1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  * Copyright 2012 Milan Jurik. All rights reserved.
25  */
26 
27 #include <stdio.h>
28 #include <string.h>
29 #include <strings.h>
30 #include <errno.h>
31 #include <fcntl.h>
32 #include <setjmp.h>
33 #include <sys/types.h>
34 #include <sys/signal.h>
35 #include <sys/time.h>
36 #include <sys/socket.h>
37 #include <sys/sockio.h>
38 #include <netinet/in.h>
39 #include <netinet/ip.h>
40 #include <sys/pfmod.h>
41 #include <sys/mman.h>
42 #include <sys/stat.h>
43 #include <sys/bufmod.h>
44 
45 #include <unistd.h>
46 #include <stropts.h>
47 #include <stdlib.h>
48 #include <ctype.h>
49 #include <values.h>
50 #include <libdlpi.h>
51 
52 #include "snoop.h"
53 
54 /*
55  * Old header format.
56  * Actually two concatenated structs:  nit_bufhdr + nit_head
57  */
58 struct ohdr {
59 	/* nit_bufhdr */
60 	int	o_msglen;
61 	int	o_totlen;
62 	/* nit_head */
63 	struct timeval o_time;
64 	int	o_drops;
65 	int	o_len;
66 };
67 
68 static void scan(char *, int, int, int, int, void (*)(), int, int, int);
69 void convert_to_network();
70 void convert_from_network();
71 static void convert_old(struct ohdr *);
72 extern sigjmp_buf jmp_env, ojmp_env;
73 static char *bufp;	/* pointer to read buffer */
74 
75 static int strioctl(int, int, int, int, void *);
76 
77 enum { DWA_NONE, DWA_EXISTS, DWA_PLUMBED };
78 
79 typedef struct dlpi_walk_arg {
80 	char	dwa_linkname[MAXLINKNAMELEN];
81 	int	dwa_type;	/* preference type above */
82 	int	dwa_s4;		/* IPv4 socket */
83 	int	dwa_s6;		/* IPv6 socket */
84 } dlpi_walk_arg_t;
85 
86 static boolean_t
87 select_datalink(const char *linkname, void *arg)
88 {
89 	struct lifreq lifr;
90 	dlpi_walk_arg_t *dwap = arg;
91 	int s4 = dwap->dwa_s4;
92 	int s6 = dwap->dwa_s6;
93 
94 	(void) strlcpy(dwap->dwa_linkname, linkname, MAXLINKNAMELEN);
95 	dwap->dwa_type = DWA_EXISTS;
96 
97 	/*
98 	 * See if it's plumbed by IP.  We prefer such links because they're
99 	 * more likely to have interesting traffic.
100 	 */
101 	bzero(&lifr, sizeof (lifr));
102 	(void) strlcpy(lifr.lifr_name, linkname, LIFNAMSIZ);
103 	if ((s4 != -1 && ioctl(s4, SIOCGLIFFLAGS, &lifr) != -1) ||
104 	    (s6 != -1 && ioctl(s6, SIOCGLIFFLAGS, &lifr) != -1)) {
105 		dwap->dwa_type = DWA_PLUMBED;
106 		return (B_TRUE);
107 	}
108 	return (B_FALSE);
109 }
110 
111 /*
112  * Open `linkname' in raw/passive mode (see dlpi_open(3DLPI)).  If `linkname'
113  * is NULL, pick a datalink as per snoop(1M).  Also gather some information
114  * about the datalink useful for building the proper packet filters.
115  */
116 boolean_t
117 open_datalink(dlpi_handle_t *dhp, const char *linkname)
118 {
119 	int retval;
120 	int flags = DLPI_PASSIVE | DLPI_RAW;
121 	dlpi_walk_arg_t dwa;
122 	dlpi_info_t dlinfo;
123 
124 	if (linkname == NULL) {
125 		/*
126 		 * Select a datalink to use by default.  Prefer datalinks that
127 		 * are plumbed by IP.
