pcap-snit.c revision 17683
117683Spst/*
217683Spst * Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996
317683Spst *	The Regents of the University of California.  All rights reserved.
417683Spst *
517683Spst * Redistribution and use in source and binary forms, with or without
617683Spst * modification, are permitted provided that: (1) source code distributions
717683Spst * retain the above copyright notice and this paragraph in its entirety, (2)
817683Spst * distributions including binary code include the above copyright notice and
917683Spst * this paragraph in its entirety in the documentation or other materials
1017683Spst * provided with the distribution, and (3) all advertising materials mentioning
1117683Spst * features or use of this software display the following acknowledgement:
1217683Spst * ``This product includes software developed by the University of California,
1317683Spst * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
1417683Spst * the University nor the names of its contributors may be used to endorse
1517683Spst * or promote products derived from this software without specific prior
1617683Spst * written permission.
1717683Spst * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
1817683Spst * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
1917683Spst * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
2017683Spst */
2117683Spst#ifndef lint
2217683Spststatic  char rcsid[] =
2317683Spst    "@(#)$Header: pcap-snit.c,v 1.42 96/07/15 00:48:51 leres Exp $ (LBL)";
2417683Spst#endif
2517683Spst
2617683Spst/*
2717683Spst * Modifications made to accommodate the new SunOS4.0 NIT facility by
2817683Spst * Micky Liu, micky@cunixc.cc.columbia.edu, Columbia University in May, 1989.
2917683Spst * This module now handles the STREAMS based NIT.
3017683Spst */
3117683Spst
3217683Spst#include <sys/types.h>
3317683Spst#include <sys/time.h>
3417683Spst#include <sys/timeb.h>
3517683Spst#include <sys/dir.h>
3617683Spst#include <sys/fcntlcom.h>
3717683Spst#include <sys/file.h>
3817683Spst#include <sys/ioctl.h>
3917683Spst#include <sys/socket.h>
4017683Spst#include <sys/stropts.h>
4117683Spst
4217683Spst#include <net/if.h>
4317683Spst#include <net/nit.h>
4417683Spst#include <net/nit_if.h>
4517683Spst#include <net/nit_pf.h>
4617683Spst#include <net/nit_buf.h>
4717683Spst
4817683Spst#include <netinet/in.h>
4917683Spst#include <netinet/in_systm.h>
5017683Spst#include <netinet/ip.h>
5117683Spst#include <netinet/if_ether.h>
5217683Spst#include <netinet/ip_var.h>
5317683Spst#include <netinet/udp.h>
5417683Spst#include <netinet/udp_var.h>
5517683Spst#include <netinet/tcp.h>
5617683Spst#include <netinet/tcpip.h>
5717683Spst
5817683Spst#include <ctype.h>
5917683Spst#include <errno.h>
6017683Spst#ifdef HAVE_MALLOC_H
6117683Spst#include <malloc.h>
6217683Spst#endif
6317683Spst#include <stdio.h>
6417683Spst#include <string.h>
6517683Spst#include <unistd.h>
6617683Spst
6717683Spst#include "pcap-int.h"
6817683Spst
6917683Spst#include "gnuc.h"
7017683Spst#ifdef HAVE_OS_PROTO_H
7117683Spst#include "os-proto.h"
7217683Spst#endif
7317683Spst
7417683Spst/*
7517683Spst * The chunk size for NIT.  This is the amount of buffering
7617683Spst * done for read calls.
7717683Spst */
7817683Spst#define CHUNKSIZE (2*1024)
7917683Spst
8017683Spst/*
8117683Spst * The total buffer space used by NIT.
