1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 22 /* 23 * Copyright 2009 Sun Microsystems, Inc. All rights reserved. 24 * Use is subject to license terms. 25 * 26 * Copyright 2021 Joyent, Inc. 27 */ 28 29 #include <stdio.h> 30 #include <unistd.h> 31 #include <stropts.h> 32 #include <string.h> 33 #include <stdlib.h> 34 #include <fcntl.h> 35 #include <stdarg.h> 36 #include <setjmp.h> 37 #include <string.h> 38 #include <errno.h> 39 #include <sys/types.h> 40 #include <sys/time.h> 41 #include <signal.h> 42 #include <sys/mman.h> 43 #include <assert.h> 44 #include <sys/sysmacros.h> 45 46 #include <sys/socket.h> 47 #include <sys/pfmod.h> 48 #include <net/if.h> 49 #include <netinet/in_systm.h> 50 #include <netinet/in.h> 51 #include <netinet/if_ether.h> 52 #include <netdb.h> 53 54 #include "snoop.h" 55 56 static int snaplen; 57 58 /* Global error recovery variables */ 59 sigjmp_buf jmp_env, ojmp_env; /* error recovery jmp buf */ 60 int snoop_nrecover; /* number of recoveries on curr pkt */ 61 int quitting; /* user termination flag */ 62 63 static struct snoop_handler *snoop_hp; /* global alarm handler head */ 64 static struct snoop_handler *snoop_tp; /* global alarm handler tail */ 65 static time_t snoop_nalarm; /* time of next alarm */ 66 67 /* protected interpreter output areas */ 68 #define MAXSUM 8 69 #define REDZONE 64 70 static char *sumline[MAXSUM]; 71 static char *detail_line; 72 static char *line; 73 static char *encap; 74 75 static int audio; 76 int maxcount; /* maximum no of packets to capture */ 77 int count; /* count of packets captured */ 78 static int sumcount; 79 int x_offset = -1; 80 int x_length = 0x7fffffff; 81 FILE *namefile; 82 boolean_t Pflg; 83 boolean_t Iflg; 84 boolean_t fflg; 85 boolean_t qflg; 86 boolean_t rflg; 87 #ifdef DEBUG 88 boolean_t zflg; 89 #endif 90 struct Pf_ext_packetfilt pf; 91 92 static int vlanid = 0; 93 94 static void usage(void); 95 static void snoop_sigrecover(int sig, siginfo_t *info, void *p); 96 static char *protmalloc(size_t); 97 static void resetperm(void); 98 99 int 100 main(int argc, char **argv) 101 { 102 int c; 103 int filter = 0; 104 int flags = F_SUM; 105 struct Pf_ext_packetfilt *fp = NULL; 106 char *icapfile = NULL; 107 char *ocapfile = NULL; 108 boolean_t nflg = B_FALSE; 109 boolean_t Nflg = B_FALSE; 110 int Cflg = 0; 111 boolean_t Uflg = B_FALSE; 112 int first = 1; 113 int last = 0x7fffffff; 114 boolean_t use_kern_pf; 115 char *p, *p2; 116 char names[MAXPATHLEN + 1]; 117 char self[MAXHOSTNAMELEN + 1]; 118 char *argstr = NULL; 119 void (*proc)(); 120 char *audiodev; 121 int ret; 122 struct sigaction sigact; 123 stack_t sigstk; 124 char *output_area; 125 int nbytes; 126 char *datalink = NULL; 127 dlpi_handle_t dh; 128 129 names[0] = '\0'; 130 /* 131 * Global error recovery: Prepare for interpreter failures 132 * with corrupted packets or confused interpreters. 133 * Allocate protected output and stack areas, with generous 134 * red-zones. 135 */ 136 nbytes = (MAXSUM + 3) * (MAXLINE + REDZONE); 137 output_area = protmalloc(nbytes); 138 if (output_area == NULL) { 139 perror("Warning: mmap"); 140 exit(1); 141 } 142 143 /* Allocate protected output areas */ 144 for (ret = 0; ret < MAXSUM; ret++) { 145 sumline[ret] = (char *)output_area; 146 output_area += (MAXLINE + REDZONE); 147 } 148 detail_line = output_area; 149 output_area += MAXLINE + REDZONE; 150 line = output_area; 151 output_area += MAXLINE + REDZONE; 152 encap = output_area; 153 output_area += MAXLINE + REDZONE; 154 155 /* Initialize an alternate signal stack to increase robustness */ 156 if ((sigstk.ss_sp = (char *)malloc(SIGSTKSZ+REDZONE)) == NULL) { 