2 * Copyright (c) 1990, 1991, 1992, 1993, 1994, 1995, 1996
3 * The Regents of the University of California. All rights reserved.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
21 * Modifications made to accommodate the new SunOS4.0 NIT facility by
22 * Micky Liu, micky@cunixc.cc.columbia.edu, Columbia University in May, 1989.
23 * This module now handles the STREAMS based NIT.
30 #include <sys/types.h>
32 #include <sys/timeb.h>
34 #include <sys/fcntlcom.h>
36 #include <sys/ioctl.h>
37 #include <sys/socket.h>
38 #include <sys/stropts.h>
42 #include <net/nit_if.h>
43 #include <net/nit_pf.h>
44 #include <net/nit_buf.h>
46 #include <netinet/in.h>
47 #include <netinet/in_systm.h>
48 #include <netinet/ip.h>
49 #include <netinet/if_ether.h>
50 #include <netinet/ip_var.h>
51 #include <netinet/udp.h>
52 #include <netinet/udp_var.h>
53 #include <netinet/tcp.h>
54 #include <netinet/tcpip.h>
64 #ifdef HAVE_OS_PROTO_H
69 * The chunk size for NIT. This is the amount of buffering
70 * done for read calls.
72 #define CHUNKSIZE (2*1024)
75 * The total buffer space used by NIT.
77 #define BUFSPACE (4*CHUNKSIZE)
80 static int nit_setflags(int, int, int, char *);
83 * Private data for capturing on STREAMS NIT devices.
86 struct pcap_stat stat
;
90 pcap_stats_snit(pcap_t
*p
, struct pcap_stat
*ps
)
92 struct pcap_snit
*psn
= p
->priv
;
95 * "ps_recv" counts packets handed to the filter, not packets
96 * that passed the filter. As filtering is done in userland,
97 * this does not include packets dropped because we ran out
100 * "ps_drop" counts packets dropped inside the "/dev/nit"
101 * device because of flow control requirements or resource
102 * exhaustion; it doesn't count packets dropped by the
103 * interface driver, or packets dropped upstream. As filtering
104 * is done in userland, it counts packets regardless of whether
105 * they would've passed the filter.
107 * These statistics don't include packets not yet read from the
108 * kernel by libpcap or packets not yet read from libpcap by the
116 pcap_read_snit(pcap_t
*p
, int cnt
, pcap_handler callback
, u_char
*user
)
118 struct pcap_snit
*psn
= p
->priv
;
120 register u_char
*bp
, *cp
, *ep
;
121 register struct nit_bufhdr
*hdrp
;
122 register struct nit_iftime
*ntp
;
123 register struct nit_iflen
*nlp
;
124 register struct nit_ifdrops
*ndp
;
129 cc
= read(p
->fd
, (char *)p
->buffer
, p
->bufsize
);
131 if (errno
== EWOULDBLOCK
)
133 snprintf(p
->errbuf
, sizeof(p
->errbuf
), "pcap_read: %s",
134 pcap_strerror(errno
));
142 * loop through each snapshot in the chunk
148 * Has "pcap_breakloop()" been called?
149 * If so, return immediately - if we haven't read any
150 * packets, clear the flag and return -2 to indicate
151 * that we were told to break out of the loop, otherwise
152 * leave the flag set, so that the *next* call will break
153 * out of the loop without having read any packets, and
154 * return the number of packets we've processed so far.