8217683Spst */
8317683Spst#define BUFSPACE (4*CHUNKSIZE)
8417683Spst
8517683Spst/* Forwards */
8617683Spststatic int nit_setflags(int, int, int, char *);
8717683Spst
8817683Spstint
8917683Spstpcap_stats(pcap_t *p, struct pcap_stat *ps)
9017683Spst{
9117683Spst
9217683Spst	*ps = p->md.stat;
9317683Spst	return (0);
9417683Spst}
9517683Spst
9617683Spstint
9717683Spstpcap_read(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
9817683Spst{
9917683Spst	register int cc, n;
10017683Spst	register struct bpf_insn *fcode = p->fcode.bf_insns;
10117683Spst	register u_char *bp, *cp, *ep;
10217683Spst	register struct nit_bufhdr *hdrp;
10317683Spst	register struct nit_iftime *ntp;
10417683Spst	register struct nit_iflen *nlp;
10517683Spst	register struct nit_ifdrops *ndp;
10617683Spst	register int caplen;
10717683Spst
10817683Spst	cc = p->cc;
10917683Spst	if (cc == 0) {
11017683Spst		cc = read(p->fd, (char *)p->buffer, p->bufsize);
11117683Spst		if (cc < 0) {
11217683Spst			if (errno == EWOULDBLOCK)
11317683Spst				return (0);
11417683Spst			sprintf(p->errbuf, "pcap_read: %s",
11517683Spst				pcap_strerror(errno));
11617683Spst			return (-1);
11717683Spst		}
11817683Spst		bp = p->buffer;
11917683Spst	} else
12017683Spst		bp = p->bp;
12117683Spst
12217683Spst	/*
12317683Spst	 * loop through each snapshot in the chunk
12417683Spst	 */
12517683Spst	n = 0;
12617683Spst	ep = bp + cc;
12717683Spst	while (bp < ep) {
12817683Spst		++p->md.stat.ps_recv;
12917683Spst		cp = bp;
13017683Spst
13117683Spst		/* get past NIT buffer  */
13217683Spst		hdrp = (struct nit_bufhdr *)cp;
13317683Spst		cp += sizeof(*hdrp);
13417683Spst
13517683Spst		/* get past NIT timer   */
13617683Spst		ntp = (struct nit_iftime *)cp;
13717683Spst		cp += sizeof(*ntp);
13817683Spst
13917683Spst		ndp = (struct nit_ifdrops *)cp;
14017683Spst		p->md.stat.ps_drop = ndp->nh_drops;
14117683Spst		cp += sizeof *ndp;
14217683Spst
14317683Spst		/* get past packet len  */
14417683Spst		nlp = (struct nit_iflen *)cp;
14517683Spst		cp += sizeof(*nlp);
14617683Spst
14717683Spst		/* next snapshot        */
14817683Spst		bp += hdrp->nhb_totlen;
14917683Spst
15017683Spst		caplen = nlp->nh_pktlen;
15117683Spst		if (caplen > p->snapshot)
15217683Spst			caplen = p->snapshot;
15317683Spst
15417683Spst		if (bpf_filter(fcode, cp, nlp->nh_pktlen, caplen)) {
15517683Spst			struct pcap_pkthdr h;
15617683Spst			h.ts = ntp->nh_timestamp;
15717683Spst			h.len = nlp->nh_pktlen;
15817683Spst			h.caplen = caplen;
15917683Spst			(*callback)(user, &h, cp);
16017683Spst			if (++n >= cnt && cnt >= 0) {
16117683Spst				p->cc = ep - bp;
16217683Spst				p->bp = bp;
16317683Spst				return (n);
16417683Spst			}
16517683Spst		}
16617683Spst	}
16717683Spst	p->cc = 0;
16817683Spst	return (n);
16917683Spst}
17017683Spst
17117683Spststatic int
17217683Spstnit_setflags(int fd, int promisc, int to_ms, char *ebuf)
17317683Spst{
17417683Spst	bpf_u_int32 flags;
17517683Spst	struct strioctl si;
17617683Spst	struct timeval timeout;
17717683Spst
17817683Spst	si.ic_timout = INFTIM;
17917683Spst	if (to_ms != 0) {
18017683Spst		timeout.tv_sec = to_ms / 1000;
18117683Spst		timeout.tv_usec = (to_ms * 1000) % 1000000;
18217683Spst		si.ic_cmd = NIOCSTIME;
18317683Spst		si.ic_len = sizeof(timeout);
18417683Spst		si.ic_dp = (char *)&timeout;
18517683Spst		if (ioctl(fd, I_STR, (char *)&si) < 0) {
18617683Spst			sprintf(ebuf, "NIOCSTIME: %s", pcap_strerror(errno));
18717683Spst			return (-1);
18817683Spst		}
18917683Spst	}
19017683Spst	flags = NI_TIMESTAMP | NI_LEN | NI_DROPS;
19117683Spst	if (promisc)
19217683Spst		flags |= NI_PROMISC;
19317683Spst	si.ic_cmd = NIOCSFLAGS;
19417683Spst	si.ic_len = sizeof(flags);
19517683Spst	si.ic_dp = (char *)&flags;
19617683Spst	if (ioctl(fd, I_STR, (char *)&si) < 0) {
19717683Spst		sprintf(ebuf, "NIOCSFLAGS: %s", pcap_strerror(errno));
19817683Spst		return (-1);
19917683Spst	}
20017683Spst	return (0);
20117683Spst}
20217683Spst
20317683Spstpcap_t *
20417683Spstpcap_open_live(char *device, int snaplen, int promisc, int to_ms, char *ebuf)
20517683Spst{
20617683Spst	struct strioctl si;		/* struct for ioctl() */
20717683Spst	struct ifreq ifr;		/* interface request struct */
20817683Spst	int chunksize = CHUNKSIZE;
20917683Spst	int fd;
21017683Spst	static char dev[] = "/dev/nit";
21117683Spst	register pcap_t *p;
21217683Spst
21317683Spst	p = (pcap_t *)malloc(sizeof(*p));
21417683Spst	if (p == NULL) {
21517683Spst		strcpy(ebuf, pcap_strerror(errno));
21617683Spst		return (NULL);
21717683Spst	}
21817683Spst
21917683Spst	if (snaplen < 96)
22017683Spst		/*
22117683Spst		 * NIT requires a snapshot length of at least 96.