157 perror("Warning: malloc"); 158 exit(1); 159 } 160 sigstk.ss_size = SIGSTKSZ; 161 sigstk.ss_flags = 0; 162 if (sigaltstack(&sigstk, (stack_t *)NULL) < 0) { 163 perror("Warning: sigaltstack"); 164 exit(1); 165 } 166 167 /* Initialize a master signal handler */ 168 sigact.sa_handler = NULL; 169 sigact.sa_sigaction = snoop_sigrecover; 170 (void) sigemptyset(&sigact.sa_mask); 171 sigact.sa_flags = SA_ONSTACK|SA_SIGINFO; 172 173 /* Register master signal handler */ 174 if (sigaction(SIGHUP, &sigact, (struct sigaction *)NULL) < 0) { 175 perror("Warning: sigaction"); 176 exit(1); 177 } 178 if (sigaction(SIGINT, &sigact, (struct sigaction *)NULL) < 0) { 179 perror("Warning: sigaction"); 180 exit(1); 181 } 182 if (sigaction(SIGQUIT, &sigact, (struct sigaction *)NULL) < 0) { 183 perror("Warning: sigaction"); 184 exit(1); 185 } 186 if (sigaction(SIGILL, &sigact, (struct sigaction *)NULL) < 0) { 187 perror("Warning: sigaction"); 188 exit(1); 189 } 190 if (sigaction(SIGTRAP, &sigact, (struct sigaction *)NULL) < 0) { 191 perror("Warning: sigaction"); 192 exit(1); 193 } 194 if (sigaction(SIGIOT, &sigact, (struct sigaction *)NULL) < 0) { 195 perror("Warning: sigaction"); 196 exit(1); 197 } 198 if (sigaction(SIGEMT, &sigact, (struct sigaction *)NULL) < 0) { 199 perror("Warning: sigaction"); 200 exit(1); 201 } 202 if (sigaction(SIGFPE, &sigact, (struct sigaction *)NULL) < 0) { 203 perror("Warning: sigaction"); 204 exit(1); 205 } 206 if (sigaction(SIGBUS, &sigact, (struct sigaction *)NULL) < 0) { 207 perror("Warning: sigaction"); 208 exit(1); 209 } 210 if (sigaction(SIGSEGV, &sigact, (struct sigaction *)NULL) < 0) { 211 perror("Warning: sigaction"); 212 exit(1); 213 } 214 if (sigaction(SIGSYS, &sigact, (struct sigaction *)NULL) < 0) { 215 perror("Warning: sigaction"); 216 exit(1); 217 } 218 if (sigaction(SIGALRM, &sigact, (struct sigaction *)NULL) < 0) { 219 perror("Warning: sigaction"); 220 exit(1); 221 } 222 if (sigaction(SIGTERM, &sigact, (struct sigaction *)NULL) < 0) { 223 perror("Warning: sigaction"); 224 exit(1); 225 } 226 227 /* Prepare for failure during program initialization/exit */ 228 if (sigsetjmp(jmp_env, 1)) { 229 exit(1); 230 } 231 (void) setvbuf(stdout, NULL, _IOLBF, BUFSIZ); 232 233 while ((c = getopt(argc, argv, "at:CPDSi:o:Nn:s:d:I:vVp:fc:x:U?rqz")) 234 != EOF) { 235 switch (c) { 236 case 'a': 237 audiodev = getenv("AUDIODEV"); 238 if (audiodev == NULL) 239 audiodev = "/dev/audio"; 240 audio = open(audiodev, O_WRONLY); 241 if (audio < 0) { 242 pr_err("Audio device %s: %m", 243 audiodev); 244 exit(1); 245 } 246 break; 247 case 't': 248 flags |= F_TIME; 249 switch (*optarg) { 250 case 'r': flags |= F_RTIME; break; 251 case 'a': flags |= F_ATIME; break; 252 case 'd': break; 253 default: usage(); 254 } 255 break; 256 case 'I': 257 if (datalink != NULL) 258 usage(); 259 Iflg = B_TRUE; 260 datalink = optarg; 261 break; 262 case 'P': 263 Pflg = B_TRUE; 264 break; 265 case 'D': 266 flags |= F_DROPS; 267 break; 268 case 'S': 269 flags |= F_LEN; 270 break; 271 case 'i': 272 icapfile = optarg; 273 break; 274 case 'o': 275 ocapfile = optarg; 276 break; 277 case 'N': 278 Nflg = B_TRUE; 279 break; 280 case 'n': 281 nflg = B_TRUE; 282 (void) strlcpy(names, optarg, MAXPATHLEN); 283 break; 284 case 's': 285 snaplen = atoi(optarg); 286 break; 287 case 'd': 288 if (Iflg) 289 usage(); 290 datalink = optarg; 291 break; 292 case 'v': 293 flags &= ~(F_SUM); 294 flags |= F_DTAIL; 295 break; 296 case 'V': 297 flags |= F_ALLSUM; 298 break; 299 case 'p': 300 p = optarg; 301 p2 = strpbrk(p, ",:-"); 302 if (p2 == NULL) { 303 first = last = atoi(p); 304 } else { 305 *p2++ = '\0'; 306 first = atoi(p); 307 last = atoi(p2); 308 } 309 break; 310 case 'f': 311 fflg = B_TRUE; 312 break; 313 case 'x': 314 p = optarg; 315 p2 = strpbrk(p, ",:-"); 316 if (p2 == NULL) { 317 x_offset = atoi(p); 318 x_length = -1; 319 } else { 320 *p2++ = '\0'; 321 x_offset = atoi(p); 322 x_length = atoi(p2); 323 } 324 break; 325 case 'c': 326 maxcount = atoi(optarg); 327 break; 328 case 'C': 329 Cflg = B_TRUE; 330 break; 331 case 'q': 332 qflg = B_TRUE; 333 break; 334 case 'r': 335 rflg = B_TRUE; 336 break; 337 case 'U': 338 Uflg = B_TRUE; 339 break; 340 #ifdef DEBUG 341 case 'z': 342 zflg = B_TRUE; 343 break; 344 #endif /* DEBUG */ 345 case '?': 346 default: 347 usage(); 348 } 349 } 350 351 if (argc > optind) 352 argstr = (char *)concat_args(&argv[optind], argc - optind); 353 354 /* 355 * Need to know before we decide on filtering method some things 356 * about the interface. So, go ahead and do part of the initialization 357 * now so we have that data. Note that if no datalink is specified, 358 * open_datalink() selects one and returns it. In an ideal world, 359 * it might be nice if the "correct" interface for the filter 360 * requested was chosen, but that's too hard. 361 */ 362 if (!icapfile) { 363 use_kern_pf = open_datalink(&dh, datalink); 364 } else { 365 use_kern_pf = B_FALSE; 366 cap_open_read(icapfile); 367 368 if (!nflg) { 369 names[0] = '\0'; 370 (void) strlcpy(names, icapfile, MAXPATHLEN); 371 (void) strlcat(names, ".names", MAXPATHLEN); 372 } 373 } 374 375 if (Uflg) 376 use_kern_pf = B_FALSE; 377 378 /* attempt to read .names file if it exists before filtering */ 379 if ((!Nflg) && names[0] != '\0') { 380 if (access(names, F_OK) == 0) { 381 load_names(names); 382 } else if (nflg) { 383 (void) fprintf(stderr, "%s not found\n", names); 384 exit(1); 385 } 386 } 387 388 if (argstr) { 389 if (use_kern_pf) { 390 ret = pf_compile(argstr, Cflg); 391 switch (ret) { 392 case 0: 393 filter++; 394 compile(argstr, Cflg); 395 break; 396 case 1: 397 fp = &pf; 398 break; 399 case 2: 400 fp = &pf; 401 filter++; 402 break; 403 } 404 } else { 405 filter++; 406 compile(argstr, Cflg); 407 } 408 409 if (Cflg) 410 exit(0); 411 } 412 413 if (flags & F_SUM) 414 flags |= F_WHO; 415 416 /* 417 * If the -o flag is set then capture packets 418 * directly to a file. Don't attempt to 419 * interpret them on the fly (F_NOW). 420 * Note: capture to file is much less likely 421 * to drop packets since we don't spend cpu 422 * cycles running through the interpreters 423 * and possibly hanging in address-to-name 424 * mappings through the name service. 425 */ 426 if (ocapfile) { 427 cap_open_write(ocapfile); 428 proc = cap_write; 429 } else { 430 flags |= F_NOW; 431 proc = process_pkt; 432 } 433 434 435 /* 436 * If the -i flag is set then get packets from 437 * the log file which has been previously captured 438 * with the -o option. 439 */ 440 if (icapfile) { 441 names[0] = '\0'; 442 (void) strlcpy(names, icapfile, MAXPATHLEN); 443 (void) strlcat(names, ".names", MAXPATHLEN); 444 445 if (Nflg) { 446 namefile = fopen(names, "w"); 447 if (namefile == NULL) { 448 perror(names); 449 exit(1); 450 } 451 flags = 0; 452 (void) fprintf(stderr, 453 "Creating name file %s\n", names); 454 } 455 456 if (flags & F_DTAIL) 457 flags = F_DTAIL; 458 else 459 flags |= F_NUM | F_TIME; 460 461 resetperm(); 462 cap_read(first, last, filter, proc, flags); 463 464 if (Nflg) 465 (void) fclose(namefile); 466 467 } else { 468 const int chunksize = 8 * 8192; 469 struct timeval timeout; 470 471 /* 472 * If listening to packets on audio 473 * then set the buffer timeout down 474 * to 1/10 sec. A higher value 475 * makes the audio "bursty". 