1 /* $NetBSD: dlpisubs.c,v 1.2 2014/11/19 19:33:30 christos Exp $ */ 2 3 /* 4 * This code is derived from code formerly in pcap-dlpi.c, originally 5 * contributed by Atanu Ghosh (atanu@cs.ucl.ac.uk), University College 6 * London, and subsequently modified by Guy Harris (guy@alum.mit.edu), 7 * Mark Pizzolato <List-tcpdump-workers@subscriptions.pizzolato.net>, 8 * Mark C. Brown (mbrown@hp.com), and Sagun Shakya <Sagun.Shakya@Sun.COM>. 9 */ 10 11 /* 12 * This file contains dlpi/libdlpi related common functions used 13 * by pcap-[dlpi,libdlpi].c. 14 */ 15 16 #include <sys/cdefs.h> 17 __RCSID("$NetBSD: dlpisubs.c,v 1.2 2014/11/19 19:33:30 christos Exp $"); 18 19 #ifdef HAVE_CONFIG_H 20 #include "config.h" 21 #endif 22 23 #ifndef DL_IPATM 24 #define DL_IPATM 0x12 /* ATM Classical IP interface */ 25 #endif 26 27 #ifdef HAVE_SYS_BUFMOD_H 28 /* 29 * Size of a bufmod chunk to pass upstream; that appears to be the 30 * biggest value to which you can set it, and setting it to that value 31 * (which is bigger than what appears to be the Solaris default of 8192) 32 * reduces the number of packet drops. 33 */ 34 #define CHUNKSIZE 65536 35 36 /* 37 * Size of the buffer to allocate for packet data we read; it must be 38 * large enough to hold a chunk. 39 */ 40 #define PKTBUFSIZE CHUNKSIZE 41 42 #else /* HAVE_SYS_BUFMOD_H */ 43 44 /* 45 * Size of the buffer to allocate for packet data we read; this is 46 * what the value used to be - there's no particular reason why it 47 * should be tied to MAXDLBUF, but we'll leave it as this for now. 48 */ 49 #define MAXDLBUF 8192 50 #define PKTBUFSIZE (MAXDLBUF * sizeof(bpf_u_int32)) 51 52 #endif 53 54 #include <sys/types.h> 55 #include <sys/time.h> 56 #ifdef HAVE_SYS_BUFMOD_H 57 #include <sys/bufmod.h> 58 #endif 59 #include <sys/dlpi.h> 60 #include <sys/stream.h> 61 62 #include <errno.h> 63 #include <memory.h> 64 #include <stdio.h> 65 #include <stdlib.h> 66 #include <string.h> 67 #include <stropts.h> 68 #include <unistd.h> 69 70 #ifdef HAVE_LIBDLPI 71 #include <libdlpi.h> 72 #endif 73 74 #include "pcap-int.h" 75 #include "dlpisubs.h" 76 77 #ifdef HAVE_SYS_BUFMOD_H 78 static void pcap_stream_err(const char *, int, char *); 79 #endif 80 81 /* 82 * Get the packet statistics. 83 */ 84 int 85 pcap_stats_dlpi(pcap_t *p, struct pcap_stat *ps) 86 { 87 struct pcap_dlpi *pd = p->priv; 88 89 /* 90 * "ps_recv" counts packets handed to the filter, not packets 91 * that passed the filter. As filtering is done in userland, 92 * this would not include packets dropped because we ran out 93 * of buffer space; in order to make this more like other 94 * platforms (Linux 2.4 and later, BSDs with BPF), where the 95 * "packets received" count includes packets received but dropped 96 * due to running out of buffer space, and to keep from confusing 97 * applications that, for example, compute packet drop percentages, 98 * we also make it count packets dropped by "bufmod" (otherwise we 99 * might run the risk of the packet drop count being bigger than 100 * the received-packet count). 101 * 102 * "ps_drop" counts packets dropped by "bufmod" because of 103 * flow control requirements or resource exhaustion; it doesn't 104 * count packets dropped by the interface driver, or packets 105 * dropped upstream. As filtering is done in userland, it counts 106 * packets regardless of whether they would've passed the filter. 