10Sstevel@tonic-gate /* 20Sstevel@tonic-gate * CDDL HEADER START 30Sstevel@tonic-gate * 40Sstevel@tonic-gate * The contents of this file are subject to the terms of the 51676Sjpk * Common Development and Distribution License (the "License"). 61676Sjpk * You may not use this file except in compliance with the License. 70Sstevel@tonic-gate * 80Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 90Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing. 100Sstevel@tonic-gate * See the License for the specific language governing permissions 110Sstevel@tonic-gate * and limitations under the License. 120Sstevel@tonic-gate * 130Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each 140Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 150Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the 160Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying 170Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner] 180Sstevel@tonic-gate * 190Sstevel@tonic-gate * CDDL HEADER END 200Sstevel@tonic-gate */ 210Sstevel@tonic-gate /* 228485SPeter.Memishian@Sun.COM * Copyright 2009 Sun Microsystems, Inc. All rights reserved. 230Sstevel@tonic-gate * Use is subject to license terms. 240Sstevel@tonic-gate */ 250Sstevel@tonic-gate 260Sstevel@tonic-gate #include <stdio.h> 270Sstevel@tonic-gate #include <string.h> 288868SPeter.Memishian@Sun.COM #include <strings.h> 290Sstevel@tonic-gate #include <errno.h> 300Sstevel@tonic-gate #include <fcntl.h> 310Sstevel@tonic-gate #include <setjmp.h> 320Sstevel@tonic-gate #include <sys/types.h> 330Sstevel@tonic-gate #include <sys/signal.h> 340Sstevel@tonic-gate #include <sys/time.h> 350Sstevel@tonic-gate #include <sys/socket.h> 360Sstevel@tonic-gate #include <sys/sockio.h> 370Sstevel@tonic-gate #include <netinet/in.h> 380Sstevel@tonic-gate #include <netinet/ip.h> 390Sstevel@tonic-gate #include <sys/pfmod.h> 400Sstevel@tonic-gate #include <sys/mman.h> 410Sstevel@tonic-gate #include <sys/stat.h> 420Sstevel@tonic-gate #include <sys/bufmod.h> 430Sstevel@tonic-gate 440Sstevel@tonic-gate #include <unistd.h> 450Sstevel@tonic-gate #include <stropts.h> 460Sstevel@tonic-gate #include <stdlib.h> 470Sstevel@tonic-gate #include <ctype.h> 480Sstevel@tonic-gate #include <values.h> 490Sstevel@tonic-gate #include <libdlpi.h> 500Sstevel@tonic-gate 510Sstevel@tonic-gate #include "snoop.h" 520Sstevel@tonic-gate 531676Sjpk /* 541676Sjpk * Old header format. 551676Sjpk * Actually two concatenated structs: nit_bufhdr + nit_head 561676Sjpk */ 571676Sjpk struct ohdr { 581676Sjpk /* nit_bufhdr */ 591676Sjpk int o_msglen; 601676Sjpk int o_totlen; 611676Sjpk /* nit_head */ 621676Sjpk struct timeval o_time; 631676Sjpk int o_drops; 641676Sjpk int o_len; 651676Sjpk }; 661676Sjpk 671676Sjpk static void scan(char *, int, int, int, int, void (*)(), int, int, int); 680Sstevel@tonic-gate void convert_to_network(); 690Sstevel@tonic-gate void convert_from_network(); 701676Sjpk static void convert_old(struct ohdr *); 710Sstevel@tonic-gate extern sigjmp_buf jmp_env, ojmp_env; 723628Sss150715 static dlpi_info_t dlinfo; 731676Sjpk static char *bufp; /* pointer to read buffer */ 740Sstevel@tonic-gate 751676Sjpk static int strioctl(int, int, int, int, void *); 76410Skcpoon 778868SPeter.Memishian@Sun.COM enum { DWA_NONE, DWA_EXISTS, DWA_PLUMBED }; 788868SPeter.Memishian@Sun.COM 798868SPeter.Memishian@Sun.COM typedef struct dlpi_walk_arg { 808868SPeter.Memishian@Sun.COM char dwa_linkname[MAXLINKNAMELEN]; 818868SPeter.Memishian@Sun.COM int dwa_type; /* preference type above */ 828868SPeter.Memishian@Sun.COM int dwa_s4; /* IPv4 socket */ 838868SPeter.Memishian@Sun.COM int dwa_s6; /* IPv6 socket */ 848868SPeter.Memishian@Sun.COM } dlpi_walk_arg_t; 858868SPeter.Memishian@Sun.COM 868868SPeter.Memishian@Sun.COM static boolean_t 878868SPeter.Memishian@Sun.COM select_datalink(const char *linkname, void *arg) 880Sstevel@tonic-gate { 898868SPeter.Memishian@Sun.COM struct lifreq lifr; 908868SPeter.Memishian@Sun.COM dlpi_walk_arg_t *dwap = arg; 918868SPeter.Memishian@Sun.COM int s4 = dwap->dwa_s4; 928868SPeter.Memishian@Sun.COM int s6 = dwap->dwa_s6; 938868SPeter.Memishian@Sun.COM 948868SPeter.Memishian@Sun.COM (void) strlcpy(dwap->dwa_linkname, linkname, MAXLINKNAMELEN); 958868SPeter.Memishian@Sun.COM dwap->dwa_type = DWA_EXISTS; 963628Sss150715 970Sstevel@tonic-gate /* 988868SPeter.Memishian@Sun.COM * See if it's plumbed by IP. We prefer such links because they're 998868SPeter.Memishian@Sun.COM * more likely to have interesting traffic. 