1 /* 2 * This code is derived from code formerly in pcap-dlpi.c, originally 3 * contributed by Atanu Ghosh (atanu (at) cs.ucl.ac.uk), University College 4 * London, and subsequently modified by Guy Harris (guy (at) alum.mit.edu), 5 * Mark Pizzolato <List-tcpdump-workers (at) subscriptions.pizzolato.net>, 6 * Mark C. Brown (mbrown (at) hp.com), and Sagun Shakya <Sagun.Shakya (at) Sun.COM>. 7 */ 8 9 /* 10 * This file contains dlpi/libdlpi related common functions used 11 * by pcap-[dlpi,libdlpi].c. 12 */ 13 #ifndef lint 14 static const char rcsid[] _U_ = 15 "@(#) $Header: /tcpdump/master/libpcap/dlpisubs.c,v 1.3 2008-12-02 16:40:19 guy Exp $ (LBL)"; 16 #endif 17 18 #ifdef HAVE_CONFIG_H 19 #include "config.h" 20 #endif 21 22 #ifndef DL_IPATM 23 #define DL_IPATM 0x12 /* ATM Classical IP interface */ 24 #endif 25 26 #ifdef HAVE_SYS_BUFMOD_H 27 /* 28 * Size of a bufmod chunk to pass upstream; that appears to be the 29 * biggest value to which you can set it, and setting it to that value 30 * (which is bigger than what appears to be the Solaris default of 8192) 31 * reduces the number of packet drops. 32 */ 33 #define CHUNKSIZE 65536 34 35 /* 36 * Size of the buffer to allocate for packet data we read; it must be 37 * large enough to hold a chunk. 38 */ 39 #define PKTBUFSIZE CHUNKSIZE 40 41 #else /* HAVE_SYS_BUFMOD_H */ 42 43 /* 44 * Size of the buffer to allocate for packet data we read; this is 45 * what the value used to be - there's no particular reason why it 46 * should be tied to MAXDLBUF, but we'll leave it as this for now. 47 */ 48 #define MAXDLBUF 8192 49 #define PKTBUFSIZE (MAXDLBUF * sizeof(bpf_u_int32)) 50 51 #endif 52 53 #include <sys/types.h> 54 #include <sys/time.h> 55 #ifdef HAVE_SYS_BUFMOD_H 56 #include <sys/bufmod.h> 57 #endif 58 #include <sys/dlpi.h> 59 #include <sys/stream.h> 60 61 #include <errno.h> 62 #include <memory.h> 63 #include <stdio.h> 64 #include <stdlib.h> 65 #include <string.h> 66 #include <stropts.h> 67 #include <unistd.h> 68 69 #ifdef HAVE_LIBDLPI 70 #include <libdlpi.h> 71 #endif 72 73 #include "pcap-int.h" 74 #include "dlpisubs.h" 75 76 #ifdef HAVE_SYS_BUFMOD_H 77 static void pcap_stream_err(const char *, int, char *); 78 #endif 79 80 /* 81 * Get the packet statistics. 82 */ 83 int 84 pcap_stats_dlpi(pcap_t *p, struct pcap_stat *ps) 85 { 86 struct pcap_dlpi *pd = p->priv; 87 88 /* 89 * "ps_recv" counts packets handed to the filter, not packets 90 * that passed the filter. As filtering is done in userland, 91 * this would not include packets dropped because we ran out 92 * of buffer space; in order to make this more like other 93 * platforms (Linux 2.4 and later, BSDs with BPF), where the 94 * "packets received" count includes packets received but dropped 95 * due to running out of buffer space, and to keep from confusing 96 * applications that, for example, compute packet drop percentages, 97 * we also make it count packets dropped by "bufmod" (otherwise we 98 * might run the risk of the packet drop count being bigger than 99 * the received-packet count). 100 * 101 * "ps_drop" counts packets dropped by "bufmod" because of 102 * flow control requirements or resource exhaustion; it doesn't 103 * count packets dropped by the interface driver, or packets 104 * dropped upstream. As filtering is done in userland, it counts 105 * packets regardless of whether they would've passed the filter. 