1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21 /*
22 * Copyright 2009 Sun Microsystems, Inc. All rights reserved.
23 * Use is subject to license terms.
24 * Copyright 2012 Milan Jurik. All rights reserved.
25 */
26
27 #include <stdio.h>
28 #include <string.h>
29 #include <strings.h>
30 #include <errno.h>
31 #include <fcntl.h>
32 #include <setjmp.h>
33 #include <sys/types.h>
34 #include <sys/signal.h>
35 #include <sys/time.h>
36 #include <sys/socket.h>
37 #include <sys/sockio.h>
38 #include <netinet/in.h>
39 #include <netinet/ip.h>
40 #include <sys/pfmod.h>
41 #include <sys/mman.h>
42 #include <sys/stat.h>
43 #include <sys/bufmod.h>
44
45 #include <unistd.h>
46 #include <stropts.h>
47 #include <stdlib.h>
48 #include <ctype.h>
49 #include <values.h>
50 #include <libdlpi.h>
51
52 #include "snoop.h"
53
54 /*
55 * Old header format.
56 * Actually two concatenated structs: nit_bufhdr + nit_head
57 */
58 struct ohdr {
59 /* nit_bufhdr */
60 int o_msglen;
61 int o_totlen;
62 /* nit_head */
63 struct timeval o_time;
64 int o_drops;
65 int o_len;
66 };
67
68 static void scan(char *, int, int, int, int, void (*)(), int, int, int);
69 void convert_to_network();
70 void convert_from_network();
71 static void convert_old(struct ohdr *);
72 extern sigjmp_buf jmp_env, ojmp_env;
73 static char *bufp; /* pointer to read buffer */
74
75 static int strioctl(int, int, int, int, void *);
76
77 enum { DWA_NONE, DWA_EXISTS, DWA_PLUMBED };
78
79 typedef struct dlpi_walk_arg {
80 char dwa_linkname[MAXLINKNAMELEN];
81 int dwa_type; /* preference type above */
82 int dwa_s4; /* IPv4 socket */
83 int dwa_s6; /* IPv6 socket */
84 } dlpi_walk_arg_t;
85
86 static boolean_t
select_datalink(const char * linkname,void * arg)87 select_datalink(const char *linkname, void *arg)
88 {
89 struct lifreq lifr;
90 dlpi_walk_arg_t *dwap = arg;
91 int s4 = dwap->dwa_s4;
92 int s6 = dwap->dwa_s6;
93
94 (void) strlcpy(dwap->dwa_linkname, linkname, MAXLINKNAMELEN);
95 dwap->dwa_type = DWA_EXISTS;
96
97 /*
98 * See if it's plumbed by IP. We prefer such links because they're
99 * more likely to have interesting traffic.
100 */
101 bzero(&lifr, sizeof (lifr));
102 (void) strlcpy(lifr.lifr_name, linkname, LIFNAMSIZ);
103 if ((s4 != -1 && ioctl(s4, SIOCGLIFFLAGS, &lifr) != -1) ||
104 (s6 != -1 && ioctl(s6, SIOCGLIFFLAGS, &lifr) != -1)) {
105 dwap->dwa_type = DWA_PLUMBED;
106 return (B_TRUE);
107 }
108 return (B_FALSE);
109 }
110
111 /*
112 * Open `linkname' in raw/passive mode (see dlpi_open(3DLPI)). If `linkname'
113 * is NULL, pick a datalink as per snoop(1M). Also gather some information
114 * about the datalink useful for building the proper packet filters.
115 */
116 boolean_t
open_datalink(dlpi_handle_t * dhp,const char * linkname)117 open_datalink(dlpi_handle_t *dhp, const char *linkname)
118 {
119 int retval;
120 int flags = DLPI_PASSIVE | DLPI_RAW;
121 dlpi_walk_arg_t dwa;
122 dlpi_info_t dlinfo;
123
124 if (linkname == NULL) {
125 /*
126 * Select a datalink to use by default. Prefer datalinks that
127 * are plumbed by IP.