1000Sstevel@tonic-gate */ 1018868SPeter.Memishian@Sun.COM bzero(&lifr, sizeof (lifr)); 1028868SPeter.Memishian@Sun.COM (void) strlcpy(lifr.lifr_name, linkname, LIFNAMSIZ); 1038868SPeter.Memishian@Sun.COM if ((s4 != -1 && ioctl(s4, SIOCGLIFFLAGS, &lifr) != -1) || 1048868SPeter.Memishian@Sun.COM (s6 != -1 && ioctl(s6, SIOCGLIFFLAGS, &lifr) != -1)) { 1058868SPeter.Memishian@Sun.COM dwap->dwa_type = DWA_PLUMBED; 1068868SPeter.Memishian@Sun.COM return (B_TRUE); 1078868SPeter.Memishian@Sun.COM } 1088868SPeter.Memishian@Sun.COM return (B_FALSE); 1098868SPeter.Memishian@Sun.COM } 1100Sstevel@tonic-gate 1118868SPeter.Memishian@Sun.COM /* 1128868SPeter.Memishian@Sun.COM * Open `linkname' in raw/passive mode (see dlpi_open(3DLPI)). If `linkname' 1138868SPeter.Memishian@Sun.COM * is NULL, pick a datalink as per snoop(1M). Also gather some information 1148868SPeter.Memishian@Sun.COM * about the datalink useful for building the proper packet filters. 1158868SPeter.Memishian@Sun.COM */ 1168868SPeter.Memishian@Sun.COM boolean_t 1178868SPeter.Memishian@Sun.COM open_datalink(dlpi_handle_t *dhp, const char *linkname) 1188868SPeter.Memishian@Sun.COM { 1198868SPeter.Memishian@Sun.COM int retval; 1208868SPeter.Memishian@Sun.COM int flags = DLPI_PASSIVE | DLPI_RAW; 1218868SPeter.Memishian@Sun.COM dlpi_walk_arg_t dwa; 1228868SPeter.Memishian@Sun.COM 1238868SPeter.Memishian@Sun.COM if (linkname == NULL) { 1248868SPeter.Memishian@Sun.COM /* 1258868SPeter.Memishian@Sun.COM * Select a datalink to use by default. Prefer datalinks that 1268868SPeter.Memishian@Sun.COM * are plumbed by IP. 1278868SPeter.Memishian@Sun.COM */ 1288868SPeter.Memishian@Sun.COM bzero(&dwa, sizeof (dwa)); 1298868SPeter.Memishian@Sun.COM dwa.dwa_s4 = socket(AF_INET, SOCK_DGRAM, 0); 1308868SPeter.Memishian@Sun.COM dwa.dwa_s6 = socket(AF_INET6, SOCK_DGRAM, 0); 1318868SPeter.Memishian@Sun.COM dlpi_walk(select_datalink, &dwa, 0); 1328868SPeter.Memishian@Sun.COM (void) close(dwa.dwa_s4); 1338868SPeter.Memishian@Sun.COM (void) close(dwa.dwa_s6); 1348868SPeter.Memishian@Sun.COM 1358868SPeter.Memishian@Sun.COM if (dwa.dwa_type == DWA_NONE) 1368868SPeter.Memishian@Sun.COM pr_err("no datalinks found"); 1378868SPeter.Memishian@Sun.COM if (dwa.dwa_type == DWA_EXISTS) { 1388868SPeter.Memishian@Sun.COM (void) fprintf(stderr, "snoop: WARNING: " 1398868SPeter.Memishian@Sun.COM "no datalinks plumbed for IP traffic\n"); 1400Sstevel@tonic-gate } 1418868SPeter.Memishian@Sun.COM linkname = dwa.dwa_linkname; 1420Sstevel@tonic-gate } 1438023SPhil.Kirk@Sun.COM if (Iflg) 1448023SPhil.Kirk@Sun.COM flags |= DLPI_DEVIPNET; 1458868SPeter.Memishian@Sun.COM if (Iflg || strcmp(linkname, "lo0") == 0) 1468023SPhil.Kirk@Sun.COM flags |= DLPI_IPNETINFO; 1478868SPeter.Memishian@Sun.COM if ((retval = dlpi_open(linkname, dhp, flags)) != DLPI_SUCCESS) { 1488868SPeter.Memishian@Sun.COM pr_err("cannot open \"%s\": %s", linkname, 1493628Sss150715 dlpi_strerror(retval)); 1500Sstevel@tonic-gate } 1510Sstevel@tonic-gate 1523628Sss150715 if ((retval = dlpi_info(*dhp, &dlinfo, 0)) != DLPI_SUCCESS) 1533628Sss150715 pr_errdlpi(*dhp, "dlpi_info failed", retval); 1540Sstevel@tonic-gate 1550Sstevel@tonic-gate for (interface = &INTERFACES[0]; interface->mac_type != -1; interface++) 1563628Sss150715 if (interface->mac_type == dlinfo.di_mactype) 1570Sstevel@tonic-gate break; 1580Sstevel@tonic-gate 1593628Sss150715 /* allow limited functionality even if interface isn't known */ 1600Sstevel@tonic-gate if (interface->mac_type == -1) { 1613628Sss150715 (void) fprintf(stderr, "snoop: WARNING: Mac Type = %x " 1623628Sss150715 "not supported\n", dlinfo.di_mactype); 1630Sstevel@tonic-gate } 1640Sstevel@tonic-gate 1650Sstevel@tonic-gate /* for backward compatibility, allow known interface mtu_sizes */ 1663628Sss150715 if (interface->mtu_size > dlinfo.di_max_sdu) 1673628Sss150715 dlinfo.di_max_sdu = interface->mtu_size; 1680Sstevel@tonic-gate 1692760Sdg199075 return (interface->try_kernel_filter); 1700Sstevel@tonic-gate } 1710Sstevel@tonic-gate 1720Sstevel@tonic-gate /* 1738868SPeter.Memishian@Sun.COM * Initialize `dh' for packet capture using the provided arguments. 