128 		 */
129 		bzero(&dwa, sizeof (dwa));
130 		dwa.dwa_s4 = socket(AF_INET, SOCK_DGRAM, 0);
131 		dwa.dwa_s6 = socket(AF_INET6, SOCK_DGRAM, 0);
132 		dlpi_walk(select_datalink, &dwa, 0);
133 		(void) close(dwa.dwa_s4);
134 		(void) close(dwa.dwa_s6);
135 
136 		if (dwa.dwa_type == DWA_NONE)
137 			pr_err("no datalinks found");
138 		if (dwa.dwa_type == DWA_EXISTS) {
139 			(void) fprintf(stderr, "snoop: WARNING: "
140 			    "no datalinks plumbed for IP traffic\n");
141 		}
142 		linkname = dwa.dwa_linkname;
143 	}
144 	if (Iflg)
145 		flags |= DLPI_DEVIPNET;
146 	if (Iflg || strcmp(linkname, "lo0") == 0)
147 		flags |= DLPI_IPNETINFO;
148 	if ((retval = dlpi_open(linkname, dhp, flags)) != DLPI_SUCCESS) {
149 		pr_err("cannot open \"%s\": %s", linkname,
150 		    dlpi_strerror(retval));
151 	}
152 
153 	if ((retval = dlpi_info(*dhp, &dlinfo, 0)) != DLPI_SUCCESS)
154 		pr_errdlpi(*dhp, "dlpi_info failed", retval);
155 
156 	for (interface = &INTERFACES[0]; interface->mac_type != -1; interface++)
157 		if (interface->mac_type == dlinfo.di_mactype)
158 			break;
159 
160 	/* allow limited functionality even if interface isn't known */
161 	if (interface->mac_type == -1) {
162 		(void) fprintf(stderr, "snoop: WARNING: Mac Type = %x "
163 		    "not supported\n", dlinfo.di_mactype);
164 	}
165 
166 	return (interface->try_kernel_filter);
167 }
168 
169 /*
170  * Initialize `dh' for packet capture using the provided arguments.
171  */
172 void
173 init_datalink(dlpi_handle_t dh, ulong_t snaplen, ulong_t chunksize,
174     struct timeval *timeout, struct Pf_ext_packetfilt *fp)
175 {
176 	int 	retv;
177 	int 	netfd;
178 
179 	retv = dlpi_bind(dh, DLPI_ANY_SAP, NULL);
180 	if (retv != DLPI_SUCCESS)
181 		pr_errdlpi(dh, "cannot bind on", retv);
182 
183 	if (Iflg) {
184 		(void) fprintf(stderr, "Using device ipnet/%s ",
185 		    dlpi_linkname(dh));
186 	} else {
187 		(void) fprintf(stderr, "Using device %s ", dlpi_linkname(dh));
188 	}
189 
190 	/*
191 	 * If Pflg not set - use physical level
192 	 * promiscuous mode.  Otherwise - just SAP level.
