10Sstevel@tonic-gate /* 20Sstevel@tonic-gate * CDDL HEADER START 30Sstevel@tonic-gate * 40Sstevel@tonic-gate * The contents of this file are subject to the terms of the 51676Sjpk * Common Development and Distribution License (the "License"). 61676Sjpk * You may not use this file except in compliance with the License. 70Sstevel@tonic-gate * 80Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 90Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing. 100Sstevel@tonic-gate * See the License for the specific language governing permissions 110Sstevel@tonic-gate * and limitations under the License. 120Sstevel@tonic-gate * 130Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each 140Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 150Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the 160Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying 170Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner] 180Sstevel@tonic-gate * 190Sstevel@tonic-gate * CDDL HEADER END 200Sstevel@tonic-gate */ 210Sstevel@tonic-gate /* 22*8485SPeter.Memishian@Sun.COM * Copyright 2009 Sun Microsystems, Inc. All rights reserved. 230Sstevel@tonic-gate * Use is subject to license terms. 240Sstevel@tonic-gate */ 250Sstevel@tonic-gate 260Sstevel@tonic-gate #include <stdio.h> 270Sstevel@tonic-gate #include <string.h> 280Sstevel@tonic-gate #include <errno.h> 290Sstevel@tonic-gate #include <fcntl.h> 300Sstevel@tonic-gate #include <setjmp.h> 310Sstevel@tonic-gate #include <sys/types.h> 320Sstevel@tonic-gate #include <sys/signal.h> 330Sstevel@tonic-gate #include <sys/time.h> 340Sstevel@tonic-gate #include <sys/socket.h> 350Sstevel@tonic-gate #include <sys/sockio.h> 360Sstevel@tonic-gate #include <net/if.h> 370Sstevel@tonic-gate #include <netinet/in_systm.h> 380Sstevel@tonic-gate #include <netinet/in.h> 390Sstevel@tonic-gate #include <netinet/ip.h> 400Sstevel@tonic-gate #include <sys/pfmod.h> 410Sstevel@tonic-gate #include <netinet/if_ether.h> 420Sstevel@tonic-gate #include <sys/mman.h> 430Sstevel@tonic-gate #include <sys/stat.h> 440Sstevel@tonic-gate #include <sys/stropts.h> 450Sstevel@tonic-gate #include <sys/bufmod.h> 460Sstevel@tonic-gate 470Sstevel@tonic-gate #include <unistd.h> 480Sstevel@tonic-gate #include <stropts.h> 490Sstevel@tonic-gate #include <stdlib.h> 500Sstevel@tonic-gate #include <ctype.h> 510Sstevel@tonic-gate #include <values.h> 520Sstevel@tonic-gate #include <libdlpi.h> 538023SPhil.Kirk@Sun.COM #include <sys/dlpi.h> 540Sstevel@tonic-gate 550Sstevel@tonic-gate #include "snoop.h" 560Sstevel@tonic-gate 571676Sjpk /* 581676Sjpk * Old header format. 591676Sjpk * Actually two concatenated structs: nit_bufhdr + nit_head 601676Sjpk */ 611676Sjpk struct ohdr { 621676Sjpk /* nit_bufhdr */ 631676Sjpk int o_msglen; 641676Sjpk int o_totlen; 651676Sjpk /* nit_head */ 661676Sjpk struct timeval o_time; 671676Sjpk int o_drops; 681676Sjpk int o_len; 691676Sjpk }; 701676Sjpk 711676Sjpk static void scan(char *, int, int, int, int, void (*)(), int, int, int); 720Sstevel@tonic-gate void convert_to_network(); 730Sstevel@tonic-gate void convert_from_network(); 741676Sjpk static void convert_old(struct ohdr *); 750Sstevel@tonic-gate extern sigjmp_buf jmp_env, ojmp_env; 763628Sss150715 static dlpi_info_t dlinfo; 771676Sjpk static char *bufp; /* pointer to read buffer */ 780Sstevel@tonic-gate 791676Sjpk static int strioctl(int, int, int, int, void *); 80410Skcpoon 810Sstevel@tonic-gate /* 823628Sss150715 * Open up the device in raw mode and passive mode 833628Sss150715 * (see dlpi_open(3DLPI)) and start finding out something about it, 843628Sss150715 * especially stuff about the data link headers. We need that information 850Sstevel@tonic-gate * to build the proper packet filters. 860Sstevel@tonic-gate */ 87410Skcpoon boolean_t 883628Sss150715 check_device(dlpi_handle_t *dhp, char **devicep) 890Sstevel@tonic-gate { 903628Sss150715 int retval; 918023SPhil.Kirk@Sun.COM int flags = DLPI_PASSIVE | DLPI_RAW; 923628Sss150715 930Sstevel@tonic-gate /* 940Sstevel@tonic-gate * Determine which network device 950Sstevel@tonic-gate * to use if none given. 960Sstevel@tonic-gate * Should get back a value like "le0". 