1 /* $NetBSD: dlpisubs.c,v 1.2 2014/11/19 19:33:30 christos Exp $ */
2
3 /*
4 * This code is derived from code formerly in pcap-dlpi.c, originally
5 * contributed by Atanu Ghosh (atanu@cs.ucl.ac.uk), University College
6 * London, and subsequently modified by Guy Harris (guy@alum.mit.edu),
7 * Mark Pizzolato <List-tcpdump-workers@subscriptions.pizzolato.net>,
8 * Mark C. Brown (mbrown@hp.com), and Sagun Shakya <Sagun.Shakya@Sun.COM>.
9 */
10
11 /*
12 * This file contains dlpi/libdlpi related common functions used
13 * by pcap-[dlpi,libdlpi].c.
14 */
15
16 #include <sys/cdefs.h>
17 __RCSID("$NetBSD: dlpisubs.c,v 1.2 2014/11/19 19:33:30 christos Exp $");
18
19 #ifdef HAVE_CONFIG_H
20 #include "config.h"
21 #endif
22
23 #ifndef DL_IPATM
24 #define DL_IPATM 0x12 /* ATM Classical IP interface */
25 #endif
26
27 #ifdef HAVE_SYS_BUFMOD_H
28 /*
29 * Size of a bufmod chunk to pass upstream; that appears to be the
30 * biggest value to which you can set it, and setting it to that value
31 * (which is bigger than what appears to be the Solaris default of 8192)
32 * reduces the number of packet drops.
33 */
34 #define CHUNKSIZE 65536
35
36 /*
37 * Size of the buffer to allocate for packet data we read; it must be
38 * large enough to hold a chunk.
39 */
40 #define PKTBUFSIZE CHUNKSIZE
41
42 #else /* HAVE_SYS_BUFMOD_H */
43
44 /*
45 * Size of the buffer to allocate for packet data we read; this is
46 * what the value used to be - there's no particular reason why it
47 * should be tied to MAXDLBUF, but we'll leave it as this for now.
48 */
49 #define MAXDLBUF 8192
50 #define PKTBUFSIZE (MAXDLBUF * sizeof(bpf_u_int32))
51
52 #endif
53
54 #include <sys/types.h>
55 #include <sys/time.h>
56 #ifdef HAVE_SYS_BUFMOD_H
57 #include <sys/bufmod.h>
58 #endif
59 #include <sys/dlpi.h>
60 #include <sys/stream.h>
61
62 #include <errno.h>
63 #include <memory.h>
64 #include <stdio.h>
65 #include <stdlib.h>
66 #include <string.h>
67 #include <stropts.h>
68 #include <unistd.h>
69
70 #ifdef HAVE_LIBDLPI
71 #include <libdlpi.h>
72 #endif
73
74 #include "pcap-int.h"
75 #include "dlpisubs.h"
76
77 #ifdef HAVE_SYS_BUFMOD_H
78 static void pcap_stream_err(const char *, int, char *);
79 #endif
80
81 /*
82 * Get the packet statistics.
83 */
84 int
pcap_stats_dlpi(pcap_t * p,struct pcap_stat * ps)85 pcap_stats_dlpi(pcap_t *p, struct pcap_stat *ps)
86 {
87 struct pcap_dlpi *pd = p->priv;
88
89 /*
90 * "ps_recv" counts packets handed to the filter, not packets
91 * that passed the filter. As filtering is done in userland,
92 * this would not include packets dropped because we ran out
93 * of buffer space; in order to make this more like other
94 * platforms (Linux 2.4 and later, BSDs with BPF), where the
95 * "packets received" count includes packets received but dropped
96 * due to running out of buffer space, and to keep from confusing
97 * applications that, for example, compute packet drop percentages,
98 * we also make it count packets dropped by "bufmod" (otherwise we
99 * might run the risk of the packet drop count being bigger than
100 * the received-packet count).
101 *
102 * "ps_drop" counts packets dropped by "bufmod" because of
103 * flow control requirements or resource exhaustion; it doesn't
104 * count packets dropped by the interface driver, or packets
105 * dropped upstream. As filtering is done in userland, it counts
106 * packets regardless of whether they would've passed the filter.
107 *
108 * These statistics don't include packets not yet read from
109 * the kernel by libpcap, but they may include packets not
110 * yet read from libpcap by the application.
111 */
112 *ps = pd->stat;
113
114 /*
115 * Add in the drop count, as per the above comment.
116 */
117 ps->ps_recv += ps->ps_drop;
118 return (0);
119 }
120
121 /*
122 * Loop through the packets and call the callback for each packet.
