last) {
4747c478bd9Sstevel@tonic-gate (void) snoop_alarm(0, NULL);
4757c478bd9Sstevel@tonic-gate break;
4767c478bd9Sstevel@tonic-gate }
4777c478bd9Sstevel@tonic-gate
4787c478bd9Sstevel@tonic-gate if (maxcount && count >= maxcount) {
479c7e4935fSss150715 (void) fprintf(stderr, "%d packets captured\n",
480c7e4935fSss150715 count);
4817c478bd9Sstevel@tonic-gate exit(0);
4827c478bd9Sstevel@tonic-gate }
4837c478bd9Sstevel@tonic-gate
4847c478bd9Sstevel@tonic-gate snoop_nrecover = 0; /* success */
4857c478bd9Sstevel@tonic-gate (void) snoop_alarm(0, NULL);
4867c478bd9Sstevel@tonic-gate last_timestamp = hdrp->sbh_timestamp; /* save stamp */
4877c478bd9Sstevel@tonic-gate }
4887c478bd9Sstevel@tonic-gate continue;
4897c478bd9Sstevel@tonic-gate err:
4907c478bd9Sstevel@tonic-gate /*
4917c478bd9Sstevel@tonic-gate * Corruption has been detected. Reset errors.
4927c478bd9Sstevel@tonic-gate */
4937c478bd9Sstevel@tonic-gate snoop_recover();
4947c478bd9Sstevel@tonic-gate
4957c478bd9Sstevel@tonic-gate /*
4967c478bd9Sstevel@tonic-gate * packet header was apparently okay. Continue.
4977c478bd9Sstevel@tonic-gate */
4987c478bd9Sstevel@tonic-gate if (header_okay)
4997c478bd9Sstevel@tonic-gate continue;
5007c478bd9Sstevel@tonic-gate
5017c478bd9Sstevel@tonic-gate /*
5027c478bd9Sstevel@tonic-gate * Otherwise try to scan forward to the next packet, using
5037c478bd9Sstevel@tonic-gate * the last known timestamp if it is available.
5047c478bd9Sstevel@tonic-gate */
5057c478bd9Sstevel@tonic-gate nhdrp = &nhdr;
5067c478bd9Sstevel@tonic-gate nhdrp->sbh_totlen = 0;
5077c478bd9Sstevel@tonic-gate if (last_timestamp.tv_sec == 0) {
5087c478bd9Sstevel@tonic-gate bp += sizeof (int);
5097c478bd9Sstevel@tonic-gate } else {
5107c478bd9Sstevel@tonic-gate for (bp += sizeof (int); bp <= bufstop;
5117c478bd9Sstevel@tonic-gate bp += sizeof (int)) {
5127c478bd9Sstevel@tonic-gate hdrp = (struct sb_hdr *)bp;
5137c478bd9Sstevel@tonic-gate /* An approximate timestamp located */
5147c478bd9Sstevel@tonic-gate if ((hdrp->sbh_timestamp.tv_sec >> 8) ==
5157c478bd9Sstevel@tonic-gate (last_timestamp.tv_sec >> 8))
5167c478bd9Sstevel@tonic-gate break;
5177c478bd9Sstevel@tonic-gate }
5187c478bd9Sstevel@tonic-gate }
5197c478bd9Sstevel@tonic-gate }
5207c478bd9Sstevel@tonic-gate /* reset jmp_env for program exit */
5217c478bd9Sstevel@tonic-gate (void) memcpy((char *)jmp_env, (char *)ojmp_env, sizeof (jmp_env));
5227c478bd9Sstevel@tonic-gate proc(0, -1, 0);
5237c478bd9Sstevel@tonic-gate }
5247c478bd9Sstevel@tonic-gate
5257c478bd9Sstevel@tonic-gate /*
5267c478bd9Sstevel@tonic-gate * Called if nwrite() encounters write problems.