128 */
129 bzero(&dwa, sizeof (dwa));
130 dwa.dwa_s4 = socket(AF_INET, SOCK_DGRAM, 0);
131 dwa.dwa_s6 = socket(AF_INET6, SOCK_DGRAM, 0);
132 dlpi_walk(select_datalink, &dwa, 0);
133 (void) close(dwa.dwa_s4);
134 (void) close(dwa.dwa_s6);
135
136 if (dwa.dwa_type == DWA_NONE)
137 pr_err("no datalinks found");
138 if (dwa.dwa_type == DWA_EXISTS) {
139 (void) fprintf(stderr, "snoop: WARNING: "
140 "no datalinks plumbed for IP traffic\n");
141 }
142 linkname = dwa.dwa_linkname;
143 }
144 if (Iflg)
145 flags |= DLPI_DEVIPNET;
146 if (Iflg || strcmp(linkname, "lo0") == 0)
147 flags |= DLPI_IPNETINFO;
148 if ((retval = dlpi_open(linkname, dhp, flags)) != DLPI_SUCCESS) {
149 pr_err("cannot open \"%s\": %s", linkname,
150 dlpi_strerror(retval));
151 }
152
153 if ((retval = dlpi_info(*dhp, &dlinfo, 0)) != DLPI_SUCCESS)
154 pr_errdlpi(*dhp, "dlpi_info failed", retval);
155
156 for (interface = &INTERFACES[0]; interface->mac_type != -1; interface++)
157 if (interface->mac_type == dlinfo.di_mactype)
158 break;
159
160 /* allow limited functionality even if interface isn't known */
161 if (interface->mac_type == -1) {
162 (void) fprintf(stderr, "snoop: WARNING: Mac Type = %x "
163 "not supported\n", dlinfo.di_mactype);
164 }
165
166 return (interface->try_kernel_filter);
167 }
168
169 /*
170 * Initialize `dh' for packet capture using the provided arguments.
171 */
172 void
init_datalink(dlpi_handle_t dh,ulong_t snaplen,ulong_t chunksize,struct timeval * timeout,struct Pf_ext_packetfilt * fp)173 init_datalink(dlpi_handle_t dh, ulong_t snaplen, ulong_t chunksize,
174 struct timeval *timeout, struct Pf_ext_packetfilt *fp)
175 {
176 int retv;
177 int netfd;
178
179 retv = dlpi_bind(dh, DLPI_ANY_SAP, NULL);
180 if (retv != DLPI_SUCCESS)
181 pr_errdlpi(dh, "cannot bind on", retv);
182
183 if (Iflg) {
184 (void) fprintf(stderr, "Using device ipnet/%s ",
185 dlpi_linkname(dh));
186 } else {
187 (void) fprintf(stderr, "Using device %s ", dlpi_linkname(dh));
188 }
189
190 /*
191 * If Pflg not set - use physical level
192 * promiscuous mode. Otherwise - just SAP level.