123 * Return the number of packets read.
124 */
125 int
pcap_process_pkts(pcap_t * p,pcap_handler callback,u_char * user,int count,u_char * bufp,int len)126 pcap_process_pkts(pcap_t *p, pcap_handler callback, u_char *user,
127 int count, u_char *bufp, int len)
128 {
129 struct pcap_dlpi *pd = p->priv;
130 int n, caplen, origlen;
131 u_char *ep, *pk;
132 struct pcap_pkthdr pkthdr;
133 #ifdef HAVE_SYS_BUFMOD_H
134 struct sb_hdr *sbp;
135 #ifdef LBL_ALIGN
136 struct sb_hdr sbhdr;
137 #endif
138 #endif
139
140 /* Loop through packets */
141 ep = bufp + len;
142 n = 0;
143
144 #ifdef HAVE_SYS_BUFMOD_H
145 while (bufp < ep) {
146 /*
147 * Has "pcap_breakloop()" been called?
148 * If so, return immediately - if we haven't read any
149 * packets, clear the flag and return -2 to indicate
150 * that we were told to break out of the loop, otherwise
151 * leave the flag set, so that the *next* call will break
152 * out of the loop without having read any packets, and
153 * return the number of packets we've processed so far.
154 */
155 if (p->break_loop) {
156 if (n == 0) {
157 p->break_loop = 0;
158 return (-2);
159 } else {
160 p->bp = bufp;
161 p->cc = ep - bufp;
162 return (n);
163 }
164 }
165 #ifdef LBL_ALIGN
166 if ((long)bufp & 3) {
167 sbp = &sbhdr;
168 memcpy(sbp, bufp, sizeof(*sbp));
169 } else
170 #endif
171 sbp = (struct sb_hdr *)bufp;
172 pd->stat.ps_drop = sbp->sbh_drops;
173 pk = bufp + sizeof(*sbp);
174 bufp += sbp->sbh_totlen;
175 origlen = sbp->sbh_origlen;
176 caplen = sbp->sbh_msglen;
177 #else
178 origlen = len;
179 caplen = min(p->snapshot, len);
180 pk = bufp;
181 bufp += caplen;
182 #endif
183 ++pd->stat.ps_recv;
184 if (bpf_filter(p->fcode.bf_insns, pk, origlen, caplen)) {
185 #ifdef HAVE_SYS_BUFMOD_H
186 pkthdr.ts.tv_sec = sbp->sbh_timestamp.tv_sec;
187 pkthdr.ts.tv_usec = sbp->sbh_timestamp.tv_usec;
188 #else
189 (void) gettimeofday(&pkthdr.ts, NULL);
190 #endif
191 pkthdr.len = origlen;
192 pkthdr.caplen = caplen;
193 /* Insure caplen does not exceed snapshot */
194 if (pkthdr.caplen > p->snapshot)
195 pkthdr.caplen = p->snapshot;
196 (*callback)(user, &pkthdr, pk);
197 if (++n >= count && !PACKET_COUNT_IS_UNLIMITED(count)) {
198 p->cc = ep - bufp;
199 p->bp = bufp;
200 return (n);
201 }
202 }
203 #ifdef HAVE_SYS_BUFMOD_H
204 }
205 #endif
206 p->cc = 0;
207 return (n);
208 }
209
210 /*
211 * Process the mac type. Returns -1 if no matching mac type found, otherwise 0.
212 */
213 int
pcap_process_mactype(pcap_t * p,u_int mactype)214 pcap_process_mactype(pcap_t *p, u_int mactype)
215 {
216 int retv = 0;
217
218 switch (mactype) {
219
220 case DL_CSMACD:
221 case DL_ETHER:
222 p->linktype = DLT_EN10MB;
223 p->offset = 2;
224 /*
225 * This is (presumably) a real Ethernet capture; give it a
226 * link-layer-type list with DLT_EN10MB and DLT_DOCSIS, so
227 * that an application can let you choose it, in case you're
228 * capturing DOCSIS traffic that a Cisco Cable Modem
229 * Termination System is putting out onto an Ethernet (it
230 * doesn't put an Ethernet header onto the wire, it puts raw
231 * DOCSIS frames out on the wire inside the low-level
232 * Ethernet framing).
233 */
234 p->dlt_list = (u_int *)malloc(sizeof(u_int) * 2);
235 /*
236 * If that fails, just leave the list empty.