193 	 */
194 	if (!Pflg) {
195 		(void) fprintf(stderr, "(promiscuous mode)\n");
196 		retv = dlpi_promiscon(dh, DL_PROMISC_PHYS);
197 		if (retv != DLPI_SUCCESS) {
198 			pr_errdlpi(dh, "promiscuous mode(physical) failed",
199 			    retv);
200 		}
201 	} else {
202 		(void) fprintf(stderr, "(non promiscuous)\n");
203 		retv = dlpi_promiscon(dh, DL_PROMISC_MULTI);
204 		if (retv != DLPI_SUCCESS) {
205 			pr_errdlpi(dh, "promiscuous mode(multicast) failed",
206 			    retv);
207 		}
208 	}
209 
210 	retv = dlpi_promiscon(dh, DL_PROMISC_SAP);
211 	if (retv != DLPI_SUCCESS)
212 		pr_errdlpi(dh, "promiscuous mode(SAP) failed", retv);
213 
214 	netfd = dlpi_fd(dh);
215 
216 	if (fp) {
217 		/*
218 		 * push and configure the packet filtering module
219 		 */
220 		if (ioctl(netfd, I_PUSH, "pfmod") < 0)
221 			pr_errdlpi(dh, "cannot push \"pfmod\"", DL_SYSERR);
222 
223 		if (strioctl(netfd, PFIOCSETF, -1, sizeof (*fp),
224 		    (char *)fp) < 0)
225 			pr_errdlpi(dh, "PFIOCSETF", DL_SYSERR);
226 	}
227 
228 	if (ioctl(netfd, I_PUSH, "bufmod") < 0)
229 		pr_errdlpi(dh, "cannot push \"bufmod\"", DL_SYSERR);
230 
231 	if (strioctl(netfd, SBIOCSTIME, -1, sizeof (struct timeval),
232 	    (char *)timeout) < 0)
233 		pr_errdlpi(dh, "SBIOCSTIME", DL_SYSERR);
234 
235 	if (strioctl(netfd, SBIOCSCHUNK, -1, sizeof (uint_t),
236 	    (char *)&chunksize) < 0)
237 		pr_errdlpi(dh, "SBIOCGCHUNK", DL_SYSERR);
238 
239 	if (strioctl(netfd, SBIOCSSNAP, -1, sizeof (uint_t),
240 	    (char *)&snaplen) < 0)
241 		pr_errdlpi(dh, "SBIOCSSNAP", DL_SYSERR);
242 
243 	/*
244 	 * Flush the read queue, to get rid of anything that
245 	 * accumulated before the device reached its final configuration.
246 	 */
247 	if (ioctl(netfd, I_FLUSH, FLUSHR) < 0)
248 		pr_errdlpi(dh, "cannot flush \"I_FLUSH\"", DL_SYSERR);
249 }
250 
251 /*
252  * Read packets from the network.  init_datalink() is called in
253  * here to set up the network interface for reading of
254  * raw ethernet packets in promiscuous mode into a buffer.
255  * Packets are read and either written directly to a file
256  * or interpreted for display on the fly.
257  */
258 void
259 net_read(dlpi_handle_t dh, size_t chunksize, int filter, void (*proc)(),
260     int flags)
261 {
262 	int 	retval;
263 	extern int count;
264 	size_t	msglen;
265 
266 	count = 0;
267 
268 	/* allocate a read buffer */
269 	bufp = malloc(chunksize);
270 	if (bufp == NULL)
271 		pr_err("no memory for %d buffer", chunksize);
272 
273 	/*
274 	 * read frames
275 	 */
276 	for (;;) {
277 		msglen = chunksize;
278 		retval = dlpi_recv(dh, NULL, NULL, bufp, &msglen, -1, NULL);
279 
280 		if (retval != DLPI_SUCCESS || quitting)
281 			break;
282 
283 		if (msglen != 0)
284 			scan(bufp, msglen, filter, 0, 0, proc, 0, 0, flags);
285 	}
286 
287 	free(bufp);
288 
289 	if (!quitting)
290 		pr_errdlpi(dh, "network read failed", retval);
291 }
292 
293 #ifdef DEBUG
294 /*
295  * corrupt: simulate packet corruption for debugging interpreters
296  */
297 void
298 corrupt(volatile char *pktp, volatile char *pstop, char *buf,
299 	volatile char *bufstop)
300 {
301 	int c;
302 	int i;
303 	int p;
304 	int li = rand() % (pstop - pktp - 1) + 1;
305 	volatile char *pp = pktp;
306 	volatile char *pe = bufstop < pstop ? bufstop : pstop;
307 
308 	if (pktp < buf || pktp > bufstop)
309 		return;
310 
311 	for (pp = pktp; pp < pe; pp += li) {
312 		c = ((pe - pp) < li ? pe - pp : li);
313 		i = (rand() % c)>>1;
314 		while (--i > 0) {
315 			p = (rand() % c);
316 			pp[p] = (unsigned char)(rand() & 0xFF);
317 		}
318 	}
319 }
320 #endif /* DEBUG */
321 
322 static void
323 scan(char *buf, int len, int filter, int cap, int old, void (*proc)(),
324     int first, int last, int flags)
325 {
326 	volatile char *bp, *bufstop;
327 	volatile struct sb_hdr *hdrp;
328 	volatile struct sb_hdr nhdr, *nhdrp;
329 	volatile char *pktp;
330 	volatile struct timeval last_timestamp;
331 	volatile int header_okay;
332 	extern int count, maxcount;
333 	extern int snoop_nrecover;
334 #ifdef	DEBUG
335 	extern int zflg;
336 #endif	/* DEBUG */
337 
338 	proc(0, 0, 0);
339 	bufstop = buf + len;
340 
341 	/*
342 	 *
343 	 * Loop through each packet in the buffer
344 	 */
345 	last_timestamp.tv_sec = 0;
346 	(void) memcpy((char *)ojmp_env, (char *)jmp_env, sizeof (jmp_env));
347 	for (bp = buf; bp < bufstop; bp += nhdrp->sbh_totlen) {
348 		/*
349 		 * Gracefully exit if user terminates
350 		 */
351 		if (quitting)
352 			break;
353 		/*
354 		 * Global error recocery: Prepare to continue when a corrupt
355 		 * packet or header is encountered.