1740Sstevel@tonic-gate */ 1750Sstevel@tonic-gate void 1768868SPeter.Memishian@Sun.COM init_datalink(dlpi_handle_t dh, ulong_t snaplen, ulong_t chunksize, 1773628Sss150715 struct timeval *timeout, struct Pf_ext_packetfilt *fp) 1780Sstevel@tonic-gate { 1793628Sss150715 int retv; 1803628Sss150715 int netfd; 1810Sstevel@tonic-gate 1823628Sss150715 retv = dlpi_bind(dh, DLPI_ANY_SAP, NULL); 1833628Sss150715 if (retv != DLPI_SUCCESS) 1843628Sss150715 pr_errdlpi(dh, "cannot bind on", retv); 1850Sstevel@tonic-gate 1868023SPhil.Kirk@Sun.COM if (Iflg) { 1878023SPhil.Kirk@Sun.COM (void) fprintf(stderr, "Using device ipnet/%s ", 1888023SPhil.Kirk@Sun.COM dlpi_linkname(dh)); 1898023SPhil.Kirk@Sun.COM } else { 1908023SPhil.Kirk@Sun.COM (void) fprintf(stderr, "Using device %s ", dlpi_linkname(dh)); 1918023SPhil.Kirk@Sun.COM } 1920Sstevel@tonic-gate 1930Sstevel@tonic-gate /* 1940Sstevel@tonic-gate * If Pflg not set - use physical level 1950Sstevel@tonic-gate * promiscuous mode. Otherwise - just SAP level. 1960Sstevel@tonic-gate */ 1970Sstevel@tonic-gate if (!Pflg) { 1980Sstevel@tonic-gate (void) fprintf(stderr, "(promiscuous mode)\n"); 1993628Sss150715 retv = dlpi_promiscon(dh, DL_PROMISC_PHYS); 2003628Sss150715 if (retv != DLPI_SUCCESS) { 2013628Sss150715 pr_errdlpi(dh, "promiscuous mode(physical) failed", 2023628Sss150715 retv); 2033628Sss150715 } 2040Sstevel@tonic-gate } else { 2050Sstevel@tonic-gate (void) fprintf(stderr, "(non promiscuous)\n"); 2063628Sss150715 retv = dlpi_promiscon(dh, DL_PROMISC_MULTI); 2073628Sss150715 if (retv != DLPI_SUCCESS) { 2083628Sss150715 pr_errdlpi(dh, "promiscuous mode(multicast) failed", 2093628Sss150715 retv); 2103628Sss150715 } 2110Sstevel@tonic-gate } 2120Sstevel@tonic-gate 2133628Sss150715 retv = dlpi_promiscon(dh, DL_PROMISC_SAP); 2143628Sss150715 if (retv != DLPI_SUCCESS) 2153628Sss150715 pr_errdlpi(dh, "promiscuous mode(SAP) failed", retv); 2160Sstevel@tonic-gate 2173628Sss150715 netfd = dlpi_fd(dh); 2180Sstevel@tonic-gate 2190Sstevel@tonic-gate if (fp) { 2200Sstevel@tonic-gate /* 2210Sstevel@tonic-gate * push and configure the packet filtering module 2220Sstevel@tonic-gate */ 2233628Sss150715 if (ioctl(netfd, I_PUSH, "pfmod") < 0) 2243628Sss150715 pr_errdlpi(dh, "cannot push \"pfmod\"", DL_SYSERR); 2250Sstevel@tonic-gate 226410Skcpoon if (strioctl(netfd, PFIOCSETF, -1, sizeof (*fp), 2273628Sss150715 (char *)fp) < 0) 2283628Sss150715 pr_errdlpi(dh, "PFIOCSETF", DL_SYSERR); 2290Sstevel@tonic-gate } 2300Sstevel@tonic-gate 2313628Sss150715 if (ioctl(netfd, I_PUSH, "bufmod") < 0) 2323628Sss150715 pr_errdlpi(dh, "cannot push \"bufmod\"", DL_SYSERR); 2333628Sss150715 2340Sstevel@tonic-gate if (strioctl(netfd, SBIOCSTIME, -1, sizeof (struct timeval), 2353628Sss150715 (char *)timeout) < 0) 2363628Sss150715 pr_errdlpi(dh, "SBIOCSTIME", DL_SYSERR); 2370Sstevel@tonic-gate 2380Sstevel@tonic-gate if (strioctl(netfd, SBIOCSCHUNK, -1, sizeof (uint_t), 2393628Sss150715 (char *)&chunksize) < 0) 2403628Sss150715 pr_errdlpi(dh, "SBIOCGCHUNK", DL_SYSERR); 2410Sstevel@tonic-gate 2420Sstevel@tonic-gate if (strioctl(netfd, SBIOCSSNAP, -1, sizeof (uint_t), 2433628Sss150715 (char *)&snaplen) < 0) 2443628Sss150715 pr_errdlpi(dh, "SBIOCSSNAP", DL_SYSERR); 2450Sstevel@tonic-gate 2460Sstevel@tonic-gate /* 2470Sstevel@tonic-gate * Flush the read queue, to get rid of anything that 2480Sstevel@tonic-gate * accumulated before the device reached its final configuration. 2490Sstevel@tonic-gate */ 2503628Sss150715 if (ioctl(netfd, I_FLUSH, FLUSHR) < 0) 2513628Sss150715 pr_errdlpi(dh, "cannot flush \"I_FLUSH\"", DL_SYSERR); 2520Sstevel@tonic-gate } 2530Sstevel@tonic-gate 2540Sstevel@tonic-gate /* 2558868SPeter.Memishian@Sun.COM * Read packets from the network. init_datalink() is called in 2560Sstevel@tonic-gate * here to set up the network interface for reading of 2570Sstevel@tonic-gate * raw ethernet packets in promiscuous mode into a buffer. 2580Sstevel@tonic-gate * Packets are read and either written directly to a file 2590Sstevel@tonic-gate * or interpreted for display on the fly. 2600Sstevel@tonic-gate */ 2610Sstevel@tonic-gate void 2623628Sss150715 net_read(dlpi_handle_t dh, size_t chunksize, int filter, void (*proc)(), 2633628Sss150715 int flags) 2640Sstevel@tonic-gate { 2653628Sss150715 int retval; 2660Sstevel@tonic-gate extern int count; 2673628Sss150715 size_t msglen; 2680Sstevel@tonic-gate 2690Sstevel@tonic-gate count = 0; 2700Sstevel@tonic-gate 2710Sstevel@tonic-gate /* allocate a read buffer */ 2720Sstevel@tonic-gate bufp = malloc(chunksize); 2730Sstevel@tonic-gate if (bufp == NULL) 2743628Sss150715 pr_err("no memory for %d buffer", chunksize); 2750Sstevel@tonic-gate 2760Sstevel@tonic-gate /* 2773628Sss150715 * read frames 