1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21 /*
22 * Copyright 2009 Sun Microsystems, Inc. All rights reserved.
23 * Use is subject to license terms.
24 */
25
26 #include <stdio.h>
27 #include <string.h>
28 #include <strings.h>
29 #include <errno.h>
30 #include <fcntl.h>
31 #include <setjmp.h>
32 #include <sys/types.h>
33 #include <sys/signal.h>
34 #include <sys/time.h>
35 #include <sys/socket.h>
36 #include <sys/sockio.h>
37 #include <netinet/in.h>
38 #include <netinet/ip.h>
39 #include <sys/pfmod.h>
40 #include <sys/mman.h>
41 #include <sys/stat.h>
42 #include <sys/bufmod.h>
43
44 #include <unistd.h>
45 #include <stropts.h>
46 #include <stdlib.h>
47 #include <ctype.h>
48 #include <values.h>
49 #include <libdlpi.h>
50
51 #include "snoop.h"
52
53 /*
54 * Old header format.
55 * Actually two concatenated structs: nit_bufhdr + nit_head
56 */
57 struct ohdr {
58 /* nit_bufhdr */
59 int o_msglen;
60 int o_totlen;
61 /* nit_head */
62 struct timeval o_time;
63 int o_drops;
64 int o_len;
65 };
66
67 static void scan(char *, int, int, int, int, void (*)(), int, int, int);
68 void convert_to_network();
69 void convert_from_network();
70 static void convert_old(struct ohdr *);
71 extern sigjmp_buf jmp_env, ojmp_env;
72 static char *bufp; /* pointer to read buffer */
73
74 static int strioctl(int, int, int, int, void *);
75
76 enum { DWA_NONE, DWA_EXISTS, DWA_PLUMBED };
77
78 typedef struct dlpi_walk_arg {
79 char dwa_linkname[MAXLINKNAMELEN];
80 int dwa_type; /* preference type above */
81 int dwa_s4; /* IPv4 socket */
82 int dwa_s6; /* IPv6 socket */
83 } dlpi_walk_arg_t;
84
85 static boolean_t
select_datalink(const char * linkname,void * arg)86 select_datalink(const char *linkname, void *arg)
87 {
88 struct lifreq lifr;
89 dlpi_walk_arg_t *dwap = arg;
90 int s4 = dwap->dwa_s4;
91 int s6 = dwap->dwa_s6;
92
93 (void) strlcpy(dwap->dwa_linkname, linkname, MAXLINKNAMELEN);
94 dwap->dwa_type = DWA_EXISTS;
95
96 /*
97 * See if it's plumbed by IP. We prefer such links because they're
98 * more likely to have interesting traffic.
99 */
100 bzero(&lifr, sizeof (lifr));
101 (void) strlcpy(lifr.lifr_name, linkname, LIFNAMSIZ);
102 if ((s4 != -1 && ioctl(s4, SIOCGLIFFLAGS, &lifr) != -1) ||
103 (s6 != -1 && ioctl(s6, SIOCGLIFFLAGS, &lifr) != -1)) {
104 dwap->dwa_type = DWA_PLUMBED;
105 return (B_TRUE);
106 }
107 return (B_FALSE);
108 }
109
110 /*
111 * Open `linkname' in raw/passive mode (see dlpi_open(3DLPI)). If `linkname'
112 * is NULL, pick a datalink as per snoop(1M). Also gather some information
113 * about the datalink useful for building the proper packet filters.
114 */
115 boolean_t
open_datalink(dlpi_handle_t * dhp,const char * linkname)116 open_datalink(dlpi_handle_t *dhp, const char *linkname)
117 {
118 int retval;
119 int flags = DLPI_PASSIVE | DLPI_RAW;
120 dlpi_walk_arg_t dwa;
121 dlpi_info_t dlinfo;
122
123 if (linkname == NULL) {
124 /*
125 * Select a datalink to use by default. Prefer datalinks that
126 * are plumbed by IP.