5277c478bd9Sstevel@tonic-gate */
5287c478bd9Sstevel@tonic-gate static void
cap_write_error(const char * msgtype)5297c478bd9Sstevel@tonic-gate cap_write_error(const char *msgtype)
5307c478bd9Sstevel@tonic-gate {
5317c478bd9Sstevel@tonic-gate (void) fprintf(stderr,
5327c478bd9Sstevel@tonic-gate "snoop: cannot write %s to capture file: %s\n",
5337c478bd9Sstevel@tonic-gate msgtype, strerror(errno));
5347c478bd9Sstevel@tonic-gate exit(1);
5357c478bd9Sstevel@tonic-gate }
5367c478bd9Sstevel@tonic-gate
5377c478bd9Sstevel@tonic-gate /*
5387c478bd9Sstevel@tonic-gate * Writes target buffer to the open file descriptor. Upon detection of a short
5397c478bd9Sstevel@tonic-gate * write, an attempt to process the remaining bytes occurs until all anticipated
5407c478bd9Sstevel@tonic-gate * bytes are written. An error status is returned to indicate any serious write
5417c478bd9Sstevel@tonic-gate * failures.
5427c478bd9Sstevel@tonic-gate */
5437c478bd9Sstevel@tonic-gate static int
nwrite(int fd,const void * buffer,size_t buflen)5447c478bd9Sstevel@tonic-gate nwrite(int fd, const void *buffer, size_t buflen)
5457c478bd9Sstevel@tonic-gate {
5467c478bd9Sstevel@tonic-gate size_t nwritten;
5477c478bd9Sstevel@tonic-gate ssize_t nbytes = 0;
5487c478bd9Sstevel@tonic-gate const char *buf = buffer;
5497c478bd9Sstevel@tonic-gate
5507c478bd9Sstevel@tonic-gate for (nwritten = 0; nwritten < buflen; nwritten += nbytes) {
5517c478bd9Sstevel@tonic-gate nbytes = write(fd, &buf[nwritten], buflen - nwritten);
5527c478bd9Sstevel@tonic-gate if (nbytes == -1)
5537c478bd9Sstevel@tonic-gate return (-1);
5547c478bd9Sstevel@tonic-gate if (nbytes == 0) {
5557c478bd9Sstevel@tonic-gate errno = EIO;
5567c478bd9Sstevel@tonic-gate return (-1);
5577c478bd9Sstevel@tonic-gate }
5587c478bd9Sstevel@tonic-gate }
5597c478bd9Sstevel@tonic-gate return (0);
5607c478bd9Sstevel@tonic-gate }
5617c478bd9Sstevel@tonic-gate
5627c478bd9Sstevel@tonic-gate /*
5637c478bd9Sstevel@tonic-gate * Routines for opening, closing, reading and writing
5647c478bd9Sstevel@tonic-gate * a capture file of packets saved with the -o option.
5657c478bd9Sstevel@tonic-gate */
566*a04d7b7bSToomas Soome static struct capfile_out_data {
567*a04d7b7bSToomas Soome int *capfile_fd; /* Open file descriptors */
568*a04d7b7bSToomas Soome int capfile_curfd;
569*a04d7b7bSToomas Soome size_t capfile_count; /* Number of files */
570*a04d7b7bSToomas Soome size_t capfile_index; /* Current file */
571*a04d7b7bSToomas Soome off_t capfile_size_limit;
572*a04d7b7bSToomas Soome } capfile_out;
5737c478bd9Sstevel@tonic-gate
5747c478bd9Sstevel@tonic-gate /*
5757c478bd9Sstevel@tonic-gate * The snoop capture file has a header to identify
5767c478bd9Sstevel@tonic-gate * it as a capture file and record its version.
5777c478bd9Sstevel@tonic-gate * A file without this header is assumed to be an
5787c478bd9Sstevel@tonic-gate * old format snoop file.
5797c478bd9Sstevel@tonic-gate *
5807c478bd9Sstevel@tonic-gate * A version 1 header looks like this:
5817c478bd9Sstevel@tonic-gate *
5827c478bd9Sstevel@tonic-gate * 0 1 2 3 4 5 6 7 8 9 10 11
5837c478bd9Sstevel@tonic-gate * +---+---+---+---+---+---+---+---+---+---+---+---+---+
5847c478bd9Sstevel@tonic-gate * | s | n | o | o | p | \0| \0| \0| version | data
5857c478bd9Sstevel@tonic-gate * +---+---+---+---+---+---+---+---+---+---+---+---+---+
5867c478bd9Sstevel@tonic-gate * | word 0 | word 1 | word 2 |
5877c478bd9Sstevel@tonic-gate *
5887c478bd9Sstevel@tonic-gate *
5897c478bd9Sstevel@tonic-gate * A version 2 header adds a word that identifies the MAC type.
