The Tcpdump Group git mirrors - libpcap/blob - dlpisubs.c

   1 /*
   2  * This code is derived from code formerly in pcap-dlpi.c, originally
   3  * contributed by Atanu Ghosh (atanu@cs.ucl.ac.uk), University College
   4  * London, and subsequently modified by Guy Harris (guy@alum.mit.edu),
   5  * Mark Pizzolato <List-tcpdump-workers@subscriptions.pizzolato.net>,
   6  * Mark C. Brown (mbrown@hp.com), and Sagun Shakya <Sagun.Shakya@Sun.COM>.
   7  */
   8
   9 /*
  10  * This file contains dlpi/libdlpi related common functions used
  11  * by pcap-[dlpi,libdlpi].c.
  12  */
  13 #ifndef lint
  14 static const char rcsid[] _U_ =
  15         "@(#) $Header: /tcpdump/master/libpcap/dlpisubs.c,v 1.1.2.2 2008-04-04 19:39:05 guy Exp $ (LBL)";
  16 #endif
  17
  18 #ifdef HAVE_CONFIG_H
  19 #include "config.h"
  20 #endif
  21
  22 #ifdef HAVE_SYS_BUFMOD_H
  23         /*
  24          * Size of a bufmod chunk to pass upstream; that appears to be the
  25          * biggest value to which you can set it, and setting it to that value
  26          * (which is bigger than what appears to be the Solaris default of 8192)
  27          * reduces the number of packet drops.
  28          */
  29 #define CHUNKSIZE       65536
  30
  31         /*
  32          * Size of the buffer to allocate for packet data we read; it must be
  33          * large enough to hold a chunk.
  34          */
  35 #define PKTBUFSIZE      CHUNKSIZE
  36
  37 #else /* HAVE_SYS_BUFMOD_H */
  38
  39         /*
  40          * Size of the buffer to allocate for packet data we read; this is
  41          * what the value used to be - there's no particular reason why it
  42          * should be tied to MAXDLBUF, but we'll leave it as this for now.
  43          */
  44 #define PKTBUFSIZE      (MAXDLBUF * sizeof(bpf_u_int32))
  45
  46 #endif
  47
  48 #include <sys/types.h>
  49 #include <sys/time.h>
  50 #ifdef HAVE_SYS_BUFMOD_H
  51 #include <sys/bufmod.h>
  52 #endif
  53 #include <sys/dlpi.h>
  54 #include <sys/stream.h>
  55
  56 #include <errno.h>
  57 #include <memory.h>
  58 #include <stdio.h>
  59 #include <stdlib.h>
  60 #include <string.h>
  61 #include <stropts.h>
  62 #include <unistd.h>
  63
  64 #include "pcap-int.h"
  65 #include "dlpisubs.h"
  66
  67 static void pcap_stream_err(const char *, int, char *);
  68
  69 /*
  70  * Get the packet statistics.
  71  */
  72 int
  73 pcap_stats_dlpi(pcap_t *p, struct pcap_stat *ps)
  74 {
  75
  76         /*
  77          * "ps_recv" counts packets handed to the filter, not packets
  78          * that passed the filter.  As filtering is done in userland,
  79          * this would not include packets dropped because we ran out
  80          * of buffer space; in order to make this more like other
  81          * platforms (Linux 2.4 and later, BSDs with BPF), where the
  82          * "packets received" count includes packets received but dropped
  83          * due to running out of buffer space, and to keep from confusing
  84          * applications that, for example, compute packet drop percentages,
  85          * we also make it count packets dropped by "bufmod" (otherwise we
  86          * might run the risk of the packet drop count being bigger than
  87          * the received-packet count).
  88          *
  89          * "ps_drop" counts packets dropped by "bufmod" because of
  90          * flow control requirements or resource exhaustion; it doesn't
  91          * count packets dropped by the interface driver, or packets
  92          * dropped upstream.  As filtering is done in userland, it counts
  93          * packets regardless of whether they would've passed the filter.
  94          *
  95          * These statistics don't include packets not yet read from
  96          * the kernel by libpcap, but they may include packets not
  97          * yet read from libpcap by the application.
  98          */
  99         *ps = p->md.stat;
 100
 101         /*
 102          * Add in the drop count, as per the above comment.
 103          */
 104         ps->ps_recv += ps->ps_drop;
 105         return (0);
 106 }
 107
 108 /*
 109  * Loop through the packets and call the callback for each packet.
 110  * Return the number of packets read.