127 */
128 bzero(&dwa, sizeof (dwa));
129 dwa.dwa_s4 = socket(AF_INET, SOCK_DGRAM, 0);
130 dwa.dwa_s6 = socket(AF_INET6, SOCK_DGRAM, 0);
131 dlpi_walk(select_datalink, &dwa, 0);
132 (void) close(dwa.dwa_s4);
133 (void) close(dwa.dwa_s6);
134
135 if (dwa.dwa_type == DWA_NONE)
136 pr_err("no datalinks found");
137 if (dwa.dwa_type == DWA_EXISTS) {
138 (void) fprintf(stderr, "snoop: WARNING: "
139 "no datalinks plumbed for IP traffic\n");
140 }
141 linkname = dwa.dwa_linkname;
142 }
143 if (Iflg)
144 flags |= DLPI_DEVIPNET;
145 if (Iflg || strcmp(linkname, "lo0") == 0)
146 flags |= DLPI_IPNETINFO;
147 if ((retval = dlpi_open(linkname, dhp, flags)) != DLPI_SUCCESS) {
148 pr_err("cannot open \"%s\": %s", linkname,
149 dlpi_strerror(retval));
150 }
151
152 if ((retval = dlpi_info(*dhp, &dlinfo, 0)) != DLPI_SUCCESS)
153 pr_errdlpi(*dhp, "dlpi_info failed", retval);
154
155 for (interface = &INTERFACES[0]; interface->mac_type != -1; interface++)
156 if (interface->mac_type == dlinfo.di_mactype)
157 break;
158
159 /* allow limited functionality even if interface isn't known */
160 if (interface->mac_type == -1) {
161 (void) fprintf(stderr, "snoop: WARNING: Mac Type = %x "
162 "not supported\n", dlinfo.di_mactype);
163 }
164
165 return (interface->try_kernel_filter);
166 }
167
168 /*
169 * Initialize `dh' for packet capture using the provided arguments.
170 */
171 void
init_datalink(dlpi_handle_t dh,ulong_t snaplen,ulong_t chunksize,struct timeval * timeout,struct Pf_ext_packetfilt * fp)172 init_datalink(dlpi_handle_t dh, ulong_t snaplen, ulong_t chunksize,
173 struct timeval *timeout, struct Pf_ext_packetfilt *fp)
174 {
175 int retv;
176 int netfd;
177
178 retv = dlpi_bind(dh, DLPI_ANY_SAP, NULL);
179 if (retv != DLPI_SUCCESS)
180 pr_errdlpi(dh, "cannot bind on", retv);
181
182 if (Iflg) {
183 (void) fprintf(stderr, "Using device ipnet/%s ",
184 dlpi_linkname(dh));
185 } else {
186 (void) fprintf(stderr, "Using device %s ", dlpi_linkname(dh));
187 }
188
189 /*
190 * If Pflg not set - use physical level
191 * promiscuous mode. Otherwise - just SAP level.