2780Sstevel@tonic-gate */ 2790Sstevel@tonic-gate for (;;) { 2803628Sss150715 msglen = chunksize; 2813628Sss150715 retval = dlpi_recv(dh, NULL, NULL, bufp, &msglen, -1, NULL); 2820Sstevel@tonic-gate 2833628Sss150715 if (retval != DLPI_SUCCESS || quitting) 2840Sstevel@tonic-gate break; 2850Sstevel@tonic-gate 2863628Sss150715 if (msglen != 0) 2873628Sss150715 scan(bufp, msglen, filter, 0, 0, proc, 0, 0, flags); 2880Sstevel@tonic-gate } 2890Sstevel@tonic-gate 2900Sstevel@tonic-gate free(bufp); 2910Sstevel@tonic-gate 2923628Sss150715 if (!quitting) 2933628Sss150715 pr_errdlpi(dh, "network read failed", retval); 2940Sstevel@tonic-gate } 2950Sstevel@tonic-gate 2960Sstevel@tonic-gate #ifdef DEBUG 2970Sstevel@tonic-gate /* 2980Sstevel@tonic-gate * corrupt: simulate packet corruption for debugging interpreters 2990Sstevel@tonic-gate */ 3000Sstevel@tonic-gate void 3010Sstevel@tonic-gate corrupt(volatile char *pktp, volatile char *pstop, char *buf, 3020Sstevel@tonic-gate volatile char *bufstop) 3030Sstevel@tonic-gate { 3040Sstevel@tonic-gate int c; 3050Sstevel@tonic-gate int i; 3060Sstevel@tonic-gate int p; 3070Sstevel@tonic-gate int li = rand() % (pstop - pktp - 1) + 1; 3080Sstevel@tonic-gate volatile char *pp = pktp; 3090Sstevel@tonic-gate volatile char *pe = bufstop < pstop ? bufstop : pstop; 3100Sstevel@tonic-gate 3110Sstevel@tonic-gate if (pktp < buf || pktp > bufstop) 3120Sstevel@tonic-gate return; 3130Sstevel@tonic-gate 3140Sstevel@tonic-gate for (pp = pktp; pp < pe; pp += li) { 3150Sstevel@tonic-gate c = ((pe - pp) < li ? pe - pp : li); 3160Sstevel@tonic-gate i = (rand() % c)>>1; 3170Sstevel@tonic-gate while (--i > 0) { 3180Sstevel@tonic-gate p = (rand() % c); 3190Sstevel@tonic-gate pp[p] = (unsigned char)(rand() & 0xFF); 3200Sstevel@tonic-gate } 3210Sstevel@tonic-gate } 3220Sstevel@tonic-gate } 3230Sstevel@tonic-gate #endif /* DEBUG */ 3240Sstevel@tonic-gate 3251676Sjpk static void 3261676Sjpk scan(char *buf, int len, int filter, int cap, int old, void (*proc)(), 3271676Sjpk int first, int last, int flags) 3280Sstevel@tonic-gate { 3290Sstevel@tonic-gate volatile char *bp, *bufstop; 3300Sstevel@tonic-gate volatile struct sb_hdr *hdrp; 3310Sstevel@tonic-gate volatile struct sb_hdr nhdr, *nhdrp; 3320Sstevel@tonic-gate volatile char *pktp; 3330Sstevel@tonic-gate volatile struct timeval last_timestamp; 3340Sstevel@tonic-gate volatile int header_okay; 3350Sstevel@tonic-gate extern int count, maxcount; 3360Sstevel@tonic-gate extern int snoop_nrecover; 3370Sstevel@tonic-gate #ifdef DEBUG 3380Sstevel@tonic-gate extern int zflg; 3390Sstevel@tonic-gate #endif /* DEBUG */ 3400Sstevel@tonic-gate 3410Sstevel@tonic-gate proc(0, 0, 0); 3420Sstevel@tonic-gate bufstop = buf + len; 3430Sstevel@tonic-gate 3440Sstevel@tonic-gate /* 3450Sstevel@tonic-gate * 3460Sstevel@tonic-gate * Loop through each packet in the buffer 3470Sstevel@tonic-gate */ 3480Sstevel@tonic-gate last_timestamp.tv_sec = 0; 3490Sstevel@tonic-gate (void) memcpy((char *)ojmp_env, (char *)jmp_env, sizeof (jmp_env)); 3500Sstevel@tonic-gate for (bp = buf; bp < bufstop; bp += nhdrp->sbh_totlen) { 3510Sstevel@tonic-gate /* 3520Sstevel@tonic-gate * Gracefully exit if user terminates 3530Sstevel@tonic-gate */ 3540Sstevel@tonic-gate if (quitting) 3550Sstevel@tonic-gate break; 3560Sstevel@tonic-gate /* 3570Sstevel@tonic-gate * Global error recocery: Prepare to continue when a corrupt 3580Sstevel@tonic-gate * packet or header is encountered. 3590Sstevel@tonic-gate */ 3600Sstevel@tonic-gate if (sigsetjmp(jmp_env, 1)) { 3610Sstevel@tonic-gate goto err; 3620Sstevel@tonic-gate } 3630Sstevel@tonic-gate 3640Sstevel@tonic-gate header_okay = 0; 3650Sstevel@tonic-gate hdrp = (struct sb_hdr *)bp; 3660Sstevel@tonic-gate nhdrp = hdrp; 3670Sstevel@tonic-gate pktp = (char *)hdrp + sizeof (*hdrp); 3680Sstevel@tonic-gate 3690Sstevel@tonic-gate /* 3700Sstevel@tonic-gate * If reading a capture file 3710Sstevel@tonic-gate * convert the headers from network 3720Sstevel@tonic-gate * byte order (for little-endians like X86) 3730Sstevel@tonic-gate */ 3740Sstevel@tonic-gate if (cap) { 3750Sstevel@tonic-gate /* 3760Sstevel@tonic-gate * If the packets come from an old 3770Sstevel@tonic-gate * capture file, convert the header. 