970Sstevel@tonic-gate */ 980Sstevel@tonic-gate if (*devicep == NULL) { 990Sstevel@tonic-gate char *cbuf; 1000Sstevel@tonic-gate static struct ifconf ifc; 1010Sstevel@tonic-gate static struct ifreq *ifr; 1020Sstevel@tonic-gate int s; 1030Sstevel@tonic-gate int n; 1040Sstevel@tonic-gate int numifs; 1050Sstevel@tonic-gate unsigned bufsize; 1060Sstevel@tonic-gate 1070Sstevel@tonic-gate if ((s = socket(AF_INET, SOCK_DGRAM, 0)) < 0) 1088023SPhil.Kirk@Sun.COM pr_err("socket"); 1090Sstevel@tonic-gate 1100Sstevel@tonic-gate if (ioctl(s, SIOCGIFNUM, (char *)&numifs) < 0) { 1110Sstevel@tonic-gate pr_err("check_device: ioctl SIOCGIFNUM"); 1120Sstevel@tonic-gate (void) close(s); 1130Sstevel@tonic-gate s = -1; 114410Skcpoon return (B_FALSE); 1150Sstevel@tonic-gate } 1160Sstevel@tonic-gate 1170Sstevel@tonic-gate bufsize = numifs * sizeof (struct ifreq); 1180Sstevel@tonic-gate cbuf = (char *)malloc(bufsize); 1190Sstevel@tonic-gate if (cbuf == NULL) { 1200Sstevel@tonic-gate pr_err("out of memory\n"); 1210Sstevel@tonic-gate (void) close(s); 1220Sstevel@tonic-gate s = -1; 123410Skcpoon return (B_FALSE); 1240Sstevel@tonic-gate } 1250Sstevel@tonic-gate ifc.ifc_len = bufsize; 1260Sstevel@tonic-gate ifc.ifc_buf = cbuf; 1270Sstevel@tonic-gate if (ioctl(s, SIOCGIFCONF, (char *)&ifc) < 0) { 1280Sstevel@tonic-gate pr_err("check_device: ioctl SIOCGIFCONF"); 1290Sstevel@tonic-gate (void) close(s); 1300Sstevel@tonic-gate s = -1; 1310Sstevel@tonic-gate (void) free(cbuf); 132410Skcpoon return (B_FALSE); 1330Sstevel@tonic-gate } 1340Sstevel@tonic-gate n = ifc.ifc_len / sizeof (struct ifreq); 1350Sstevel@tonic-gate ifr = ifc.ifc_req; 1360Sstevel@tonic-gate for (; n > 0; n--, ifr++) { 1370Sstevel@tonic-gate if (strchr(ifr->ifr_name, ':') != NULL) 1380Sstevel@tonic-gate continue; 1390Sstevel@tonic-gate if (ioctl(s, SIOCGIFFLAGS, (char *)ifr) < 0) 1400Sstevel@tonic-gate pr_err("ioctl SIOCGIFFLAGS"); 1410Sstevel@tonic-gate if ((ifr->ifr_flags & 142*8485SPeter.Memishian@Sun.COM (IFF_VIRTUAL|IFF_IPMP|IFF_UP| 1438023SPhil.Kirk@Sun.COM IFF_RUNNING)) == (IFF_UP|IFF_RUNNING)) 1440Sstevel@tonic-gate break; 1450Sstevel@tonic-gate } 1460Sstevel@tonic-gate 1470Sstevel@tonic-gate if (n == 0) 1480Sstevel@tonic-gate pr_err("No network interface devices found"); 1490Sstevel@tonic-gate 1500Sstevel@tonic-gate *devicep = ifr->ifr_name; 1510Sstevel@tonic-gate (void) close(s); 1520Sstevel@tonic-gate } 1538023SPhil.Kirk@Sun.COM if (Iflg) 1548023SPhil.Kirk@Sun.COM flags |= DLPI_DEVIPNET; 1558023SPhil.Kirk@Sun.COM if (Iflg || strcmp(*devicep, "lo0") == 0) 1568023SPhil.Kirk@Sun.COM flags |= DLPI_IPNETINFO; 1578023SPhil.Kirk@Sun.COM if ((retval = dlpi_open(*devicep, dhp, flags)) != DLPI_SUCCESS) { 1583628Sss150715 pr_err("cannot open \"%s\": %s", *devicep, 1593628Sss150715 dlpi_strerror(retval)); 1600Sstevel@tonic-gate } 1610Sstevel@tonic-gate 1623628Sss150715 if ((retval = dlpi_info(*dhp, &dlinfo, 0)) != DLPI_SUCCESS) 1633628Sss150715 pr_errdlpi(*dhp, "dlpi_info failed", retval); 1640Sstevel@tonic-gate 1650Sstevel@tonic-gate for (interface = &INTERFACES[0]; interface->mac_type != -1; interface++) 1663628Sss150715 if (interface->mac_type == dlinfo.di_mactype) 1670Sstevel@tonic-gate break; 1680Sstevel@tonic-gate 1693628Sss150715 /* allow limited functionality even if interface isn't known */ 1700Sstevel@tonic-gate if (interface->mac_type == -1) { 1713628Sss150715 (void) fprintf(stderr, "snoop: WARNING: Mac Type = %x " 1723628Sss150715 "not supported\n", dlinfo.di_mactype); 1730Sstevel@tonic-gate } 1740Sstevel@tonic-gate 1750Sstevel@tonic-gate /* for backward compatibility, allow known interface mtu_sizes */ 1763628Sss150715 if (interface->mtu_size > dlinfo.di_max_sdu) 1773628Sss150715 dlinfo.di_max_sdu = interface->mtu_size; 1780Sstevel@tonic-gate 1792760Sdg199075 return (interface->try_kernel_filter); 1800Sstevel@tonic-gate } 1810Sstevel@tonic-gate 1820Sstevel@tonic-gate /* 1830Sstevel@tonic-gate * Do whatever is necessary to initialize the interface 1843628Sss150715 * for packet capture. Bind the device opened in check_device(), set 1853628Sss150715 * promiscuous mode, push the streams buffer module and packet filter 1863628Sss150715 * module, set various buffer parameters. 