193 */
194 if (!Pflg) {
195 (void) fprintf(stderr, "(promiscuous mode)\n");
196 retv = dlpi_promiscon(dh, DL_PROMISC_PHYS);
197 if (retv != DLPI_SUCCESS) {
198 pr_errdlpi(dh, "promiscuous mode(physical) failed",
199 retv);
200 }
201 } else {
202 (void) fprintf(stderr, "(non promiscuous)\n");
203 retv = dlpi_promiscon(dh, DL_PROMISC_MULTI);
204 if (retv != DLPI_SUCCESS) {
205 pr_errdlpi(dh, "promiscuous mode(multicast) failed",
206 retv);
207 }
208 }
209
210 retv = dlpi_promiscon(dh, DL_PROMISC_SAP);
211 if (retv != DLPI_SUCCESS)
212 pr_errdlpi(dh, "promiscuous mode(SAP) failed", retv);
213
214 netfd = dlpi_fd(dh);
215
216 if (fp) {
217 /*
218 * push and configure the packet filtering module
219 */
220 if (ioctl(netfd, I_PUSH, "pfmod") < 0)
221 pr_errdlpi(dh, "cannot push \"pfmod\"", DL_SYSERR);
222
223 if (strioctl(netfd, PFIOCSETF, -1, sizeof (*fp),
224 (char *)fp) < 0)
225 pr_errdlpi(dh, "PFIOCSETF", DL_SYSERR);
226 }
227
228 if (ioctl(netfd, I_PUSH, "bufmod") < 0)
229 pr_errdlpi(dh, "cannot push \"bufmod\"", DL_SYSERR);
230
231 if (strioctl(netfd, SBIOCSTIME, -1, sizeof (struct timeval),
232 (char *)timeout) < 0)
233 pr_errdlpi(dh, "SBIOCSTIME", DL_SYSERR);
234
235 if (strioctl(netfd, SBIOCSCHUNK, -1, sizeof (uint_t),
236 (char *)&chunksize) < 0)
237 pr_errdlpi(dh, "SBIOCGCHUNK", DL_SYSERR);
238
239 if (strioctl(netfd, SBIOCSSNAP, -1, sizeof (uint_t),
240 (char *)&snaplen) < 0)
241 pr_errdlpi(dh, "SBIOCSSNAP", DL_SYSERR);
242
243 /*
244 * Flush the read queue, to get rid of anything that
245 * accumulated before the device reached its final configuration.
246 */
247 if (ioctl(netfd, I_FLUSH, FLUSHR) < 0)
248 pr_errdlpi(dh, "cannot flush \"I_FLUSH\"", DL_SYSERR);
249 }
250
251 /*
252 * Read packets from the network. init_datalink() is called in
253 * here to set up the network interface for reading of
254 * raw ethernet packets in promiscuous mode into a buffer.
255 * Packets are read and either written directly to a file
256 * or interpreted for display on the fly.
257 */
258 void
net_read(dlpi_handle_t dh,size_t chunksize,int filter,void (* proc)(),int flags)259 net_read(dlpi_handle_t dh, size_t chunksize, int filter, void (*proc)(),
260 int flags)
261 {
262 int retval;
263 extern int count;
264 size_t msglen;
265
266 count = 0;
267
268 /* allocate a read buffer */
269 bufp = malloc(chunksize);
270 if (bufp == NULL)
271 pr_err("no memory for %d buffer", chunksize);
272
273 /*
274 * read frames
275 */
276 for (;;) {
277 msglen = chunksize;
278 retval = dlpi_recv(dh, NULL, NULL, bufp, &msglen, -1, NULL);
279
280 if (retval != DLPI_SUCCESS || quitting)
281 break;
282
283 if (msglen != 0)
284 scan(bufp, msglen, filter, 0, 0, proc, 0, 0, flags);
285 }
286
287 free(bufp);
288
289 if (!quitting)
290 pr_errdlpi(dh, "network read failed", retval);
291 }
292
293 #ifdef DEBUG
294 /*
295 * corrupt: simulate packet corruption for debugging interpreters
296 */
297 void
corrupt(volatile char * pktp,volatile char * pstop,char * buf,volatile char * bufstop)298 corrupt(volatile char *pktp, volatile char *pstop, char *buf,
299 volatile char *bufstop)
300 {
301 int c;
302 int i;
303 int p;
304 int li = rand() % (pstop - pktp - 1) + 1;
305 volatile char *pp = pktp;
