1 /* 2 * This code is derived from code formerly in pcap-dlpi.c, originally 3 * contributed by Atanu Ghosh (atanu@cs.ucl.ac.uk), University College 4 * London, and subsequently modified by Guy Harris (guy@alum.mit.edu), 5 * Mark Pizzolato <List-tcpdump-workers@subscriptions.pizzolato.net>, 6 * Mark C. Brown (mbrown@hp.com), and Sagun Shakya <Sagun.Shakya@Sun.COM>. 7 */ 8 9 /* 10 * This file contains dlpi/libdlpi related common functions used 11 * by pcap-[dlpi,libdlpi].c. 12 */ 13 #ifndef lint 14 static const char rcsid[] _U_ = 15 "@(#) $Header: /tcpdump/master/libpcap/dlpisubs.c,v 1.1.2.2 2008-04-04 19:39:05 guy Exp $ (LBL)"; 16 #endif 17 18 #ifdef HAVE_CONFIG_H 19 #include "config.h" 20 #endif 21 22 #ifdef HAVE_SYS_BUFMOD_H 23 /* 24 * Size of a bufmod chunk to pass upstream; that appears to be the 25 * biggest value to which you can set it, and setting it to that value 26 * (which is bigger than what appears to be the Solaris default of 8192) 27 * reduces the number of packet drops. 28 */ 29 #define CHUNKSIZE 65536 30 31 /* 32 * Size of the buffer to allocate for packet data we read; it must be 33 * large enough to hold a chunk. 34 */ 35 #define PKTBUFSIZE CHUNKSIZE 36 37 #else /* HAVE_SYS_BUFMOD_H */ 38 39 /* 40 * Size of the buffer to allocate for packet data we read; this is 41 * what the value used to be - there's no particular reason why it 42 * should be tied to MAXDLBUF, but we'll leave it as this for now. 43 */ 44 #define PKTBUFSIZE (MAXDLBUF * sizeof(bpf_u_int32)) 45 46 #endif 47 48 #include <sys/types.h> 49 #include <sys/time.h> 50 #ifdef HAVE_SYS_BUFMOD_H 51 #include <sys/bufmod.h> 52 #endif 53 #include <sys/dlpi.h> 54 #include <sys/stream.h> 55 56 #include <errno.h> 57 #include <memory.h> 58 #include <stdio.h> 59 #include <stdlib.h> 60 #include <string.h> 61 #include <stropts.h> 62 #include <unistd.h> 63 64 #include "pcap-int.h" 65 #include "dlpisubs.h" 66 67 static void pcap_stream_err(const char *, int, char *); 68 69 /* 70 * Get the packet statistics. 71 */ 72 int 73 pcap_stats_dlpi(pcap_t *p, struct pcap_stat *ps) 74 { 75 76 /* 77 * "ps_recv" counts packets handed to the filter, not packets 78 * that passed the filter. As filtering is done in userland, 79 * this would not include packets dropped because we ran out 80 * of buffer space; in order to make this more like other 81 * platforms (Linux 2.4 and later, BSDs with BPF), where the 82 * "packets received" count includes packets received but dropped 83 * due to running out of buffer space, and to keep from confusing 84 * applications that, for example, compute packet drop percentages, 85 * we also make it count packets dropped by "bufmod" (otherwise we 86 * might run the risk of the packet drop count being bigger than 87 * the received-packet count). 88 * 89 * "ps_drop" counts packets dropped by "bufmod" because of 90 * flow control requirements or resource exhaustion; it doesn't 91 * count packets dropped by the interface driver, or packets 92 * dropped upstream. As filtering is done in userland, it counts 93 * packets regardless of whether they would've passed the filter. 