1 /* $NetBSD: dlpisubs.c,v 1.3 2017/01/24 22:29:28 christos Exp $ */ 2 3 /* 4 * This code is derived from code formerly in pcap-dlpi.c, originally 5 * contributed by Atanu Ghosh (atanu@cs.ucl.ac.uk), University College 6 * London, and subsequently modified by Guy Harris (guy@alum.mit.edu), 7 * Mark Pizzolato <List-tcpdump-workers@subscriptions.pizzolato.net>, 8 * Mark C. Brown (mbrown@hp.com), and Sagun Shakya <Sagun.Shakya@Sun.COM>. 9 */ 10 11 /* 12 * This file contains dlpi/libdlpi related common functions used 13 * by pcap-[dlpi,libdlpi].c. 14 */ 15 16 #include <sys/cdefs.h> 17 __RCSID("$NetBSD: dlpisubs.c,v 1.3 2017/01/24 22:29:28 christos Exp $"); 18 19 #ifdef HAVE_CONFIG_H 20 #include "config.h" 21 #endif 22 23 #ifndef DL_IPATM 24 #define DL_IPATM 0x12 /* ATM Classical IP interface */ 25 #endif 26 27 #ifdef HAVE_SYS_BUFMOD_H 28 /* 29 * Size of a bufmod chunk to pass upstream; that appears to be the 30 * biggest value to which you can set it, and setting it to that value 31 * (which is bigger than what appears to be the Solaris default of 8192) 32 * reduces the number of packet drops. 33 */ 34 #define CHUNKSIZE 65536 35 36 /* 37 * Size of the buffer to allocate for packet data we read; it must be 38 * large enough to hold a chunk. 39 */ 40 #define PKTBUFSIZE CHUNKSIZE 41 42 #else /* HAVE_SYS_BUFMOD_H */ 43 44 /* 45 * Size of the buffer to allocate for packet data we read; this is 46 * what the value used to be - there's no particular reason why it 47 * should be tied to MAXDLBUF, but we'll leave it as this for now. 48 */ 49 #define MAXDLBUF 8192 50 #define PKTBUFSIZE (MAXDLBUF * sizeof(bpf_u_int32)) 51 52 #endif 53 54 #include <sys/types.h> 55 #include <sys/time.h> 56 #ifdef HAVE_SYS_BUFMOD_H 57 #include <sys/bufmod.h> 58 #endif 59 #include <sys/dlpi.h> 60 #include <sys/stream.h> 61 62 #include <errno.h> 63 #include <memory.h> 64 #include <stdio.h> 65 #include <stdlib.h> 66 #include <string.h> 67 #include <stropts.h> 68 #include <unistd.h> 69 70 #ifdef HAVE_LIBDLPI 71 #include <libdlpi.h> 72 #endif 73 74 #include "pcap-int.h" 75 #include "dlpisubs.h" 76 77 #ifdef HAVE_SYS_BUFMOD_H 78 static void pcap_stream_err(const char *, int, char *); 79 #endif 80 81 /* 82 * Get the packet statistics. 83 */ 84 int 85 pcap_stats_dlpi(pcap_t *p, struct pcap_stat *ps) 86 { 87 struct pcap_dlpi *pd = p->priv; 88 89 /* 90 * "ps_recv" counts packets handed to the filter, not packets 91 * that passed the filter. As filtering is done in userland, 92 * this would not include packets dropped because we ran out 93 * of buffer space; in order to make this more like other 94 * platforms (Linux 2.4 and later, BSDs with BPF), where the 95 * "packets received" count includes packets received but dropped 96 * due to running out of buffer space, and to keep from confusing 97 * applications that, for example, compute packet drop percentages, 98 * we also make it count packets dropped by "bufmod" (otherwise we 99 * might run the risk of the packet drop count being bigger than 100 * the received-packet count). 101 * 102 * "ps_drop" counts packets dropped by "bufmod" because of 103 * flow control requirements or resource exhaustion; it doesn't 104 * count packets dropped by the interface driver, or packets 105 * dropped upstream. As filtering is done in userland, it counts 106 * packets regardless of whether they would've passed the filter. 107 * 108 * These statistics don't include packets not yet read from 109 * the kernel by libpcap, but they may include packets not 110 * yet read from libpcap by the application. 