5907c478bd9Sstevel@tonic-gate * This allows for capture files from FDDI etc.
5917c478bd9Sstevel@tonic-gate *
5927c478bd9Sstevel@tonic-gate * 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
5937c478bd9Sstevel@tonic-gate * +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
5947c478bd9Sstevel@tonic-gate * | s | n | o | o | p | \0| \0| \0| version | MAC type | data
5957c478bd9Sstevel@tonic-gate * +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
5967c478bd9Sstevel@tonic-gate * | word 0 | word 1 | word 2 | word 3
5977c478bd9Sstevel@tonic-gate *
5987c478bd9Sstevel@tonic-gate */
59945916cd2Sjpk static const char *snoop_id = "snoop\0\0\0";
60045916cd2Sjpk static const int snoop_idlen = 8;
60145916cd2Sjpk static const int snoop_version = 2;
6027c478bd9Sstevel@tonic-gate
603*a04d7b7bSToomas Soome static void
cap_write_header(int fd)604*a04d7b7bSToomas Soome cap_write_header(int fd)
605*a04d7b7bSToomas Soome {
606*a04d7b7bSToomas Soome int vers, mac;
607*a04d7b7bSToomas Soome
608*a04d7b7bSToomas Soome /* Write header */
609*a04d7b7bSToomas Soome vers = htonl(snoop_version);
610*a04d7b7bSToomas Soome if (nwrite(fd, snoop_id, snoop_idlen) == -1)
611*a04d7b7bSToomas Soome cap_write_error("snoop_id");
612*a04d7b7bSToomas Soome
613*a04d7b7bSToomas Soome if (nwrite(fd, &vers, sizeof (int)) == -1)
614*a04d7b7bSToomas Soome cap_write_error("version");
615*a04d7b7bSToomas Soome
616*a04d7b7bSToomas Soome mac = htonl(interface->mac_type);
617*a04d7b7bSToomas Soome if (nwrite(fd, &mac, sizeof (int)) == -1)
618*a04d7b7bSToomas Soome cap_write_error("mac_type");
619*a04d7b7bSToomas Soome }
620*a04d7b7bSToomas Soome
6217c478bd9Sstevel@tonic-gate void
cap_open_write(const char * name)622c7e4935fSss150715 cap_open_write(const char *name)
6237c478bd9Sstevel@tonic-gate {
624*a04d7b7bSToomas Soome bzero(&capfile_out, sizeof (capfile_out));
6257c478bd9Sstevel@tonic-gate
626*a04d7b7bSToomas Soome capfile_out.capfile_curfd = open(name,
627*a04d7b7bSToomas Soome O_CREAT | O_TRUNC | O_RDWR, 0666);
628*a04d7b7bSToomas Soome if (capfile_out.capfile_curfd < 0) {
6297c478bd9Sstevel@tonic-gate pr_err("%s: %m", name);
630*a04d7b7bSToomas Soome exit(1);
631*a04d7b7bSToomas Soome }
632*a04d7b7bSToomas Soome cap_write_header(capfile_out.capfile_curfd);
6337c478bd9Sstevel@tonic-gate }
6347c478bd9Sstevel@tonic-gate
635*a04d7b7bSToomas Soome void
cap_open_wr_multi(const char * prefix,size_t nfiles,off_t limit)636*a04d7b7bSToomas Soome cap_open_wr_multi(const char *prefix, size_t nfiles, off_t limit)
637*a04d7b7bSToomas Soome {
638*a04d7b7bSToomas Soome size_t i;
639*a04d7b7bSToomas Soome char *name;
640*a04d7b7bSToomas Soome
641*a04d7b7bSToomas Soome capfile_out.capfile_count = nfiles;
642*a04d7b7bSToomas Soome capfile_out.capfile_size_limit = limit;
643*a04d7b7bSToomas Soome capfile_out.capfile_index = 0;
644*a04d7b7bSToomas Soome