170 /* get past NIT buffer */
171 hdrp
= (struct nit_bufhdr
*)cp
;
174 /* get past NIT timer */
175 ntp
= (struct nit_iftime
*)cp
;
178 ndp
= (struct nit_ifdrops
*)cp
;
179 psn
->stat
.ps_drop
= ndp
->nh_drops
;
182 /* get past packet len */
183 nlp
= (struct nit_iflen
*)cp
;
187 bp
+= hdrp
->nhb_totlen
;
189 caplen
= nlp
->nh_pktlen
;
190 if (caplen
> p
->snapshot
)
191 caplen
= p
->snapshot
;
193 if (bpf_filter(p
->fcode
.bf_insns
, cp
, nlp
->nh_pktlen
, caplen
)) {
194 struct pcap_pkthdr h
;
195 h
.ts
= ntp
->nh_timestamp
;
196 h
.len
= nlp
->nh_pktlen
;
198 (*callback
)(user
, &h
, cp
);
199 if (++n
>= cnt
&& !PACKET_COUNT_IS_UNLIMITED(cnt
)) {
211 pcap_inject_snit(pcap_t
*p
, const void *buf
, size_t size
)
213 struct strbuf ctl
, data
;
216 * XXX - can we just do
218 ret = write(pd->f, buf, size);
220 ctl
.len
= sizeof(*sa
); /* XXX - what was this? */
221 ctl
.buf
= (char *)sa
;
224 ret
= putmsg(p
->fd
, &ctl
, &data
);
226 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
, "send: %s",
227 pcap_strerror(errno
));
234 nit_setflags(pcap_t
*p
)
239 struct timeval timeout
;
241 if (p
->opt
.immediate
) {
243 * Set the chunk size to zero, so that chunks get sent
246 si
.ic_cmd
= NIOCSCHUNK
;
247 si
.ic_len
= sizeof(zero
);
248 si
.ic_dp
= (char *)&zero
;
249 if (ioctl(p
->fd
, I_STR
, (char *)&si
) < 0) {
250 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
, "NIOCSCHUNK: %s",
251 pcap_strerror(errno
));
255 si
.ic_timout
= INFTIM
;
256 if (p
->opt
.timeout
!= 0) {
257 timeout
.tv_sec
= p
->opt
.timeout
/ 1000;
258 timeout
.tv_usec
= (p
->opt
.timeout
* 1000) % 1000000;
259 si
.ic_cmd
= NIOCSTIME
;
260 si
.ic_len
= sizeof(timeout
);
261 si
.ic_dp
= (char *)&timeout
;
262 if (ioctl(p
->fd
, I_STR
, (char *)&si
) < 0) {
263 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
, "NIOCSTIME: %s",
264 pcap_strerror(errno
));
268 flags
= NI_TIMESTAMP
| NI_LEN
| NI_DROPS
;
271 si
.ic_cmd
= NIOCSFLAGS
;
272 si
.ic_len
= sizeof(flags
);
273 si
.ic_dp
= (char *)&flags
;
274 if (ioctl(p
->fd
, I_STR
, (char *)&si
) < 0) {
275 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
, "NIOCSFLAGS: %s",
276 pcap_strerror(errno
));
283 pcap_activate_snit(pcap_t
*p
)
285 struct strioctl si
; /* struct for ioctl() */
286 struct ifreq ifr
; /* interface request struct */
287 int chunksize
= CHUNKSIZE
;
289 static char dev
[] = "/dev/nit";
293 * No monitor mode on SunOS 4.x (no Wi-Fi devices on
294 * hardware supported by SunOS 4.x).
296 return (PCAP_ERROR_RFMON_NOTSUP
);
299 if (p
->snapshot
< 96)
301 * NIT requires a snapshot length of at least 96.
306 * Initially try a read/write open (to allow the inject
307 * method to work). If that fails due to permission
308 * issues, fall back to read-only. This allows a
309 * non-root user to be granted specific access to pcap
310 * capabilities via file permissions.