476 */ 477 if (audio) { 478 timeout.tv_sec = 0; 479 timeout.tv_usec = 100000; 480 } else { 481 timeout.tv_sec = 1; 482 timeout.tv_usec = 0; 483 } 484 485 init_datalink(dh, snaplen, chunksize, &timeout, fp); 486 if (! qflg && ocapfile) 487 show_count(); 488 resetperm(); 489 net_read(dh, chunksize, filter, proc, flags); 490 dlpi_close(dh); 491 492 if (!(flags & F_NOW)) 493 (void) printf("\n"); 494 } 495 496 if (ocapfile) 497 cap_close(); 498 499 return (0); 500 } 501 502 static int tone[] = { 503 0x076113, 0x153333, 0x147317, 0x144311, 0x147315, 0x050353, 0x037103, 0x051106, 504 0x157155, 0x142723, 0x133273, 0x134664, 0x051712, 0x024465, 0x026447, 0x072473, 505 0x136715, 0x126257, 0x135256, 0x047344, 0x034476, 0x027464, 0x036062, 0x133334, 506 0x127256, 0x130660, 0x136262, 0x040724, 0x016446, 0x025437, 0x137171, 0x127672, 507 0x124655, 0x134654, 0x032741, 0x021447, 0x037450, 0x125675, 0x127650, 0x077277, 508 0x046514, 0x036077, 0x035471, 0x147131, 0x136272, 0x162720, 0x166151, 0x037527, 509 }; 510 511 /* 512 * Make a sound on /dev/audio according to the length of the packet. The 513 * tone data was ripped from /usr/share/audio/samples/au/bark.au. The 514 * amount of waveform used is a function of packet length e.g. a series 515 * of small packets is heard as clicks, whereas a series of NFS packets in 516 * an 8k read sounds like a "WHAAAARP". 517 */ 518 void 519 click(int len) 520 { 521 len /= 8; 522 len = len ? len : 4; 523 524 if (audio) { 525 (void) write(audio, tone, len); 526 } 527 } 528 529 /* Display a count of packets */ 530 void 531 show_count() 532 { 533 static int prev = -1; 534 535 if (count == prev) 536 return; 537 538 prev = count; 539 (void) fprintf(stderr, "\r%d ", count); 540 } 541 542 #define ENCAP_LEN 16 /* Hold "(NN encap)" */ 543 544 /* 545 * Display data that's external to the packet. 546 * This constitutes the first half of the summary 547 * line display. 548 */ 549 void 550 show_pktinfo(int flags, int num, char *src, char *dst, struct timeval *ptvp, 551 struct timeval *tvp, int drops, int len) 552 { 553 struct tm *tm; 554 static struct timeval tvp0; 555 int sec, usec; 556 char *lp = line; 557 int i, start; 558 559 if (flags & F_NUM) { 560 (void) sprintf(lp, "%3d ", num); 561 lp += strlen(lp); 562 } 563 tm = localtime(&tvp->tv_sec); 564 565 if (flags & F_TIME) { 566 if (flags & F_ATIME) { 567 (void) sprintf(lp, "%02d:%02d:%02d.%05d ", 568 tm->tm_hour, tm->tm_min, tm->tm_sec, 569 (int)tvp->tv_usec / 10); 570 lp += strlen(lp); 571 } else { 572 if (flags & F_RTIME) { 573 if (tvp0.tv_sec == 0) { 574 tvp0.tv_sec = tvp->tv_sec; 575 tvp0.tv_usec = tvp->tv_usec; 576 } 577 ptvp = &tvp0; 578 } 579 sec = tvp->tv_sec - ptvp->tv_sec; 580 usec = tvp->tv_usec - ptvp->tv_usec; 581 if (usec < 0) { 582 usec += 1000000; 583 sec -= 1; 584 } 585 (void) sprintf(lp, "%3d.%05d ", sec, usec / 10); 586 lp += strlen(lp); 587 } 588 } 589 590 if ((flags & F_SUM) && !(flags & F_ALLSUM) && (vlanid != 0)) { 591 (void) snprintf(lp, MAXLINE, "VLAN#%i: ", vlanid); 592 lp += strlen(lp); 593 } 594 595 if (flags & F_WHO) { 596 (void) sprintf(lp, "%12s -> %-12s ", src, dst); 597 lp += strlen(lp); 598 } 599 600 if (flags & F_DROPS) { 601 (void) sprintf(lp, "drops: %d ", drops); 602 lp += strlen(lp); 603 } 604 605 if (flags & F_LEN) { 606 (void) sprintf(lp, "length: %4d ", len); 607 lp += strlen(lp); 608 } 609 610 if (flags & F_SUM) { 611 if (flags & F_ALLSUM) 612 (void) printf("________________________________\n"); 613 614 start = flags & F_ALLSUM ? 