306 volatile char *pe = bufstop < pstop ? bufstop : pstop;
307
308 if (pktp < buf || pktp > bufstop)
309 return;
310
311 for (pp = pktp; pp < pe; pp += li) {
312 c = ((pe - pp) < li ? pe - pp : li);
313 i = (rand() % c)>>1;
314 while (--i > 0) {
315 p = (rand() % c);
316 pp[p] = (unsigned char)(rand() & 0xFF);
317 }
318 }
319 }
320 #endif /* DEBUG */
321
322 static void
scan(char * buf,int len,int filter,int cap,int old,void (* proc)(),int first,int last,int flags)323 scan(char *buf, int len, int filter, int cap, int old, void (*proc)(),
324 int first, int last, int flags)
325 {
326 volatile char *bp, *bufstop;
327 volatile struct sb_hdr *hdrp;
328 volatile struct sb_hdr nhdr, *nhdrp;
329 volatile char *pktp;
330 volatile struct timeval last_timestamp;
331 volatile int header_okay;
332 extern int count, maxcount;
333 extern int snoop_nrecover;
334 #ifdef DEBUG
335 extern int zflg;
336 #endif /* DEBUG */
337
338 proc(0, 0, 0);
339 bufstop = buf + len;
340
341 /*
342 *
343 * Loop through each packet in the buffer
344 */
345 last_timestamp.tv_sec = 0;
346 (void) memcpy((char *)ojmp_env, (char *)jmp_env, sizeof (jmp_env));
347 for (bp = buf; bp < bufstop; bp += nhdrp->sbh_totlen) {
348 /*
349 * Gracefully exit if user terminates
350 */
351 if (quitting)
352 break;
353 /*
354 * Global error recocery: Prepare to continue when a corrupt
355 * packet or header is encountered.
356 */
357 if (sigsetjmp(jmp_env, 1)) {
358 goto err;
359 }
360
361 header_okay = 0;
362 hdrp = (struct sb_hdr *)bp;
363 nhdrp = hdrp;
364 pktp = (char *)hdrp + sizeof (*hdrp);
365
366 /*
367 * If reading a capture file
368 * convert the headers from network
369 * byte order (for little-endians like X86)
370 */
371 if (cap) {
372 /*
373 * If the packets come from an old
374 * capture file, convert the header.
375 */
376 if (old) {
377 convert_old((struct ohdr *)hdrp);
378 }
379
380 nhdrp = &nhdr;
381
382 nhdrp->sbh_origlen = ntohl(hdrp->sbh_origlen);
383 nhdrp->sbh_msglen = ntohl(hdrp->sbh_msglen);
384 nhdrp->sbh_totlen = ntohl(hdrp->sbh_totlen);
385 nhdrp->sbh_drops = ntohl(hdrp->sbh_drops);
386 nhdrp->sbh_timestamp.tv_sec =
387 ntohl(hdrp->sbh_timestamp.tv_sec);
388 nhdrp->sbh_timestamp.tv_usec =
389 ntohl(hdrp->sbh_timestamp.tv_usec);
390 }
391
392 /* Enhanced check for valid header */
393
394 if ((nhdrp->sbh_totlen == 0) ||
395 (bp + nhdrp->sbh_totlen) < bp ||
396 (bp + nhdrp->sbh_totlen) > bufstop ||
397 (nhdrp->sbh_origlen == 0) ||
398 (bp + nhdrp->sbh_origlen) < bp ||
399 (nhdrp->sbh_msglen == 0) ||
400 (bp + nhdrp->sbh_msglen) < bp ||
401 (bp + nhdrp->sbh_msglen) > bufstop ||
402 (nhdrp->sbh_msglen > nhdrp->sbh_origlen) ||
403 (nhdrp->sbh_totlen < nhdrp->sbh_msglen) ||
404 (nhdrp->sbh_timestamp.tv_sec == 0)) {
405 if (cap) {
406 (void) fprintf(stderr, "(warning) bad packet "
407 "header in capture file");
408 } else {
409 (void) fprintf(stderr, "(warning) bad packet "
410 "header in buffer");
411 }
412 (void) fprintf(stderr, " offset %d: length=%d\n",
413 bp - buf, nhdrp->sbh_totlen);
414 goto err;
415 }
416
417 /*
418 * Check for incomplete packet. We are conservative here,
419 * since we don't know how good the checking is in other
420 * parts of the code. We pass a partial packet, with
421 * a warning.