111 */ 112 *ps = pd->stat; 113 114 /* 115 * Add in the drop count, as per the above comment. 116 */ 117 ps->ps_recv += ps->ps_drop; 118 return (0); 119 } 120 121 /* 122 * Loop through the packets and call the callback for each packet. 123 * Return the number of packets read. 124 */ 125 int 126 pcap_process_pkts(pcap_t *p, pcap_handler callback, u_char *user, 127 int count, u_char *bufp, int len) 128 { 129 struct pcap_dlpi *pd = p->priv; 130 int n, caplen, origlen; 131 u_char *ep, *pk; 132 struct pcap_pkthdr pkthdr; 133 #ifdef HAVE_SYS_BUFMOD_H 134 struct sb_hdr *sbp; 135 #ifdef LBL_ALIGN 136 struct sb_hdr sbhdr; 137 #endif 138 #endif 139 140 /* Loop through packets */ 141 ep = bufp + len; 142 n = 0; 143 144 #ifdef HAVE_SYS_BUFMOD_H 145 while (bufp < ep) { 146 /* 147 * Has "pcap_breakloop()" been called? 148 * If so, return immediately - if we haven't read any 149 * packets, clear the flag and return -2 to indicate 150 * that we were told to break out of the loop, otherwise 151 * leave the flag set, so that the *next* call will break 152 * out of the loop without having read any packets, and 153 * return the number of packets we've processed so far. 154 */ 155 if (p->break_loop) { 156 if (n == 0) { 157 p->break_loop = 0; 158 return (-2); 159 } else { 160 p->bp = bufp; 161 p->cc = ep - bufp; 162 return (n); 163 } 164 } 165 #ifdef LBL_ALIGN 166 if ((long)bufp & 3) { 167 sbp = &sbhdr; 168 memcpy(sbp, bufp, sizeof(*sbp)); 169 } else 170 #endif 171 sbp = (struct sb_hdr *)bufp; 172 pd->stat.ps_drop = sbp->sbh_drops; 173 pk = bufp + sizeof(*sbp); 174 bufp += sbp->sbh_totlen; 175 origlen = sbp->sbh_origlen; 176 caplen = sbp->sbh_msglen; 177 #else 178 origlen = len; 179 caplen = min(p->snapshot, len); 180 pk = bufp; 181 bufp += caplen; 182 #endif 183 ++pd->stat.ps_recv; 184 if (bpf_filter(p->fcode.bf_insns, pk, origlen, caplen)) { 185 #ifdef HAVE_SYS_BUFMOD_H 186 pkthdr.ts.tv_sec = sbp->sbh_timestamp.tv_sec; 187 pkthdr.ts.tv_usec = sbp->sbh_timestamp.tv_usec; 188 #else 189 (void) gettimeofday(&pkthdr.ts, NULL); 190 #endif 191 pkthdr.len = origlen; 192 pkthdr.caplen = caplen; 193 /* Insure caplen does not exceed snapshot */ 194 if (pkthdr.caplen > (bpf_u_int32)p->snapshot) 195 pkthdr.caplen = (bpf_u_int32)p->snapshot; 196 (*callback)(user, &pkthdr, pk); 197 if (++n >= count && !PACKET_COUNT_IS_UNLIMITED(count)) { 198 p->cc = ep - bufp; 199 p->bp = bufp; 200 return (n); 201 } 202 } 203 #ifdef HAVE_SYS_BUFMOD_H 204 } 205 #endif 206 p->cc = 0; 207 return (n); 208 } 209 210 /* 211 * Process the mac type. Returns -1 if no matching mac type found, otherwise 0. 212 */ 213 int 214 pcap_process_mactype(pcap_t *p, u_int mactype) 215 { 216 int retv = 0; 217 218 switch (mactype) { 219 220 case DL_CSMACD: 221 case DL_ETHER: 222 p->linktype = DLT_EN10MB; 223 p->offset = 2; 224 /* 225 * This is (presumably) a real Ethernet capture; give it a 226 * link-layer-type list with DLT_EN10MB and DLT_DOCSIS, so 227 * that an application can let you choose it, in case you're 228 * capturing DOCSIS traffic that a Cisco Cable Modem 229 * Termination System is putting out onto an Ethernet (it 230 * doesn't put an Ethernet header onto the wire, it puts raw 231 * DOCSIS frames out on the wire inside the low-level 232 * Ethernet framing). 233 */ 234 p->dlt_list = (u_int *)malloc(sizeof(u_int) * 2); 235 /* 236 * If that fails, just leave the list empty. 