dlpisubs.c revision 335640
1/* 2 * This code is derived from code formerly in pcap-dlpi.c, originally 3 * contributed by Atanu Ghosh (atanu@cs.ucl.ac.uk), University College 4 * London, and subsequently modified by Guy Harris (guy@alum.mit.edu), 5 * Mark Pizzolato <List-tcpdump-workers@subscriptions.pizzolato.net>, 6 * Mark C. Brown (mbrown@hp.com), and Sagun Shakya <Sagun.Shakya@Sun.COM>. 7 */ 8 9/* 10 * This file contains dlpi/libdlpi related common functions used 11 * by pcap-[dlpi,libdlpi].c. 12 */ 13 14#ifdef HAVE_CONFIG_H 15#include <config.h> 16#endif 17 18#ifndef DL_IPATM 19#define DL_IPATM 0x12 /* ATM Classical IP interface */ 20#endif 21 22#ifdef HAVE_SYS_BUFMOD_H 23 /* 24 * Size of a bufmod chunk to pass upstream; that appears to be the 25 * biggest value to which you can set it, and setting it to that value 26 * (which is bigger than what appears to be the Solaris default of 8192) 27 * reduces the number of packet drops. 28 */ 29#define CHUNKSIZE 65536 30 31 /* 32 * Size of the buffer to allocate for packet data we read; it must be 33 * large enough to hold a chunk. 34 */ 35#define PKTBUFSIZE CHUNKSIZE 36 37#else /* HAVE_SYS_BUFMOD_H */ 38 39 /* 40 * Size of the buffer to allocate for packet data we read; this is 41 * what the value used to be - there's no particular reason why it 42 * should be tied to MAXDLBUF, but we'll leave it as this for now. 43 */ 44#define MAXDLBUF 8192 45#define PKTBUFSIZE (MAXDLBUF * sizeof(bpf_u_int32)) 46 47#endif 48 49#include <sys/types.h> 50#include <sys/time.h> 51#ifdef HAVE_SYS_BUFMOD_H 52#include <sys/bufmod.h> 53#endif 54#include <sys/dlpi.h> 55#include <sys/stream.h> 56 57#include <errno.h> 58#include <memory.h> 59#include <stdio.h> 60#include <stdlib.h> 61#include <string.h> 62#include <stropts.h> 63#include <unistd.h> 64 65#ifdef HAVE_LIBDLPI 66#include <libdlpi.h> 67#endif 68 69#include "pcap-int.h" 70#include "dlpisubs.h" 71 72#ifdef HAVE_SYS_BUFMOD_H 73static void pcap_stream_err(const char *, int, char *); 74#endif 75 76/* 77 * Get the packet statistics. 78 */ 79int 80pcap_stats_dlpi(pcap_t *p, struct pcap_stat *ps) 81{ 82 struct pcap_dlpi *pd = p->priv; 83 84 /* 85 * "ps_recv" counts packets handed to the filter, not packets 86 * that passed the filter. As filtering is done in userland, 87 * this would not include packets dropped because we ran out 88 * of buffer space; in order to make this more like other 89 * platforms (Linux 2.4 and later, BSDs with BPF), where the 90 * "packets received" count includes packets received but dropped 91 * due to running out of buffer space, and to keep from confusing 92 * applications that, for example, compute packet drop percentages, 93 * we also make it count packets dropped by "bufmod" (otherwise we 94 * might run the risk of the packet drop count being bigger than 95 * the received-packet count). 96 * 97 * "ps_drop" counts packets dropped by "bufmod" because of 98 * flow control requirements or resource exhaustion; it doesn't 99 * count packets dropped by the interface driver, or packets 100 * dropped upstream. As filtering is done in userland, it counts 101 * packets regardless of whether they would've passed the filter. 102 * 103 * These statistics don't include packets not yet read from 104 * the kernel by libpcap, but they may include packets not 105 * yet read from libpcap by the application. 106 */ 107 *ps = pd->stat; 108 109 /* 110 * Add in the drop count, as per the above comment. 