1870Sstevel@tonic-gate */ 1880Sstevel@tonic-gate void 1893628Sss150715 initdevice(dlpi_handle_t dh, ulong_t snaplen, ulong_t chunksize, 1903628Sss150715 struct timeval *timeout, struct Pf_ext_packetfilt *fp) 1910Sstevel@tonic-gate { 1923628Sss150715 int retv; 1933628Sss150715 int netfd; 1948023SPhil.Kirk@Sun.COM int val = 1; 1950Sstevel@tonic-gate 1963628Sss150715 retv = dlpi_bind(dh, DLPI_ANY_SAP, NULL); 1973628Sss150715 if (retv != DLPI_SUCCESS) 1983628Sss150715 pr_errdlpi(dh, "cannot bind on", retv); 1990Sstevel@tonic-gate 2008023SPhil.Kirk@Sun.COM if (Iflg) { 2018023SPhil.Kirk@Sun.COM (void) fprintf(stderr, "Using device ipnet/%s ", 2028023SPhil.Kirk@Sun.COM dlpi_linkname(dh)); 2038023SPhil.Kirk@Sun.COM } else { 2048023SPhil.Kirk@Sun.COM (void) fprintf(stderr, "Using device %s ", dlpi_linkname(dh)); 2058023SPhil.Kirk@Sun.COM } 2060Sstevel@tonic-gate 2070Sstevel@tonic-gate /* 2080Sstevel@tonic-gate * If Pflg not set - use physical level 2090Sstevel@tonic-gate * promiscuous mode. Otherwise - just SAP level. 2100Sstevel@tonic-gate */ 2110Sstevel@tonic-gate if (!Pflg) { 2120Sstevel@tonic-gate (void) fprintf(stderr, "(promiscuous mode)\n"); 2133628Sss150715 retv = dlpi_promiscon(dh, DL_PROMISC_PHYS); 2143628Sss150715 if (retv != DLPI_SUCCESS) { 2153628Sss150715 pr_errdlpi(dh, "promiscuous mode(physical) failed", 2163628Sss150715 retv); 2173628Sss150715 } 2180Sstevel@tonic-gate } else { 2190Sstevel@tonic-gate (void) fprintf(stderr, "(non promiscuous)\n"); 2203628Sss150715 retv = dlpi_promiscon(dh, DL_PROMISC_MULTI); 2213628Sss150715 if (retv != DLPI_SUCCESS) { 2223628Sss150715 pr_errdlpi(dh, "promiscuous mode(multicast) failed", 2233628Sss150715 retv); 2243628Sss150715 } 2250Sstevel@tonic-gate } 2260Sstevel@tonic-gate 2273628Sss150715 retv = dlpi_promiscon(dh, DL_PROMISC_SAP); 2283628Sss150715 if (retv != DLPI_SUCCESS) 2293628Sss150715 pr_errdlpi(dh, "promiscuous mode(SAP) failed", retv); 2300Sstevel@tonic-gate 2313628Sss150715 netfd = dlpi_fd(dh); 2320Sstevel@tonic-gate 2330Sstevel@tonic-gate if (fp) { 2340Sstevel@tonic-gate /* 2350Sstevel@tonic-gate * push and configure the packet filtering module 2360Sstevel@tonic-gate */ 2373628Sss150715 if (ioctl(netfd, I_PUSH, "pfmod") < 0) 2383628Sss150715 pr_errdlpi(dh, "cannot push \"pfmod\"", DL_SYSERR); 2390Sstevel@tonic-gate 240410Skcpoon if (strioctl(netfd, PFIOCSETF, -1, sizeof (*fp), 2413628Sss150715 (char *)fp) < 0) 2423628Sss150715 pr_errdlpi(dh, "PFIOCSETF", DL_SYSERR); 2430Sstevel@tonic-gate } 2440Sstevel@tonic-gate 2453628Sss150715 if (ioctl(netfd, I_PUSH, "bufmod") < 0) 2463628Sss150715 pr_errdlpi(dh, "cannot push \"bufmod\"", DL_SYSERR); 2473628Sss150715 2480Sstevel@tonic-gate if (strioctl(netfd, SBIOCSTIME, -1, sizeof (struct timeval), 2493628Sss150715 (char *)timeout) < 0) 2503628Sss150715 pr_errdlpi(dh, "SBIOCSTIME", DL_SYSERR); 2510Sstevel@tonic-gate 2520Sstevel@tonic-gate if (strioctl(netfd, SBIOCSCHUNK, -1, sizeof (uint_t), 2533628Sss150715 (char *)&chunksize) < 0) 2543628Sss150715 pr_errdlpi(dh, "SBIOCGCHUNK", DL_SYSERR); 2550Sstevel@tonic-gate 2560Sstevel@tonic-gate if (strioctl(netfd, SBIOCSSNAP, -1, sizeof (uint_t), 2573628Sss150715 (char *)&snaplen) < 0) 2583628Sss150715 pr_errdlpi(dh, "SBIOCSSNAP", DL_SYSERR); 2590Sstevel@tonic-gate 2600Sstevel@tonic-gate /* 2610Sstevel@tonic-gate * Flush the read queue, to get rid of anything that 2620Sstevel@tonic-gate * accumulated before the device reached its final configuration. 2630Sstevel@tonic-gate */ 2643628Sss150715 if (ioctl(netfd, I_FLUSH, FLUSHR) < 0) 2653628Sss150715 pr_errdlpi(dh, "cannot flush \"I_FLUSH\"", DL_SYSERR); 2660Sstevel@tonic-gate } 2670Sstevel@tonic-gate 2680Sstevel@tonic-gate /* 2690Sstevel@tonic-gate * Read packets from the network. Initdevice is called in 2700Sstevel@tonic-gate * here to set up the network interface for reading of 2710Sstevel@tonic-gate * raw ethernet packets in promiscuous mode into a buffer. 2720Sstevel@tonic-gate * Packets are read and either written directly to a file 2730Sstevel@tonic-gate * or interpreted for display on the fly. 2740Sstevel@tonic-gate */ 2750Sstevel@tonic-gate void 2763628Sss150715 net_read(dlpi_handle_t dh, size_t chunksize, int filter, void (*proc)(), 2773628Sss150715 int flags) 2780Sstevel@tonic-gate { 2793628Sss150715 int retval; 2800Sstevel@tonic-gate extern int count; 2813628Sss150715 size_t msglen; 2820Sstevel@tonic-gate 2830Sstevel@tonic-gate count = 0; 2840Sstevel@tonic-gate 2850Sstevel@tonic-gate /* allocate a read buffer */ 2860Sstevel@tonic-gate bufp = malloc(chunksize); 2870Sstevel@tonic-gate if (bufp == NULL) 2883628Sss150715 pr_err("no memory for %d buffer", chunksize); 2890Sstevel@tonic-gate 2900Sstevel@tonic-gate /* 2913628Sss150715 * read frames 2920Sstevel@tonic-gate */ 2930Sstevel@tonic-gate for (;;) { 2943628Sss150715 msglen = chunksize; 2953628Sss150715 retval = dlpi_recv(dh, NULL, NULL, bufp, &msglen, -1, NULL); 