422 */
423 if (pktp + nhdrp->sbh_msglen > bufstop) {
424 (void) fprintf(stderr, "truncated packet buffer\n");
425 nhdrp->sbh_msglen = bufstop - pktp;
426 }
427
428 #ifdef DEBUG
429 if (zflg)
430 corrupt(pktp, pktp + nhdrp->sbh_msglen, buf, bufstop);
431 #endif /* DEBUG */
432
433 header_okay = 1;
434 if (!filter ||
435 want_packet((uchar_t *)pktp,
436 nhdrp->sbh_msglen,
437 nhdrp->sbh_origlen)) {
438 count++;
439
440 /*
441 * Start deadman timer for interpreter processing
442 */
443 (void) snoop_alarm(SNOOP_ALARM_GRAN*SNOOP_MAXRECOVER,
444 NULL);
445
446 encap_levels = 0;
447 if (!cap || count >= first)
448 proc(nhdrp, pktp, count, flags);
449
450 if (cap && count >= last) {
451 (void) snoop_alarm(0, NULL);
452 break;
453 }
454
455 if (maxcount && count >= maxcount) {
456 (void) fprintf(stderr, "%d packets captured\n",
457 count);
458 exit(0);
459 }
460
461 snoop_nrecover = 0; /* success */
462 (void) snoop_alarm(0, NULL);
463 last_timestamp = hdrp->sbh_timestamp; /* save stamp */
464 }
465 continue;
466 err:
467 /*
468 * Corruption has been detected. Reset errors.
469 */
470 snoop_recover();
471
472 /*
473 * packet header was apparently okay. Continue.
474 */
475 if (header_okay)
476 continue;
477
478 /*
479 * Otherwise try to scan forward to the next packet, using
480 * the last known timestamp if it is available.
481 */
482 nhdrp = &nhdr;
483 nhdrp->sbh_totlen = 0;
484 if (last_timestamp.tv_sec == 0) {
485 bp += sizeof (int);
486 } else {
487 for (bp += sizeof (int); bp <= bufstop;
488 bp += sizeof (int)) {
489 hdrp = (struct sb_hdr *)bp;
490 /* An approximate timestamp located */
491 if ((hdrp->sbh_timestamp.tv_sec >> 8) ==
492 (last_timestamp.tv_sec >> 8))
493 break;
494 }
495 }
496 }
497 /* reset jmp_env for program exit */
498 (void) memcpy((char *)jmp_env, (char *)ojmp_env, sizeof (jmp_env));
499 proc(0, -1, 0);
500 }
501
502 /*
503 * Called if nwrite() encounters write problems.
504 */
505 static void
cap_write_error(const char * msgtype)506 cap_write_error(const char *msgtype)
507 {
508 (void) fprintf(stderr,
509 "snoop: cannot write %s to capture file: %s\n",
510 msgtype, strerror(errno));
511 exit(1);
512 }
513
514 /*
515 * Writes target buffer to the open file descriptor. Upon detection of a short
516 * write, an attempt to process the remaining bytes occurs until all anticipated
517 * bytes are written. An error status is returned to indicate any serious write
518 * failures.
519 */
520 static int
nwrite(int fd,const void * buffer,size_t buflen)521 nwrite(int fd, const void *buffer, size_t buflen)
522 {
523 size_t nwritten;
524 ssize_t nbytes = 0;
525 const char *buf = buffer;
526
527 for (nwritten = 0; nwritten < buflen; nwritten += nbytes) {
528 nbytes = write(fd, &buf[nwritten], buflen - nwritten);
529 if (nbytes == -1)
530 return (-1);
531 if (nbytes == 0) {
532 errno = EIO;
533 return (-1);
534 }
535 }
536 return (0);
537 }
538
539 /*
540 * Routines for opening, closing, reading and writing
541 * a capture file of packets saved with the -o option.