 111  */
 112 int
 113 pcap_process_pkts(pcap_t *p, pcap_handler callback, u_char *user,
 114         int count, u_char *bufp, int len)
 115 {
 116         int n, caplen, origlen;
 117         u_char *ep, *pk;
 118         struct pcap_pkthdr pkthdr;
 119 #ifdef HAVE_SYS_BUFMOD_H
 120         struct sb_hdr *sbp;
 121 #ifdef LBL_ALIGN
 122         struct sb_hdr sbhdr;
 123 #endif
 124 #endif
 125
 126         /* Loop through packets */
 127         ep = bufp + len;
 128         n = 0;
 129
 130 #ifdef HAVE_SYS_BUFMOD_H
 131         while (bufp < ep) {
 132                 /*
 133                  * Has "pcap_breakloop()" been called?
 134                  * If so, return immediately - if we haven't read any
 135                  * packets, clear the flag and return -2 to indicate
 136                  * that we were told to break out of the loop, otherwise
 137                  * leave the flag set, so that the *next* call will break
 138                  * out of the loop without having read any packets, and
 139                  * return the number of packets we've processed so far.
 140                  */
 141                 if (p->break_loop) {
 142                         if (n == 0) {
 143                                 p->break_loop = 0;
 144                                 return (-2);
 145                         } else {
 146                                 p->bp = bufp;
 147                                 p->cc = ep - bufp;
 148                                 return (n);
 149                         }
 150                 }
 151 #ifdef LBL_ALIGN
 152                 if ((long)bufp & 3) {
 153                         sbp = &sbhdr;
 154                         memcpy(sbp, bufp, sizeof(*sbp));
 155                 } else
 156 #endif
 157                         sbp = (struct sb_hdr *)bufp;
 158                 p->md.stat.ps_drop = sbp->sbh_drops;
 159                 pk = bufp + sizeof(*sbp);
 160                 bufp += sbp->sbh_totlen;
 161                 origlen = sbp->sbh_origlen;
 162                 caplen = sbp->sbh_msglen;
 163 #else
 164                 origlen = len;
 165                 caplen = min(p->snapshot, len);
 166                 pk = bufp;
 167                 bufp += caplen;
 168 #endif
 169                 ++p->md.stat.ps_recv;
 170                 if (bpf_filter(p->fcode.bf_insns, pk, origlen, caplen)) {
 171 #ifdef HAVE_SYS_BUFMOD_H
 172                         pkthdr.ts.tv_sec = sbp->sbh_timestamp.tv_sec;
 173                         pkthdr.ts.tv_usec = sbp->sbh_timestamp.tv_usec;
 174 #else
 175                         (void) gettimeofday(&pkthdr.ts, NULL);
 176 #endif
 177                         pkthdr.len = origlen;
 178                         pkthdr.caplen = caplen;
 179                         /* Insure caplen does not exceed snapshot */
 180                         if (pkthdr.caplen > p->snapshot)
 181                                 pkthdr.caplen = p->snapshot;
 182                         (*callback)(user, &pkthdr, pk);
 183                         if (++n >= count && count >= 0) {
 184                                 p->cc = ep - bufp;
 185                                 p->bp = bufp;
 186                                 return (n);
 187                         }
 188                 }
 189 #ifdef HAVE_SYS_BUFMOD_H
 190         }
 191 #endif
 192         p->cc = 0;
 193         return (n);
 194 }
 195
 196 /*
 197  * Process the mac type. Returns -1 if no matching mac type found, otherwise 0.
 198  */
 199 int
 200 pcap_process_mactype(pcap_t *p, u_int mactype)
 201 {
 202         int retv = 0;
 203
 204         switch (mactype) {
 205
 206         case DL_CSMACD:
 207         case DL_ETHER:
 208                 p->linktype = DLT_EN10MB;
 209                 p->offset = 2;
 210                 /*
 211                  * This is (presumably) a real Ethernet capture; give it a
 212                  * link-layer-type list with DLT_EN10MB and DLT_DOCSIS, so
 213                  * that an application can let you choose it, in case you're
 214                  * capturing DOCSIS traffic that a Cisco Cable Modem
 215                  * Termination System is putting out onto an Ethernet (it
 216                  * doesn't put an Ethernet header onto the wire, it puts raw
 217                  * DOCSIS frames out on the wire inside the low-level
 218                  * Ethernet framing).
 219                  */
 220                 p->dlt_list = (u_int *)malloc(sizeof(u_int) * 2);
 221                 /*
 222                  * If that fails, just leave the list empty.