2960Sstevel@tonic-gate 2973628Sss150715 if (retval != DLPI_SUCCESS || quitting) 2980Sstevel@tonic-gate break; 2990Sstevel@tonic-gate 3003628Sss150715 if (msglen != 0) 3013628Sss150715 scan(bufp, msglen, filter, 0, 0, proc, 0, 0, flags); 3020Sstevel@tonic-gate } 3030Sstevel@tonic-gate 3040Sstevel@tonic-gate free(bufp); 3050Sstevel@tonic-gate 3063628Sss150715 if (!quitting) 3073628Sss150715 pr_errdlpi(dh, "network read failed", retval); 3080Sstevel@tonic-gate } 3090Sstevel@tonic-gate 3100Sstevel@tonic-gate #ifdef DEBUG 3110Sstevel@tonic-gate /* 3120Sstevel@tonic-gate * corrupt: simulate packet corruption for debugging interpreters 3130Sstevel@tonic-gate */ 3140Sstevel@tonic-gate void 3150Sstevel@tonic-gate corrupt(volatile char *pktp, volatile char *pstop, char *buf, 3160Sstevel@tonic-gate volatile char *bufstop) 3170Sstevel@tonic-gate { 3180Sstevel@tonic-gate int c; 3190Sstevel@tonic-gate int i; 3200Sstevel@tonic-gate int p; 3210Sstevel@tonic-gate int li = rand() % (pstop - pktp - 1) + 1; 3220Sstevel@tonic-gate volatile char *pp = pktp; 3230Sstevel@tonic-gate volatile char *pe = bufstop < pstop ? bufstop : pstop; 3240Sstevel@tonic-gate 3250Sstevel@tonic-gate if (pktp < buf || pktp > bufstop) 3260Sstevel@tonic-gate return; 3270Sstevel@tonic-gate 3280Sstevel@tonic-gate for (pp = pktp; pp < pe; pp += li) { 3290Sstevel@tonic-gate c = ((pe - pp) < li ? pe - pp : li); 3300Sstevel@tonic-gate i = (rand() % c)>>1; 3310Sstevel@tonic-gate while (--i > 0) { 3320Sstevel@tonic-gate p = (rand() % c); 3330Sstevel@tonic-gate pp[p] = (unsigned char)(rand() & 0xFF); 3340Sstevel@tonic-gate } 3350Sstevel@tonic-gate } 3360Sstevel@tonic-gate } 3370Sstevel@tonic-gate #endif /* DEBUG */ 3380Sstevel@tonic-gate 3391676Sjpk static void 3401676Sjpk scan(char *buf, int len, int filter, int cap, int old, void (*proc)(), 3411676Sjpk int first, int last, int flags) 3420Sstevel@tonic-gate { 3430Sstevel@tonic-gate volatile char *bp, *bufstop; 3440Sstevel@tonic-gate volatile struct sb_hdr *hdrp; 3450Sstevel@tonic-gate volatile struct sb_hdr nhdr, *nhdrp; 3460Sstevel@tonic-gate volatile char *pktp; 3470Sstevel@tonic-gate volatile struct timeval last_timestamp; 3480Sstevel@tonic-gate volatile int header_okay; 3490Sstevel@tonic-gate extern int count, maxcount; 3500Sstevel@tonic-gate extern int snoop_nrecover; 3510Sstevel@tonic-gate #ifdef DEBUG 3520Sstevel@tonic-gate extern int zflg; 3530Sstevel@tonic-gate #endif /* DEBUG */ 3540Sstevel@tonic-gate 3550Sstevel@tonic-gate proc(0, 0, 0); 3560Sstevel@tonic-gate bufstop = buf + len; 3570Sstevel@tonic-gate 3580Sstevel@tonic-gate /* 3590Sstevel@tonic-gate * 3600Sstevel@tonic-gate * Loop through each packet in the buffer 3610Sstevel@tonic-gate */ 3620Sstevel@tonic-gate last_timestamp.tv_sec = 0; 3630Sstevel@tonic-gate (void) memcpy((char *)ojmp_env, (char *)jmp_env, sizeof (jmp_env)); 3640Sstevel@tonic-gate for (bp = buf; bp < bufstop; bp += nhdrp->sbh_totlen) { 3650Sstevel@tonic-gate /* 3660Sstevel@tonic-gate * Gracefully exit if user terminates 3670Sstevel@tonic-gate */ 3680Sstevel@tonic-gate if (quitting) 3690Sstevel@tonic-gate break; 3700Sstevel@tonic-gate /* 3710Sstevel@tonic-gate * Global error recocery: Prepare to continue when a corrupt 3720Sstevel@tonic-gate * packet or header is encountered. 3730Sstevel@tonic-gate */ 3740Sstevel@tonic-gate if (sigsetjmp(jmp_env, 1)) { 3750Sstevel@tonic-gate goto err; 3760Sstevel@tonic-gate } 3770Sstevel@tonic-gate 3780Sstevel@tonic-gate header_okay = 0; 3790Sstevel@tonic-gate hdrp = (struct sb_hdr *)bp; 3800Sstevel@tonic-gate nhdrp = hdrp; 3810Sstevel@tonic-gate pktp = (char *)hdrp + sizeof (*hdrp); 3820Sstevel@tonic-gate 3830Sstevel@tonic-gate /* 3840Sstevel@tonic-gate * If reading a capture file 3850Sstevel@tonic-gate * convert the headers from network 3860Sstevel@tonic-gate * byte order (for little-endians like X86) 3870Sstevel@tonic-gate */ 3880Sstevel@tonic-gate if (cap) { 3890Sstevel@tonic-gate /* 3900Sstevel@tonic-gate * If the packets come from an old 3910Sstevel@tonic-gate * capture file, convert the header. 