192 */
193 if (!Pflg) {
194 (void) fprintf(stderr, "(promiscuous mode)\n");
195 retv = dlpi_promiscon(dh, DL_PROMISC_PHYS);
196 if (retv != DLPI_SUCCESS) {
197 pr_errdlpi(dh, "promiscuous mode(physical) failed",
198 retv);
199 }
200 } else {
201 (void) fprintf(stderr, "(non promiscuous)\n");
202 retv = dlpi_promiscon(dh, DL_PROMISC_MULTI);
203 if (retv != DLPI_SUCCESS) {
204 pr_errdlpi(dh, "promiscuous mode(multicast) failed",
205 retv);
206 }
207 }
208
209 retv = dlpi_promiscon(dh, DL_PROMISC_SAP);
210 if (retv != DLPI_SUCCESS)
211 pr_errdlpi(dh, "promiscuous mode(SAP) failed", retv);
212
213 netfd = dlpi_fd(dh);
214
215 if (fp) {
216 /*
217 * push and configure the packet filtering module
218 */
219 if (ioctl(netfd, I_PUSH, "pfmod") < 0)
220 pr_errdlpi(dh, "cannot push \"pfmod\"", DL_SYSERR);
221
222 if (strioctl(netfd, PFIOCSETF, -1, sizeof (*fp),
223 (char *)fp) < 0)
224 pr_errdlpi(dh, "PFIOCSETF", DL_SYSERR);
225 }
226
227 if (ioctl(netfd, I_PUSH, "bufmod") < 0)
228 pr_errdlpi(dh, "cannot push \"bufmod\"", DL_SYSERR);
229
230 if (strioctl(netfd, SBIOCSTIME, -1, sizeof (struct timeval),
231 (char *)timeout) < 0)
232 pr_errdlpi(dh, "SBIOCSTIME", DL_SYSERR);
233
234 if (strioctl(netfd, SBIOCSCHUNK, -1, sizeof (uint_t),
235 (char *)&chunksize) < 0)
236 pr_errdlpi(dh, "SBIOCGCHUNK", DL_SYSERR);
237
238 if (strioctl(netfd, SBIOCSSNAP, -1, sizeof (uint_t),
239 (char *)&snaplen) < 0)
240 pr_errdlpi(dh, "SBIOCSSNAP", DL_SYSERR);
241
242 /*
243 * Flush the read queue, to get rid of anything that
244 * accumulated before the device reached its final configuration.
245 */
246 if (ioctl(netfd, I_FLUSH, FLUSHR) < 0)
247 pr_errdlpi(dh, "cannot flush \"I_FLUSH\"", DL_SYSERR);
248 }
249
250 /*
251 * Read packets from the network. init_datalink() is called in
252 * here to set up the network interface for reading of
253 * raw ethernet packets in promiscuous mode into a buffer.
254 * Packets are read and either written directly to a file
255 * or interpreted for display on the fly.
256 */
257 void
net_read(dlpi_handle_t dh,size_t chunksize,int filter,void (* proc)(),int flags)258 net_read(dlpi_handle_t dh, size_t chunksize, int filter, void (*proc)(),
259 int flags)
260 {
261 int retval;
262 extern int count;
263 size_t msglen;
264
265 count = 0;
266
267 /* allocate a read buffer */
268 bufp = malloc(chunksize);
269 if (bufp == NULL)
270 pr_err("no memory for %d buffer", chunksize);
271
272 /*
273 * read frames
274 */
275 for (;;) {
276 msglen = chunksize;
277 retval = dlpi_recv(dh, NULL, NULL, bufp, &msglen, -1, NULL);
278
279 if (retval != DLPI_SUCCESS || quitting)
280 break;
281
282 if (msglen != 0)
283 scan(bufp, msglen, filter, 0, 0, proc, 0, 0, flags);
284 }
285
286 free(bufp);
287
288 if (!quitting)
289 pr_errdlpi(dh, "network read failed", retval);
290 }
291
292 #ifdef DEBUG
293 /*
294 * corrupt: simulate packet corruption for debugging interpreters
295 */
296 void
corrupt(volatile char * pktp,volatile char * pstop,char * buf,volatile char * bufstop)297 corrupt(volatile char *pktp, volatile char *pstop, char *buf,
298 volatile char *bufstop)
299 {
300 int c;
301 int i;
302 int p;
303 int li = rand() % (pstop - pktp - 1) + 1;
304 volatile char *pp = pktp;