0 : sumcount - 1; 615 (void) sprintf(encap, " (%d encap)", total_encap_levels - 1); 616 (void) printf("%s%s%s\n", line, sumline[start], 617 ((flags & F_ALLSUM) || (total_encap_levels == 1)) ? "" : 618 encap); 619 620 for (i = start + 1; i < sumcount; i++) 621 (void) printf("%s%s\n", line, sumline[i]); 622 623 sumcount = 0; 624 } 625 626 if (flags & F_DTAIL) { 627 (void) printf("%s\n\n", detail_line); 628 detail_line[0] = '\0'; 629 } 630 } 631 632 /* 633 * The following three routines are called back 634 * from the interpreters to display their stuff. 635 * The theory is that when snoop becomes a window 636 * based tool we can just supply a new version of 637 * get_sum_line and get_detail_line and not have 638 * to touch the interpreters at all. 639 */ 640 char * 641 get_sum_line() 642 { 643 int tsumcount = sumcount; 644 645 if (sumcount >= MAXSUM) { 646 sumcount = 0; /* error recovery */ 647 pr_err( 648 "get_sum_line: sumline overflow (sumcount=%d, MAXSUM=%d)\n", 649 tsumcount, MAXSUM); 650 } 651 652 sumline[sumcount][0] = '\0'; 653 return (sumline[sumcount++]); 654 } 655 656 /*ARGSUSED*/ 657 char * 658 get_detail_line(int off, int len) 659 { 660 if (detail_line[0]) { 661 (void) printf("%s\n", detail_line); 662 detail_line[0] = '\0'; 663 } 664 return (detail_line); 665 } 666 667 /* 668 * This function exists to make sure that VLAN information is 669 * prepended to summary lines displayed. The problem this function 670 * solves is how to display VLAN information while in summary mode. 671 * Each interpretor uses the get_sum_line and get_detail_line functions 672 * to get a character buffer to display information to the user. 673 * get_sum_line is the important one here. Each call to get_sum_line 674 * gets a buffer which stores one line of information. In summary mode, 675 * the last line generated is the line printed. Instead of changing each 676 * interpreter to add VLAN information to the summary line, the ethernet 677 * interpreter changes to call this function and set an ID. If the ID is not 678 * zero and snoop is in default summary mode, snoop displays the 679 * VLAN information at the beginning of the output line. Otherwise, 680 * no VLAN information is displayed. 681 */ 682 void 683 set_vlan_id(int id) 684 { 685 vlanid = id; 686 } 687 688 /* 689 * Print an error. 690 * Works like printf (fmt string and variable args) 691 * except that it will substitute an error message 692 * for a "%m" string (like syslog) and it calls 693 * long_jump - it doesn't return to where it was 694 * called from - it goes to the last setjmp(). 695 */ 696 /* VARARGS1 */ 697 void 698 pr_err(const char *fmt, ...) 699 { 700 va_list ap; 701 char buf[1024], *p2; 702 const char *p1; 703 704 (void) strcpy(buf, "snoop: "); 705 p2 = buf + strlen(buf); 706 707 /* 708 * Note that we terminate the buffer with '\n' and '\0'. 709 */ 710 for (p1 = fmt; *p1 != '\0' && p2 < buf + sizeof (buf) - 2; p1++) { 711 if (*p1 == '%' && *(p1+1) == 'm') { 712 const char *errstr; 713 714 if ((errstr = strerror(errno)) != NULL) { 715 *p2 = '\0'; 716 (void) strlcat(buf, errstr, sizeof (buf)); 717 p2 += strlen(p2); 718 } 719 p1++; 720 } else { 721 *p2++ = *p1; 722 } 723 } 724 if (p2 > buf && *(p2-1) != '\n') 725 *p2++ = '\n'; 726 *p2 = '\0'; 727 728 va_start(ap, fmt); 729 /* LINTED: E_SEC_PRINTF_VAR_FMT */ 730 (void) vfprintf(stderr, buf, ap); 731 va_end(ap); 732 snoop_sigrecover(-1, NULL, NULL); /* global error recovery */ 733 } 734 735 /* 736 * Store a copy of linkname associated with the DLPI handle. 737 * Save errno before closing the dlpi handle so that the 738 * correct error value is used if 'err' is a system error. 