3780Sstevel@tonic-gate */ 3790Sstevel@tonic-gate if (old) { 3801676Sjpk convert_old((struct ohdr *)hdrp); 3810Sstevel@tonic-gate } 3820Sstevel@tonic-gate 3830Sstevel@tonic-gate nhdrp = &nhdr; 3840Sstevel@tonic-gate 3850Sstevel@tonic-gate nhdrp->sbh_origlen = ntohl(hdrp->sbh_origlen); 3860Sstevel@tonic-gate nhdrp->sbh_msglen = ntohl(hdrp->sbh_msglen); 3870Sstevel@tonic-gate nhdrp->sbh_totlen = ntohl(hdrp->sbh_totlen); 3880Sstevel@tonic-gate nhdrp->sbh_drops = ntohl(hdrp->sbh_drops); 3890Sstevel@tonic-gate nhdrp->sbh_timestamp.tv_sec = 3908023SPhil.Kirk@Sun.COM ntohl(hdrp->sbh_timestamp.tv_sec); 3910Sstevel@tonic-gate nhdrp->sbh_timestamp.tv_usec = 3928023SPhil.Kirk@Sun.COM ntohl(hdrp->sbh_timestamp.tv_usec); 3930Sstevel@tonic-gate } 3940Sstevel@tonic-gate 3950Sstevel@tonic-gate /* Enhanced check for valid header */ 3960Sstevel@tonic-gate 3970Sstevel@tonic-gate if ((nhdrp->sbh_totlen == 0) || 3980Sstevel@tonic-gate (bp + nhdrp->sbh_totlen) < bp || 3990Sstevel@tonic-gate (bp + nhdrp->sbh_totlen) > bufstop || 4000Sstevel@tonic-gate (nhdrp->sbh_origlen == 0) || 4010Sstevel@tonic-gate (bp + nhdrp->sbh_origlen) < bp || 4020Sstevel@tonic-gate (nhdrp->sbh_msglen == 0) || 4030Sstevel@tonic-gate (bp + nhdrp->sbh_msglen) < bp || 4040Sstevel@tonic-gate (bp + nhdrp->sbh_msglen) > bufstop || 4050Sstevel@tonic-gate (nhdrp->sbh_msglen > nhdrp->sbh_origlen) || 4060Sstevel@tonic-gate (nhdrp->sbh_totlen < nhdrp->sbh_msglen) || 4070Sstevel@tonic-gate (nhdrp->sbh_timestamp.tv_sec == 0)) { 4088023SPhil.Kirk@Sun.COM if (cap) { 4093628Sss150715 (void) fprintf(stderr, "(warning) bad packet " 4103628Sss150715 "header in capture file"); 4118023SPhil.Kirk@Sun.COM } else { 4123628Sss150715 (void) fprintf(stderr, "(warning) bad packet " 4133628Sss150715 "header in buffer"); 4148023SPhil.Kirk@Sun.COM } 4150Sstevel@tonic-gate (void) fprintf(stderr, " offset %d: length=%d\n", 4168023SPhil.Kirk@Sun.COM bp - buf, nhdrp->sbh_totlen); 4170Sstevel@tonic-gate goto err; 4180Sstevel@tonic-gate } 4190Sstevel@tonic-gate 4200Sstevel@tonic-gate if (nhdrp->sbh_totlen > 4213628Sss150715 (dlinfo.di_max_sdu + MAX_HDRTRAILER)) { 4220Sstevel@tonic-gate if (cap) 4233628Sss150715 (void) fprintf(stderr, "(warning) packet length" 4243628Sss150715 " greater than MTU in capture file"); 4250Sstevel@tonic-gate else 4263628Sss150715 (void) fprintf(stderr, "(warning) packet length" 4273628Sss150715 " greater than MTU in buffer"); 4280Sstevel@tonic-gate 4290Sstevel@tonic-gate (void) fprintf(stderr, " offset %d: length=%d\n", 4308023SPhil.Kirk@Sun.COM bp - buf, nhdrp->sbh_totlen); 4310Sstevel@tonic-gate } 4320Sstevel@tonic-gate 4330Sstevel@tonic-gate /* 4340Sstevel@tonic-gate * Check for incomplete packet. We are conservative here, 4350Sstevel@tonic-gate * since we don't know how good the checking is in other 4360Sstevel@tonic-gate * parts of the code. We pass a partial packet, with 4370Sstevel@tonic-gate * a warning. 4380Sstevel@tonic-gate */ 4390Sstevel@tonic-gate if (pktp + nhdrp->sbh_msglen > bufstop) { 4403628Sss150715 (void) fprintf(stderr, "truncated packet buffer\n"); 4410Sstevel@tonic-gate nhdrp->sbh_msglen = bufstop - pktp; 4420Sstevel@tonic-gate } 4430Sstevel@tonic-gate 4440Sstevel@tonic-gate #ifdef DEBUG 4450Sstevel@tonic-gate if (zflg) 4460Sstevel@tonic-gate corrupt(pktp, pktp + nhdrp->sbh_msglen, buf, bufstop); 4470Sstevel@tonic-gate #endif /* DEBUG */ 4480Sstevel@tonic-gate 4490Sstevel@tonic-gate header_okay = 1; 4500Sstevel@tonic-gate if (!filter || 451*10616SSebastien.Roy@Sun.COM want_packet((uchar_t *)pktp, 4528023SPhil.Kirk@Sun.COM nhdrp->sbh_msglen, 4538023SPhil.Kirk@Sun.COM nhdrp->sbh_origlen)) { 4540Sstevel@tonic-gate count++; 4550Sstevel@tonic-gate 4560Sstevel@tonic-gate /* 4570Sstevel@tonic-gate * Start deadman timer for interpreter processing 4580Sstevel@tonic-gate */ 4590Sstevel@tonic-gate (void) snoop_alarm(SNOOP_ALARM_GRAN*SNOOP_MAXRECOVER, 4608023SPhil.Kirk@Sun.COM NULL); 4610Sstevel@tonic-gate 4620Sstevel@tonic-gate encap_levels = 0; 4630Sstevel@tonic-gate if (!cap || count >= first) 4640Sstevel@tonic-gate proc(nhdrp, pktp, count, flags); 4650Sstevel@tonic-gate 4660Sstevel@tonic-gate if (cap && count >= last) { 4670Sstevel@tonic-gate (void) snoop_alarm(0, NULL); 4680Sstevel@tonic-gate break; 4690Sstevel@tonic-gate } 4700Sstevel@tonic-gate 4710Sstevel@tonic-gate if (maxcount && count >= maxcount) { 4723628Sss150715 (void) fprintf(stderr, "%d packets captured\n", 4733628Sss150715 count); 4740Sstevel@tonic-gate exit(0); 4750Sstevel@tonic-gate } 4760Sstevel@tonic-gate 4770Sstevel@tonic-gate snoop_nrecover = 0; /* success */ 4780Sstevel@tonic-gate (void) snoop_alarm(0, NULL); 4790Sstevel@tonic-gate last_timestamp = hdrp->sbh_timestamp; /* save stamp */ 4800Sstevel@tonic-gate } 4810Sstevel@tonic-gate continue; 4820Sstevel@tonic-gate err: 4830Sstevel@tonic-gate /* 4840Sstevel@tonic-gate * Corruption has been detected. Reset errors. 