305 volatile char *pe = bufstop < pstop ? bufstop : pstop;
306
307 if (pktp < buf || pktp > bufstop)
308 return;
309
310 for (pp = pktp; pp < pe; pp += li) {
311 c = ((pe - pp) < li ? pe - pp : li);
312 i = (rand() % c)>>1;
313 while (--i > 0) {
314 p = (rand() % c);
315 pp[p] = (unsigned char)(rand() & 0xFF);
316 }
317 }
318 }
319 #endif /* DEBUG */
320
321 static void
scan(char * buf,int len,int filter,int cap,int old,void (* proc)(),int first,int last,int flags)322 scan(char *buf, int len, int filter, int cap, int old, void (*proc)(),
323 int first, int last, int flags)
324 {
325 volatile char *bp, *bufstop;
326 volatile struct sb_hdr *hdrp;
327 volatile struct sb_hdr nhdr, *nhdrp;
328 volatile char *pktp;
329 volatile struct timeval last_timestamp;
330 volatile int header_okay;
331 extern int count, maxcount;
332 extern int snoop_nrecover;
333 #ifdef DEBUG
334 extern int zflg;
335 #endif /* DEBUG */
336
337 proc(0, 0, 0);
338 bufstop = buf + len;
339
340 /*
341 *
342 * Loop through each packet in the buffer
343 */
344 last_timestamp.tv_sec = 0;
345 (void) memcpy((char *)ojmp_env, (char *)jmp_env, sizeof (jmp_env));
346 for (bp = buf; bp < bufstop; bp += nhdrp->sbh_totlen) {
347 /*
348 * Gracefully exit if user terminates
349 */
350 if (quitting)
351 break;
352 /*
353 * Global error recocery: Prepare to continue when a corrupt
354 * packet or header is encountered.
355 */
356 if (sigsetjmp(jmp_env, 1)) {
357 goto err;
358 }
359
360 header_okay = 0;
361 hdrp = (struct sb_hdr *)bp;
362 nhdrp = hdrp;
363 pktp = (char *)hdrp + sizeof (*hdrp);
364
365 /*
366 * If reading a capture file
367 * convert the headers from network
368 * byte order (for little-endians like X86)
369 */
370 if (cap) {
371 /*
372 * If the packets come from an old
373 * capture file, convert the header.
374 */
375 if (old) {
376 convert_old((struct ohdr *)hdrp);
377 }
378
379 nhdrp = &nhdr;
380
381 nhdrp->sbh_origlen = ntohl(hdrp->sbh_origlen);
382 nhdrp->sbh_msglen = ntohl(hdrp->sbh_msglen);
383 nhdrp->sbh_totlen = ntohl(hdrp->sbh_totlen);
384 nhdrp->sbh_drops = ntohl(hdrp->sbh_drops);
385 nhdrp->sbh_timestamp.tv_sec =
386 ntohl(hdrp->sbh_timestamp.tv_sec);
387 nhdrp->sbh_timestamp.tv_usec =
388 ntohl(hdrp->sbh_timestamp.tv_usec);
389 }
390
391 /* Enhanced check for valid header */
392
393 if ((nhdrp->sbh_totlen == 0) ||
394 (bp + nhdrp->sbh_totlen) < bp ||
395 (bp + nhdrp->sbh_totlen) > bufstop ||
396 (nhdrp->sbh_origlen == 0) ||
397 (bp + nhdrp->sbh_origlen) < bp ||
398 (nhdrp->sbh_msglen == 0) ||
399 (bp + nhdrp->sbh_msglen) < bp ||
400 (bp + nhdrp->sbh_msglen) > bufstop ||
401 (nhdrp->sbh_msglen > nhdrp->sbh_origlen) ||
402 (nhdrp->sbh_totlen < nhdrp->sbh_msglen) ||
403 (nhdrp->sbh_timestamp.tv_sec == 0)) {
404 if (cap) {
405 (void) fprintf(stderr, "(warning) bad packet "
406 "header in capture file");
407 } else {
408 (void) fprintf(stderr, "(warning) bad packet "
409 "header in buffer");
410 }
411 (void) fprintf(stderr, " offset %d: length=%d\n",
412 bp - buf, nhdrp->sbh_totlen);
413 goto err;
414 }
415
416 /*
417 * Check for incomplete packet. We are conservative here,
418 * since we don't know how good the checking is in other
419 * parts of the code. We pass a partial packet, with
420 * a warning.