107 * 108 * These statistics don't include packets not yet read from 109 * the kernel by libpcap, but they may include packets not 110 * yet read from libpcap by the application. 111 */ 112 *ps = pd->stat; 113 114 /* 115 * Add in the drop count, as per the above comment. 116 */ 117 ps->ps_recv += ps->ps_drop; 118 return (0); 119 } 120 121 /* 122 * Loop through the packets and call the callback for each packet. 123 * Return the number of packets read. 124 */ 125 int 126 pcap_process_pkts(pcap_t *p, pcap_handler callback, u_char *user, 127 int count, u_char *bufp, int len) 128 { 129 struct pcap_dlpi *pd = p->priv; 130 int n, caplen, origlen; 131 u_char *ep, *pk; 132 struct pcap_pkthdr pkthdr; 133 #ifdef HAVE_SYS_BUFMOD_H 134 struct sb_hdr *sbp; 135 #ifdef LBL_ALIGN 136 struct sb_hdr sbhdr; 137 #endif 138 #endif 139 140 /* Loop through packets */ 141 ep = bufp + len; 142 n = 0; 143 144 #ifdef HAVE_SYS_BUFMOD_H 145 while (bufp < ep) { 146 /* 147 * Has "pcap_breakloop()" been called? 148 * If so, return immediately - if we haven't read any 149 * packets, clear the flag and return -2 to indicate 150 * that we were told to break out of the loop, otherwise 151 * leave the flag set, so that the *next* call will break 152 * out of the loop without having read any packets, and 153 * return the number of packets we've processed so far. 154 */ 155 if (p->break_loop) { 156 if (n == 0) { 157 p->break_loop = 0; 158 return (-2); 159 } else { 160 p->bp = bufp; 161 p->cc = ep - bufp; 162 return (n); 163 } 164 } 165 #ifdef LBL_ALIGN 166 if ((long)bufp & 3) { 167 sbp = &sbhdr; 168 memcpy(sbp, bufp, sizeof(*sbp)); 169 } else 170 #endif 171 sbp = (struct sb_hdr *)bufp; 172 pd->stat.ps_drop = sbp->sbh_drops; 173 pk = bufp + sizeof(*sbp); 174 bufp += sbp->sbh_totlen; 175 origlen = sbp->sbh_origlen; 176 caplen = sbp->sbh_msglen; 177 #else 178 origlen = len; 179 caplen = min(p->snapshot, len); 180 pk = bufp; 181 bufp += caplen; 182 #endif 183 ++pd->stat.ps_recv; 184 if (bpf_filter(p->fcode.bf_insns, pk, origlen, caplen)) { 185 #ifdef HAVE_SYS_BUFMOD_H 186 pkthdr.ts.tv_sec = sbp->sbh_timestamp.tv_sec; 187 pkthdr.ts.tv_usec = sbp->sbh_timestamp.tv_usec; 188 #else 189 (void) gettimeofday(&pkthdr.ts, NULL); 190 #endif 191 pkthdr.len = origlen; 192 pkthdr.caplen = caplen; 193 /* Insure caplen does not exceed snapshot */ 194 if (pkthdr.caplen > p->snapshot) 195 pkthdr.caplen = p->snapshot; 196 (*callback)(user, &pkthdr, pk); 197 if (++n >= count && !PACKET_COUNT_IS_UNLIMITED(count)) { 198 p->cc = ep - bufp; 199 p->bp = bufp; 200 return (n); 201 } 202 } 203 #ifdef HAVE_SYS_BUFMOD_H 204 } 205 #endif 206 p->cc = 0; 207 return (n); 208 } 209 210 /* 211 * Process the mac type. Returns -1 if no matching mac type found, otherwise 0. 212 */ 213 int 214 pcap_process_mactype(pcap_t *p, u_int mactype) 215 { 216 int retv = 0; 217 218 switch (mactype) { 219 220 case DL_CSMACD: 221 case DL_ETHER: 222 p->linktype = DLT_EN10MB; 223 p->offset = 2; 224 /* 225 * This is (presumably) a real Ethernet capture; give it a 226 * link-layer-type list with DLT_EN10MB and DLT_DOCSIS, so 227 * that an application can let you choose it, in case you're 228 * capturing DOCSIS traffic that a Cisco Cable Modem 229 * Termination System is putting out onto an Ethernet (it 230 * doesn't put an Ethernet header onto the wire, it puts raw 231 * DOCSIS frames out on the wire inside the low-level 232 * Ethernet framing). 