3920Sstevel@tonic-gate */ 3930Sstevel@tonic-gate if (old) { 3941676Sjpk convert_old((struct ohdr *)hdrp); 3950Sstevel@tonic-gate } 3960Sstevel@tonic-gate 3970Sstevel@tonic-gate nhdrp = &nhdr; 3980Sstevel@tonic-gate 3990Sstevel@tonic-gate nhdrp->sbh_origlen = ntohl(hdrp->sbh_origlen); 4000Sstevel@tonic-gate nhdrp->sbh_msglen = ntohl(hdrp->sbh_msglen); 4010Sstevel@tonic-gate nhdrp->sbh_totlen = ntohl(hdrp->sbh_totlen); 4020Sstevel@tonic-gate nhdrp->sbh_drops = ntohl(hdrp->sbh_drops); 4030Sstevel@tonic-gate nhdrp->sbh_timestamp.tv_sec = 4048023SPhil.Kirk@Sun.COM ntohl(hdrp->sbh_timestamp.tv_sec); 4050Sstevel@tonic-gate nhdrp->sbh_timestamp.tv_usec = 4068023SPhil.Kirk@Sun.COM ntohl(hdrp->sbh_timestamp.tv_usec); 4070Sstevel@tonic-gate } 4080Sstevel@tonic-gate 4090Sstevel@tonic-gate /* Enhanced check for valid header */ 4100Sstevel@tonic-gate 4110Sstevel@tonic-gate if ((nhdrp->sbh_totlen == 0) || 4120Sstevel@tonic-gate (bp + nhdrp->sbh_totlen) < bp || 4130Sstevel@tonic-gate (bp + nhdrp->sbh_totlen) > bufstop || 4140Sstevel@tonic-gate (nhdrp->sbh_origlen == 0) || 4150Sstevel@tonic-gate (bp + nhdrp->sbh_origlen) < bp || 4160Sstevel@tonic-gate (nhdrp->sbh_msglen == 0) || 4170Sstevel@tonic-gate (bp + nhdrp->sbh_msglen) < bp || 4180Sstevel@tonic-gate (bp + nhdrp->sbh_msglen) > bufstop || 4190Sstevel@tonic-gate (nhdrp->sbh_msglen > nhdrp->sbh_origlen) || 4200Sstevel@tonic-gate (nhdrp->sbh_totlen < nhdrp->sbh_msglen) || 4210Sstevel@tonic-gate (nhdrp->sbh_timestamp.tv_sec == 0)) { 4228023SPhil.Kirk@Sun.COM if (cap) { 4233628Sss150715 (void) fprintf(stderr, "(warning) bad packet " 4243628Sss150715 "header in capture file"); 4258023SPhil.Kirk@Sun.COM } else { 4263628Sss150715 (void) fprintf(stderr, "(warning) bad packet " 4273628Sss150715 "header in buffer"); 4288023SPhil.Kirk@Sun.COM } 4290Sstevel@tonic-gate (void) fprintf(stderr, " offset %d: length=%d\n", 4308023SPhil.Kirk@Sun.COM bp - buf, nhdrp->sbh_totlen); 4310Sstevel@tonic-gate goto err; 4320Sstevel@tonic-gate } 4330Sstevel@tonic-gate 4340Sstevel@tonic-gate if (nhdrp->sbh_totlen > 4353628Sss150715 (dlinfo.di_max_sdu + MAX_HDRTRAILER)) { 4360Sstevel@tonic-gate if (cap) 4373628Sss150715 (void) fprintf(stderr, "(warning) packet length" 4383628Sss150715 " greater than MTU in capture file"); 4390Sstevel@tonic-gate else 4403628Sss150715 (void) fprintf(stderr, "(warning) packet length" 4413628Sss150715 " greater than MTU in buffer"); 4420Sstevel@tonic-gate 4430Sstevel@tonic-gate (void) fprintf(stderr, " offset %d: length=%d\n", 4448023SPhil.Kirk@Sun.COM bp - buf, nhdrp->sbh_totlen); 4450Sstevel@tonic-gate } 4460Sstevel@tonic-gate 4470Sstevel@tonic-gate /* 4480Sstevel@tonic-gate * Check for incomplete packet. We are conservative here, 4490Sstevel@tonic-gate * since we don't know how good the checking is in other 4500Sstevel@tonic-gate * parts of the code. We pass a partial packet, with 4510Sstevel@tonic-gate * a warning. 4520Sstevel@tonic-gate */ 4530Sstevel@tonic-gate if (pktp + nhdrp->sbh_msglen > bufstop) { 4543628Sss150715 (void) fprintf(stderr, "truncated packet buffer\n"); 4550Sstevel@tonic-gate nhdrp->sbh_msglen = bufstop - pktp; 4560Sstevel@tonic-gate } 4570Sstevel@tonic-gate 4580Sstevel@tonic-gate #ifdef DEBUG 4590Sstevel@tonic-gate if (zflg) 4600Sstevel@tonic-gate corrupt(pktp, pktp + nhdrp->sbh_msglen, buf, bufstop); 4610Sstevel@tonic-gate #endif /* DEBUG */ 4620Sstevel@tonic-gate 4630Sstevel@tonic-gate header_okay = 1; 4640Sstevel@tonic-gate if (!filter || 4658023SPhil.Kirk@Sun.COM want_packet(pktp, 4668023SPhil.Kirk@Sun.COM nhdrp->sbh_msglen, 4678023SPhil.Kirk@Sun.COM nhdrp->sbh_origlen)) { 4680Sstevel@tonic-gate count++; 4690Sstevel@tonic-gate 4700Sstevel@tonic-gate /* 4710Sstevel@tonic-gate * Start deadman timer for interpreter processing 4720Sstevel@tonic-gate */ 4730Sstevel@tonic-gate (void) snoop_alarm(SNOOP_ALARM_GRAN*SNOOP_MAXRECOVER, 4748023SPhil.Kirk@Sun.COM NULL); 4750Sstevel@tonic-gate 4760Sstevel@tonic-gate encap_levels = 0; 4770Sstevel@tonic-gate if (!cap || count >= first) 4780Sstevel@tonic-gate proc(nhdrp, pktp, count, flags); 4790Sstevel@tonic-gate 4800Sstevel@tonic-gate if (cap && count >= last) { 4810Sstevel@tonic-gate (void) snoop_alarm(0, NULL); 4820Sstevel@tonic-gate break; 4830Sstevel@tonic-gate } 4840Sstevel@tonic-gate 4850Sstevel@tonic-gate if (maxcount && count >= maxcount) { 4863628Sss150715 (void) fprintf(stderr, "%d packets captured\n", 4873628Sss150715 count); 4880Sstevel@tonic-gate exit(0); 4890Sstevel@tonic-gate } 4900Sstevel@tonic-gate 4910Sstevel@tonic-gate snoop_nrecover = 0; /* success */ 4920Sstevel@tonic-gate (void) snoop_alarm(0, NULL); 4930Sstevel@tonic-gate last_timestamp = hdrp->sbh_timestamp; /* save stamp */ 4940Sstevel@tonic-gate } 4950Sstevel@tonic-gate continue; 4960Sstevel@tonic-gate err: 4970Sstevel@tonic-gate /* 4980Sstevel@tonic-gate * Corruption has been detected. Reset errors. 