421 */
422 if (pktp + nhdrp->sbh_msglen > bufstop) {
423 (void) fprintf(stderr, "truncated packet buffer\n");
424 nhdrp->sbh_msglen = bufstop - pktp;
425 }
426
427 #ifdef DEBUG
428 if (zflg)
429 corrupt(pktp, pktp + nhdrp->sbh_msglen, buf, bufstop);
430 #endif /* DEBUG */
431
432 header_okay = 1;
433 if (!filter ||
434 want_packet((uchar_t *)pktp,
435 nhdrp->sbh_msglen,
436 nhdrp->sbh_origlen)) {
437 count++;
438
439 /*
440 * Start deadman timer for interpreter processing
441 */
442 (void) snoop_alarm(SNOOP_ALARM_GRAN*SNOOP_MAXRECOVER,
443 NULL);
444
445 encap_levels = 0;
446 if (!cap || count >= first)
447 proc(nhdrp, pktp, count, flags);
448
449 if (cap && count >= last) {
450 (void) snoop_alarm(0, NULL);
451 break;
452 }
453
454 if (maxcount && count >= maxcount) {
455 (void) fprintf(stderr, "%d packets captured\n",
456 count);
457 exit(0);
458 }
459
460 snoop_nrecover = 0; /* success */
461 (void) snoop_alarm(0, NULL);
462 last_timestamp = hdrp->sbh_timestamp; /* save stamp */
463 }
464 continue;
465 err:
466 /*
467 * Corruption has been detected. Reset errors.
468 */
469 snoop_recover();
470
471 /*
472 * packet header was apparently okay. Continue.
473 */
474 if (header_okay)
475 continue;
476
477 /*
478 * Otherwise try to scan forward to the next packet, using
479 * the last known timestamp if it is available.
480 */
481 nhdrp = &nhdr;
482 nhdrp->sbh_totlen = 0;
483 if (last_timestamp.tv_sec == 0) {
484 bp += sizeof (int);
485 } else {
486 for (bp += sizeof (int); bp <= bufstop;
487 bp += sizeof (int)) {
488 hdrp = (struct sb_hdr *)bp;
489 /* An approximate timestamp located */
490 if ((hdrp->sbh_timestamp.tv_sec >> 8) ==
491 (last_timestamp.tv_sec >> 8))
492 break;
493 }
494 }
495 }
496 /* reset jmp_env for program exit */
497 (void) memcpy((char *)jmp_env, (char *)ojmp_env, sizeof (jmp_env));
498 proc(0, -1, 0);
499 }
500
501 /*
502 * Called if nwrite() encounters write problems.
503 */
504 static void
cap_write_error(const char * msgtype)505 cap_write_error(const char *msgtype)
506 {
507 (void) fprintf(stderr,
508 "snoop: cannot write %s to capture file: %s\n",
509 msgtype, strerror(errno));
510 exit(1);
511 }
512
513 /*
514 * Writes target buffer to the open file descriptor. Upon detection of a short
515 * write, an attempt to process the remaining bytes occurs until all anticipated
516 * bytes are written. An error status is returned to indicate any serious write
517 * failures.
518 */
519 static int
nwrite(int fd,const void * buffer,size_t buflen)520 nwrite(int fd, const void *buffer, size_t buflen)
521 {
522 size_t nwritten;
523 ssize_t nbytes = 0;
524 const char *buf = buffer;
525
526 for (nwritten = 0; nwritten < buflen; nwritten += nbytes) {
527 nbytes = write(fd, &buf[nwritten], buflen - nwritten);
528 if (nbytes == -1)
529 return (-1);
530 if (nbytes == 0) {
531 errno = EIO;
532 return (-1);
533 }
534 }
535 return (0);
536 }
537
538 /*
539 * Routines for opening, closing, reading and writing
540 * a capture file of packets saved with the -o option.