356 		 */
357 		if (sigsetjmp(jmp_env, 1)) {
358 			goto err;
359 		}
360 
361 		header_okay = 0;
362 		hdrp = (struct sb_hdr *)bp;
363 		nhdrp = hdrp;
364 		pktp = (char *)hdrp + sizeof (*hdrp);
365 
366 		/*
367 		 * If reading a capture file
368 		 * convert the headers from network
369 		 * byte order (for little-endians like X86)
370 		 */
371 		if (cap) {
372 			/*
373 			 * If the packets come from an old
374 			 * capture file, convert the header.
375 			 */
376 			if (old) {
377 				convert_old((struct ohdr *)hdrp);
378 			}
379 
380 			nhdrp = &nhdr;
381 
382 			nhdrp->sbh_origlen = ntohl(hdrp->sbh_origlen);
383 			nhdrp->sbh_msglen = ntohl(hdrp->sbh_msglen);
384 			nhdrp->sbh_totlen = ntohl(hdrp->sbh_totlen);
385 			nhdrp->sbh_drops = ntohl(hdrp->sbh_drops);
386 			nhdrp->sbh_timestamp.tv_sec =
387 			    ntohl(hdrp->sbh_timestamp.tv_sec);
388 			nhdrp->sbh_timestamp.tv_usec =
389 			    ntohl(hdrp->sbh_timestamp.tv_usec);
390 		}
391 
392 		/* Enhanced check for valid header */
393 
394 		if ((nhdrp->sbh_totlen == 0) ||
395 		    (bp + nhdrp->sbh_totlen) < bp ||
396 		    (bp + nhdrp->sbh_totlen) > bufstop ||
397 		    (nhdrp->sbh_origlen == 0) ||
398 		    (bp + nhdrp->sbh_origlen) < bp ||
399 		    (nhdrp->sbh_msglen == 0) ||
400 		    (bp + nhdrp->sbh_msglen) < bp ||
401 		    (bp + nhdrp->sbh_msglen) > bufstop ||
402 		    (nhdrp->sbh_msglen > nhdrp->sbh_origlen) ||
403 		    (nhdrp->sbh_totlen < nhdrp->sbh_msglen) ||
404 		    (nhdrp->sbh_timestamp.tv_sec == 0)) {
405 			if (cap) {
406 				(void) fprintf(stderr, "(warning) bad packet "
407 				    "header in capture file");
408 			} else {
409 				(void) fprintf(stderr, "(warning) bad packet "
410 				    "header in buffer");
411 			}
412 			(void) fprintf(stderr, " offset %d: length=%d\n",
413 			    bp - buf, nhdrp->sbh_totlen);
414 			goto err;
415 		}
416 
417 		/*
418 		 * Check for incomplete packet.  We are conservative here,
419 		 * since we don't know how good the checking is in other
420 		 * parts of the code.  We pass a partial packet, with
421 		 * a warning.