4990Sstevel@tonic-gate */ 5000Sstevel@tonic-gate snoop_recover(); 5010Sstevel@tonic-gate 5020Sstevel@tonic-gate /* 5030Sstevel@tonic-gate * packet header was apparently okay. Continue. 5040Sstevel@tonic-gate */ 5050Sstevel@tonic-gate if (header_okay) 5060Sstevel@tonic-gate continue; 5070Sstevel@tonic-gate 5080Sstevel@tonic-gate /* 5090Sstevel@tonic-gate * Otherwise try to scan forward to the next packet, using 5100Sstevel@tonic-gate * the last known timestamp if it is available. 5110Sstevel@tonic-gate */ 5120Sstevel@tonic-gate nhdrp = &nhdr; 5130Sstevel@tonic-gate nhdrp->sbh_totlen = 0; 5140Sstevel@tonic-gate if (last_timestamp.tv_sec == 0) { 5150Sstevel@tonic-gate bp += sizeof (int); 5160Sstevel@tonic-gate } else { 5170Sstevel@tonic-gate for (bp += sizeof (int); bp <= bufstop; 5188023SPhil.Kirk@Sun.COM bp += sizeof (int)) { 5190Sstevel@tonic-gate hdrp = (struct sb_hdr *)bp; 5200Sstevel@tonic-gate /* An approximate timestamp located */ 5210Sstevel@tonic-gate if ((hdrp->sbh_timestamp.tv_sec >> 8) == 5220Sstevel@tonic-gate (last_timestamp.tv_sec >> 8)) 5230Sstevel@tonic-gate break; 5240Sstevel@tonic-gate } 5250Sstevel@tonic-gate } 5260Sstevel@tonic-gate } 5270Sstevel@tonic-gate /* reset jmp_env for program exit */ 5280Sstevel@tonic-gate (void) memcpy((char *)jmp_env, (char *)ojmp_env, sizeof (jmp_env)); 5290Sstevel@tonic-gate proc(0, -1, 0); 5300Sstevel@tonic-gate } 5310Sstevel@tonic-gate 5320Sstevel@tonic-gate /* 5330Sstevel@tonic-gate * Called if nwrite() encounters write problems. 5340Sstevel@tonic-gate */ 5350Sstevel@tonic-gate static void 5360Sstevel@tonic-gate cap_write_error(const char *msgtype) 5370Sstevel@tonic-gate { 5380Sstevel@tonic-gate (void) fprintf(stderr, 5398023SPhil.Kirk@Sun.COM "snoop: cannot write %s to capture file: %s\n", 5408023SPhil.Kirk@Sun.COM msgtype, strerror(errno)); 5410Sstevel@tonic-gate exit(1); 5420Sstevel@tonic-gate } 5430Sstevel@tonic-gate 5440Sstevel@tonic-gate /* 5450Sstevel@tonic-gate * Writes target buffer to the open file descriptor. Upon detection of a short 5460Sstevel@tonic-gate * write, an attempt to process the remaining bytes occurs until all anticipated 5470Sstevel@tonic-gate * bytes are written. An error status is returned to indicate any serious write 5480Sstevel@tonic-gate * failures. 5490Sstevel@tonic-gate */ 5500Sstevel@tonic-gate static int 5510Sstevel@tonic-gate nwrite(int fd, const void *buffer, size_t buflen) 5520Sstevel@tonic-gate { 5530Sstevel@tonic-gate size_t nwritten; 5540Sstevel@tonic-gate ssize_t nbytes = 0; 5550Sstevel@tonic-gate const char *buf = buffer; 5560Sstevel@tonic-gate 5570Sstevel@tonic-gate for (nwritten = 0; nwritten < buflen; nwritten += nbytes) { 5580Sstevel@tonic-gate nbytes = write(fd, &buf[nwritten], buflen - nwritten); 5590Sstevel@tonic-gate if (nbytes == -1) 5600Sstevel@tonic-gate return (-1); 5610Sstevel@tonic-gate if (nbytes == 0) { 5620Sstevel@tonic-gate errno = EIO; 5630Sstevel@tonic-gate return (-1); 5640Sstevel@tonic-gate } 5650Sstevel@tonic-gate } 5660Sstevel@tonic-gate return (0); 5670Sstevel@tonic-gate } 5680Sstevel@tonic-gate 5690Sstevel@tonic-gate /* 5700Sstevel@tonic-gate * Routines for opening, closing, reading and writing 5710Sstevel@tonic-gate * a capture file of packets saved with the -o option. 5720Sstevel@tonic-gate */ 5730Sstevel@tonic-gate static int capfile_out; 5740Sstevel@tonic-gate 5750Sstevel@tonic-gate /* 5760Sstevel@tonic-gate * The snoop capture file has a header to identify 5770Sstevel@tonic-gate * it as a capture file and record its version. 5780Sstevel@tonic-gate * A file without this header is assumed to be an 5790Sstevel@tonic-gate * old format snoop file. 5800Sstevel@tonic-gate * 5810Sstevel@tonic-gate * A version 1 header looks like this: 5820Sstevel@tonic-gate * 5830Sstevel@tonic-gate * 0 1 2 3 4 5 6 7 8 9 10 11 5840Sstevel@tonic-gate * +---+---+---+---+---+---+---+---+---+---+---+---+---+ 5850Sstevel@tonic-gate * | s | n | o | o | p | \0| \0| \0| version | data 5860Sstevel@tonic-gate * +---+---+---+---+---+---+---+---+---+---+---+---+---+ 5870Sstevel@tonic-gate * | word 0 | word 1 | word 2 | 5880Sstevel@tonic-gate * 5890Sstevel@tonic-gate * 5900Sstevel@tonic-gate * A version 2 header adds a word that identifies the MAC type. 5910Sstevel@tonic-gate * This allows for capture files from FDDI etc. 5920Sstevel@tonic-gate * 