542 */
543 static int capfile_out;
544
545 /*
546 * The snoop capture file has a header to identify
547 * it as a capture file and record its version.
548 * A file without this header is assumed to be an
549 * old format snoop file.
550 *
551 * A version 1 header looks like this:
552 *
553 * 0 1 2 3 4 5 6 7 8 9 10 11
554 * +---+---+---+---+---+---+---+---+---+---+---+---+---+
555 * | s | n | o | o | p | \0| \0| \0| version | data
556 * +---+---+---+---+---+---+---+---+---+---+---+---+---+
557 * | word 0 | word 1 | word 2 |
558 *
559 *
560 * A version 2 header adds a word that identifies the MAC type.
561 * This allows for capture files from FDDI etc.
562 *
563 * 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
564 * +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
565 * | s | n | o | o | p | \0| \0| \0| version | MAC type | data
566 * +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
567 * | word 0 | word 1 | word 2 | word 3
568 *
569 */
570 static const char *snoop_id = "snoop\0\0\0";
571 static const int snoop_idlen = 8;
572 static const int snoop_version = 2;
573
574 void
cap_open_write(const char * name)575 cap_open_write(const char *name)
576 {
577 int vers;
578
579 capfile_out = open(name, O_CREAT | O_TRUNC | O_RDWR, 0666);
580 if (capfile_out < 0)
581 pr_err("%s: %m", name);
582
583 vers = htonl(snoop_version);
584 if (nwrite(capfile_out, snoop_id, snoop_idlen) == -1)
585 cap_write_error("snoop_id");
586
587 if (nwrite(capfile_out, &vers, sizeof (int)) == -1)
588 cap_write_error("version");
589 }
590
591
592 void
cap_close(void)593 cap_close(void)
594 {
595 (void) close(capfile_out);
596 }
597
598 static char *cap_buffp = NULL;
599 static int cap_len = 0;
600 static int cap_new;
601
602 void
cap_open_read(const char * name)603 cap_open_read(const char *name)
604 {
605 struct stat st;
606 int cap_vers;
607 int *word;
608 int device_mac_type = -1;
609 int capfile_in;
610
611 capfile_in = open(name, O_RDONLY);
612 if (capfile_in < 0)
613 pr_err("couldn't open %s: %m", name);
614
615 if (fstat(capfile_in, &st) < 0)
616 pr_err("couldn't stat %s: %m", name);
617 cap_len = st.st_size;
618
619 cap_buffp = mmap(0, cap_len, PROT_READ, MAP_PRIVATE, capfile_in, 0);
620 (void) close(capfile_in);
621 if ((int)cap_buffp == -1)
622 pr_err("couldn't mmap %s: %m", name);
623
624 /* Check if new snoop capture file format */
625
626 cap_new = bcmp(cap_buffp, snoop_id, snoop_idlen) == 0;
627
628 /*
629 * If new file - check version and
630 * set buffer pointer to point at first packet
631 */
632 if (cap_new) {
633 cap_vers = ntohl(*(int *)(cap_buffp + snoop_idlen));
634 cap_buffp += snoop_idlen + sizeof (int);
635 cap_len -= snoop_idlen + sizeof (int);
636
637 switch (cap_vers) {
638 case 1:
639 device_mac_type = DL_ETHER;
640 break;
641
642 case 2:
643 device_mac_type = ntohl(*((int *)cap_buffp));
644 cap_buffp += sizeof (int);
645 cap_len -= sizeof (int);
646 break;
647
648 default:
649 pr_err("capture file: %s: Version %d unrecognized\n",
650 name, cap_vers);
651 }
652