422 		 */
423 		if (pktp + nhdrp->sbh_msglen > bufstop) {
424 			(void) fprintf(stderr, "truncated packet buffer\n");
425 			nhdrp->sbh_msglen = bufstop - pktp;
426 		}
427 
428 #ifdef DEBUG
429 		if (zflg)
430 			corrupt(pktp, pktp + nhdrp->sbh_msglen, buf, bufstop);
431 #endif /* DEBUG */
432 
433 		header_okay = 1;
434 		if (!filter ||
435 		    want_packet((uchar_t *)pktp,
436 		    nhdrp->sbh_msglen,
437 		    nhdrp->sbh_origlen)) {
438 			count++;
439 
440 			/*
441 			 * Start deadman timer for interpreter processing
442 			 */
443 			(void) snoop_alarm(SNOOP_ALARM_GRAN*SNOOP_MAXRECOVER,
444 			    NULL);
445 
446 			encap_levels = 0;
447 			if (!cap || count >= first)
448 				proc(nhdrp, pktp, count, flags);
449 
450 			if (cap && count >= last) {
451 				(void) snoop_alarm(0, NULL);
452 				break;
453 			}
454 
455 			if (maxcount && count >= maxcount) {
456 				(void) fprintf(stderr, "%d packets captured\n",
457 				    count);
458 				exit(0);
459 			}
460 
461 			snoop_nrecover = 0;			/* success */
462 			(void) snoop_alarm(0, NULL);
463 			last_timestamp = hdrp->sbh_timestamp;	/* save stamp */
464 		}
465 		continue;
466 err:
467 		/*
468 		 * Corruption has been detected. Reset errors.
469 		 */
470 		snoop_recover();
471 
472 		/*
473 		 * packet header was apparently okay. Continue.
474 		 */
475 		if (header_okay)
476 			continue;
477 
478 		/*
479 		 * Otherwise try to scan forward to the next packet, using
480 		 * the last known timestamp if it is available.
481 		 */
482 		nhdrp = &nhdr;
483 		nhdrp->sbh_totlen = 0;
484 		if (last_timestamp.tv_sec == 0) {
485 			bp += sizeof (int);
486 		} else {
487 			for (bp += sizeof (int); bp <= bufstop;
488 			    bp += sizeof (int)) {
489 				hdrp = (struct sb_hdr *)bp;
490 				/* An approximate timestamp located */
491 				if ((hdrp->sbh_timestamp.tv_sec >> 8) ==
492 				    (last_timestamp.tv_sec >> 8))
493 					break;
494 			}
495 		}
496 	}
497 	/* reset jmp_env for program exit */
498 	(void) memcpy((char *)jmp_env, (char *)ojmp_env, sizeof (jmp_env));
499 	proc(0, -1, 0);
500 }
501 
502 /*
503  * Called if nwrite() encounters write problems.
504  */
505 static void
506 cap_write_error(const char *msgtype)
507 {
508 	(void) fprintf(stderr,
509 	    "snoop: cannot write %s to capture file: %s\n",
510 	    msgtype, strerror(errno));
511 	exit(1);
512 }
513 
514 /*
515  * Writes target buffer to the open file descriptor. Upon detection of a short
516  * write, an attempt to process the remaining bytes occurs until all anticipated
517  * bytes are written. An error status is returned to indicate any serious write
518  * failures.
519  */
520 static int
521 nwrite(int fd, const void *buffer, size_t buflen)
522 {
523 	size_t nwritten;
524 	ssize_t nbytes = 0;
525 	const char *buf = buffer;
526 
527 	for (nwritten = 0; nwritten < buflen; nwritten += nbytes) {
528 		nbytes = write(fd, &buf[nwritten], buflen - nwritten);
529 		if (nbytes == -1)
530 			return (-1);
531 		if (nbytes == 0) {
532 			errno = EIO;
533 			return (-1);
534 		}
535 	}
536 	return (0);
537 }
538 
539 /*
540  * Routines for opening, closing, reading and writing
541  * a capture file of packets saved with the -o option.