645*a04d7b7bSToomas Soome capfile_out.capfile_fd = malloc(nfiles *
646*a04d7b7bSToomas Soome sizeof (*capfile_out.capfile_fd));
647*a04d7b7bSToomas Soome if (capfile_out.capfile_fd == NULL) {
648*a04d7b7bSToomas Soome pr_err("out of memory\n");
649*a04d7b7bSToomas Soome exit(1);
650*a04d7b7bSToomas Soome }
651*a04d7b7bSToomas Soome
652*a04d7b7bSToomas Soome /* Open all files. */
653*a04d7b7bSToomas Soome for (i = 0; i < nfiles; i++) {
654*a04d7b7bSToomas Soome if (asprintf(&name, "%s-%02d.snoop", prefix, i) < 0) {
655*a04d7b7bSToomas Soome pr_err("out of memory\n");
656*a04d7b7bSToomas Soome exit(1);
657*a04d7b7bSToomas Soome }
658*a04d7b7bSToomas Soome capfile_out.capfile_fd[i] = open(name,
659*a04d7b7bSToomas Soome O_CREAT | O_TRUNC | O_RDWR, 0666);
660*a04d7b7bSToomas Soome if (capfile_out.capfile_fd[i] < 0) {
661*a04d7b7bSToomas Soome pr_err("%s: %m", name);
662*a04d7b7bSToomas Soome exit(1);
663*a04d7b7bSToomas Soome }
664*a04d7b7bSToomas Soome free(name);
665*a04d7b7bSToomas Soome
666*a04d7b7bSToomas Soome /* Write header */
667*a04d7b7bSToomas Soome cap_write_header(capfile_out.capfile_fd[i]);
668*a04d7b7bSToomas Soome }
669*a04d7b7bSToomas Soome capfile_out.capfile_curfd = capfile_out.capfile_fd[0];
670*a04d7b7bSToomas Soome }
671*a04d7b7bSToomas Soome
672*a04d7b7bSToomas Soome /*
673*a04d7b7bSToomas Soome * set capfile_curfd and truncate file.
674*a04d7b7bSToomas Soome */
675*a04d7b7bSToomas Soome static void
cap_switch_file(void)676*a04d7b7bSToomas Soome cap_switch_file(void)
677*a04d7b7bSToomas Soome {
678*a04d7b7bSToomas Soome size_t idx = capfile_out.capfile_index;
679*a04d7b7bSToomas Soome
680*a04d7b7bSToomas Soome /* pick next file */
681*a04d7b7bSToomas Soome if (idx == capfile_out.capfile_count - 1)
682*a04d7b7bSToomas Soome capfile_out.capfile_index = 0;
683*a04d7b7bSToomas Soome else
684*a04d7b7bSToomas Soome capfile_out.capfile_index++;
685*a04d7b7bSToomas Soome
686*a04d7b7bSToomas Soome idx = capfile_out.capfile_index;
687*a04d7b7bSToomas Soome (void) lseek(capfile_out.capfile_fd[idx], 16, SEEK_SET);
688*a04d7b7bSToomas Soome (void) ftruncate(capfile_out.capfile_fd[idx], 16);
689*a04d7b7bSToomas Soome capfile_out.capfile_curfd = capfile_out.capfile_fd[idx];
690*a04d7b7bSToomas Soome }
6917c478bd9Sstevel@tonic-gate
6927c478bd9Sstevel@tonic-gate void
cap_close(void)69345916cd2Sjpk cap_close(void)
6947c478bd9Sstevel@tonic-gate {
695*a04d7b7bSToomas Soome size_t i;
696*a04d7b7bSToomas Soome
697*a04d7b7bSToomas Soome if (capfile_out.capfile_count == 0) {
698*a04d7b7bSToomas Soome (void) close(capfile_out.capfile_curfd);
699*a04d7b7bSToomas Soome } else {
700*a04d7b7bSToomas Soome for (i = 0; i < capfile_out.capfile_count; i++)
701*a04d7b7bSToomas Soome (void) close(capfile_out.capfile_fd[i]);
702*a04d7b7bSToomas Soome }
7037c478bd9Sstevel@tonic-gate }
7047c478bd9Sstevel@tonic-gate
7057c478bd9Sstevel@tonic-gate static char *cap_buffp = NULL;