 223                  */
 224                 if (p->dlt_list != NULL) {
 225                         p->dlt_list[0] = DLT_EN10MB;
 226                         p->dlt_list[1] = DLT_DOCSIS;
 227                         p->dlt_count = 2;
 228                 }
 229                 break;
 230
 231         case DL_FDDI:
 232                 p->linktype = DLT_FDDI;
 233                 p->offset = 3;
 234                 break;
 235
 236         case DL_TPR:
 237                 /* XXX - what about DL_TPB?  Is that Token Bus?  */
 238                 p->linktype = DLT_IEEE802;
 239                 p->offset = 2;
 240                 break;
 241
 242 #ifdef HAVE_SOLARIS
 243         case DL_IPATM:
 244                 p->linktype = DLT_SUNATM;
 245                 p->offset = 0;  /* works for LANE and LLC encapsulation */
 246                 break;
 247 #endif
 248
 249         default:
 250                 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "unknown mactype %u",
 251                     mactype);
 252                 retv = -1;
 253         }
 254
 255         return (retv);
 256 }
 257
 258 #ifdef HAVE_SYS_BUFMOD_H
 259 /*
 260  * Push and configure the buffer module. Returns -1 for error, otherwise 0.
 261  */
 262 int
 263 pcap_conf_bufmod(pcap_t *p, int snaplen, int timeout)
 264 {
 265         int retv = 0;
 266
 267         bpf_u_int32 ss, chunksize;
 268
 269         /* Non-standard call to get the data nicely buffered. */
 270         if (ioctl(p->fd, I_PUSH, "bufmod") != 0) {
 271                 pcap_stream_err("I_PUSH bufmod", errno, p->errbuf);
 272                 retv = -1;
 273         }
 274
 275         ss = snaplen;
 276         if (ss > 0 &&
 277             strioctl(p->fd, SBIOCSSNAP, sizeof(ss), (char *)&ss) != 0) {
 278                 pcap_stream_err("SBIOCSSNAP", errno, p->errbuf);
 279                 retv = -1;
 280         }
 281
 282         /* Set up the bufmod timeout. */
 283         if (timeout != 0) {
 284                 struct timeval to;
 285
 286                 to.tv_sec = timeout / 1000;
 287                 to.tv_usec = (timeout * 1000) % 1000000;
 288                 if (strioctl(p->fd, SBIOCSTIME, sizeof(to), (char *)&to) != 0) {
 289                         pcap_stream_err("SBIOCSTIME", errno, p->errbuf);
 290                         retv = -1;
 291                 }
 292         }
 293
 294         /* Set the chunk length. */
 295         chunksize = CHUNKSIZE;
 296         if (strioctl(p->fd, SBIOCSCHUNK, sizeof(chunksize), (char *)&chunksize)
 297             != 0) {
 298                 pcap_stream_err("SBIOCSCHUNKP", errno, p->errbuf);
 299                 retv = -1;
 300         }
 301
 302         return (retv);
 303 }
 304 #endif /* HAVE_SYS_BUFMOD_H */
 305
 306 /*
 307  * Allocate data buffer. Returns -1 if memory allocation fails, else 0.
 308  */
 309 int
 310 pcap_alloc_databuf(pcap_t *p)
 311 {
 312         p->bufsize = PKTBUFSIZE;
 313         p->buffer = (u_char *)malloc(p->bufsize + p->offset);
 314         if (p->buffer == NULL) {
 315                 strlcpy(p->errbuf, pcap_strerror(errno), PCAP_ERRBUF_SIZE);
 316                 return (-1);
 317         }
 318
 319         return (0);
 320 }
 321
 322 /*
 323  * Issue a STREAMS I_STR ioctl. Returns -1 on error, otherwise
 324  * length of returned data on success.
 325  */
 326 int
 327 strioctl(int fd, int cmd, int len, char *dp)
 328 {
 329         struct strioctl str;
 330         int retv;
 331
 332         str.ic_cmd = cmd;
 333         str.ic_timout = -1;
 334         str.ic_len = len;
 335         str.ic_dp = dp;
 336         if ((retv = ioctl(fd, I_STR, &str)) < 0)
 337                 return (retv);
 338
 339         return (str.ic_len);
 340 }
 341
 342 /*
 343  * Write stream error message to errbuf.
 344  */
 345 static void
 346 pcap_stream_err(const char *func, int err, char *errbuf)
 347 {
 348         snprintf(errbuf, PCAP_ERRBUF_SIZE, "%s: %s", func, pcap_strerror(err));
 349 }