1*0Sstevel@tonic-gate /* 2*0Sstevel@tonic-gate * Copyright (C) 1993-2001 by Darren Reed. 3*0Sstevel@tonic-gate * 4*0Sstevel@tonic-gate * See the IPFILTER.LICENCE file for details on licencing. 5*0Sstevel@tonic-gate * 6*0Sstevel@tonic-gate * $Id: ipft_sn.c,v 1.7 2003/02/16 02:32:36 darrenr Exp $ 7*0Sstevel@tonic-gate */ 8*0Sstevel@tonic-gate 9*0Sstevel@tonic-gate /* 10*0Sstevel@tonic-gate * Written to comply with the recent RFC 1761 from Sun. 11*0Sstevel@tonic-gate */ 12*0Sstevel@tonic-gate #include "ipf.h" 13*0Sstevel@tonic-gate #include "snoop.h" 14*0Sstevel@tonic-gate #include "ipt.h" 15*0Sstevel@tonic-gate 16*0Sstevel@tonic-gate #if !defined(lint) 17*0Sstevel@tonic-gate static const char rcsid[] = "@(#)$Id: ipft_sn.c,v 1.7 2003/02/16 02:32:36 darrenr Exp $"; 18*0Sstevel@tonic-gate #endif 19*0Sstevel@tonic-gate 20*0Sstevel@tonic-gate struct llc { 21*0Sstevel@tonic-gate int lc_sz; /* LLC header length */ 22*0Sstevel@tonic-gate int lc_to; /* LLC Type offset */ 23*0Sstevel@tonic-gate int lc_tl; /* LLC Type length */ 24*0Sstevel@tonic-gate }; 25*0Sstevel@tonic-gate 26*0Sstevel@tonic-gate /* 27*0Sstevel@tonic-gate * While many of these maybe the same, some do have different header formats 28*0Sstevel@tonic-gate * which make this useful. 29*0Sstevel@tonic-gate */ 30*0Sstevel@tonic-gate static struct llc llcs[SDL_MAX+1] = { 31*0Sstevel@tonic-gate { 0, 0, 0 }, /* SDL_8023 */ 32*0Sstevel@tonic-gate { 0, 0, 0 }, /* SDL_8024 */ 33*0Sstevel@tonic-gate { 0, 0, 0 }, /* SDL_8025 */ 34*0Sstevel@tonic-gate { 0, 0, 0 }, /* SDL_8026 */ 35*0Sstevel@tonic-gate { 14, 12, 2 }, /* SDL_ETHER */ 36*0Sstevel@tonic-gate { 0, 0, 0 }, /* SDL_HDLC */ 37*0Sstevel@tonic-gate { 0, 0, 0 }, /* SDL_CHSYNC */ 38*0Sstevel@tonic-gate { 0, 0, 0 }, /* SDL_IBMCC */ 39*0Sstevel@tonic-gate { 0, 0, 0 }, /* SDL_FDDI */ 40*0Sstevel@tonic-gate { 0, 0, 0 }, /* SDL_OTHER */ 41*0Sstevel@tonic-gate }; 42*0Sstevel@tonic-gate 43*0Sstevel@tonic-gate static int snoop_open __P((char *)); 44*0Sstevel@tonic-gate static int snoop_close __P((void)); 45*0Sstevel@tonic-gate static int snoop_readip __P((char *, int, char **, int *)); 46*0Sstevel@tonic-gate 47*0Sstevel@tonic-gate static int sfd = -1, s_type = -1; 48*0Sstevel@tonic-gate static int snoop_read_rec __P((struct snooppkt *)); 49*0Sstevel@tonic-gate 50*0Sstevel@tonic-gate struct ipread snoop = { snoop_open, snoop_close, snoop_readip, 0 }; 51*0Sstevel@tonic-gate 52*0Sstevel@tonic-gate 53*0Sstevel@tonic-gate static int snoop_open(fname) 54*0Sstevel@tonic-gate char *fname; 55*0Sstevel@tonic-gate { 56*0Sstevel@tonic-gate struct snoophdr sh; 57*0Sstevel@tonic-gate int fd; 58*0Sstevel@tonic-gate int s_v; 59*0Sstevel@tonic-gate 60*0Sstevel@tonic-gate if (sfd != -1) 