7067c478bd9Sstevel@tonic-gate static int cap_len = 0;
7077c478bd9Sstevel@tonic-gate static int cap_new;
7087c478bd9Sstevel@tonic-gate
7097c478bd9Sstevel@tonic-gate void
cap_open_read(const char * name)710c7e4935fSss150715 cap_open_read(const char *name)
7117c478bd9Sstevel@tonic-gate {
7127c478bd9Sstevel@tonic-gate struct stat st;
7137c478bd9Sstevel@tonic-gate int cap_vers;
7147d897698SMilan Jurik int *word;
7157d897698SMilan Jurik int device_mac_type = -1;
7167c478bd9Sstevel@tonic-gate int capfile_in;
7177c478bd9Sstevel@tonic-gate
7187c478bd9Sstevel@tonic-gate capfile_in = open(name, O_RDONLY);
7197c478bd9Sstevel@tonic-gate if (capfile_in < 0)
7207c478bd9Sstevel@tonic-gate pr_err("couldn't open %s: %m", name);
7217c478bd9Sstevel@tonic-gate
7227c478bd9Sstevel@tonic-gate if (fstat(capfile_in, &st) < 0)
7237c478bd9Sstevel@tonic-gate pr_err("couldn't stat %s: %m", name);
7247c478bd9Sstevel@tonic-gate cap_len = st.st_size;
7257c478bd9Sstevel@tonic-gate
7267c478bd9Sstevel@tonic-gate cap_buffp = mmap(0, cap_len, PROT_READ, MAP_PRIVATE, capfile_in, 0);
72745916cd2Sjpk (void) close(capfile_in);
7287c478bd9Sstevel@tonic-gate if ((int)cap_buffp == -1)
7297c478bd9Sstevel@tonic-gate pr_err("couldn't mmap %s: %m", name);
7307c478bd9Sstevel@tonic-gate
7317c478bd9Sstevel@tonic-gate /* Check if new snoop capture file format */
7327c478bd9Sstevel@tonic-gate
7337c478bd9Sstevel@tonic-gate cap_new = bcmp(cap_buffp, snoop_id, snoop_idlen) == 0;
7347c478bd9Sstevel@tonic-gate
7357c478bd9Sstevel@tonic-gate /*
7367c478bd9Sstevel@tonic-gate * If new file - check version and
7377c478bd9Sstevel@tonic-gate * set buffer pointer to point at first packet
7387c478bd9Sstevel@tonic-gate */
7397c478bd9Sstevel@tonic-gate if (cap_new) {
7407c478bd9Sstevel@tonic-gate cap_vers = ntohl(*(int *)(cap_buffp + snoop_idlen));
7417c478bd9Sstevel@tonic-gate cap_buffp += snoop_idlen + sizeof (int);
7427c478bd9Sstevel@tonic-gate cap_len -= snoop_idlen + sizeof (int);
7437c478bd9Sstevel@tonic-gate
7447c478bd9Sstevel@tonic-gate switch (cap_vers) {
7457c478bd9Sstevel@tonic-gate case 1:
7467c478bd9Sstevel@tonic-gate device_mac_type = DL_ETHER;
7477c478bd9Sstevel@tonic-gate break;
7487c478bd9Sstevel@tonic-gate
7497c478bd9Sstevel@tonic-gate case 2:
7507c478bd9Sstevel@tonic-gate device_mac_type = ntohl(*((int *)cap_buffp));
7517c478bd9Sstevel@tonic-gate cap_buffp += sizeof (int);
7527c478bd9Sstevel@tonic-gate cap_len -= sizeof (int);
7537c478bd9Sstevel@tonic-gate break;
7547c478bd9Sstevel@tonic-gate
7557c478bd9Sstevel@tonic-gate default:
7567c478bd9Sstevel@tonic-gate pr_err("capture file: %s: Version %d unrecognized\n",
7577c478bd9Sstevel@tonic-gate name, cap_vers);
7587c478bd9Sstevel@tonic-gate }
7597c478bd9Sstevel@tonic-gate
7607c478bd9Sstevel@tonic-gate for (interface = &INTERFACES[0]; interface->mac_type != -1;
7617c478bd9Sstevel@tonic-gate interface++)