106 * 107 * These statistics don't include packets not yet read from 108 * the kernel by libpcap, but they may include packets not 109 * yet read from libpcap by the application. 110 */ 111 *ps = pd->stat; 112 113 /* 114 * Add in the drop count, as per the above comment. 115 */ 116 ps->ps_recv += ps->ps_drop; 117 return (0); 118 } 119 120 /* 121 * Loop through the packets and call the callback for each packet. 122 * Return the number of packets read. 123 */ 124 int 125 pcap_process_pkts(pcap_t *p, pcap_handler callback, u_char *user, 126 int count, u_char *bufp, int len) 127 { 128 struct pcap_dlpi *pd = p->priv; 129 int n, caplen, origlen; 130 u_char *ep, *pk; 131 struct pcap_pkthdr pkthdr; 132 #ifdef HAVE_SYS_BUFMOD_H 133 struct sb_hdr *sbp; 134 #ifdef LBL_ALIGN 135 struct sb_hdr sbhdr; 136 #endif 137 #endif 138 139 /* Loop through packets */ 140 ep = bufp + len; 141 n = 0; 142 143 #ifdef HAVE_SYS_BUFMOD_H 144 while (bufp < ep) { 145 /* 146 * Has "pcap_breakloop()" been called? 147 * If so, return immediately - if we haven't read any 148 * packets, clear the flag and return -2 to indicate 149 * that we were told to break out of the loop, otherwise 150 * leave the flag set, so that the *next* call will break 151 * out of the loop without having read any packets, and 152 * return the number of packets we've processed so far. 153 */ 154 if (p->break_loop) { 155 if (n == 0) { 156 p->break_loop = 0; 157 return (-2); 158 } else { 159 p->bp = bufp; 160 p->cc = ep - bufp; 161 return (n); 162 } 163 } 164 #ifdef LBL_ALIGN 165 if ((long)bufp & 3) { 166 sbp = &sbhdr; 167 memcpy(sbp, bufp, sizeof(*sbp)); 168 } else 169 #endif 170 sbp = (struct sb_hdr *)bufp; 171 pd->stat.ps_drop = sbp->sbh_drops; 172 pk = bufp + sizeof(*sbp); 173 bufp += sbp->sbh_totlen; 174 origlen = sbp->sbh_origlen; 175 caplen = sbp->sbh_msglen; 176 #else 177 origlen = len; 178 caplen = min(p->snapshot, len); 179 pk = bufp; 180 bufp += caplen; 181 #endif 182 ++pd->stat.ps_recv; 183 if (bpf_filter(p->fcode.bf_insns, pk, origlen, caplen)) { 184 #ifdef HAVE_SYS_BUFMOD_H 185 pkthdr.ts.tv_sec = sbp->sbh_timestamp.tv_sec; 186 pkthdr.ts.tv_usec = sbp->sbh_timestamp.tv_usec; 187 #else 188 (void) gettimeofday(&pkthdr.ts, NULL); 189 #endif 190 pkthdr.len = origlen; 191 pkthdr.caplen = caplen; 192 /* Insure caplen does not exceed snapshot */ 193 if (pkthdr.caplen > p->snapshot) 194 pkthdr.caplen = p->snapshot; 195 (*callback)(user, &pkthdr, pk); 196 if (++n >= count && !PACKET_COUNT_IS_UNLIMITED(count)) { 197 p->cc = ep - bufp; 198 p->bp = bufp; 199 return (n); 200 } 201 } 202 #ifdef HAVE_SYS_BUFMOD_H 203 } 204 #endif 205 p->cc = 0; 206 return (n); 207 } 208 209 /* 210 * Process the mac type. Returns -1 if no matching mac type found, otherwise 0. 211 */ 212 int 213 pcap_process_mactype(pcap_t *p, u_int mactype) 214 { 215 int retv = 0; 216 217 switch (mactype) { 218 219 case DL_CSMACD: 220 case DL_ETHER: 221 p->linktype = DLT_EN10MB; 222 p->offset = 2; 223 /* 224 * This is (presumably) a real Ethernet capture; give it a 225 * link-layer-type list with DLT_EN10MB and DLT_DOCSIS, so 226 * that an application can let you choose it, in case you're 227 * capturing DOCSIS traffic that a Cisco Cable Modem 228 * Termination System is putting out onto an Ethernet (it 229 * doesn't put an Ethernet header onto the wire, it puts raw 230 * DOCSIS frames out on the wire inside the low-level 231 * Ethernet framing). 