541 */
542 static int capfile_out;
543
544 /*
545 * The snoop capture file has a header to identify
546 * it as a capture file and record its version.
547 * A file without this header is assumed to be an
548 * old format snoop file.
549 *
550 * A version 1 header looks like this:
551 *
552 * 0 1 2 3 4 5 6 7 8 9 10 11
553 * +---+---+---+---+---+---+---+---+---+---+---+---+---+
554 * | s | n | o | o | p | \0| \0| \0| version | data
555 * +---+---+---+---+---+---+---+---+---+---+---+---+---+
556 * | word 0 | word 1 | word 2 |
557 *
558 *
559 * A version 2 header adds a word that identifies the MAC type.
560 * This allows for capture files from FDDI etc.
561 *
562 * 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
563 * +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
564 * | s | n | o | o | p | \0| \0| \0| version | MAC type | data
565 * +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
566 * | word 0 | word 1 | word 2 | word 3
567 *
568 */
569 static const char *snoop_id = "snoop\0\0\0";
570 static const int snoop_idlen = 8;
571 static const int snoop_version = 2;
572
573 void
cap_open_write(const char * name)574 cap_open_write(const char *name)
575 {
576 int vers;
577
578 capfile_out = open(name, O_CREAT | O_TRUNC | O_RDWR, 0666);
579 if (capfile_out < 0)
580 pr_err("%s: %m", name);
581
582 vers = htonl(snoop_version);
583 if (nwrite(capfile_out, snoop_id, snoop_idlen) == -1)
584 cap_write_error("snoop_id");
585
586 if (nwrite(capfile_out, &vers, sizeof (int)) == -1)
587 cap_write_error("version");
588 }
589
590
591 void
cap_close(void)592 cap_close(void)
593 {
594 (void) close(capfile_out);
595 }
596
597 static char *cap_buffp = NULL;
598 static int cap_len = 0;
599 static int cap_new;
600
601 void
cap_open_read(const char * name)602 cap_open_read(const char *name)
603 {
604 struct stat st;
605 int cap_vers;
606 int *word, device_mac_type;
607 int capfile_in;
608
609 capfile_in = open(name, O_RDONLY);
610 if (capfile_in < 0)
611 pr_err("couldn't open %s: %m", name);
612
613 if (fstat(capfile_in, &st) < 0)
614 pr_err("couldn't stat %s: %m", name);
615 cap_len = st.st_size;
616
617 cap_buffp = mmap(0, cap_len, PROT_READ, MAP_PRIVATE, capfile_in, 0);
618 (void) close(capfile_in);
619 if ((int)cap_buffp == -1)
620 pr_err("couldn't mmap %s: %m", name);
621
622 /* Check if new snoop capture file format */
623
624 cap_new = bcmp(cap_buffp, snoop_id, snoop_idlen) == 0;
625
626 /*
627 * If new file - check version and
628 * set buffer pointer to point at first packet
629 */
630 if (cap_new) {
631 cap_vers = ntohl(*(int *)(cap_buffp + snoop_idlen));
632 cap_buffp += snoop_idlen + sizeof (int);
633 cap_len -= snoop_idlen + sizeof (int);
634
635 switch (cap_vers) {
636 case 1:
637 device_mac_type = DL_ETHER;
638 break;
639
640 case 2:
641 device_mac_type = ntohl(*((int *)cap_buffp));
642 cap_buffp += sizeof (int);
643 cap_len -= sizeof (int);
644 break;
645
646 default:
647 pr_err("capture file: %s: Version %d unrecognized\n",
648 name, cap_vers);
649 }
650