237 */ 238 if (p->dlt_list != NULL) { 239 p->dlt_list[0] = DLT_EN10MB; 240 p->dlt_list[1] = DLT_DOCSIS; 241 p->dlt_count = 2; 242 } 243 break; 244 245 case DL_FDDI: 246 p->linktype = DLT_FDDI; 247 p->offset = 3; 248 break; 249 250 case DL_TPR: 251 /* XXX - what about DL_TPB? Is that Token Bus? */ 252 p->linktype = DLT_IEEE802; 253 p->offset = 2; 254 break; 255 256 #ifdef HAVE_SOLARIS 257 case DL_IPATM: 258 p->linktype = DLT_SUNATM; 259 p->offset = 0; /* works for LANE and LLC encapsulation */ 260 break; 261 #endif 262 263 #ifdef DL_IPV4 264 case DL_IPV4: 265 p->linktype = DLT_IPV4; 266 p->offset = 0; 267 break; 268 #endif 269 270 #ifdef DL_IPV6 271 case DL_IPV6: 272 p->linktype = DLT_IPV6; 273 p->offset = 0; 274 break; 275 #endif 276 277 #ifdef DL_IPNET 278 case DL_IPNET: 279 p->linktype = DLT_IPNET; 280 p->offset = 0; 281 break; 282 #endif 283 284 default: 285 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "unknown mactype 0x%x", 286 mactype); 287 retv = -1; 288 } 289 290 return (retv); 291 } 292 293 #ifdef HAVE_SYS_BUFMOD_H 294 /* 295 * Push and configure the buffer module. Returns -1 for error, otherwise 0. 296 */ 297 int 298 pcap_conf_bufmod(pcap_t *p, int snaplen) 299 { 300 struct timeval to; 301 bpf_u_int32 ss, chunksize; 302 303 /* Non-standard call to get the data nicely buffered. */ 304 if (ioctl(p->fd, I_PUSH, "bufmod") != 0) { 305 pcap_stream_err("I_PUSH bufmod", errno, p->errbuf); 306 return (-1); 307 } 308 309 ss = snaplen; 310 if (ss > 0 && 311 strioctl(p->fd, SBIOCSSNAP, sizeof(ss), (char *)&ss) != 0) { 312 pcap_stream_err("SBIOCSSNAP", errno, p->errbuf); 313 return (-1); 314 } 315 316 if (p->opt.immediate) { 317 /* Set the timeout to zero, for immediate delivery. */ 318 to.tv_sec = 0; 319 to.tv_usec = 0; 320 if (strioctl(p->fd, SBIOCSTIME, sizeof(to), (char *)&to) != 0) { 321 pcap_stream_err("SBIOCSTIME", errno, p->errbuf); 322 return (-1); 323 } 324 } else { 325 /* Set up the bufmod timeout. */ 326 if (p->opt.timeout != 0) { 327 to.tv_sec = p->opt.timeout / 1000; 328 to.tv_usec = (p->opt.timeout * 1000) % 1000000; 329 if (strioctl(p->fd, SBIOCSTIME, sizeof(to), (char *)&to) != 0) { 330 pcap_stream_err("SBIOCSTIME", errno, p->errbuf); 331 return (-1); 332 } 333 } 334 335 /* Set the chunk length. */ 336 chunksize = CHUNKSIZE; 337 if (strioctl(p->fd, SBIOCSCHUNK, sizeof(chunksize), (char *)&chunksize) 338 != 0) { 339 pcap_stream_err("SBIOCSCHUNKP", errno, p->errbuf); 340 return (-1); 341 } 342 } 343 344 return (0); 345 } 346 #endif /* HAVE_SYS_BUFMOD_H */ 347 348 /* 349 * Allocate data buffer. Returns -1 if memory allocation fails, else 0. 350 */ 351 int 352 pcap_alloc_databuf(pcap_t *p) 353 { 354 p->bufsize = PKTBUFSIZE; 355 p->buffer = malloc(p->bufsize + p->offset); 356 if (p->buffer == NULL) { 357 strlcpy(p->errbuf, pcap_strerror(errno), PCAP_ERRBUF_SIZE); 358 return (-1); 359 } 360 361 return (0); 362 } 363 364 /* 365 * Issue a STREAMS I_STR ioctl. Returns -1 on error, otherwise 366 * length of returned data on success. 367 */ 368 int 369 strioctl(int fd, int cmd, int len, char *dp) 370 { 371 struct strioctl str; 372 int retv; 373 374 str.ic_cmd = cmd; 375 str.ic_timout = -1; 376 str.ic_len = len; 377 str.ic_dp = dp; 378 if ((retv = ioctl(fd, I_STR, &str)) < 0) 379 return (retv); 380 381 return (str.ic_len); 382 } 383 384 #ifdef HAVE_SYS_BUFMOD_H 385 /* 386 * Write stream error message to errbuf. 387 */ 388 static void 389 pcap_stream_err(const char *func, int err, char *errbuf) 390 { 391 pcap_snprintf(errbuf, PCAP_ERRBUF_SIZE, "%s: %s", func, pcap_strerror(err)); 392 } 393 #endif 394