5930Sstevel@tonic-gate * 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 5940Sstevel@tonic-gate * +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+ 5950Sstevel@tonic-gate * | s | n | o | o | p | \0| \0| \0| version | MAC type | data 5960Sstevel@tonic-gate * +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+ 5970Sstevel@tonic-gate * | word 0 | word 1 | word 2 | word 3 5980Sstevel@tonic-gate * 5990Sstevel@tonic-gate */ 6001676Sjpk static const char *snoop_id = "snoop\0\0\0"; 6011676Sjpk static const int snoop_idlen = 8; 6021676Sjpk static const int snoop_version = 2; 6030Sstevel@tonic-gate 6040Sstevel@tonic-gate void 6053628Sss150715 cap_open_write(const char *name) 6060Sstevel@tonic-gate { 6070Sstevel@tonic-gate int vers; 6080Sstevel@tonic-gate 6090Sstevel@tonic-gate capfile_out = open(name, O_CREAT | O_TRUNC | O_RDWR, 0666); 6100Sstevel@tonic-gate if (capfile_out < 0) 6110Sstevel@tonic-gate pr_err("%s: %m", name); 6120Sstevel@tonic-gate 6130Sstevel@tonic-gate vers = htonl(snoop_version); 6141676Sjpk if (nwrite(capfile_out, snoop_id, snoop_idlen) == -1) 6150Sstevel@tonic-gate cap_write_error("snoop_id"); 6160Sstevel@tonic-gate 6171676Sjpk if (nwrite(capfile_out, &vers, sizeof (int)) == -1) 6180Sstevel@tonic-gate cap_write_error("version"); 6190Sstevel@tonic-gate } 6200Sstevel@tonic-gate 6210Sstevel@tonic-gate 6220Sstevel@tonic-gate void 6231676Sjpk cap_close(void) 6240Sstevel@tonic-gate { 6251676Sjpk (void) close(capfile_out); 6260Sstevel@tonic-gate } 6270Sstevel@tonic-gate 6280Sstevel@tonic-gate static char *cap_buffp = NULL; 6290Sstevel@tonic-gate static int cap_len = 0; 6300Sstevel@tonic-gate static int cap_new; 6310Sstevel@tonic-gate 6320Sstevel@tonic-gate void 6333628Sss150715 cap_open_read(const char *name) 6340Sstevel@tonic-gate { 6350Sstevel@tonic-gate struct stat st; 6360Sstevel@tonic-gate int cap_vers; 6370Sstevel@tonic-gate int *word, device_mac_type; 6380Sstevel@tonic-gate int capfile_in; 6390Sstevel@tonic-gate 6400Sstevel@tonic-gate capfile_in = open(name, O_RDONLY); 6410Sstevel@tonic-gate if (capfile_in < 0) 6420Sstevel@tonic-gate pr_err("couldn't open %s: %m", name); 6430Sstevel@tonic-gate 6440Sstevel@tonic-gate if (fstat(capfile_in, &st) < 0) 6450Sstevel@tonic-gate pr_err("couldn't stat %s: %m", name); 6460Sstevel@tonic-gate cap_len = st.st_size; 6470Sstevel@tonic-gate 6480Sstevel@tonic-gate cap_buffp = mmap(0, cap_len, PROT_READ, MAP_PRIVATE, capfile_in, 0); 6491676Sjpk (void) close(capfile_in); 6500Sstevel@tonic-gate if ((int)cap_buffp == -1) 6510Sstevel@tonic-gate pr_err("couldn't mmap %s: %m", name); 6520Sstevel@tonic-gate 6530Sstevel@tonic-gate /* Check if new snoop capture file format */ 6540Sstevel@tonic-gate 6550Sstevel@tonic-gate cap_new = bcmp(cap_buffp, snoop_id, snoop_idlen) == 0; 6560Sstevel@tonic-gate 6570Sstevel@tonic-gate /* 6580Sstevel@tonic-gate * If new file - check version and 6590Sstevel@tonic-gate * set buffer pointer to point at first packet 6600Sstevel@tonic-gate */ 6610Sstevel@tonic-gate if (cap_new) { 6620Sstevel@tonic-gate cap_vers = ntohl(*(int *)(cap_buffp + snoop_idlen)); 6630Sstevel@tonic-gate cap_buffp += snoop_idlen + sizeof (int); 6640Sstevel@tonic-gate cap_len -= snoop_idlen + sizeof (int); 6650Sstevel@tonic-gate 6660Sstevel@tonic-gate switch (cap_vers) { 6670Sstevel@tonic-gate case 1: 6680Sstevel@tonic-gate device_mac_type = DL_ETHER; 6690Sstevel@tonic-gate break; 6700Sstevel@tonic-gate 6710Sstevel@tonic-gate case 2: 6720Sstevel@tonic-gate device_mac_type = ntohl(*((int *)cap_buffp)); 6730Sstevel@tonic-gate cap_buffp += sizeof (int); 6740Sstevel@tonic-gate cap_len -= sizeof (int); 6750Sstevel@tonic-gate break; 6760Sstevel@tonic-gate 6770Sstevel@tonic-gate default: 6780Sstevel@tonic-gate pr_err("capture file: %s: Version %d unrecognized\n", 6798023SPhil.Kirk@Sun.COM name, cap_vers); 6800Sstevel@tonic-gate } 6810Sstevel@tonic-gate 6820Sstevel@tonic-gate for (interface = &INTERFACES[0]; interface->mac_type != -1; 6838023SPhil.Kirk@Sun.COM interface++) 6840Sstevel@tonic-gate if (interface->mac_type == device_mac_type) 6850Sstevel@tonic-gate break; 6860Sstevel@tonic-gate 6870Sstevel@tonic-gate if (interface->mac_type == -1) 6880Sstevel@tonic-gate pr_err("Mac Type = %x is not supported\n", 6898023SPhil.Kirk@Sun.COM device_mac_type); 6900Sstevel@tonic-gate } else { 6910Sstevel@tonic-gate /* Use heuristic to check if it's an old-style file */ 6920Sstevel@tonic-gate 6930Sstevel@tonic-gate device_mac_type = DL_ETHER; 6940Sstevel@tonic-gate word = (int *)cap_buffp; 6950Sstevel@tonic-gate 6960Sstevel@tonic-gate if (!