4850Sstevel@tonic-gate */ 4860Sstevel@tonic-gate snoop_recover(); 4870Sstevel@tonic-gate 4880Sstevel@tonic-gate /* 4890Sstevel@tonic-gate * packet header was apparently okay. Continue. 4900Sstevel@tonic-gate */ 4910Sstevel@tonic-gate if (header_okay) 4920Sstevel@tonic-gate continue; 4930Sstevel@tonic-gate 4940Sstevel@tonic-gate /* 4950Sstevel@tonic-gate * Otherwise try to scan forward to the next packet, using 4960Sstevel@tonic-gate * the last known timestamp if it is available. 4970Sstevel@tonic-gate */ 4980Sstevel@tonic-gate nhdrp = &nhdr; 4990Sstevel@tonic-gate nhdrp->sbh_totlen = 0; 5000Sstevel@tonic-gate if (last_timestamp.tv_sec == 0) { 5010Sstevel@tonic-gate bp += sizeof (int); 5020Sstevel@tonic-gate } else { 5030Sstevel@tonic-gate for (bp += sizeof (int); bp <= bufstop; 5048023SPhil.Kirk@Sun.COM bp += sizeof (int)) { 5050Sstevel@tonic-gate hdrp = (struct sb_hdr *)bp; 5060Sstevel@tonic-gate /* An approximate timestamp located */ 5070Sstevel@tonic-gate if ((hdrp->sbh_timestamp.tv_sec >> 8) == 5080Sstevel@tonic-gate (last_timestamp.tv_sec >> 8)) 5090Sstevel@tonic-gate break; 5100Sstevel@tonic-gate } 5110Sstevel@tonic-gate } 5120Sstevel@tonic-gate } 5130Sstevel@tonic-gate /* reset jmp_env for program exit */ 5140Sstevel@tonic-gate (void) memcpy((char *)jmp_env, (char *)ojmp_env, sizeof (jmp_env)); 5150Sstevel@tonic-gate proc(0, -1, 0); 5160Sstevel@tonic-gate } 5170Sstevel@tonic-gate 5180Sstevel@tonic-gate /* 5190Sstevel@tonic-gate * Called if nwrite() encounters write problems. 5200Sstevel@tonic-gate */ 5210Sstevel@tonic-gate static void 5220Sstevel@tonic-gate cap_write_error(const char *msgtype) 5230Sstevel@tonic-gate { 5240Sstevel@tonic-gate (void) fprintf(stderr, 5258023SPhil.Kirk@Sun.COM "snoop: cannot write %s to capture file: %s\n", 5268023SPhil.Kirk@Sun.COM msgtype, strerror(errno)); 5270Sstevel@tonic-gate exit(1); 5280Sstevel@tonic-gate } 5290Sstevel@tonic-gate 5300Sstevel@tonic-gate /* 5310Sstevel@tonic-gate * Writes target buffer to the open file descriptor. Upon detection of a short 5320Sstevel@tonic-gate * write, an attempt to process the remaining bytes occurs until all anticipated 5330Sstevel@tonic-gate * bytes are written. An error status is returned to indicate any serious write 5340Sstevel@tonic-gate * failures. 5350Sstevel@tonic-gate */ 5360Sstevel@tonic-gate static int 5370Sstevel@tonic-gate nwrite(int fd, const void *buffer, size_t buflen) 5380Sstevel@tonic-gate { 5390Sstevel@tonic-gate size_t nwritten; 5400Sstevel@tonic-gate ssize_t nbytes = 0; 5410Sstevel@tonic-gate const char *buf = buffer; 5420Sstevel@tonic-gate 5430Sstevel@tonic-gate for (nwritten = 0; nwritten < buflen; nwritten += nbytes) { 5440Sstevel@tonic-gate nbytes = write(fd, &buf[nwritten], buflen - nwritten); 5450Sstevel@tonic-gate if (nbytes == -1) 5460Sstevel@tonic-gate return (-1); 5470Sstevel@tonic-gate if (nbytes == 0) { 5480Sstevel@tonic-gate errno = EIO; 5490Sstevel@tonic-gate return (-1); 5500Sstevel@tonic-gate } 5510Sstevel@tonic-gate } 5520Sstevel@tonic-gate return (0); 5530Sstevel@tonic-gate } 5540Sstevel@tonic-gate 5550Sstevel@tonic-gate /* 5560Sstevel@tonic-gate * Routines for opening, closing, reading and writing 5570Sstevel@tonic-gate * a capture file of packets saved with the -o option. 5580Sstevel@tonic-gate */ 5590Sstevel@tonic-gate static int capfile_out; 5600Sstevel@tonic-gate 5610Sstevel@tonic-gate /* 5620Sstevel@tonic-gate * The snoop capture file has a header to identify 5630Sstevel@tonic-gate * it as a capture file and record its version. 5640Sstevel@tonic-gate * A file without this header is assumed to be an 5650Sstevel@tonic-gate * old format snoop file. 5660Sstevel@tonic-gate * 5670Sstevel@tonic-gate * A version 1 header looks like this: 5680Sstevel@tonic-gate * 5690Sstevel@tonic-gate * 0 1 2 3 4 5 6 7 8 9 10 11 5700Sstevel@tonic-gate * +---+---+---+---+---+---+---+---+---+---+---+---+---+ 5710Sstevel@tonic-gate * | s | n | o | o | p | \0| \0| \0| version | data 5720Sstevel@tonic-gate * +---+---+---+---+---+---+---+---+---+---+---+---+---+ 5730Sstevel@tonic-gate * | word 0 | word 1 | word 2 | 5740Sstevel@tonic-gate * 5750Sstevel@tonic-gate * 5760Sstevel@tonic-gate * A version 2 header adds a word that identifies the MAC type. 5770Sstevel@tonic-gate * This