1 /* $NetBSD: dlpisubs.c,v 1.5 2023/08/17 15:18:12 christos Exp $ */ 2 3 /* 4 * This code is derived from code formerly in pcap-dlpi.c, originally 5 * contributed by Atanu Ghosh (atanu@cs.ucl.ac.uk), University College 6 * London, and subsequently modified by Guy Harris (guy@alum.mit.edu), 7 * Mark Pizzolato <List-tcpdump-workers@subscriptions.pizzolato.net>, 8 * Mark C. Brown (mbrown@hp.com), and Sagun Shakya <Sagun.Shakya@Sun.COM>. 9 */ 10 11 /* 12 * This file contains dlpi/libdlpi related common functions used 13 * by pcap-[dlpi,libdlpi].c. 14 */ 15 16 #include <sys/cdefs.h> 17 __RCSID("$NetBSD: dlpisubs.c,v 1.5 2023/08/17 15:18:12 christos Exp $"); 18 19 #ifdef HAVE_CONFIG_H 20 #include <config.h> 21 #endif 22 23 #ifndef DL_IPATM 24 #define DL_IPATM 0x12 /* ATM Classical IP interface */ 25 #endif 26 27 #ifdef HAVE_SYS_BUFMOD_H 28 /* 29 * Size of a bufmod chunk to pass upstream; that appears to be the 30 * biggest value to which you can set it, and setting it to that value 31 * (which is bigger than what appears to be the Solaris default of 8192) 32 * reduces the number of packet drops. 33 */ 34 #define CHUNKSIZE 65536 35 36 /* 37 * Size of the buffer to allocate for packet data we read; it must be 38 * large enough to hold a chunk. 39 */ 40 #define PKTBUFSIZE CHUNKSIZE 41 42 #else /* HAVE_SYS_BUFMOD_H */ 43 44 /* 45 * Size of the buffer to allocate for packet data we read; this is 46 * what the value used to be - there's no particular reason why it 47 * should be tied to MAXDLBUF, but we'll leave it as this for now. 48 */ 49 #define MAXDLBUF 8192 50 #define PKTBUFSIZE (MAXDLBUF * sizeof(bpf_u_int32)) 51 52 #endif 53 54 #include <sys/types.h> 55 #include <sys/time.h> 56 #ifdef HAVE_SYS_BUFMOD_H 57 #include <sys/bufmod.h> 58 #endif 59 #include <sys/dlpi.h> 60 #include <sys/stream.h> 61 62 #include <errno.h> 63 #include <memory.h> 64 #include <stdio.h> 65 #include <stdlib.h> 66 #include <string.h> 67 #include <stropts.h> 68 #include <unistd.h> 69 70 #ifdef HAVE_LIBDLPI 71 #include <libdlpi.h> 72 #endif 73 74 #include "pcap-int.h" 75 #include "dlpisubs.h" 76 77 #ifdef HAVE_SYS_BUFMOD_H 78 static void pcap_stream_err(const char *, int, char *); 79 #endif 80 81 /* 82 * Get the packet statistics. 83 */ 84 int 85 pcap_stats_dlpi(pcap_t *p, struct pcap_stat *ps) 86 { 87 struct pcap_dlpi *pd = p->priv; 88 89 /* 90 * "ps_recv" counts packets handed to the filter, not packets 91 * that passed the filter. As filtering is done in userland, 92 * this would not include packets dropped because we ran out 93 * of buffer space; in order to make this more like other 94 * platforms (Linux 2.4 and later, BSDs with BPF), where the 95 * "packets received" count includes packets received but dropped 96 * due to running out of buffer space, and to keep from confusing 97 * applications that, for example, compute packet drop percentages, 98 * we also make it count packets dropped by "bufmod" (otherwise we 99 * might run the risk of the packet drop count being bigger than 100 * the received-packet count). 101 * 102 * "ps_drop" counts packets dropped by "bufmod" because of 103 * flow control requirements or resource exhaustion; it doesn't 104 * count packets dropped by the interface driver, or packets 105 * dropped upstream. As filtering is done in userland, it counts 106 * packets regardless of whether they would've passed the filter. 107 * 108 * These statistics don't include packets not yet read from 109 * the kernel by libpcap, but they may include packets not 110 * yet read from libpcap by the application. 111 */ 112 *ps = pd->stat; 113 114 /* 115 * Add in the drop count, as per the above comment. 116 */ 117 ps->ps_recv += ps->ps_drop; 118 return (0); 119 } 120 121 /* 122 * Does the processor for which we're compiling this support aligned loads? 