7627c478bd9Sstevel@tonic-gate if (interface->mac_type == device_mac_type)
7637c478bd9Sstevel@tonic-gate break;
7647c478bd9Sstevel@tonic-gate
7657c478bd9Sstevel@tonic-gate if (interface->mac_type == -1)
7667c478bd9Sstevel@tonic-gate pr_err("Mac Type = %x is not supported\n",
7677c478bd9Sstevel@tonic-gate device_mac_type);
7687c478bd9Sstevel@tonic-gate } else {
7697c478bd9Sstevel@tonic-gate /* Use heuristic to check if it's an old-style file */
7707c478bd9Sstevel@tonic-gate
7717c478bd9Sstevel@tonic-gate device_mac_type = DL_ETHER;
7727c478bd9Sstevel@tonic-gate word = (int *)cap_buffp;
7737c478bd9Sstevel@tonic-gate
7747c478bd9Sstevel@tonic-gate if (!((word[0] < 1600 && word[1] < 1600) &&
7757c478bd9Sstevel@tonic-gate (word[0] < word[1]) &&
7767c478bd9Sstevel@tonic-gate (word[2] > 610000000 && word[2] < 770000000)))
7777c478bd9Sstevel@tonic-gate pr_err("not a capture file: %s", name);
7787c478bd9Sstevel@tonic-gate
7797c478bd9Sstevel@tonic-gate /* Change protection so's we can fix the headers */
7807c478bd9Sstevel@tonic-gate
7817c478bd9Sstevel@tonic-gate if (mprotect(cap_buffp, cap_len, PROT_READ | PROT_WRITE) < 0)
7827c478bd9Sstevel@tonic-gate pr_err("mprotect: %s: %m", name);
7837c478bd9Sstevel@tonic-gate }
7847c478bd9Sstevel@tonic-gate }
7857c478bd9Sstevel@tonic-gate
7867c478bd9Sstevel@tonic-gate void
cap_read(int first,int last,int filter,void (* proc)(),int flags)787c7e4935fSss150715 cap_read(int first, int last, int filter, void (*proc)(), int flags)
7887c478bd9Sstevel@tonic-gate {
7897c478bd9Sstevel@tonic-gate extern int count;
7907c478bd9Sstevel@tonic-gate
7917c478bd9Sstevel@tonic-gate count = 0;
7927c478bd9Sstevel@tonic-gate
7937c478bd9Sstevel@tonic-gate scan(cap_buffp, cap_len, filter, 1, !cap_new, proc, first, last, flags);
7947c478bd9Sstevel@tonic-gate
79545916cd2Sjpk (void) munmap(cap_buffp, cap_len);
7967c478bd9Sstevel@tonic-gate }
7977c478bd9Sstevel@tonic-gate
7987c478bd9Sstevel@tonic-gate void
cap_write(struct sb_hdr * hdrp,char * pktp,int num __unused,int flags __unused)799*a04d7b7bSToomas Soome cap_write(struct sb_hdr *hdrp, char *pktp, int num __unused, int flags __unused)
8007c478bd9Sstevel@tonic-gate {
801*a04d7b7bSToomas Soome int pktlen;
8027c478bd9Sstevel@tonic-gate struct sb_hdr nhdr;
8037c478bd9Sstevel@tonic-gate extern boolean_t qflg;
8047c478bd9Sstevel@tonic-gate
8057c478bd9Sstevel@tonic-gate if (hdrp == NULL)
8067c478bd9Sstevel@tonic-gate return;
8077c478bd9Sstevel@tonic-gate
808*a04d7b7bSToomas Soome if (capfile_out.capfile_count != 0) {
809*a04d7b7bSToomas Soome off_t cur_off;
810*a04d7b7bSToomas Soome
811*a04d7b7bSToomas Soome cur_off = lseek(capfile_out.capfile_curfd, 0, SEEK_CUR);
812*a04d7b7bSToomas Soome if (cur_off >= capfile_out.capfile_size_limit) {
813*a04d7b7bSToomas Soome cap_switch_file();
814*a04d7b7bSToomas Soome }
8157c478bd9Sstevel@tonic-gate }
8167c478bd9Sstevel@tonic-gate
8177c478bd9Sstevel@tonic-gate pktlen = hdrp->sbh_totlen - sizeof (*hdrp);