allows for capture files from FDDI etc. 5780Sstevel@tonic-gate * 5790Sstevel@tonic-gate * 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 5800Sstevel@tonic-gate * +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+ 5810Sstevel@tonic-gate * | s | n | o | o | p | \0| \0| \0| version | MAC type | data 5820Sstevel@tonic-gate * +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+ 5830Sstevel@tonic-gate * | word 0 | word 1 | word 2 | word 3 5840Sstevel@tonic-gate * 5850Sstevel@tonic-gate */ 5861676Sjpk static const char *snoop_id = "snoop\0\0\0"; 5871676Sjpk static const int snoop_idlen = 8; 5881676Sjpk static const int snoop_version = 2; 5890Sstevel@tonic-gate 5900Sstevel@tonic-gate void 5913628Sss150715 cap_open_write(const char *name) 5920Sstevel@tonic-gate { 5930Sstevel@tonic-gate int vers; 5940Sstevel@tonic-gate 5950Sstevel@tonic-gate capfile_out = open(name, O_CREAT | O_TRUNC | O_RDWR, 0666); 5960Sstevel@tonic-gate if (capfile_out < 0) 5970Sstevel@tonic-gate pr_err("%s: %m", name); 5980Sstevel@tonic-gate 5990Sstevel@tonic-gate vers = htonl(snoop_version); 6001676Sjpk if (nwrite(capfile_out, snoop_id, snoop_idlen) == -1) 6010Sstevel@tonic-gate cap_write_error("snoop_id"); 6020Sstevel@tonic-gate 6031676Sjpk if (nwrite(capfile_out, &vers, sizeof (int)) == -1) 6040Sstevel@tonic-gate cap_write_error("version"); 6050Sstevel@tonic-gate } 6060Sstevel@tonic-gate 6070Sstevel@tonic-gate 6080Sstevel@tonic-gate void 6091676Sjpk cap_close(void) 6100Sstevel@tonic-gate { 6111676Sjpk (void) close(capfile_out); 6120Sstevel@tonic-gate } 6130Sstevel@tonic-gate 6140Sstevel@tonic-gate static char *cap_buffp = NULL; 6150Sstevel@tonic-gate static int cap_len = 0; 6160Sstevel@tonic-gate static int cap_new; 6170Sstevel@tonic-gate 6180Sstevel@tonic-gate void 6193628Sss150715 cap_open_read(const char *name) 6200Sstevel@tonic-gate { 6210Sstevel@tonic-gate struct stat st; 6220Sstevel@tonic-gate int cap_vers; 6230Sstevel@tonic-gate int *word, device_mac_type; 6240Sstevel@tonic-gate int capfile_in; 6250Sstevel@tonic-gate 6260Sstevel@tonic-gate capfile_in = open(name, O_RDONLY); 6270Sstevel@tonic-gate if (capfile_in < 0) 6280Sstevel@tonic-gate pr_err("couldn't open %s: %m", name); 6290Sstevel@tonic-gate 6300Sstevel@tonic-gate if (fstat(capfile_in, &st) < 0) 6310Sstevel@tonic-gate pr_err("couldn't stat %s: %m", name); 6320Sstevel@tonic-gate cap_len = st.st_size; 6330Sstevel@tonic-gate 6340Sstevel@tonic-gate cap_buffp = mmap(0, cap_len, PROT_READ, MAP_PRIVATE, capfile_in, 0); 6351676Sjpk (void) close(capfile_in); 6360Sstevel@tonic-gate if ((int)cap_buffp == -1) 6370Sstevel@tonic-gate pr_err("couldn't mmap %s: %m", name); 6380Sstevel@tonic-gate 6390Sstevel@tonic-gate /* Check if new snoop capture file format */ 6400Sstevel@tonic-gate 6410Sstevel@tonic-gate cap_new = bcmp(cap_buffp, snoop_id, snoop_idlen) == 0; 6420Sstevel@tonic-gate 6430Sstevel@tonic-gate /* 6440Sstevel@tonic-gate * If new file - check version and 6450Sstevel@tonic-gate * set buffer pointer to point at first packet 6460Sstevel@tonic-gate */ 6470Sstevel@tonic-gate if (cap_new) { 6480Sstevel@tonic-gate cap_vers = ntohl(*(int *)(cap_buffp + snoop_idlen)); 6490Sstevel@tonic-gate cap_buffp += snoop_idlen + sizeof (int); 6500Sstevel@tonic-gate cap_len -= snoop_idlen + sizeof (int); 6510Sstevel@tonic-gate 6520Sstevel@tonic-gate switch (cap_vers) { 6530Sstevel@tonic-gate case 1: 6540Sstevel@tonic-gate device_mac_type = DL_ETHER; 6550Sstevel@tonic-gate break; 6560Sstevel@tonic-gate 6570Sstevel@tonic-gate case 2: 6580Sstevel@tonic-gate device_mac_type = ntohl(*((int *)cap_buffp)); 6590Sstevel@tonic-gate cap_buffp += sizeof (int); 6600Sstevel@tonic-gate cap_len -= sizeof (int); 6610Sstevel@tonic-gate break; 6620Sstevel@tonic-gate 6630Sstevel@tonic-gate default: 6640Sstevel@tonic-gate pr_err("capture file: %s: Version %d unrecognized\n", 6658023SPhil.Kirk@Sun.COM name, cap_vers); 6660Sstevel@tonic-gate } 6670Sstevel@tonic-gate 6680Sstevel@tonic-gate for (interface = &INTERFACES[0]; interface->mac_type != -1; 6698023SPhil.Kirk@Sun.COM interface++) 6700Sstevel@tonic-gate if (interface->mac_type == device_mac_type) 6710Sstevel@tonic-gate break; 6720Sstevel@tonic-gate 6730Sstevel@tonic-gate if (interface->mac_type == -1) 6740Sstevel@tonic-gate pr_err("Mac Type = %x is not supported\n", 6758023SPhil.Kirk@Sun.COM device_mac_type); 6760Sstevel@tonic-gate } else { 6770Sstevel@tonic-gate /* Use heuristic to check if it's an old-style file */ 6780Sstevel@tonic-gate 6790Sstevel@tonic-gate device_mac_type = DL_ETHER; 6800Sstevel@tonic-gate word = (int *)cap_buffp; 6810Sstevel@tonic-gate 6820Sstevel@tonic-gate if (!