739 */ 740 void 741 pr_errdlpi(dlpi_handle_t dh, const char *cmd, int err) 742 { 743 int save_errno = errno; 744 char linkname[DLPI_LINKNAME_MAX]; 745 746 (void) strlcpy(linkname, dlpi_linkname(dh), sizeof (linkname)); 747 748 dlpi_close(dh); 749 errno = save_errno; 750 751 pr_err("%s on \"%s\": %s", cmd, linkname, dlpi_strerror(err)); 752 } 753 754 /* 755 * Ye olde usage proc 756 * PLEASE keep this up to date! 757 * Naive users *love* this stuff. 758 */ 759 static void 760 usage(void) 761 { 762 (void) fprintf(stderr, "\nUsage: snoop\n"); 763 (void) fprintf(stderr, 764 "\t[ -a ] # Listen to packets on audio\n"); 765 (void) fprintf(stderr, 766 "\t[ -d link ] # Listen on named link\n"); 767 (void) fprintf(stderr, 768 "\t[ -s snaplen ] # Truncate packets\n"); 769 (void) fprintf(stderr, 770 "\t[ -I IP interface ] # Listen on named IP interface\n"); 771 (void) fprintf(stderr, 772 "\t[ -c count ] # Quit after count packets\n"); 773 (void) fprintf(stderr, 774 "\t[ -P ] # Turn OFF promiscuous mode\n"); 775 (void) fprintf(stderr, 776 "\t[ -D ] # Report dropped packets\n"); 777 (void) fprintf(stderr, 778 "\t[ -S ] # Report packet size\n"); 779 (void) fprintf(stderr, 780 "\t[ -i file ] # Read previously captured packets\n"); 781 (void) fprintf(stderr, 782 "\t[ -o file ] # Capture packets in file\n"); 783 (void) fprintf(stderr, 784 "\t[ -n file ] # Load addr-to-name table from file\n"); 785 (void) fprintf(stderr, 786 "\t[ -N ] # Create addr-to-name table\n"); 787 (void) fprintf(stderr, 788 "\t[ -t r|a|d ] # Time: Relative, Absolute or Delta\n"); 789 (void) fprintf(stderr, 790 "\t[ -v ] # Verbose packet display\n"); 791 (void) fprintf(stderr, 792 "\t[ -V ] # Show all summary lines\n"); 793 (void) fprintf(stderr, 794 "\t[ -p first[,last] ] # Select packet(s) to display\n"); 795 (void) fprintf(stderr, 796 "\t[ -x offset[,length] ] # Hex dump from offset for length\n"); 797 (void) fprintf(stderr, 798 "\t[ -C ] # Print packet filter code\n"); 799 (void) fprintf(stderr, 800 "\t[ -q ] # Suppress printing packet count\n"); 801 (void) fprintf(stderr, 802 "\t[ -r ] # Do not resolve address to name\n"); 803 (void) fprintf(stderr, 804 "\n\t[ filter expression ]\n"); 805 (void) fprintf(stderr, "\nExample:\n"); 806 (void) fprintf(stderr, "\tsnoop -o saved host fred\n\n"); 807 (void) fprintf(stderr, "\tsnoop -i saved -tr -v -p19\n"); 808 exit(1); 809 } 810 811 /* 812 * sdefault: default global alarm handler. Causes the current packet 813 * to be skipped. 814 */ 815 static void 816 sdefault(void) 817 { 818 snoop_nrecover = SNOOP_MAXRECOVER; 819 } 820 821 /* 822 * snoop_alarm: register or unregister an alarm handler to be called after 823 * s_sec seconds. Because snoop wasn't written to tolerate random signal 824 * delivery, periodic SIGALRM delivery (or SA_RESTART) cannot be used. 825 * 826 * s_sec argument of 0 seconds unregisters the handler. 827 * s_handler argument of NULL registers default handler sdefault(), or 828 * unregisters all signal handlers (for error recovery). 829 * 830 * Variables must be volatile to force the compiler to not optimize 831 * out the signal blocking. 832 */ 833 /*ARGSUSED*/ 834 int 835 snoop_alarm(int s_sec, void (*s_handler)()) 836 { 837 volatile time_t now; 838 volatile time_t nalarm = 0; 839 volatile struct snoop_handler *sh = NULL; 840 volatile struct snoop_handler *hp, *tp, *next; 841 volatile sigset_t s_mask; 842 volatile int ret = -1; 843 844 (void) sigemptyset((sigset_t *)&s_mask); 845 (void) sigaddset((sigset_t *)&s_mask, SIGALRM); 846 if (s_sec < 0) 847 return (-1); 848 849 /* register an alarm handler */ 850 now = time(NULL); 851 if (s_sec) { 852 sh = malloc(sizeof (struct snoop_handler)); 853 sh->s_time = now + s_sec; 854 if (s_handler == NULL) 855 s_handler = sdefault; 856 sh->s_handler = s_handler; 857 sh->s_next = NULL; 858 (void) sigprocmask(SIG_BLOCK, (sigset_t *)&s_mask, NULL); 859 if (snoop_hp == NULL) { 860 snoop_hp = snoop_tp = (struct snoop_handler *)sh; 861 862 snoop_nalarm = sh->s_time; 863 (void) alarm(sh->s_time - now); 864 } else { 865 snoop_tp->s_next = (struct snoop_handler *)sh; 866 snoop_tp = (struct snoop_handler *)sh; 867 868 if (sh->s_time < snoop_nalarm) { 869 snoop_nalarm = sh->s_time; 870 (void) alarm(sh->s_time - now); 871 } 872 } 873 (void) sigprocmask(SIG_UNBLOCK, (sigset_t *)&s_mask, NULL); 874 875 return (0); 876 } 877 878 /* unregister an alarm handler */ 879 (void) sigprocmask(SIG_BLOCK, (sigset_t *)&s_mask, NULL); 880 tp = (struct snoop_handler *)&snoop_hp; 881 for (hp = snoop_hp; hp; hp = next) { 882 next = hp->s_next; 883 if (s_handler == NULL || hp->s_handler == s_handler) { 884 ret = 0; 885 tp->s_next = hp->s_next; 886 if (snoop_tp == hp) { 887 if (tp == (struct snoop_handler *)&snoop_hp) 888 snoop_tp = NULL; 889 else 890 snoop_tp = (struct snoop_handler *)tp; 891 } 892 free((void *)hp); 893 } else { 894 if (nalarm == 0 || nalarm > hp->s_time) 895 nalarm = now < hp->s_time ? hp->s_time : 896 now + 1; 897 tp = hp; 898 } 899 } 900 /* 901 * Stop or adjust timer 902 */ 903 if (snoop_hp == NULL) { 904 snoop_nalarm = 0; 905 (void) alarm(0); 906 } else if (nalarm > 0 && nalarm < snoop_nalarm) { 907 snoop_nalarm = nalarm; 908 (void) alarm(nalarm - now); 909 } 910 911 (void) sigprocmask(SIG_UNBLOCK, (sigset_t *)&s_mask, NULL); 912 return (ret); 913 } 914 915 /* 916 * snoop_recover: reset snoop's output area, and any internal variables, 917 * to allow continuation. 918 * XXX: make this an interface such that each interpreter can 919 * register a reset routine. 920 */ 921 void 922 snoop_recover(void) 923 { 924 int i; 925 926 /* Error recovery: reset output_area and associated variables */ 927 for (i = 0; i < MAXSUM; i++) 928 sumline[i][0] = '\0'; 929 detail_line[0] = '\0'; 930 line[0] = '\0'; 931 encap[0] = '\0'; 932 sumcount = 0; 933 934 /* stacking/unstacking cannot be relied upon */ 935 encap_levels = 0; 936 total_encap_levels = 1; 937 938 /* remove any pending timeouts */ 939 (void) snoop_alarm(0, NULL); 940 } 941 942 /* 943 * snoop_sigrecover: global sigaction routine to manage recovery 944 * from catastrophic interpreter failures while interpreting 945 * corrupt trace files/packets. SIGALRM timeouts, program errors, 946 * and user termination are all handled. In the case of a corrupt 947 * packet or confused interpreter, the packet will be skipped, and 948 * execution will continue in scan(). 949 * 950 * Global alarm handling (see snoop_alarm()) is managed here. 951 * 952 * Variables must be volatile to force the compiler to not optimize 953 * out the signal blocking. 954 */ 955 /*ARGSUSED*/ 956 static void 957 snoop_sigrecover(int sig, siginfo_t *info, void *p) 958 { 959 volatile time_t now; 960 volatile time_t nalarm = 0; 961 volatile struct snoop_handler *hp; 962 963 /* 964 * Invoke any registered alarms. This involves first calculating 965 * the time for the next alarm, setting it up, then progressing 966 * through handler invocations. Note that since handlers may 967 * use siglongjmp(), in the worst case handlers may be serviced 968 * at a later time. 969 */ 970 if (sig == SIGALRM) { 971 now = time(NULL); 972 /* Calculate next alarm time */ 973 for (hp = snoop_hp; hp; hp = hp->s_next) { 974 if (hp->s_time) { 975 if ((hp->s_time - now) > 0) { 976 if (nalarm == 0 || nalarm > hp->s_time) 977 nalarm = now < hp->s_time ? 