61*0Sstevel@tonic-gate return sfd; 62*0Sstevel@tonic-gate 63*0Sstevel@tonic-gate if (!strcmp(fname, "-")) 64*0Sstevel@tonic-gate fd = 0; 65*0Sstevel@tonic-gate else if ((fd = open(fname, O_RDONLY)) == -1) 66*0Sstevel@tonic-gate return -1; 67*0Sstevel@tonic-gate 68*0Sstevel@tonic-gate if (read(fd, (char *)&sh, sizeof(sh)) != sizeof(sh)) 69*0Sstevel@tonic-gate return -2; 70*0Sstevel@tonic-gate 71*0Sstevel@tonic-gate s_v = (int)ntohl(sh.s_v); 72*0Sstevel@tonic-gate s_type = (int)ntohl(sh.s_type); 73*0Sstevel@tonic-gate 74*0Sstevel@tonic-gate if (s_v != SNOOP_VERSION || 75*0Sstevel@tonic-gate s_type < 0 || s_type > SDL_MAX) { 76*0Sstevel@tonic-gate (void) close(fd); 77*0Sstevel@tonic-gate return -2; 78*0Sstevel@tonic-gate } 79*0Sstevel@tonic-gate 80*0Sstevel@tonic-gate sfd = fd; 81*0Sstevel@tonic-gate printf("opened snoop file %s:\n", fname); 82*0Sstevel@tonic-gate printf("\tid: %8.8s version: %d type: %d\n", sh.s_id, s_v, s_type); 83*0Sstevel@tonic-gate 84*0Sstevel@tonic-gate return fd; 85*0Sstevel@tonic-gate } 86*0Sstevel@tonic-gate 87*0Sstevel@tonic-gate 88*0Sstevel@tonic-gate static int snoop_close() 89*0Sstevel@tonic-gate { 90*0Sstevel@tonic-gate return close(sfd); 91*0Sstevel@tonic-gate } 92*0Sstevel@tonic-gate 93*0Sstevel@tonic-gate 94*0Sstevel@tonic-gate /* 95*0Sstevel@tonic-gate * read in the header (and validate) which should be the first record 96*0Sstevel@tonic-gate * in a snoop file. 97*0Sstevel@tonic-gate */ 98*0Sstevel@tonic-gate static int snoop_read_rec(rec) 99*0Sstevel@tonic-gate struct snooppkt *rec; 100*0Sstevel@tonic-gate { 101*0Sstevel@tonic-gate int n, plen, ilen; 102*0Sstevel@tonic-gate 103*0Sstevel@tonic-gate if (read(sfd, (char *)rec, sizeof(*rec)) != sizeof(*rec)) 104*0Sstevel@tonic-gate return -2; 105*0Sstevel@tonic-gate 106*0Sstevel@tonic-gate ilen = (int)ntohl(rec->sp_ilen); 107*0Sstevel@tonic-gate plen = (int)ntohl(rec->sp_plen); 108*0Sstevel@tonic-gate if (ilen > plen || plen < sizeof(*rec)) 109*0Sstevel@tonic-gate return -2; 110*0Sstevel@tonic-gate 111*0Sstevel@tonic-gate plen -= sizeof(*rec); 112*0Sstevel@tonic-gate n = MIN(plen, ilen); 113*0Sstevel@tonic-gate if (!n || n < 0) 114*0Sstevel@tonic-gate return -3; 115*0Sstevel@tonic-gate 116*0Sstevel@tonic-gate return plen; 117*0Sstevel@tonic-gate } 118*0Sstevel@tonic-gate 119*0Sstevel@tonic-gate 120*0Sstevel@tonic-gate #ifdef notyet 121*0Sstevel@tonic-gate /* 122*0Sstevel@tonic-gate * read an entire snoop packet record. only the data part is copied into 123*0Sstevel@tonic-gate * the available buffer, with the number of bytes copied returned. 