651 for (interface = &INTERFACES[0]; interface->mac_type != -1;
652 interface++)
653 if (interface->mac_type == device_mac_type)
654 break;
655
656 if (interface->mac_type == -1)
657 pr_err("Mac Type = %x is not supported\n",
658 device_mac_type);
659 } else {
660 /* Use heuristic to check if it's an old-style file */
661
662 device_mac_type = DL_ETHER;
663 word = (int *)cap_buffp;
664
665 if (!((word[0] < 1600 && word[1] < 1600) &&
666 (word[0] < word[1]) &&
667 (word[2] > 610000000 && word[2] < 770000000)))
668 pr_err("not a capture file: %s", name);
669
670 /* Change protection so's we can fix the headers */
671
672 if (mprotect(cap_buffp, cap_len, PROT_READ | PROT_WRITE) < 0)
673 pr_err("mprotect: %s: %m", name);
674 }
675 }
676
677 void
cap_read(int first,int last,int filter,void (* proc)(),int flags)678 cap_read(int first, int last, int filter, void (*proc)(), int flags)
679 {
680 extern int count;
681
682 count = 0;
683
684 scan(cap_buffp, cap_len, filter, 1, !cap_new, proc, first, last, flags);
685
686 (void) munmap(cap_buffp, cap_len);
687 }
688
689 /* ARGSUSED */
690 void
cap_write(struct sb_hdr * hdrp,char * pktp,int num,int flags)691 cap_write(struct sb_hdr *hdrp, char *pktp, int num, int flags)
692 {
693 int pktlen, mac;
694 static int first = 1;
695 struct sb_hdr nhdr;
696 extern boolean_t qflg;
697
698 if (hdrp == NULL)
699 return;
700
701 if (first) {
702 first = 0;
703 mac = htonl(interface->mac_type);
704 if (nwrite(capfile_out, &mac, sizeof (int)) == -1)
705 cap_write_error("mac_type");
706 }
707
708 pktlen = hdrp->sbh_totlen - sizeof (*hdrp);
709
710 /*
711 * Convert sb_hdr to network byte order
712 */
713 nhdr.sbh_origlen = htonl(hdrp->sbh_origlen);
714 nhdr.sbh_msglen = htonl(hdrp->sbh_msglen);
715 nhdr.sbh_totlen = htonl(hdrp->sbh_totlen);
716 nhdr.sbh_drops = htonl(hdrp->sbh_drops);
717 nhdr.sbh_timestamp.tv_sec = htonl(hdrp->sbh_timestamp.tv_sec);
718 nhdr.sbh_timestamp.tv_usec = htonl(hdrp->sbh_timestamp.tv_usec);
719
720 if (nwrite(capfile_out, &nhdr, sizeof (nhdr)) == -1)
721 cap_write_error("packet header");
722
723 if (nwrite(capfile_out, pktp, pktlen) == -1)
724 cap_write_error("packet");
725
726 if (! qflg)
727 show_count();
728 }
729
730 /*
731 * Convert a packet header from
732 * old to new format.
733 */
734 static void
convert_old(struct ohdr * ohdrp)735 convert_old(struct ohdr *ohdrp)
736 {
737 struct sb_hdr nhdr;
738
739 nhdr.sbh_origlen = ohdrp->o_len;
740 nhdr.sbh_msglen = ohdrp->o_msglen;
741 nhdr.sbh_totlen = ohdrp->o_totlen;
742 nhdr.sbh_drops = ohdrp->o_drops;
743 nhdr.sbh_timestamp = ohdrp->o_time;
744
745 *(struct sb_hdr *)ohdrp = nhdr;
746 }
747
748 static int
strioctl(int fd,int cmd,int timout,int len,void * dp)749 strioctl(int fd, int cmd, int timout, int len, void *dp)
750 {
751 struct strioctl sioc;
752 int rc;
753
754 sioc.ic_cmd = cmd;
755 sioc.ic_timout = timout;
756 sioc.ic_len = len;
757 sioc.ic_dp = dp;
758 rc = ioctl(fd, I_STR, &sioc);
759
760 if (rc < 0)
761 return (rc);
762 else
763 return (sioc.ic_len);
764 }
765