542  */
543 static int capfile_out;
544 
545 /*
546  * The snoop capture file has a header to identify
547  * it as a capture file and record its version.
548  * A file without this header is assumed to be an
549  * old format snoop file.
550  *
551  * A version 1 header looks like this:
552  *
553  *   0   1   2   3   4   5   6   7   8   9  10  11
554  * +---+---+---+---+---+---+---+---+---+---+---+---+---+
555  * | s | n | o | o | p | \0| \0| \0|    version    |  data
556  * +---+---+---+---+---+---+---+---+---+---+---+---+---+
557  * |	 word 0	   |	 word 1	   |	 word 2	   |
558  *
559  *
560  * A version 2 header adds a word that identifies the MAC type.
561  * This allows for capture files from FDDI etc.
562  *
563  *   0   1   2   3   4   5   6   7   8   9  10  11  12  13  14  15
564  * +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
565  * | s | n | o | o | p | \0| \0| \0|    version    |    MAC type   | data
566  * +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
567  * |	 word 0	   |	 word 1	   |	 word 2	   |	 word 3
568  *
569  */
570 static const char *snoop_id = "snoop\0\0\0";
571 static const int snoop_idlen = 8;
572 static const int snoop_version = 2;
573 
574 void
575 cap_open_write(const char *name)
576 {
577 	int vers;
578 
579 	capfile_out = open(name, O_CREAT | O_TRUNC | O_RDWR, 0666);
580 	if (capfile_out < 0)
581 		pr_err("%s: %m", name);
582 
583 	vers = htonl(snoop_version);
584 	if (nwrite(capfile_out, snoop_id, snoop_idlen) == -1)
585 		cap_write_error("snoop_id");
586 
587 	if (nwrite(capfile_out, &vers, sizeof (int)) == -1)
588 		cap_write_error("version");
589 }
590 
591 
592 void
593 cap_close(void)
594 {
595 	(void) close(capfile_out);
596 }
597 
598 static char *cap_buffp = NULL;
599 static int cap_len = 0;
600 static int cap_new;
601 
602 void
603 cap_open_read(const char *name)
604 {
605 	struct stat st;
606 	int cap_vers;
607 	int *word;
608 	int device_mac_type = -1;
609 	int capfile_in;
610 
611 	capfile_in = open(name, O_RDONLY);
612 	if (capfile_in < 0)
613 		pr_err("couldn't open %s: %m", name);
614 
615 	if (fstat(capfile_in, &st) < 0)
616 		pr_err("couldn't stat %s: %m", name);
617 	cap_len = st.st_size;
618 
619 	cap_buffp = mmap(0, cap_len, PROT_READ, MAP_PRIVATE, capfile_in, 0);
620 	(void) close(capfile_in);
621 	if ((int)cap_buffp == -1)
622 		pr_err("couldn't mmap %s: %m", name);
623 
624 	/* Check if new snoop capture file format */
625 
626 	cap_new = bcmp(cap_buffp, snoop_id, snoop_idlen) == 0;
627 
628 	/*
629 	 * If new file - check version and
630 	 * set buffer pointer to point at first packet
631 	 */
632 	if (cap_new) {
633 		cap_vers = ntohl(*(int *)(cap_buffp + snoop_idlen));
634 		cap_buffp += snoop_idlen + sizeof (int);
635 		cap_len   -= snoop_idlen + sizeof (int);
636 
637 		switch (cap_vers) {
638 		case 1:
639 			device_mac_type = DL_ETHER;
640 			break;
641 
642 		case 2:
643 			device_mac_type = ntohl(*((int *)cap_buffp));
644 			cap_buffp += sizeof (int);
645 			cap_len   -= sizeof (int);
646 			break;
647 
648 		default:
649 			pr_err("capture file: %s: Version %d unrecognized\n",
650 			    name, cap_vers);
651 		}
652 
653 		for (interface = &INTERFACES[0]; interface->mac_type != -1;
654 		    interface++)
655 			if (interface->mac_type == device_mac_type)
656 				break;
657 
658 		if (interface->mac_type == -1)
659 			pr_err("Mac Type = %x is not supported\n",
660 			    device_mac_type);
661 	} else {
662 		/* Use heuristic to check if it's an old-style file */
663 
664 		device_mac_type = DL_ETHER;
665 		word = (int *)cap_buffp;
666 
667 		if (!((word[0] < 1600 && word[1] < 1600) &&
668 		    (word[0] < word[1]) &&
669 		    (word[2] > 610000000 && word[2] < 770000000)))
670 			pr_err("not a capture file: %s", name);
671 
672 		/* Change protection so's we can fix the headers */
673 
674 		if (mprotect(cap_buffp, cap_len, PROT_READ | PROT_WRITE) < 0)
675 			pr_err("mprotect: %s: %m", name);
676 	}
677 }
678 
679 void
680 cap_read(int first, int last, int filter, void (*proc)(), int flags)
681 {
682 	extern int count;
683 
684 	count = 0;
685 
686 	scan(cap_buffp, cap_len, filter, 1, !cap_new, proc, first, last, flags);
687 
688 	(void) munmap(cap_buffp, cap_len);
689 }
690 
691 /* ARGSUSED */
692 void
693 cap_write(struct sb_hdr *hdrp, char *pktp, int num, int flags)
694 {
695 	int pktlen, mac;
696 	static int first = 1;
697 	struct sb_hdr nhdr;
698 	extern boolean_t qflg;
699 
700 	if (hdrp == NULL)
701 		return;
702 
703 	if (first) {
704 		first = 0;
705 		mac = htonl(interface->mac_type);
706 		if (nwrite(capfile_out, &mac, sizeof (int)) == -1)
707 			cap_write_error("mac_type");
708 	}
709 
710 	pktlen = hdrp->sbh_totlen - sizeof (*hdrp);
711 
712 	/*
713 	 * Convert sb_hdr to network byte order
714 	 */
715 	nhdr.sbh_origlen = htonl(hdrp->sbh_origlen);
716 	nhdr.sbh_msglen = htonl(hdrp->sbh_msglen);
717 	nhdr.sbh_totlen = htonl(hdrp->sbh_totlen);
718 	nhdr.sbh_drops = htonl(hdrp->sbh_drops);
719 	nhdr.sbh_timestamp.tv_sec = htonl(hdrp->sbh_timestamp.tv_sec);
720 	nhdr.sbh_timestamp.tv_usec = htonl(hdrp->sbh_timestamp.tv_usec);
721 
722 	if (nwrite(capfile_out, &nhdr, sizeof (nhdr)) == -1)
723 		cap_write_error("packet header");
724 
725 	if (nwrite(capfile_out, pktp, pktlen) == -1)
726 		cap_write_error("packet");
727 
728 	if (! qflg)
729 		show_count();
730 }
731 
732 /*
733  * Convert a packet header from
734  * old to new format.
735  */
736 static void
737 convert_old(struct ohdr *ohdrp)
738 {
739 	struct sb_hdr nhdr;
740 
741 	nhdr.sbh_origlen = ohdrp->o_len;
742 	nhdr.sbh_msglen  = ohdrp->o_msglen;
743 	nhdr.sbh_totlen  = ohdrp->o_totlen;
744 	nhdr.sbh_drops   = ohdrp->o_drops;
745 	nhdr.sbh_timestamp = ohdrp->o_time;
746 
747 	*(struct sb_hdr *)ohdrp = nhdr;
748 }
749 
750 static int
751 strioctl(int fd, int cmd, int timout, int len, void *dp)
752 {
753 	struct	strioctl	sioc;
754 	int	rc;
755 
756 	sioc.ic_cmd = cmd;
757 	sioc.ic_timout = timout;
758 	sioc.ic_len = len;
759 	sioc.ic_dp = dp;
760 	rc = ioctl(fd, I_STR, &sioc);
761 
762 	if (rc < 0)
763 		return (rc);
764 	else
765 		return (sioc.ic_len);
766 }
767