237 */
238 if (p->dlt_list != NULL) {
239 p->dlt_list[0] = DLT_EN10MB;
240 p->dlt_list[1] = DLT_DOCSIS;
241 p->dlt_count = 2;
242 }
243 break;
244
245 case DL_FDDI:
246 p->linktype = DLT_FDDI;
247 p->offset = 3;
248 break;
249
250 case DL_TPR:
251 /* XXX - what about DL_TPB? Is that Token Bus? */
252 p->linktype = DLT_IEEE802;
253 p->offset = 2;
254 break;
255
256 #ifdef HAVE_SOLARIS
257 case DL_IPATM:
258 p->linktype = DLT_SUNATM;
259 p->offset = 0; /* works for LANE and LLC encapsulation */
260 break;
261 #endif
262
263 default:
264 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "unknown mactype %u",
265 mactype);
266 retv = -1;
267 }
268
269 return (retv);
270 }
271
272 #ifdef HAVE_SYS_BUFMOD_H
273 /*
274 * Push and configure the buffer module. Returns -1 for error, otherwise 0.
275 */
276 int
pcap_conf_bufmod(pcap_t * p,int snaplen)277 pcap_conf_bufmod(pcap_t *p, int snaplen)
278 {
279 struct timeval to;
280 bpf_u_int32 ss, chunksize;
281
282 /* Non-standard call to get the data nicely buffered. */
283 if (ioctl(p->fd, I_PUSH, "bufmod") != 0) {
284 pcap_stream_err("I_PUSH bufmod", errno, p->errbuf);
285 return (-1);
286 }
287
288 ss = snaplen;
289 if (ss > 0 &&
290 strioctl(p->fd, SBIOCSSNAP, sizeof(ss), (char *)&ss) != 0) {
291 pcap_stream_err("SBIOCSSNAP", errno, p->errbuf);
292 return (-1);
293 }
294
295 if (p->opt.immediate) {
296 /* Set the timeout to zero, for immediate delivery. */
297 to.tv_sec = 0;
298 to.tv_usec = 0;
299 if (strioctl(p->fd, SBIOCSTIME, sizeof(to), (char *)&to) != 0) {
300 pcap_stream_err("SBIOCSTIME", errno, p->errbuf);
301 return (-1);
302 }
303 } else {
304 /* Set up the bufmod timeout. */
305 if (p->opt.timeout != 0) {
306 to.tv_sec = p->opt.timeout / 1000;
307 to.tv_usec = (p->opt.timeout * 1000) % 1000000;
308 if (strioctl(p->fd, SBIOCSTIME, sizeof(to), (char *)&to) != 0) {
309 pcap_stream_err("SBIOCSTIME", errno, p->errbuf);
310 return (-1);
311 }
312 }
313
314 /* Set the chunk length. */
315 chunksize = CHUNKSIZE;
316 if (strioctl(p->fd, SBIOCSCHUNK, sizeof(chunksize), (char *)&chunksize)
317 != 0) {
318 pcap_stream_err("SBIOCSCHUNKP", errno, p->errbuf);
319 return (-1);
320 }
321 }
322
323 return (0);
324 }
325 #endif /* HAVE_SYS_BUFMOD_H */
326
327 /*
328 * Allocate data buffer. Returns -1 if memory allocation fails, else 0.
329 */
330 int
pcap_alloc_databuf(pcap_t * p)331 pcap_alloc_databuf(pcap_t *p)
332 {
333 p->bufsize = PKTBUFSIZE;
334 p->buffer = (u_char *)malloc(p->bufsize + p->offset);
335 if (p->buffer == NULL) {
336 strlcpy(p->errbuf, pcap_strerror(errno), PCAP_ERRBUF_SIZE);
337 return (-1);
338 }
339
340 return (0);
341 }
342
343 /*
344 * Issue a STREAMS I_STR ioctl. Returns -1 on error, otherwise
345 * length of returned data on success.
346 */
347 int
strioctl(int fd,int cmd,int len,char * dp)348 strioctl(int fd, int cmd, int len, char *dp)
349 {
350 struct strioctl str;
351 int retv;
352
353 str.ic_cmd = cmd;
354 str.ic_timout = -1;
355 str.ic_len = len;
356 str.ic_dp = dp;
357 if ((retv = ioctl(fd, I_STR, &str)) < 0)
358 return (retv);
359
360 return (str.ic_len);
361 }
362
363 #ifdef HAVE_SYS_BUFMOD_H
364 /*
365 * Write stream error message to errbuf.
366 */
367 static void
pcap_stream_err(const char * func,int err,char * errbuf)368 pcap_stream_err(const char *func, int err, char *errbuf)
369 {
370 snprintf(errbuf, PCAP_ERRBUF_SIZE, "%s: %s", func, pcap_strerror(err));
371 }
372 #endif
373