233 */ 234 p->dlt_list = (u_int *)malloc(sizeof(u_int) * 2); 235 /* 236 * If that fails, just leave the list empty. 237 */ 238 if (p->dlt_list != NULL) { 239 p->dlt_list[0] = DLT_EN10MB; 240 p->dlt_list[1] = DLT_DOCSIS; 241 p->dlt_count = 2; 242 } 243 break; 244 245 case DL_FDDI: 246 p->linktype = DLT_FDDI; 247 p->offset = 3; 248 break; 249 250 case DL_TPR: 251 /* XXX - what about DL_TPB? Is that Token Bus? */ 252 p->linktype = DLT_IEEE802; 253 p->offset = 2; 254 break; 255 256 #ifdef HAVE_SOLARIS 257 case DL_IPATM: 258 p->linktype = DLT_SUNATM; 259 p->offset = 0; /* works for LANE and LLC encapsulation */ 260 break; 261 #endif 262 263 default: 264 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "unknown mactype %u", 265 mactype); 266 retv = -1; 267 } 268 269 return (retv); 270 } 271 272 #ifdef HAVE_SYS_BUFMOD_H 273 /* 274 * Push and configure the buffer module. Returns -1 for error, otherwise 0. 275 */ 276 int 277 pcap_conf_bufmod(pcap_t *p, int snaplen) 278 { 279 struct timeval to; 280 bpf_u_int32 ss, chunksize; 281 282 /* Non-standard call to get the data nicely buffered. */ 283 if (ioctl(p->fd, I_PUSH, "bufmod") != 0) { 284 pcap_stream_err("I_PUSH bufmod", errno, p->errbuf); 285 return (-1); 286 } 287 288 ss = snaplen; 289 if (ss > 0 && 290 strioctl(p->fd, SBIOCSSNAP, sizeof(ss), (char *)&ss) != 0) { 291 pcap_stream_err("SBIOCSSNAP", errno, p->errbuf); 292 return (-1); 293 } 294 295 if (p->opt.immediate) { 296 /* Set the timeout to zero, for immediate delivery. */ 297 to.tv_sec = 0; 298 to.tv_usec = 0; 299 if (strioctl(p->fd, SBIOCSTIME, sizeof(to), (char *)&to) != 0) { 300 pcap_stream_err("SBIOCSTIME", errno, p->errbuf); 301 return (-1); 302 } 303 } else { 304 /* Set up the bufmod timeout. */ 305 if (p->opt.timeout != 0) { 306 to.tv_sec = p->opt.timeout / 1000; 307 to.tv_usec = (p->opt.timeout * 1000) % 1000000; 308 if (strioctl(p->fd, SBIOCSTIME, sizeof(to), (char *)&to) != 0) { 309 pcap_stream_err("SBIOCSTIME", errno, p->errbuf); 310 return (-1); 311 } 312 } 313 314 /* Set the chunk length. */ 315 chunksize = CHUNKSIZE; 316 if (strioctl(p->fd, SBIOCSCHUNK, sizeof(chunksize), (char *)&chunksize) 317 != 0) { 318 pcap_stream_err("SBIOCSCHUNKP", errno, p->errbuf); 319 return (-1); 320 } 321 } 322 323 return (0); 324 } 325 #endif /* HAVE_SYS_BUFMOD_H */ 326 327 /* 328 * Allocate data buffer. Returns -1 if memory allocation fails, else 0. 329 */ 330 int 331 pcap_alloc_databuf(pcap_t *p) 332 { 333 p->bufsize = PKTBUFSIZE; 334 p->buffer = (u_char *)malloc(p->bufsize + p->offset); 335 if (p->buffer == NULL) { 336 strlcpy(p->errbuf, pcap_strerror(errno), PCAP_ERRBUF_SIZE); 337 return (-1); 338 } 339 340 return (0); 341 } 342 343 /* 344 * Issue a STREAMS I_STR ioctl. Returns -1 on error, otherwise 345 * length of returned data on success. 346 */ 347 int 348 strioctl(int fd, int cmd, int len, char *dp) 349 { 350 struct strioctl str; 351 int retv; 352 353 str.ic_cmd = cmd; 354 str.ic_timout = -1; 355 str.ic_len = len; 356 str.ic_dp = dp; 357 if ((retv = ioctl(fd, I_STR, &str)) < 0) 358 return (retv); 359 360 return (str.ic_len); 361 } 362 363 #ifdef HAVE_SYS_BUFMOD_H 364 /* 365 * Write stream error message to errbuf. 366 */ 367 static void 368 pcap_stream_err(const char *func, int err, char *errbuf) 369 { 370 snprintf(errbuf, PCAP_ERRBUF_SIZE, "%s: %s", func, pcap_strerror(err)); 371 } 372 #endif 373