94 * 95 * These statistics don't include packets not yet read from 96 * the kernel by libpcap, but they may include packets not 97 * yet read from libpcap by the application. 98 */ 99 *ps = p->md.stat; 100 101 /* 102 * Add in the drop count, as per the above comment. 103 */ 104 ps->ps_recv += ps->ps_drop; 105 return (0); 106 } 107 108 /* 109 * Loop through the packets and call the callback for each packet. 110 * Return the number of packets read. 111 */ 112 int 113 pcap_process_pkts(pcap_t *p, pcap_handler callback, u_char *user, 114 int count, u_char *bufp, int len) 115 { 116 int n, caplen, origlen; 117 u_char *ep, *pk; 118 struct pcap_pkthdr pkthdr; 119 #ifdef HAVE_SYS_BUFMOD_H 120 struct sb_hdr *sbp; 121 #ifdef LBL_ALIGN 122 struct sb_hdr sbhdr; 123 #endif 124 #endif 125 126 /* Loop through packets */ 127 ep = bufp + len; 128 n = 0; 129 130 #ifdef HAVE_SYS_BUFMOD_H 131 while (bufp < ep) { 132 /* 133 * Has "pcap_breakloop()" been called? 134 * If so, return immediately - if we haven't read any 135 * packets, clear the flag and return -2 to indicate 136 * that we were told to break out of the loop, otherwise 137 * leave the flag set, so that the *next* call will break 138 * out of the loop without having read any packets, and 139 * return the number of packets we've processed so far. 140 */ 141 if (p->break_loop) { 142 if (n == 0) { 143 p->break_loop = 0; 144 return (-2); 145 } else { 146 p->bp = bufp; 147 p->cc = ep - bufp; 148 return (n); 149 } 150 } 151 #ifdef LBL_ALIGN 152 if ((long)bufp & 3) { 153 sbp = &sbhdr; 154 memcpy(sbp, bufp, sizeof(*sbp)); 155 } else 156 #endif 157 sbp = (struct sb_hdr *)bufp; 158 p->md.stat.ps_drop = sbp->sbh_drops; 159 pk = bufp + sizeof(*sbp); 160 bufp += sbp->sbh_totlen; 161 origlen = sbp->sbh_origlen; 162 caplen = sbp->sbh_msglen; 163 #else 164 origlen = len; 165 caplen = min(p->snapshot, len); 166 pk = bufp; 167 bufp += caplen; 168 #endif 169 ++p->md.stat.ps_recv; 170 if (bpf_filter(p->fcode.bf_insns, pk, origlen, caplen)) { 171 #ifdef HAVE_SYS_BUFMOD_H 172 pkthdr.ts.tv_sec = sbp->sbh_timestamp.tv_sec; 173 pkthdr.ts.tv_usec = sbp->sbh_timestamp.tv_usec; 174 #else 175 (void) gettimeofday(&pkthdr.ts, NULL); 176 #endif 177 pkthdr.len = origlen; 178 pkthdr.caplen = caplen; 179 /* Insure caplen does not exceed snapshot */ 180 if (pkthdr.caplen > p->snapshot) 181 pkthdr.caplen = p->snapshot; 182 (*callback)(user, &pkthdr, pk); 183 if (++n >= count && count >= 0) { 184 p->cc = ep - bufp; 185 p->bp = bufp; 186 return (n); 187 } 188 } 189 #ifdef HAVE_SYS_BUFMOD_H 190 } 191 #endif 192 p->cc = 0; 193 return (n); 194 } 195 196 /* 197 * Process the mac type. Returns -1 if no matching mac type found, otherwise 0. 198 */ 199 int 200 pcap_process_mactype(pcap_t *p, u_int mactype) 201 { 202 int retv = 0; 203 204 switch (mactype) { 205 206 case DL_CSMACD: 207 case DL_ETHER: 208 p->linktype = DLT_EN10MB; 209 p->offset = 2; 210 /* 211 * This is (presumably) a real Ethernet capture; give it a 212 * link-layer-type list with DLT_EN10MB and DLT_DOCSIS, so 213 * that an application can let you choose it, in case you're 214 * capturing DOCSIS traffic that a Cisco Cable Modem 215 * Termination System is putting out onto an Ethernet (it 216 * doesn't put an Ethernet header onto the wire, it puts raw 217 * DOCSIS frames out on the wire inside the low-level 218 * Ethernet framing). 