124*0Sstevel@tonic-gate */ 125*0Sstevel@tonic-gate static int snoop_read(buf, cnt) 126*0Sstevel@tonic-gate char *buf; 127*0Sstevel@tonic-gate int cnt; 128*0Sstevel@tonic-gate { 129*0Sstevel@tonic-gate struct snooppkt rec; 130*0Sstevel@tonic-gate static char *bufp = NULL; 131*0Sstevel@tonic-gate int i, n; 132*0Sstevel@tonic-gate 133*0Sstevel@tonic-gate if ((i = snoop_read_rec(&rec)) <= 0) 134*0Sstevel@tonic-gate return i; 135*0Sstevel@tonic-gate 136*0Sstevel@tonic-gate if (!bufp) 137*0Sstevel@tonic-gate bufp = malloc(i); 138*0Sstevel@tonic-gate else 139*0Sstevel@tonic-gate bufp = realloc(bufp, i); 140*0Sstevel@tonic-gate 141*0Sstevel@tonic-gate if (read(sfd, bufp, i) != i) 142*0Sstevel@tonic-gate return -2; 143*0Sstevel@tonic-gate 144*0Sstevel@tonic-gate n = MIN(i, cnt); 145*0Sstevel@tonic-gate bcopy(bufp, buf, n); 146*0Sstevel@tonic-gate return n; 147*0Sstevel@tonic-gate } 148*0Sstevel@tonic-gate #endif 149*0Sstevel@tonic-gate 150*0Sstevel@tonic-gate 151*0Sstevel@tonic-gate /* 152*0Sstevel@tonic-gate * return only an IP packet read into buf 153*0Sstevel@tonic-gate */ 154*0Sstevel@tonic-gate static int snoop_readip(buf, cnt, ifn, dir) 155*0Sstevel@tonic-gate char *buf, **ifn; 156*0Sstevel@tonic-gate int cnt, *dir; 157*0Sstevel@tonic-gate { 158*0Sstevel@tonic-gate static char *bufp = NULL; 159*0Sstevel@tonic-gate struct snooppkt rec; 160*0Sstevel@tonic-gate struct llc *l; 161*0Sstevel@tonic-gate char ty[4], *s; 162*0Sstevel@tonic-gate int i, n; 163*0Sstevel@tonic-gate 164*0Sstevel@tonic-gate do { 165*0Sstevel@tonic-gate if ((i = snoop_read_rec(&rec)) <= 0) 166*0Sstevel@tonic-gate return i; 167*0Sstevel@tonic-gate 168*0Sstevel@tonic-gate if (!bufp) 169*0Sstevel@tonic-gate bufp = malloc(i); 170*0Sstevel@tonic-gate else 171*0Sstevel@tonic-gate bufp = realloc(bufp, i); 172*0Sstevel@tonic-gate s = bufp; 173*0Sstevel@tonic-gate 174*0Sstevel@tonic-gate if (read(sfd, s, i) != i) 175*0Sstevel@tonic-gate return -2; 176*0Sstevel@tonic-gate 177*0Sstevel@tonic-gate l = &llcs[s_type]; 178*0Sstevel@tonic-gate i -= l->lc_to; 179*0Sstevel@tonic-gate s += l->lc_to; 180*0Sstevel@tonic-gate /* 181*0Sstevel@tonic-gate * XXX - bogus assumption here on the part of the time field 182*0Sstevel@tonic-gate * that it won't be greater than 4 bytes and the 1st two will 183*0Sstevel@tonic-gate * have the values 8 and 0 for IP. Should be a table of 184*0Sstevel@tonic-gate * these too somewhere. Really only works for SDL_ETHER. 185*0Sstevel@tonic-gate */ 186*0Sstevel@tonic-gate bcopy(s, ty, l->lc_tl); 187*0Sstevel@tonic-gate } while (ty[0] != 0x8 && ty[1] != 0); 188*0Sstevel@tonic-gate 189*0Sstevel@tonic-gate i -= l->lc_tl; 190*0Sstevel@tonic-gate s += l->lc_tl; 191*0Sstevel@tonic-gate n = MIN(i, cnt); 192*0Sstevel@tonic-gate bcopy(s, buf, n); 193*0Sstevel@tonic-gate 194*0Sstevel@tonic-gate return n; 195*0Sstevel@tonic-gate } 196