((word[0] < 1600 && word[1] < 1600) && 6970Sstevel@tonic-gate (word[0] < word[1]) && 6980Sstevel@tonic-gate (word[2] > 610000000 && word[2] < 770000000))) 6990Sstevel@tonic-gate pr_err("not a capture file: %s", name); 7000Sstevel@tonic-gate 7010Sstevel@tonic-gate /* Change protection so's we can fix the headers */ 7020Sstevel@tonic-gate 7030Sstevel@tonic-gate if (mprotect(cap_buffp, cap_len, PROT_READ | PROT_WRITE) < 0) 7040Sstevel@tonic-gate pr_err("mprotect: %s: %m", name); 7050Sstevel@tonic-gate } 7063628Sss150715 dlinfo.di_max_sdu = MAXINT; /* Decode any stored packet. */ 7070Sstevel@tonic-gate } 7080Sstevel@tonic-gate 7090Sstevel@tonic-gate void 7103628Sss150715 cap_read(int first, int last, int filter, void (*proc)(), int flags) 7110Sstevel@tonic-gate { 7120Sstevel@tonic-gate extern int count; 7130Sstevel@tonic-gate 7140Sstevel@tonic-gate count = 0; 7150Sstevel@tonic-gate 7160Sstevel@tonic-gate scan(cap_buffp, cap_len, filter, 1, !cap_new, proc, first, last, flags); 7170Sstevel@tonic-gate 7181676Sjpk (void) munmap(cap_buffp, cap_len); 7190Sstevel@tonic-gate } 7200Sstevel@tonic-gate 7211676Sjpk /* ARGSUSED */ 7220Sstevel@tonic-gate void 7233628Sss150715 cap_write(struct sb_hdr *hdrp, char *pktp, int num, int flags) 7240Sstevel@tonic-gate { 7250Sstevel@tonic-gate int pktlen, mac; 7260Sstevel@tonic-gate static int first = 1; 7270Sstevel@tonic-gate struct sb_hdr nhdr; 7280Sstevel@tonic-gate extern boolean_t qflg; 7290Sstevel@tonic-gate 7300Sstevel@tonic-gate if (hdrp == NULL) 7310Sstevel@tonic-gate return; 7320Sstevel@tonic-gate 7330Sstevel@tonic-gate if (first) { 7340Sstevel@tonic-gate first = 0; 7350Sstevel@tonic-gate mac = htonl(interface->mac_type); 7361676Sjpk if (nwrite(capfile_out, &mac, sizeof (int)) == -1) 7370Sstevel@tonic-gate cap_write_error("mac_type"); 7380Sstevel@tonic-gate } 7390Sstevel@tonic-gate 7400Sstevel@tonic-gate pktlen = hdrp->sbh_totlen - sizeof (*hdrp); 7410Sstevel@tonic-gate 7420Sstevel@tonic-gate /* 7430Sstevel@tonic-gate * Convert sb_hdr to network byte order 7440Sstevel@tonic-gate */ 7450Sstevel@tonic-gate nhdr.sbh_origlen = htonl(hdrp->sbh_origlen); 7460Sstevel@tonic-gate nhdr.sbh_msglen = htonl(hdrp->sbh_msglen); 7470Sstevel@tonic-gate nhdr.sbh_totlen = htonl(hdrp->sbh_totlen); 7480Sstevel@tonic-gate nhdr.sbh_drops = htonl(hdrp->sbh_drops); 7490Sstevel@tonic-gate nhdr.sbh_timestamp.tv_sec = htonl(hdrp->sbh_timestamp.tv_sec); 7500Sstevel@tonic-gate nhdr.sbh_timestamp.tv_usec = htonl(hdrp->sbh_timestamp.tv_usec); 7510Sstevel@tonic-gate 7521676Sjpk if (nwrite(capfile_out, &nhdr, sizeof (nhdr)) == -1) 7530Sstevel@tonic-gate cap_write_error("packet header"); 7540Sstevel@tonic-gate 7551676Sjpk if (nwrite(capfile_out, pktp, pktlen) == -1) 7560Sstevel@tonic-gate cap_write_error("packet"); 7570Sstevel@tonic-gate 7580Sstevel@tonic-gate if (! qflg) 7590Sstevel@tonic-gate show_count(); 7600Sstevel@tonic-gate } 7610Sstevel@tonic-gate 7620Sstevel@tonic-gate /* 7630Sstevel@tonic-gate * Convert a packet header from 7640Sstevel@tonic-gate * old to new format. 7650Sstevel@tonic-gate */ 7661676Sjpk static void 7671676Sjpk convert_old(struct ohdr *ohdrp) 7680Sstevel@tonic-gate { 7690Sstevel@tonic-gate struct sb_hdr nhdr; 7700Sstevel@tonic-gate 7710Sstevel@tonic-gate nhdr.sbh_origlen = ohdrp->o_len; 7720Sstevel@tonic-gate nhdr.sbh_msglen = ohdrp->o_msglen; 7730Sstevel@tonic-gate nhdr.sbh_totlen = ohdrp->o_totlen; 7740Sstevel@tonic-gate nhdr.sbh_drops = ohdrp->o_drops; 7750Sstevel@tonic-gate nhdr.sbh_timestamp = ohdrp->o_time; 7760Sstevel@tonic-gate 7770Sstevel@tonic-gate *(struct sb_hdr *)ohdrp = nhdr; 7780Sstevel@tonic-gate } 7790Sstevel@tonic-gate 780410Skcpoon static int 7811676Sjpk strioctl(int fd, int cmd, int timout, int len, void *dp) 7820Sstevel@tonic-gate { 7830Sstevel@tonic-gate struct strioctl sioc; 7840Sstevel@tonic-gate int rc; 7850Sstevel@tonic-gate 7860Sstevel@tonic-gate sioc.ic_cmd = cmd; 7870Sstevel@tonic-gate sioc.ic_timout = timout; 7880Sstevel@tonic-gate sioc.ic_len = len; 7890Sstevel@tonic-gate sioc.ic_dp = dp; 7900Sstevel@tonic-gate rc = ioctl(fd, I_STR, &sioc); 7910Sstevel@tonic-gate 7920Sstevel@tonic-gate if (rc < 0) 7930Sstevel@tonic-gate return (rc); 7940Sstevel@tonic-gate else 7950Sstevel@tonic-gate return (sioc.ic_len); 7960Sstevel@tonic-gate } 797