111 */ 112 ps->ps_recv += ps->ps_drop; 113 return (0); 114} 115 116/* 117 * Loop through the packets and call the callback for each packet. 118 * Return the number of packets read. 119 */ 120int 121pcap_process_pkts(pcap_t *p, pcap_handler callback, u_char *user, 122 int count, u_char *bufp, int len) 123{ 124 struct pcap_dlpi *pd = p->priv; 125 int n, caplen, origlen; 126 u_char *ep, *pk; 127 struct pcap_pkthdr pkthdr; 128#ifdef HAVE_SYS_BUFMOD_H 129 struct sb_hdr *sbp; 130#ifdef LBL_ALIGN 131 struct sb_hdr sbhdr; 132#endif 133#endif 134 135 /* Loop through packets */ 136 ep = bufp + len; 137 n = 0; 138 139#ifdef HAVE_SYS_BUFMOD_H 140 while (bufp < ep) { 141 /* 142 * Has "pcap_breakloop()" been called? 143 * If so, return immediately - if we haven't read any 144 * packets, clear the flag and return -2 to indicate 145 * that we were told to break out of the loop, otherwise 146 * leave the flag set, so that the *next* call will break 147 * out of the loop without having read any packets, and 148 * return the number of packets we've processed so far. 149 */ 150 if (p->break_loop) { 151 if (n == 0) { 152 p->break_loop = 0; 153 return (-2); 154 } else { 155 p->bp = bufp; 156 p->cc = ep - bufp; 157 return (n); 158 } 159 } 160#ifdef LBL_ALIGN 161 if ((long)bufp & 3) { 162 sbp = &sbhdr; 163 memcpy(sbp, bufp, sizeof(*sbp)); 164 } else 165#endif 166 sbp = (struct sb_hdr *)bufp; 167 pd->stat.ps_drop = sbp->sbh_drops; 168 pk = bufp + sizeof(*sbp); 169 bufp += sbp->sbh_totlen; 170 origlen = sbp->sbh_origlen; 171 caplen = sbp->sbh_msglen; 172#else 173 origlen = len; 174 caplen = min(p->snapshot, len); 175 pk = bufp; 176 bufp += caplen; 177#endif 178 ++pd->stat.ps_recv; 179 if (bpf_filter(p->fcode.bf_insns, pk, origlen, caplen)) { 180#ifdef HAVE_SYS_BUFMOD_H 181 pkthdr.ts.tv_sec = sbp->sbh_timestamp.tv_sec; 182 pkthdr.ts.tv_usec = sbp->sbh_timestamp.tv_usec; 183#else 184 (void) gettimeofday(&pkthdr.ts, NULL); 185#endif 186 pkthdr.len = origlen; 187 pkthdr.caplen = caplen; 188 /* Insure caplen does not exceed snapshot */ 189 if (pkthdr.caplen > (bpf_u_int32)p->snapshot) 190 pkthdr.caplen = (bpf_u_int32)p->snapshot; 191 (*callback)(user, &pkthdr, pk); 192 if (++n >= count && !PACKET_COUNT_IS_UNLIMITED(count)) { 193 p->cc = ep - bufp; 194 p->bp = bufp; 195 return (n); 196 } 197 } 198#ifdef HAVE_SYS_BUFMOD_H 199 } 200#endif 201 p->cc = 0; 202 return (n); 203} 204 205/* 206 * Process the mac type. Returns -1 if no matching mac type found, otherwise 0. 207 */ 208int 209pcap_process_mactype(pcap_t *p, u_int mactype) 210{ 211 int retv = 0; 212 213 switch (mactype) { 214 215 case DL_CSMACD: 216 case DL_ETHER: 217 p->linktype = DLT_EN10MB; 218 p->offset = 2; 219 /* 220 * This is (presumably) a real Ethernet capture; give it a 221 * link-layer-type list with DLT_EN10MB and DLT_DOCSIS, so 222 * that an application can let you choose it, in case you're 223 * capturing DOCSIS traffic that a Cisco Cable Modem 224 * Termination System is putting out onto an Ethernet (it 225 * doesn't put an Ethernet header onto the wire, it puts raw 226 * DOCSIS frames out on the wire inside the low-level 227 * Ethernet framing). 228 */ 229 p->dlt_list = (u_int *)malloc(sizeof(u_int) * 2); 230 /* 231 * If that fails, just leave the list empty. 