219 */ 220 p->dlt_list = (u_int *)malloc(sizeof(u_int) * 2); 221 /* 222 * If that fails, just leave the list empty. 223 */ 224 if (p->dlt_list != NULL) { 225 p->dlt_list[0] = DLT_EN10MB; 226 p->dlt_list[1] = DLT_DOCSIS; 227 p->dlt_count = 2; 228 } 229 break; 230 231 case DL_FDDI: 232 p->linktype = DLT_FDDI; 233 p->offset = 3; 234 break; 235 236 case DL_TPR: 237 /* XXX - what about DL_TPB? Is that Token Bus? */ 238 p->linktype = DLT_IEEE802; 239 p->offset = 2; 240 break; 241 242 #ifdef HAVE_SOLARIS 243 case DL_IPATM: 244 p->linktype = DLT_SUNATM; 245 p->offset = 0; /* works for LANE and LLC encapsulation */ 246 break; 247 #endif 248 249 default: 250 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "unknown mactype %u", 251 mactype); 252 retv = -1; 253 } 254 255 return (retv); 256 } 257 258 #ifdef HAVE_SYS_BUFMOD_H 259 /* 260 * Push and configure the buffer module. Returns -1 for error, otherwise 0. 261 */ 262 int 263 pcap_conf_bufmod(pcap_t *p, int snaplen, int timeout) 264 { 265 int retv = 0; 266 267 bpf_u_int32 ss, chunksize; 268 269 /* Non-standard call to get the data nicely buffered. */ 270 if (ioctl(p->fd, I_PUSH, "bufmod") != 0) { 271 pcap_stream_err("I_PUSH bufmod", errno, p->errbuf); 272 retv = -1; 273 } 274 275 ss = snaplen; 276 if (ss > 0 && 277 strioctl(p->fd, SBIOCSSNAP, sizeof(ss), (char *)&ss) != 0) { 278 pcap_stream_err("SBIOCSSNAP", errno, p->errbuf); 279 retv = -1; 280 } 281 282 /* Set up the bufmod timeout. */ 283 if (timeout != 0) { 284 struct timeval to; 285 286 to.tv_sec = timeout / 1000; 287 to.tv_usec = (timeout * 1000) % 1000000; 288 if (strioctl(p->fd, SBIOCSTIME, sizeof(to), (char *)&to) != 0) { 289 pcap_stream_err("SBIOCSTIME", errno, p->errbuf); 290 retv = -1; 291 } 292 } 293 294 /* Set the chunk length. */ 295 chunksize = CHUNKSIZE; 296 if (strioctl(p->fd, SBIOCSCHUNK, sizeof(chunksize), (char *)&chunksize) 297 != 0) { 298 pcap_stream_err("SBIOCSCHUNKP", errno, p->errbuf); 299 retv = -1; 300 } 301 302 return (retv); 303 } 304 #endif /* HAVE_SYS_BUFMOD_H */ 305 306 /* 307 * Allocate data buffer. Returns -1 if memory allocation fails, else 0. 308 */ 309 int 310 pcap_alloc_databuf(pcap_t *p) 311 { 312 p->bufsize = PKTBUFSIZE; 313 p->buffer = (u_char *)malloc(p->bufsize + p->offset); 314 if (p->buffer == NULL) { 315 strlcpy(p->errbuf, pcap_strerror(errno), PCAP_ERRBUF_SIZE); 316 return (-1); 317 } 318 319 return (0); 320 } 321 322 /* 323 * Issue a STREAMS I_STR ioctl. Returns -1 on error, otherwise 324 * length of returned data on success. 325 */ 326 int 327 strioctl(int fd, int cmd, int len, char *dp) 328 { 329 struct strioctl str; 330 int retv; 331 332 str.ic_cmd = cmd; 333 str.ic_timout = -1; 334 str.ic_len = len; 335 str.ic_dp = dp; 336 if ((retv = ioctl(fd, I_STR, &str)) < 0) 337 return (retv); 338 339 return (str.ic_len); 340 } 341 342 /* 343 * Write stream error message to errbuf. 344 */ 345 static void 346 pcap_stream_err(const char *func, int err, char *errbuf) 347 { 348 snprintf(errbuf, PCAP_ERRBUF_SIZE, "%s: %s", func, pcap_strerror(err)); 349 } 350