232 */ 233 p->dlt_list = (u_int *)malloc(sizeof(u_int) * 2); 234 /* 235 * If that fails, just leave the list empty. 236 */ 237 if (p->dlt_list != NULL) { 238 p->dlt_list[0] = DLT_EN10MB; 239 p->dlt_list[1] = DLT_DOCSIS; 240 p->dlt_count = 2; 241 } 242 break; 243 244 case DL_FDDI: 245 p->linktype = DLT_FDDI; 246 p->offset = 3; 247 break; 248 249 case DL_TPR: 250 /* XXX - what about DL_TPB? Is that Token Bus? */ 251 p->linktype = DLT_IEEE802; 252 p->offset = 2; 253 break; 254 255 #ifdef HAVE_SOLARIS 256 case DL_IPATM: 257 p->linktype = DLT_SUNATM; 258 p->offset = 0; /* works for LANE and LLC encapsulation */ 259 break; 260 #endif 261 262 default: 263 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "unknown mactype %u", 264 mactype); 265 retv = -1; 266 } 267 268 return (retv); 269 } 270 271 #ifdef HAVE_SYS_BUFMOD_H 272 /* 273 * Push and configure the buffer module. Returns -1 for error, otherwise 0. 274 */ 275 int 276 pcap_conf_bufmod(pcap_t *p, int snaplen) 277 { 278 struct timeval to; 279 bpf_u_int32 ss, chunksize; 280 281 /* Non-standard call to get the data nicely buffered. */ 282 if (ioctl(p->fd, I_PUSH, "bufmod") != 0) { 283 pcap_stream_err("I_PUSH bufmod", errno, p->errbuf); 284 return (-1); 285 } 286 287 ss = snaplen; 288 if (ss > 0 && 289 strioctl(p->fd, SBIOCSSNAP, sizeof(ss), (char *)&ss) != 0) { 290 pcap_stream_err("SBIOCSSNAP", errno, p->errbuf); 291 return (-1); 292 } 293 294 if (p->opt.immediate) { 295 /* Set the timeout to zero, for immediate delivery. */ 296 to.tv_sec = 0; 297 to.tv_usec = 0; 298 if (strioctl(p->fd, SBIOCSTIME, sizeof(to), (char *)&to) != 0) { 299 pcap_stream_err("SBIOCSTIME", errno, p->errbuf); 300 return (-1); 301 } 302 } else { 303 /* Set up the bufmod timeout. */ 304 if (p->opt.timeout != 0) { 305 to.tv_sec = p->opt.timeout / 1000; 306 to.tv_usec = (p->opt.timeout * 1000) % 1000000; 307 if (strioctl(p->fd, SBIOCSTIME, sizeof(to), (char *)&to) != 0) { 308 pcap_stream_err("SBIOCSTIME", errno, p->errbuf); 309 return (-1); 310 } 311 } 312 313 /* Set the chunk length. */ 314 chunksize = CHUNKSIZE; 315 if (strioctl(p->fd, SBIOCSCHUNK, sizeof(chunksize), (char *)&chunksize) 316 != 0) { 317 pcap_stream_err("SBIOCSCHUNKP", errno, p->errbuf); 318 return (-1); 319 } 320 } 321 322 return (0); 323 } 324 #endif /* HAVE_SYS_BUFMOD_H */ 325 326 /* 327 * Allocate data buffer. Returns -1 if memory allocation fails, else 0. 328 */ 329 int 330 pcap_alloc_databuf(pcap_t *p) 331 { 332 p->bufsize = PKTBUFSIZE; 333 p->buffer = (u_char *)malloc(p->bufsize + p->offset); 334 if (p->buffer == NULL) { 335 strlcpy(p->errbuf, pcap_strerror(errno), PCAP_ERRBUF_SIZE); 336 return (-1); 337 } 338 339 return (0); 340 } 341 342 /* 343 * Issue a STREAMS I_STR ioctl. Returns -1 on error, otherwise 344 * length of returned data on success. 345 */ 346 int 347 strioctl(int fd, int cmd, int len, char *dp) 348 { 349 struct strioctl str; 350 int retv; 351 352 str.ic_cmd = cmd; 353 str.ic_timout = -1; 354 str.ic_len = len; 355 str.ic_dp = dp; 356 if ((retv = ioctl(fd, I_STR, &str)) < 0) 357 return (retv); 358 359 return (str.ic_len); 360 } 361 362 #ifdef HAVE_SYS_BUFMOD_H 363 /* 364 * Write stream error message to errbuf. 365 */ 366 static void 367 pcap_stream_err(const char *func, int err, char *errbuf) 368 { 369 snprintf(errbuf, PCAP_ERRBUF_SIZE, "%s: %s", func, pcap_strerror(err)); 370 } 371 #endif 372
