1 /* $NetBSD: pcap-nit.c,v 1.3 2015/03/31 21:39:42 christos Exp $ */
2
3 /*
4 * Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996
5 * The Regents of the University of California. All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that: (1) source code distributions
9 * retain the above copyright notice and this paragraph in its entirety, (2)
10 * distributions including binary code include the above copyright notice and
11 * this paragraph in its entirety in the documentation or other materials
12 * provided with the distribution, and (3) all advertising materials mentioning
13 * features or use of this software display the following acknowledgement:
14 * ``This product includes software developed by the University of California,
15 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
16 * the University nor the names of its contributors may be used to endorse
17 * or promote products derived from this software without specific prior
18 * written permission.
19 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
20 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
21 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
22 */
23
24 #include <sys/cdefs.h>
25 __RCSID("$NetBSD: pcap-nit.c,v 1.3 2015/03/31 21:39:42 christos Exp $");
26
27 #ifdef HAVE_CONFIG_H
28 #include "config.h"
29 #endif
30
31 #include <sys/types.h>
32 #include <sys/time.h>
33 #include <sys/timeb.h>
34 #include <sys/file.h>
35 #include <sys/ioctl.h>
36 #include <sys/socket.h>
37
38 #include <net/if.h>
39 #include <net/nit.h>
40
41 #include <netinet/in.h>
42 #include <netinet/in_systm.h>
43 #include <netinet/ip.h>
44 #include <netinet/if_ether.h>
45 #include <netinet/ip_var.h>
46 #include <netinet/udp.h>
47 #include <netinet/udp_var.h>
48 #include <netinet/tcp.h>
49 #include <netinet/tcpip.h>
50
51 #include <ctype.h>
52 #include <errno.h>
53 #include <stdio.h>
54
55 #include "pcap-int.h"
56
57 #ifdef HAVE_OS_PROTO_H
58 #include "os-proto.h"
59 #endif
60
61 /*
62 * The chunk size for NIT. This is the amount of buffering
63 * done for read calls.
64 */
65 #define CHUNKSIZE (2*1024)
66
67 /*
68 * The total buffer space used by NIT.
69 */
70 #define BUFSPACE (4*CHUNKSIZE)
71
72 /* Forwards */
73 static int nit_setflags(int, int, int, char *);
74
75 /*
76 * Private data for capturing on NIT devices.
77 */
78 struct pcap_nit {
79 struct pcap_stat stat;
80 };
81
82 static int
pcap_stats_nit(pcap_t * p,struct pcap_stat * ps)83 pcap_stats_nit(pcap_t *p, struct pcap_stat *ps)
84 {
85 struct pcap_nit *pn = p->priv;
86
87 /*
88 * "ps_recv" counts packets handed to the filter, not packets
89 * that passed the filter. As filtering is done in userland,
90 * this does not include packets dropped because we ran out
91 * of buffer space.
92 *
93 * "ps_drop" presumably counts packets dropped by the socket
94 * because of flow control requirements or resource exhaustion;
95 * it doesn't count packets dropped by the interface driver.
96 * As filtering is done in userland, it counts packets regardless
97 * of whether they would've passed the filter.
98 *
99 * These statistics don't include packets not yet read from the
100 * kernel by libpcap or packets not yet read from libpcap by the
101 * application.
102 */
103 *ps = pn->stat;
104 return (0);
105 }
106
107 static int
pcap_read_nit(pcap_t * p,int cnt,pcap_handler callback,u_char * user)108 pcap_read_nit(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
109 {
110 struct pcap_nit *pn = p->priv;
111 register int cc, n;
112 register u_char *bp, *cp, *ep;
113 register struct nit_hdr *nh;
114 register int caplen;
115
116 cc = p->cc;
117 if (cc == 0) {
118 cc = read(p->fd, (char *)p->buffer, p->bufsize);
119 if (cc < 0) {
120 if (errno == EWOULDBLOCK)
121 return (0);
122 snprintf(p->errbuf, sizeof(p->errbuf), "pcap_read: %s",
123 pcap_strerror(errno));
124 return (-1);
125 }
126 bp = p->buffer;
127 } else
128 bp = p->bp;
129
130 /*
131 * Loop through each packet. The increment expression
132 * rounds up to the next int boundary past the end of
133 * the previous packet.