653 for (interface = &INTERFACES[0]; interface->mac_type != -1;
654 interface++)
655 if (interface->mac_type == device_mac_type)
656 break;
657
658 if (interface->mac_type == -1)
659 pr_err("Mac Type = %x is not supported\n",
660 device_mac_type);
661 } else {
662 /* Use heuristic to check if it's an old-style file */
663
664 device_mac_type = DL_ETHER;
665 word = (int *)cap_buffp;
666
667 if (!((word[0] < 1600 && word[1] < 1600) &&
668 (word[0] < word[1]) &&
669 (word[2] > 610000000 && word[2] < 770000000)))
670 pr_err("not a capture file: %s", name);
671
672 /* Change protection so's we can fix the headers */
673
674 if (mprotect(cap_buffp, cap_len, PROT_READ | PROT_WRITE) < 0)
675 pr_err("mprotect: %s: %m", name);
676 }
677 }
678
679 void
cap_read(int first,int last,int filter,void (* proc)(),int flags)680 cap_read(int first, int last, int filter, void (*proc)(), int flags)
681 {
682 extern int count;
683
684 count = 0;
685
686 scan(cap_buffp, cap_len, filter, 1, !cap_new, proc, first, last, flags);
687
688 (void) munmap(cap_buffp, cap_len);
689 }
690
691 /* ARGSUSED */
692 void
cap_write(struct sb_hdr * hdrp,char * pktp,int num,int flags)693 cap_write(struct sb_hdr *hdrp, char *pktp, int num, int flags)
694 {
695 int pktlen, mac;
696 static int first = 1;
697 struct sb_hdr nhdr;
698 extern boolean_t qflg;
699
700 if (hdrp == NULL)
701 return;
702
703 if (first) {
704 first = 0;
705 mac = htonl(interface->mac_type);
706 if (nwrite(capfile_out, &mac, sizeof (int)) == -1)
707 cap_write_error("mac_type");
708 }
709
710 pktlen = hdrp->sbh_totlen - sizeof (*hdrp);
711
712 /*
713 * Convert sb_hdr to network byte order
714 */
715 nhdr.sbh_origlen = htonl(hdrp->sbh_origlen);
716 nhdr.sbh_msglen = htonl(hdrp->sbh_msglen);
717 nhdr.sbh_totlen = htonl(hdrp->sbh_totlen);
718 nhdr.sbh_drops = htonl(hdrp->sbh_drops);
719 nhdr.sbh_timestamp.tv_sec = htonl(hdrp->sbh_timestamp.tv_sec);
720 nhdr.sbh_timestamp.tv_usec = htonl(hdrp->sbh_timestamp.tv_usec);
721
722 if (nwrite(capfile_out, &nhdr, sizeof (nhdr)) == -1)
723 cap_write_error("packet header");
724
725 if (nwrite(capfile_out, pktp, pktlen) == -1)
726 cap_write_error("packet");
727
728 if (! qflg)
729 show_count();
730 }
731
732 /*
733 * Convert a packet header from
734 * old to new format.
735 */
736 static void
convert_old(struct ohdr * ohdrp)737 convert_old(struct ohdr *ohdrp)
738 {
739 struct sb_hdr nhdr;
740
741 nhdr.sbh_origlen = ohdrp->o_len;
742 nhdr.sbh_msglen = ohdrp->o_msglen;
743 nhdr.sbh_totlen = ohdrp->o_totlen;
744 nhdr.sbh_drops = ohdrp->o_drops;
745 nhdr.sbh_timestamp = ohdrp->o_time;
746
747 *(struct sb_hdr *)ohdrp = nhdr;
748 }
749
750 static int
strioctl(int fd,int cmd,int timout,int len,void * dp)751 strioctl(int fd, int cmd, int timout, int len, void *dp)
752 {
753 struct strioctl sioc;
754 int rc;
755
756 sioc.ic_cmd = cmd;
757 sioc.ic_timout = timout;
758 sioc.ic_len = len;
759 sioc.ic_dp = dp;
760 rc = ioctl(fd, I_STR, &sioc);
761
762 if (rc < 0)
763 return (rc);
764 else
765 return (sioc.ic_len);
766 }
767