123 */ 124 #if (defined(__i386__) || defined(_M_IX86) || defined(__X86__) || defined(__x86_64__) || defined(_M_X64)) || \ 125 (defined(__arm__) || defined(_M_ARM) || defined(__aarch64__)) || \ 126 (defined(__m68k__) && (!defined(__mc68000__) && !defined(__mc68010__))) || \ 127 (defined(__ppc__) || defined(__ppc64__) || defined(_M_PPC) || defined(_ARCH_PPC) || defined(_ARCH_PPC64)) || \ 128 (defined(__s390__) || defined(__s390x__) || defined(__zarch__)) 129 /* Yes, it does. */ 130 #else 131 /* No, it doesn't. */ 132 #define REQUIRE_ALIGNMENT 133 #endif 134 135 /* 136 * Loop through the packets and call the callback for each packet. 137 * Return the number of packets read. 138 */ 139 int 140 pcap_process_pkts(pcap_t *p, pcap_handler callback, u_char *user, 141 int count, u_char *bufp, int len) 142 { 143 struct pcap_dlpi *pd = p->priv; 144 int n, caplen, origlen; 145 u_char *ep, *pk; 146 struct pcap_pkthdr pkthdr; 147 #ifdef HAVE_SYS_BUFMOD_H 148 struct sb_hdr *sbp; 149 #ifdef REQUIRE_ALIGNMENT 150 struct sb_hdr sbhdr; 151 #endif 152 #endif 153 154 /* 155 * Loop through packets. 156 * 157 * This assumes that a single buffer of packets will have 158 * <= INT_MAX packets, so the packet count doesn't overflow. 159 */ 160 ep = bufp + len; 161 n = 0; 162 163 #ifdef HAVE_SYS_BUFMOD_H 164 while (bufp < ep) { 165 /* 166 * Has "pcap_breakloop()" been called? 167 * If so, return immediately - if we haven't read any 168 * packets, clear the flag and return -2 to indicate 169 * that we were told to break out of the loop, otherwise 170 * leave the flag set, so that the *next* call will break 171 * out of the loop without having read any packets, and 172 * return the number of packets we've processed so far. 173 */ 174 if (p->break_loop) { 175 if (n == 0) { 176 p->break_loop = 0; 177 return (-2); 178 } else { 179 p->bp = bufp; 180 p->cc = ep - bufp; 181 return (n); 182 } 183 } 184 #ifdef REQUIRE_ALIGNMENT 185 if ((long)bufp & 3) { 186 sbp = &sbhdr; 187 memcpy(sbp, bufp, sizeof(*sbp)); 188 } else 189 #endif 190 sbp = (struct sb_hdr *)bufp; 191 pd->stat.ps_drop = sbp->sbh_drops; 192 pk = bufp + sizeof(*sbp); 193 bufp += sbp->sbh_totlen; 194 origlen = sbp->sbh_origlen; 195 caplen = sbp->sbh_msglen; 196 #else 197 origlen = len; 198 caplen = min(p->snapshot, len); 199 pk = bufp; 200 bufp += caplen; 201 #endif 202 ++pd->stat.ps_recv; 203 if (pcap_filter(p->fcode.bf_insns, pk, origlen, caplen)) { 204 #ifdef HAVE_SYS_BUFMOD_H 205 pkthdr.ts.tv_sec = sbp->sbh_timestamp.tv_sec; 206 pkthdr.ts.tv_usec = sbp->sbh_timestamp.tv_usec; 207 #else 208 (void) gettimeofday(&pkthdr.ts, NULL); 209 #endif 210 pkthdr.len = origlen; 211 pkthdr.caplen = caplen; 212 /* Insure caplen does not exceed snapshot */ 213 if (pkthdr.caplen > (bpf_u_int32)p->snapshot) 214 pkthdr.caplen = (bpf_u_int32)p->snapshot; 215 (*callback)(user, &pkthdr, pk); 216 if (++n >= count && !PACKET_COUNT_IS_UNLIMITED(count)) { 217 p->cc = ep - bufp; 218 p->bp = bufp; 219 return (n); 220 } 221 } 222 #ifdef HAVE_SYS_BUFMOD_H 223 } 224 #endif 225 p->cc = 0; 226 return (n); 227 } 228 229 /* 230 * Process the mac type. Returns -1 if no matching mac type found, otherwise 0. 231 */ 232 int 233 pcap_process_mactype(pcap_t *p, u_int mactype) 234 { 235 int retv = 0; 236 237 switch (mactype) { 238 239 case DL_CSMACD: 240 case DL_ETHER: 241 p->linktype = DLT_EN10MB; 242 p->offset = 2; 243 /* 244 * This is (presumably) a real Ethernet capture; give it a 245 * link-layer-type list with DLT_EN10MB and DLT_DOCSIS, so 246 * that an application can let you choose it, in case you're 247 * capturing DOCSIS traffic that a Cisco Cable Modem 248 * Termination System is putting out onto an Ethernet (it 249 * doesn't put an Ethernet header onto the wire, it puts raw 250 * DOCSIS frames out on the wire inside the low-level 251 * Ethernet framing). 252 */ 253 p->dlt_list = (u_int *)malloc(sizeof(u_int) * 2); 254 /* 255 * If that fails, just leave the list empty. 