((word[0] < 1600 && word[1] < 1600) && 6830Sstevel@tonic-gate (word[0] < word[1]) && 6840Sstevel@tonic-gate (word[2] > 610000000 && word[2] < 770000000))) 6850Sstevel@tonic-gate pr_err("not a capture file: %s", name); 6860Sstevel@tonic-gate 6870Sstevel@tonic-gate /* Change protection so's we can fix the headers */ 6880Sstevel@tonic-gate 6890Sstevel@tonic-gate if (mprotect(cap_buffp, cap_len, PROT_READ | PROT_WRITE) < 0) 6900Sstevel@tonic-gate pr_err("mprotect: %s: %m", name); 6910Sstevel@tonic-gate } 6923628Sss150715 dlinfo.di_max_sdu = MAXINT; /* Decode any stored packet. */ 6930Sstevel@tonic-gate } 6940Sstevel@tonic-gate 6950Sstevel@tonic-gate void 6963628Sss150715 cap_read(int first, int last, int filter, void (*proc)(), int flags) 6970Sstevel@tonic-gate { 6980Sstevel@tonic-gate extern int count; 6990Sstevel@tonic-gate 7000Sstevel@tonic-gate count = 0; 7010Sstevel@tonic-gate 7020Sstevel@tonic-gate scan(cap_buffp, cap_len, filter, 1, !cap_new, proc, first, last, flags); 7030Sstevel@tonic-gate 7041676Sjpk (void) munmap(cap_buffp, cap_len); 7050Sstevel@tonic-gate } 7060Sstevel@tonic-gate 7071676Sjpk /* ARGSUSED */ 7080Sstevel@tonic-gate void 7093628Sss150715 cap_write(struct sb_hdr *hdrp, char *pktp, int num, int flags) 7100Sstevel@tonic-gate { 7110Sstevel@tonic-gate int pktlen, mac; 7120Sstevel@tonic-gate static int first = 1; 7130Sstevel@tonic-gate struct sb_hdr nhdr; 7140Sstevel@tonic-gate extern boolean_t qflg; 7150Sstevel@tonic-gate 7160Sstevel@tonic-gate if (hdrp == NULL) 7170Sstevel@tonic-gate return; 7180Sstevel@tonic-gate 7190Sstevel@tonic-gate if (first) { 7200Sstevel@tonic-gate first = 0; 7210Sstevel@tonic-gate mac = htonl(interface->mac_type); 7221676Sjpk if (nwrite(capfile_out, &mac, sizeof (int)) == -1) 7230Sstevel@tonic-gate cap_write_error("mac_type"); 7240Sstevel@tonic-gate } 7250Sstevel@tonic-gate 7260Sstevel@tonic-gate pktlen = hdrp->sbh_totlen - sizeof (*hdrp); 7270Sstevel@tonic-gate 7280Sstevel@tonic-gate /* 7290Sstevel@tonic-gate * Convert sb_hdr to network byte order 7300Sstevel@tonic-gate */ 7310Sstevel@tonic-gate nhdr.sbh_origlen = htonl(hdrp->sbh_origlen); 7320Sstevel@tonic-gate nhdr.sbh_msglen = htonl(hdrp->sbh_msglen); 7330Sstevel@tonic-gate nhdr.sbh_totlen = htonl(hdrp->sbh_totlen); 7340Sstevel@tonic-gate nhdr.sbh_drops = htonl(hdrp->sbh_drops); 7350Sstevel@tonic-gate nhdr.sbh_timestamp.tv_sec = htonl(hdrp->sbh_timestamp.tv_sec); 7360Sstevel@tonic-gate nhdr.sbh_timestamp.tv_usec = htonl(hdrp->sbh_timestamp.tv_usec); 7370Sstevel@tonic-gate 7381676Sjpk if (nwrite(capfile_out, &nhdr, sizeof (nhdr)) == -1) 7390Sstevel@tonic-gate cap_write_error("packet header"); 7400Sstevel@tonic-gate 7411676Sjpk if (nwrite(capfile_out, pktp, pktlen) == -1) 7420Sstevel@tonic-gate cap_write_error("packet"); 7430Sstevel@tonic-gate 7440Sstevel@tonic-gate if (! qflg) 7450Sstevel@tonic-gate show_count(); 7460Sstevel@tonic-gate } 7470Sstevel@tonic-gate 7480Sstevel@tonic-gate /* 7490Sstevel@tonic-gate * Convert a packet header from 7500Sstevel@tonic-gate * old to new format. 7510Sstevel@tonic-gate */ 7521676Sjpk static void 7531676Sjpk convert_old(struct ohdr *ohdrp) 7540Sstevel@tonic-gate { 7550Sstevel@tonic-gate struct sb_hdr nhdr; 7560Sstevel@tonic-gate 7570Sstevel@tonic-gate nhdr.sbh_origlen = ohdrp->o_len; 7580Sstevel@tonic-gate nhdr.sbh_msglen = ohdrp->o_msglen; 7590Sstevel@tonic-gate nhdr.sbh_totlen = ohdrp->o_totlen; 7600Sstevel@tonic-gate nhdr.sbh_drops = ohdrp->o_drops; 7610Sstevel@tonic-gate nhdr.sbh_timestamp = ohdrp->o_time; 7620Sstevel@tonic-gate 7630Sstevel@tonic-gate *(struct sb_hdr *)ohdrp = nhdr; 7640Sstevel@tonic-gate } 7650Sstevel@tonic-gate 766410Skcpoon static int 7671676Sjpk strioctl(int fd, int cmd, int timout, int len, void *dp) 7680Sstevel@tonic-gate { 7690Sstevel@tonic-gate struct strioctl sioc; 7700Sstevel@tonic-gate int rc; 7710Sstevel@tonic-gate 7720Sstevel@tonic-gate sioc.ic_cmd = cmd; 7730Sstevel@tonic-gate sioc.ic_timout = timout; 7740Sstevel@tonic-gate sioc.ic_len = len; 7750Sstevel@tonic-gate sioc.ic_dp = dp; 7760Sstevel@tonic-gate rc = ioctl(fd, I_STR, &sioc); 7770Sstevel@tonic-gate 7780Sstevel@tonic-gate if (rc < 0) 7790Sstevel@tonic-gate return (rc); 7800Sstevel@tonic-gate else 7810Sstevel@tonic-gate return (sioc.ic_len); 7820Sstevel@tonic-gate } 783