134 */
135 n = 0;
136 ep = bp + cc;
137 while (bp < ep) {
138 /*
139 * Has "pcap_breakloop()" been called?
140 * If so, return immediately - if we haven't read any
141 * packets, clear the flag and return -2 to indicate
142 * that we were told to break out of the loop, otherwise
143 * leave the flag set, so that the *next* call will break
144 * out of the loop without having read any packets, and
145 * return the number of packets we've processed so far.
146 */
147 if (p->break_loop) {
148 if (n == 0) {
149 p->break_loop = 0;
150 return (-2);
151 } else {
152 p->cc = ep - bp;
153 p->bp = bp;
154 return (n);
155 }
156 }
157
158 nh = (struct nit_hdr *)bp;
159 cp = bp + sizeof(*nh);
160
161 switch (nh->nh_state) {
162
163 case NIT_CATCH:
164 break;
165
166 case NIT_NOMBUF:
167 case NIT_NOCLUSTER:
168 case NIT_NOSPACE:
169 pn->stat.ps_drop = nh->nh_dropped;
170 continue;
171
172 case NIT_SEQNO:
173 continue;
174
175 default:
176 snprintf(p->errbuf, sizeof(p->errbuf),
177 "bad nit state %d", nh->nh_state);
178 return (-1);
179 }
180 ++pn->stat.ps_recv;
181 bp += ((sizeof(struct nit_hdr) + nh->nh_datalen +
182 sizeof(int) - 1) & ~(sizeof(int) - 1));
183
184 caplen = nh->nh_wirelen;
185 if (caplen > p->snapshot)
186 caplen = p->snapshot;
187 if (bpf_filter(p->fcode.bf_insns, cp, nh->nh_wirelen, caplen)) {
188 struct pcap_pkthdr h;
189 h.ts = nh->nh_timestamp;
190 h.len = nh->nh_wirelen;
191 h.caplen = caplen;
192 (*callback)(user, &h, cp);
193 if (++n >= cnt && !PACKET_COUNT_IS_UNLIMITED(cnt)) {
194 p->cc = ep - bp;
195 p->bp = bp;
196 return (n);
197 }
198 }
199 }
200 p->cc = 0;
201 return (n);
202 }
203
204 static int
pcap_inject_nit(pcap_t * p,const void * buf,size_t size)205 pcap_inject_nit(pcap_t *p, const void *buf, size_t size)
206 {
207 struct sockaddr sa;
208 int ret;
209
210 memset(&sa, 0, sizeof(sa));
211 strncpy(sa.sa_data, device, sizeof(sa.sa_data));
212 ret = sendto(p->fd, buf, size, 0, &sa, sizeof(sa));
213 if (ret == -1) {
214 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "send: %s",
215 pcap_strerror(errno));
216 return (-1);
217 }
218 return (ret);
219 }
220
221 static int
nit_setflags(pcap_t * p)222 nit_setflags(pcap_t *p)
223 {
224 struct nit_ioc nioc;
225
226 memset(&nioc, 0, sizeof(nioc));
227 nioc.nioc_typetomatch = NT_ALLTYPES;
228 nioc.nioc_snaplen = p->snapshot;
229 nioc.nioc_bufalign = sizeof(int);
230 nioc.nioc_bufoffset = 0;
231
232 if (p->opt.buffer_size != 0)
233 nioc.nioc_bufspace = p->opt.buffer_size;
234 else {
235 /* Default buffer size */
236 nioc.nioc_bufspace = BUFSPACE;
237 }
238
239 if (p->opt.immediate) {
240 /*
241 * XXX - will this cause packets to be delivered immediately?
242 * XXX - given that this is for SunOS prior to 4.0, do
243 * we care?