256 */ 257 if (p->dlt_list != NULL) { 258 p->dlt_list[0] = DLT_EN10MB; 259 p->dlt_list[1] = DLT_DOCSIS; 260 p->dlt_count = 2; 261 } 262 break; 263 264 case DL_FDDI: 265 p->linktype = DLT_FDDI; 266 p->offset = 3; 267 break; 268 269 case DL_TPR: 270 /* XXX - what about DL_TPB? Is that Token Bus? */ 271 p->linktype = DLT_IEEE802; 272 p->offset = 2; 273 break; 274 275 #ifdef HAVE_SOLARIS 276 case DL_IPATM: 277 p->linktype = DLT_SUNATM; 278 p->offset = 0; /* works for LANE and LLC encapsulation */ 279 break; 280 #endif 281 282 #ifdef DL_IPV4 283 case DL_IPV4: 284 p->linktype = DLT_IPV4; 285 p->offset = 0; 286 break; 287 #endif 288 289 #ifdef DL_IPV6 290 case DL_IPV6: 291 p->linktype = DLT_IPV6; 292 p->offset = 0; 293 break; 294 #endif 295 296 #ifdef DL_IPNET 297 case DL_IPNET: 298 /* 299 * XXX - DL_IPNET devices default to "raw IP" rather than 300 * "IPNET header"; see 301 * 302 * https://seclists.org/tcpdump/2009/q1/202 303 * 304 * We'd have to do DL_IOC_IPNET_INFO to enable getting 305 * the IPNET header. 306 */ 307 p->linktype = DLT_RAW; 308 p->offset = 0; 309 break; 310 #endif 311 312 default: 313 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "unknown mactype 0x%x", 314 mactype); 315 retv = -1; 316 } 317 318 return (retv); 319 } 320 321 #ifdef HAVE_SYS_BUFMOD_H 322 /* 323 * Push and configure the buffer module. Returns -1 for error, otherwise 0. 324 */ 325 int 326 pcap_conf_bufmod(pcap_t *p, int snaplen) 327 { 328 struct timeval to; 329 bpf_u_int32 ss, chunksize; 330 331 /* Non-standard call to get the data nicely buffered. */ 332 if (ioctl(p->fd, I_PUSH, "bufmod") != 0) { 333 pcap_stream_err("I_PUSH bufmod", errno, p->errbuf); 334 return (-1); 335 } 336 337 ss = snaplen; 338 if (ss > 0 && 339 strioctl(p->fd, SBIOCSSNAP, sizeof(ss), (char *)&ss) != 0) { 340 pcap_stream_err("SBIOCSSNAP", errno, p->errbuf); 341 return (-1); 342 } 343 344 if (p->opt.immediate) { 345 /* Set the timeout to zero, for immediate delivery. */ 346 to.tv_sec = 0; 347 to.tv_usec = 0; 348 if (strioctl(p->fd, SBIOCSTIME, sizeof(to), (char *)&to) != 0) { 349 pcap_stream_err("SBIOCSTIME", errno, p->errbuf); 350 return (-1); 351 } 352 } else { 353 /* Set up the bufmod timeout. */ 354 if (p->opt.timeout != 0) { 355 to.tv_sec = p->opt.timeout / 1000; 356 to.tv_usec = (p->opt.timeout * 1000) % 1000000; 357 if (strioctl(p->fd, SBIOCSTIME, sizeof(to), (char *)&to) != 0) { 358 pcap_stream_err("SBIOCSTIME", errno, p->errbuf); 359 return (-1); 360 } 361 } 362 363 /* Set the chunk length. */ 364 chunksize = CHUNKSIZE; 365 if (strioctl(p->fd, SBIOCSCHUNK, sizeof(chunksize), (char *)&chunksize) 366 != 0) { 367 pcap_stream_err("SBIOCSCHUNKP", errno, p->errbuf); 368 return (-1); 369 } 370 } 371 372 return (0); 373 } 374 #endif /* HAVE_SYS_BUFMOD_H */ 375 376 /* 377 * Allocate data buffer. Returns -1 if memory allocation fails, else 0. 378 */ 379 int 380 pcap_alloc_databuf(pcap_t *p) 381 { 382 p->bufsize = PKTBUFSIZE; 383 p->buffer = malloc(p->bufsize + p->offset); 384 if (p->buffer == NULL) { 385 pcap_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE, 386 errno, "malloc"); 387 return (-1); 388 } 389 390 return (0); 391 } 392 393 /* 394 * Issue a STREAMS I_STR ioctl. Returns -1 on error, otherwise 395 * length of returned data on success. 396 */ 397 int 398 strioctl(int fd, int cmd, int len, char *dp) 399 { 400 struct strioctl str; 401 int retv; 402 403 str.ic_cmd = cmd; 404 str.ic_timout = -1; 405 str.ic_len = len; 406 str.ic_dp = dp; 407 if ((retv = ioctl(fd, I_STR, &str)) < 0) 408 return (retv); 409 410 return (str.ic_len); 411 } 412 413 #ifdef HAVE_SYS_BUFMOD_H 414 /* 415 * Write stream error message to errbuf. 416 */ 417 static void 418 pcap_stream_err(const char *func, int err, char *errbuf) 419 { 420 pcap_fmt_errmsg_for_errno(errbuf, PCAP_ERRBUF_SIZE, err, "%s", func); 421 } 422 #endif 423