232 */ 233 if (p->dlt_list != NULL) { 234 p->dlt_list[0] = DLT_EN10MB; 235 p->dlt_list[1] = DLT_DOCSIS; 236 p->dlt_count = 2; 237 } 238 break; 239 240 case DL_FDDI: 241 p->linktype = DLT_FDDI; 242 p->offset = 3; 243 break; 244 245 case DL_TPR: 246 /* XXX - what about DL_TPB? Is that Token Bus? */ 247 p->linktype = DLT_IEEE802; 248 p->offset = 2; 249 break; 250 251#ifdef HAVE_SOLARIS 252 case DL_IPATM: 253 p->linktype = DLT_SUNATM; 254 p->offset = 0; /* works for LANE and LLC encapsulation */ 255 break; 256#endif 257 258#ifdef DL_IPV4 259 case DL_IPV4: 260 p->linktype = DLT_IPV4; 261 p->offset = 0; 262 break; 263#endif 264 265#ifdef DL_IPV6 266 case DL_IPV6: 267 p->linktype = DLT_IPV6; 268 p->offset = 0; 269 break; 270#endif 271 272#ifdef DL_IPNET 273 case DL_IPNET: 274 /* 275 * XXX - DL_IPNET devices default to "raw IP" rather than 276 * "IPNET header"; see 277 * 278 * http://seclists.org/tcpdump/2009/q1/202 279 * 280 * We'd have to do DL_IOC_IPNET_INFO to enable getting 281 * the IPNET header. 282 */ 283 p->linktype = DLT_RAW; 284 p->offset = 0; 285 break; 286#endif 287 288 default: 289 pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "unknown mactype 0x%x", 290 mactype); 291 retv = -1; 292 } 293 294 return (retv); 295} 296 297#ifdef HAVE_SYS_BUFMOD_H 298/* 299 * Push and configure the buffer module. Returns -1 for error, otherwise 0. 300 */ 301int 302pcap_conf_bufmod(pcap_t *p, int snaplen) 303{ 304 struct timeval to; 305 bpf_u_int32 ss, chunksize; 306 307 /* Non-standard call to get the data nicely buffered. */ 308 if (ioctl(p->fd, I_PUSH, "bufmod") != 0) { 309 pcap_stream_err("I_PUSH bufmod", errno, p->errbuf); 310 return (-1); 311 } 312 313 ss = snaplen; 314 if (ss > 0 && 315 strioctl(p->fd, SBIOCSSNAP, sizeof(ss), (char *)&ss) != 0) { 316 pcap_stream_err("SBIOCSSNAP", errno, p->errbuf); 317 return (-1); 318 } 319 320 if (p->opt.immediate) { 321 /* Set the timeout to zero, for immediate delivery. */ 322 to.tv_sec = 0; 323 to.tv_usec = 0; 324 if (strioctl(p->fd, SBIOCSTIME, sizeof(to), (char *)&to) != 0) { 325 pcap_stream_err("SBIOCSTIME", errno, p->errbuf); 326 return (-1); 327 } 328 } else { 329 /* Set up the bufmod timeout. */ 330 if (p->opt.timeout != 0) { 331 to.tv_sec = p->opt.timeout / 1000; 332 to.tv_usec = (p->opt.timeout * 1000) % 1000000; 333 if (strioctl(p->fd, SBIOCSTIME, sizeof(to), (char *)&to) != 0) { 334 pcap_stream_err("SBIOCSTIME", errno, p->errbuf); 335 return (-1); 336 } 337 } 338 339 /* Set the chunk length. */ 340 chunksize = CHUNKSIZE; 341 if (strioctl(p->fd, SBIOCSCHUNK, sizeof(chunksize), (char *)&chunksize) 342 != 0) { 343 pcap_stream_err("SBIOCSCHUNKP", errno, p->errbuf); 344 return (-1); 345 } 346 } 347 348 return (0); 349} 350#endif /* HAVE_SYS_BUFMOD_H */ 351 352/* 353 * Allocate data buffer. Returns -1 if memory allocation fails, else 0. 354 */ 355int 356pcap_alloc_databuf(pcap_t *p) 357{ 358 p->bufsize = PKTBUFSIZE; 359 p->buffer = malloc(p->bufsize + p->offset); 360 if (p->buffer == NULL) { 361 pcap_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE, 362 errno, "malloc"); 363 return (-1); 364 } 365 366 return (0); 367} 368 369/* 370 * Issue a STREAMS I_STR ioctl. Returns -1 on error, otherwise 371 * length of returned data on success. 372 */ 373int 374strioctl(int fd, int cmd, int len, char *dp) 375{ 376 struct strioctl str; 377 int retv; 378 379 str.ic_cmd = cmd; 380 str.ic_timout = -1; 381 str.ic_len = len; 382 str.ic_dp = dp; 383 if ((retv = ioctl(fd, I_STR, &str)) < 0) 384 return (retv); 385 386 return (str.ic_len); 387} 388 389#ifdef HAVE_SYS_BUFMOD_H 390/* 391 * Write stream error message to errbuf. 392 */ 393static void 394pcap_stream_err(const char *func, int err, char *errbuf) 395{ 396 pcap_fmt_errmsg_for_errno(errbuf, PCAP_ERRBUF_SIZE, err, "%s", func); 397} 398#endif 399