978 hp->s_time : now + 1; 979 } 980 } 981 } 982 /* Setup next alarm */ 983 if (nalarm) { 984 snoop_nalarm = nalarm; 985 (void) alarm(nalarm - now); 986 } else { 987 snoop_nalarm = 0; 988 } 989 990 /* Invoke alarm handlers (may not return) */ 991 for (hp = snoop_hp; hp; hp = hp->s_next) { 992 if (hp->s_time) { 993 if ((now - hp->s_time) >= 0) { 994 hp->s_time = 0; /* only invoke once */ 995 if (hp->s_handler) 996 hp->s_handler(); 997 } 998 } 999 } 1000 } else { 1001 snoop_nrecover++; 1002 } 1003 1004 /* 1005 * Exit if a signal has occurred after snoop has begun the process 1006 * of quitting. 1007 */ 1008 if (quitting) 1009 exit(1); 1010 1011 /* 1012 * If an alarm handler has timed out, and snoop_nrecover has 1013 * reached SNOOP_MAXRECOVER, skip to the next packet. 1014 * 1015 * If any other signal has occurred, and snoop_nrecover has 1016 * reached SNOOP_MAXRECOVER, give up. 1017 */ 1018 if (sig == SIGALRM) { 1019 if (ioctl(STDOUT_FILENO, I_CANPUT, 0) == 0) { 1020 /* 1021 * We've stalled on output, which is not a critical 1022 * failure. Reset the recovery counter so we do not 1023 * consider this a persistent failure, and return so 1024 * we do not skip this packet. 1025 */ 1026 snoop_nrecover = 0; 1027 return; 1028 } 1029 if (snoop_nrecover >= SNOOP_MAXRECOVER) { 1030 (void) fprintf(stderr, 1031 "snoop: WARNING: skipping from packet %d\n", 1032 count); 1033 snoop_nrecover = 0; 1034 } else { 1035 /* continue trying */ 1036 return; 1037 } 1038 } else if (snoop_nrecover >= SNOOP_MAXRECOVER) { 1039 (void) fprintf(stderr, 1040 "snoop: ERROR: cannot recover from packet %d\n", count); 1041 exit(1); 1042 } 1043 1044 #ifdef DEBUG 1045 (void) fprintf(stderr, "snoop_sigrecover(%d, %p, %p)\n", sig, info, p); 1046 #endif /* DEBUG */ 1047 1048 /* 1049 * Prepare to quit. This allows final processing to occur 1050 * after first terminal interruption. 1051 */ 1052 if (sig == SIGTERM || sig == SIGHUP || sig == SIGINT) { 1053 quitting = 1; 1054 return; 1055 } else if (sig != -1 && sig != SIGALRM) { 1056 /* Inform user that snoop has taken a fault */ 1057 (void) fprintf(stderr, 1058 "WARNING: received signal %d from packet %d\n", 1059 sig, count); 1060 } 1061 1062 /* Reset interpreter variables */ 1063 snoop_recover(); 1064 1065 /* Continue in scan() with the next packet */ 1066 siglongjmp(jmp_env, 1); 1067 /*NOTREACHED*/ 1068 } 1069 1070 /* 1071 * Protected malloc for global error recovery: prepare for interpreter 1072 * failures with corrupted packets or confused interpreters. Dynamically 1073 * allocate `nbytes' bytes, and sandwich it between two PROT_NONE pages to 1074 * catch writes outside of the allocated region. 1075 */ 1076 static char * 1077 protmalloc(size_t nbytes) 1078 { 1079 caddr_t start; 1080 int psz = sysconf(_SC_PAGESIZE); 1081 1082 nbytes = P2ROUNDUP(nbytes, psz); 1083 start = mmap(NULL, nbytes + psz * 2, PROT_READ|PROT_WRITE, 1084 MAP_PRIVATE|MAP_ANON, -1, 0); 1085 if (start == MAP_FAILED) { 1086 perror("Error: protmalloc: mmap"); 1087 return (NULL); 1088 } 1089 assert(IS_P2ALIGNED(start, psz)); 1090 if (mprotect(start, 1, PROT_NONE) == -1) 1091 perror("Warning: mprotect"); 1092 1093 start += psz; 1094 if (mprotect(start + nbytes, 1, PROT_NONE) == -1) 1095 perror("Warning: mprotect"); 1096 1097 return (start); 1098 } 1099 1100 /* 1101 * resetperm - reduce security vulnerabilities by resetting 1102 * owner/group/permissions. Always attempt setuid() - if we have 1103 * permission to drop our privilege level, do so. 1104 */ 1105 void 1106 resetperm(void) 1107 { 1108 if (geteuid() == 0) { 1109 (void) setgid(GID_NOBODY); 1110 (void) setuid(UID_NOBODY); 1111 } 1112 } 1113