22217683Spst		 */
22317683Spst		snaplen = 96;
22417683Spst
22517683Spst	bzero(p, sizeof(*p));
22617683Spst	p->fd = fd = open(dev, O_RDONLY);
22717683Spst	if (fd < 0) {
22817683Spst		sprintf(ebuf, "%s: %s", dev, pcap_strerror(errno));
22917683Spst		goto bad;
23017683Spst	}
23117683Spst
23217683Spst	/* arrange to get discrete messages from the STREAM and use NIT_BUF */
23317683Spst	if (ioctl(fd, I_SRDOPT, (char *)RMSGD) < 0) {
23417683Spst		sprintf(ebuf, "I_SRDOPT: %s", pcap_strerror(errno));
23517683Spst		goto bad;
23617683Spst	}
23717683Spst	if (ioctl(fd, I_PUSH, "nbuf") < 0) {
23817683Spst		sprintf(ebuf, "push nbuf: %s", pcap_strerror(errno));
23917683Spst		goto bad;
24017683Spst	}
24117683Spst	/* set the chunksize */
24217683Spst	si.ic_cmd = NIOCSCHUNK;
24317683Spst	si.ic_timout = INFTIM;
24417683Spst	si.ic_len = sizeof(chunksize);
24517683Spst	si.ic_dp = (char *)&chunksize;
24617683Spst	if (ioctl(fd, I_STR, (char *)&si) < 0) {
24717683Spst		sprintf(ebuf, "NIOCSCHUNK: %s", pcap_strerror(errno));
24817683Spst		goto bad;
24917683Spst	}
25017683Spst
25117683Spst	/* request the interface */
25217683Spst	strncpy(ifr.ifr_name, device, sizeof(ifr.ifr_name));
25317683Spst	ifr.ifr_name[sizeof(ifr.ifr_name) - 1] = ' ';
25417683Spst	si.ic_cmd = NIOCBIND;
25517683Spst	si.ic_len = sizeof(ifr);
25617683Spst	si.ic_dp = (char *)&ifr;
25717683Spst	if (ioctl(fd, I_STR, (char *)&si) < 0) {
25817683Spst		sprintf(ebuf, "NIOCBIND: %s: %s",
25917683Spst			ifr.ifr_name, pcap_strerror(errno));
26017683Spst		goto bad;
26117683Spst	}
26217683Spst
26317683Spst	/* set the snapshot length */
26417683Spst	si.ic_cmd = NIOCSSNAP;
26517683Spst	si.ic_len = sizeof(snaplen);
26617683Spst	si.ic_dp = (char *)&snaplen;
26717683Spst	if (ioctl(fd, I_STR, (char *)&si) < 0) {
26817683Spst		sprintf(ebuf, "NIOCSSNAP: %s", pcap_strerror(errno));
26917683Spst		goto bad;
27017683Spst	}
27117683Spst	p->snapshot = snaplen;
27217683Spst	if (nit_setflags(p->fd, promisc, to_ms, ebuf) < 0)
27317683Spst		goto bad;
27417683Spst
27517683Spst	(void)ioctl(fd, I_FLUSH, (char *)FLUSHR);
27617683Spst	/*
27717683Spst	 * NIT supports only ethernets.
27817683Spst	 */
27917683Spst	p->linktype = DLT_EN10MB;
28017683Spst
28117683Spst	p->bufsize = BUFSPACE;
28217683Spst	p->buffer = (u_char *)malloc(p->bufsize);
28317683Spst	if (p->buffer == NULL) {
28417683Spst		strcpy(ebuf, pcap_strerror(errno));
28517683Spst		goto bad;
28617683Spst	}
28717683Spst	return (p);
28817683Spst bad:
28917683Spst	if (fd >= 0)
29017683Spst		close(fd);
29117683Spst	free(p);
29217683Spst	return (NULL);
29317683Spst}
29417683Spst
29517683Spstint
29617683Spstpcap_setfilter(pcap_t *p, struct bpf_program *fp)
29717683Spst{
29817683Spst
29917683Spst	p->fcode = *fp;
30017683Spst	return (0);
30117683Spst}
302