312 * XXX - we should have an API that has a flag that
313 * controls whether to open read-only or read-write,
314 * so that denial of permission to send (or inability
315 * to send, if sending packets isn't supported on
316 * the device in question) can be indicated at open
319 p
->fd
= fd
= open(dev
, O_RDWR
);
320 if (fd
< 0 && errno
== EACCES
)
321 p
->fd
= fd
= open(dev
, O_RDONLY
);
323 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
, "%s: %s", dev
,
324 pcap_strerror(errno
));
328 /* arrange to get discrete messages from the STREAM and use NIT_BUF */
329 if (ioctl(fd
, I_SRDOPT
, (char *)RMSGD
) < 0) {
330 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
, "I_SRDOPT: %s",
331 pcap_strerror(errno
));
334 if (ioctl(fd
, I_PUSH
, "nbuf") < 0) {
335 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
, "push nbuf: %s",
336 pcap_strerror(errno
));
339 /* set the chunksize */
340 si
.ic_cmd
= NIOCSCHUNK
;
341 si
.ic_timout
= INFTIM
;
342 si
.ic_len
= sizeof(chunksize
);
343 si
.ic_dp
= (char *)&chunksize
;
344 if (ioctl(fd
, I_STR
, (char *)&si
) < 0) {
345 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
, "NIOCSCHUNK: %s",
346 pcap_strerror(errno
));
350 /* request the interface */
351 strncpy(ifr
.ifr_name
, p
->opt
.source
, sizeof(ifr
.ifr_name
));
352 ifr
.ifr_name
[sizeof(ifr
.ifr_name
) - 1] = '\0';
353 si
.ic_cmd
= NIOCBIND
;
354 si
.ic_len
= sizeof(ifr
);
355 si
.ic_dp
= (char *)&ifr
;
356 if (ioctl(fd
, I_STR
, (char *)&si
) < 0) {
357 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
, "NIOCBIND: %s: %s",
358 ifr
.ifr_name
, pcap_strerror(errno
));
362 /* set the snapshot length */
363 si
.ic_cmd
= NIOCSSNAP
;
364 si
.ic_len
= sizeof(p
->snapshot
);
365 si
.ic_dp
= (char *)&p
->snapshot
;
366 if (ioctl(fd
, I_STR
, (char *)&si
) < 0) {
367 snprintf(p
->errbuf
, PCAP_ERRBUF_SIZE
, "NIOCSSNAP: %s",
368 pcap_strerror(errno
));
371 if (nit_setflags(p
) < 0)
374 (void)ioctl(fd
, I_FLUSH
, (char *)FLUSHR
);
376 * NIT supports only ethernets.
378 p
->linktype
= DLT_EN10MB
;
380 p
->bufsize
= BUFSPACE
;
381 p
->buffer
= (u_char
*)malloc(p
->bufsize
);
382 if (p
->buffer
== NULL
) {
383 strlcpy(p
->errbuf
, pcap_strerror(errno
), PCAP_ERRBUF_SIZE
);
388 * "p->fd" is an FD for a STREAMS device, so "select()" and
389 * "poll()" should work on it.
391 p
->selectable_fd
= p
->fd
;
394 * This is (presumably) a real Ethernet capture; give it a
395 * link-layer-type list with DLT_EN10MB and DLT_DOCSIS, so
396 * that an application can let you choose it, in case you're
397 * capturing DOCSIS traffic that a Cisco Cable Modem
398 * Termination System is putting out onto an Ethernet (it
399 * doesn't put an Ethernet header onto the wire, it puts raw
400 * DOCSIS frames out on the wire inside the low-level
403 p
->dlt_list
= (u_int
*) malloc(sizeof(u_int
) * 2);
405 * If that fails, just leave the list empty.
407 if (p
->dlt_list
!= NULL
) {
408 p
->dlt_list
[0] = DLT_EN10MB
;
409 p
->dlt_list
[1] = DLT_DOCSIS
;
413 p
->read_op
= pcap_read_snit
;
414 p
->inject_op
= pcap_inject_snit
;
415 p
->setfilter_op
= install_bpf_program
; /* no kernel filtering */
416 p
->setdirection_op
= NULL
; /* Not implemented. */
417 p
->set_datalink_op
= NULL
; /* can't change data link type */
418 p
->getnonblock_op
= pcap_getnonblock_fd
;
419 p
->setnonblock_op
= pcap_setnonblock_fd
;
420 p
->stats_op
= pcap_stats_snit
;
424 pcap_cleanup_live_common(p
);
429 pcap_create_interface(const char *device
, char *ebuf
)
433 p
= pcap_create_common(device
, ebuf
, sizeof (struct pcap_snit
));
437 p
->activate_op
= pcap_activate_snit
;
442 pcap_platform_finddevs(pcap_if_t
**alldevsp
, char *errbuf
)