244 */
245 nioc.nioc_chunksize = 0;
246 } else
247 nioc.nioc_chunksize = CHUNKSIZE;
248 if (p->opt.timeout != 0) {
249 nioc.nioc_flags |= NF_TIMEOUT;
250 nioc.nioc_timeout.tv_sec = p->opt.timeout / 1000;
251 nioc.nioc_timeout.tv_usec = (p->opt.timeout * 1000) % 1000000;
252 }
253 if (p->opt.promisc)
254 nioc.nioc_flags |= NF_PROMISC;
255
256 if (ioctl(p->fd, SIOCSNIT, &nioc) < 0) {
257 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "SIOCSNIT: %s",
258 pcap_strerror(errno));
259 return (-1);
260 }
261 return (0);
262 }
263
264 static int
pcap_activate_nit(pcap_t * p)265 pcap_activate_nit(pcap_t *p)
266 {
267 int fd;
268 struct sockaddr_nit snit;
269
270 if (p->opt.rfmon) {
271 /*
272 * No monitor mode on SunOS 3.x or earlier (no
273 * Wi-Fi *devices* for the hardware that supported
274 * them!).
275 */
276 return (PCAP_ERROR_RFMON_NOTSUP);
277 }
278
279 if (p->snapshot < 96)
280 /*
281 * NIT requires a snapshot length of at least 96.
282 */
283 p->snapshot = 96;
284
285 memset(p, 0, sizeof(*p));
286 p->fd = fd = socket(AF_NIT, SOCK_RAW, NITPROTO_RAW);
287 if (fd < 0) {
288 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
289 "socket: %s", pcap_strerror(errno));
290 goto bad;
291 }
292 snit.snit_family = AF_NIT;
293 (void)strncpy(snit.snit_ifname, p->opt.source, NITIFSIZ);
294
295 if (bind(fd, (struct sockaddr *)&snit, sizeof(snit))) {
296 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
297 "bind: %s: %s", snit.snit_ifname, pcap_strerror(errno));
298 goto bad;
299 }
300 if (nit_setflags(p) < 0)
301 goto bad;
302
303 /*
304 * NIT supports only ethernets.
305 */
306 p->linktype = DLT_EN10MB;
307
308 p->bufsize = BUFSPACE;
309 p->buffer = (u_char *)malloc(p->bufsize);
310 if (p->buffer == NULL) {
311 strlcpy(p->errbuf, pcap_strerror(errno), PCAP_ERRBUF_SIZE);
312 goto bad;
313 }
314
315 /*
316 * "p->fd" is a socket, so "select()" should work on it.
317 */
318 p->selectable_fd = p->fd;
319
320 /*
321 * This is (presumably) a real Ethernet capture; give it a
322 * link-layer-type list with DLT_EN10MB and DLT_DOCSIS, so
323 * that an application can let you choose it, in case you're
324 * capturing DOCSIS traffic that a Cisco Cable Modem
325 * Termination System is putting out onto an Ethernet (it
326 * doesn't put an Ethernet header onto the wire, it puts raw
327 * DOCSIS frames out on the wire inside the low-level
328 * Ethernet framing).
329 */
330 p->dlt_list = (u_int *) malloc(sizeof(u_int) * 2);
331 /*
332 * If that fails, just leave the list empty.
333 */
334 if (p->dlt_list != NULL) {
335 p->dlt_list[0] = DLT_EN10MB;
336 p->dlt_list[1] = DLT_DOCSIS;
337 p->dlt_count = 2;
338 }
339
340 p->read_op = pcap_read_nit;
341 p->inject_op = pcap_inject_nit;
342 p->setfilter_op = install_bpf_program; /* no kernel filtering */
343 p->setdirection_op = NULL; /* Not implemented. */
344 p->set_datalink_op = NULL; /* can't change data link type */
345 p->getnonblock_op = pcap_getnonblock_fd;
346 p->setnonblock_op = pcap_setnonblock_fd;
347 p->stats_op = pcap_stats_nit;
348
349 return (0);
350 bad:
351 pcap_cleanup_live_common(p);
352 return (PCAP_ERROR);
353 }
354
355 pcap_t *
pcap_create_interface(const char * device,char * ebuf)356 pcap_create_interface(const char *device, char *ebuf)
357 {
358 pcap_t *p;
359
360 p = pcap_create_common(device, ebuf, sizeof (struct pcap_nit));
361 if (p == NULL)
362 return (NULL);
363
364 p->activate_op = pcap_activate_nit;
365 return (p);
366 }
367
368 int
pcap_platform_finddevs(pcap_if_t ** alldevsp,char * errbuf)369 pcap_platform_finddevs(pcap_if_t **alldevsp, char *errbuf)
370 {
371 return (0);
372 }
373