8187c478bd9Sstevel@tonic-gate
8197c478bd9Sstevel@tonic-gate /*
8207c478bd9Sstevel@tonic-gate * Convert sb_hdr to network byte order
8217c478bd9Sstevel@tonic-gate */
8227c478bd9Sstevel@tonic-gate nhdr.sbh_origlen = htonl(hdrp->sbh_origlen);
8237c478bd9Sstevel@tonic-gate nhdr.sbh_msglen = htonl(hdrp->sbh_msglen);
8247c478bd9Sstevel@tonic-gate nhdr.sbh_totlen = htonl(hdrp->sbh_totlen);
8257c478bd9Sstevel@tonic-gate nhdr.sbh_drops = htonl(hdrp->sbh_drops);
8267c478bd9Sstevel@tonic-gate nhdr.sbh_timestamp.tv_sec = htonl(hdrp->sbh_timestamp.tv_sec);
8277c478bd9Sstevel@tonic-gate nhdr.sbh_timestamp.tv_usec = htonl(hdrp->sbh_timestamp.tv_usec);
8287c478bd9Sstevel@tonic-gate
829*a04d7b7bSToomas Soome if (nwrite(capfile_out.capfile_curfd, &nhdr, sizeof (nhdr)) == -1)
8307c478bd9Sstevel@tonic-gate cap_write_error("packet header");
8317c478bd9Sstevel@tonic-gate
832*a04d7b7bSToomas Soome if (nwrite(capfile_out.capfile_curfd, pktp, pktlen) == -1)
8337c478bd9Sstevel@tonic-gate cap_write_error("packet");
8347c478bd9Sstevel@tonic-gate
8357c478bd9Sstevel@tonic-gate if (!qflg)
8367c478bd9Sstevel@tonic-gate show_count();
8377c478bd9Sstevel@tonic-gate }
8387c478bd9Sstevel@tonic-gate
8397c478bd9Sstevel@tonic-gate /*
8407c478bd9Sstevel@tonic-gate * Convert a packet header from
8417c478bd9Sstevel@tonic-gate * old to new format.
8427c478bd9Sstevel@tonic-gate */
84345916cd2Sjpk static void
convert_old(struct ohdr * ohdrp)84445916cd2Sjpk convert_old(struct ohdr *ohdrp)
8457c478bd9Sstevel@tonic-gate {
8467c478bd9Sstevel@tonic-gate struct sb_hdr nhdr;
8477c478bd9Sstevel@tonic-gate
8487c478bd9Sstevel@tonic-gate nhdr.sbh_origlen = ohdrp->o_len;
8497c478bd9Sstevel@tonic-gate nhdr.sbh_msglen = ohdrp->o_msglen;
8507c478bd9Sstevel@tonic-gate nhdr.sbh_totlen = ohdrp->o_totlen;
8517c478bd9Sstevel@tonic-gate nhdr.sbh_drops = ohdrp->o_drops;
8527c478bd9Sstevel@tonic-gate nhdr.sbh_timestamp = ohdrp->o_time;
8537c478bd9Sstevel@tonic-gate
8547c478bd9Sstevel@tonic-gate *(struct sb_hdr *)ohdrp = nhdr;
8557c478bd9Sstevel@tonic-gate }
8567c478bd9Sstevel@tonic-gate
8572e3b6467Skcpoon static int
strioctl(int fd,int cmd,int timout,int len,void * dp)85845916cd2Sjpk strioctl(int fd, int cmd, int timout, int len, void *dp)
8597c478bd9Sstevel@tonic-gate {
8607c478bd9Sstevel@tonic-gate struct strioctl sioc;
8617c478bd9Sstevel@tonic-gate int rc;
8627c478bd9Sstevel@tonic-gate
8637c478bd9Sstevel@tonic-gate sioc.ic_cmd = cmd;
8647c478bd9Sstevel@tonic-gate sioc.ic_timout = timout;
8657c478bd9Sstevel@tonic-gate sioc.ic_len = len;
8667c478bd9Sstevel@tonic-gate sioc.ic_dp = dp;
8677c478bd9Sstevel@tonic-gate rc = ioctl(fd, I_STR, &sioc);
8687c478bd9Sstevel@tonic-gate
8697c478bd9Sstevel@tonic-gate if (rc < 0)
8707c478bd9Sstevel@tonic-gate return (rc);
8717c478bd9Sstevel@tonic-gate else
8727c478bd9Sstevel@tonic-gate return (sioc.ic_len);
8737c478bd9Sstevel@tonic-gate }
874