1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2009 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 26 #include <stdio.h> 27 #include <string.h> 28 #include <strings.h> 29 #include <errno.h> 30 #include <fcntl.h> 31 #include <setjmp.h> 32 #include <sys/types.h> 33 #include <sys/signal.h> 34 #include <sys/time.h> 35 #include <sys/socket.h> 36 #include <sys/sockio.h> 37 #include <netinet/in.h> 38 #include <netinet/ip.h> 39 #include <sys/pfmod.h> 40 #include <sys/mman.h> 41 #include <sys/stat.h> 42 #include <sys/bufmod.h> 43 44 #include <unistd.h> 45 #include <stropts.h> 46 #include <stdlib.h> 47 #include <ctype.h> 48 #include <values.h> 49 #include <libdlpi.h> 50 51 #include "snoop.h" 52 53 /* 54 * Old header format. 55 * Actually two concatenated structs: nit_bufhdr + nit_head 56 */ 57 struct ohdr { 58 /* nit_bufhdr */ 59 int o_msglen; 60 int o_totlen; 61 /* nit_head */ 62 struct timeval o_time; 63 int o_drops; 64 int o_len; 65 }; 66 67 static void scan(char *, int, int, int, int, void (*)(), int, int, int); 68 void convert_to_network(); 69 void convert_from_network(); 70 static void convert_old(struct ohdr *); 71 extern sigjmp_buf jmp_env, ojmp_env; 72 static dlpi_info_t dlinfo; 73 static char *bufp; /* pointer to read buffer */ 74 75 static int strioctl(int, int, int, int, void *); 76 77 enum { DWA_NONE, DWA_EXISTS, DWA_PLUMBED }; 78 79 typedef struct dlpi_walk_arg { 80 char dwa_linkname[MAXLINKNAMELEN]; 81 int dwa_type; /* preference type above */ 82 int dwa_s4; /* IPv4 socket */ 83 int dwa_s6; /* IPv6 socket */ 84 } dlpi_walk_arg_t; 85 86 static boolean_t 87 select_datalink(const char *linkname, void *arg) 88 { 89 struct lifreq lifr; 90 dlpi_walk_arg_t *dwap = arg; 91 int s4 = dwap->dwa_s4; 92 int s6 = dwap->dwa_s6; 93 94 (void) strlcpy(dwap->dwa_linkname, linkname, MAXLINKNAMELEN); 95 dwap->dwa_type = DWA_EXISTS; 96 97 /* 98 * See if it's plumbed by IP. We prefer such links because they're 99 * more likely to have interesting traffic. 100 */ 101 bzero(&lifr, sizeof (lifr)); 102 (void) strlcpy(lifr.lifr_name, linkname, LIFNAMSIZ); 103 if ((s4 != -1 && ioctl(s4, SIOCGLIFFLAGS, &lifr) != -1) || 104 (s6 != -1 && ioctl(s6, SIOCGLIFFLAGS, &lifr) != -1)) { 105 dwap->dwa_type = DWA_PLUMBED; 106 return (B_TRUE); 107 } 108 return (B_FALSE); 109 } 110 111 /* 112 * Open `linkname' in raw/passive mode (see dlpi_open(3DLPI)). If `linkname' 113 * is NULL, pick a datalink as per snoop(1M). Also gather some information 114 * about the datalink useful for building the proper packet filters. 115 */ 116 boolean_t 117 open_datalink(dlpi_handle_t *dhp, const char *linkname) 118 { 119 int retval; 120 int flags = DLPI_PASSIVE | DLPI_RAW; 121 dlpi_walk_arg_t dwa; 122 123 if (linkname == NULL) { 124 /* 125 * Select a datalink to use by default. Prefer datalinks that 126 * are plumbed by IP. 127 */ 128 bzero(&dwa, sizeof (dwa)); 129 dwa.dwa_s4 = socket(AF_INET, SOCK_DGRAM, 0); 130 dwa.dwa_s6 = socket(AF_INET6, SOCK_DGRAM, 0); 131 dlpi_walk(select_datalink, &dwa, 0); 132 (void) close(dwa.dwa_s4); 133 (void) close(dwa.dwa_s6); 134 135 if (dwa.dwa_type == DWA_NONE) 136 pr_err("no datalinks found"); 137 if (dwa.dwa_type == DWA_EXISTS) { 138 (void) fprintf(stderr, "snoop: WARNING: " 139 "no datalinks plumbed for IP traffic\n"); 140 } 141 linkname = dwa.dwa_linkname; 142 } 143 if (Iflg) 144 flags |= DLPI_DEVIPNET; 145 if (Iflg || strcmp(linkname, "lo0") == 0) 146 flags |= DLPI_IPNETINFO; 147 if ((retval = dlpi_open(linkname, dhp, flags)) != DLPI_SUCCESS) { 148 pr_err("cannot open \"%s\": %s", linkname, 149 dlpi_strerror(retval)); 150 } 151 152 if ((retval = dlpi_info(*dhp, &dlinfo, 0)) != DLPI_SUCCESS) 153 pr_errdlpi(*dhp, "dlpi_info failed", retval); 154 155 for (interface = &INTERFACES[0]; interface->mac_type != -1; interface++) 156 if (interface->mac_type == dlinfo.di_mactype) 157 break; 158 159 /* allow limited functionality even if interface isn't known */ 160 if (interface->mac_type == -1) { 161 (void) fprintf(stderr, "snoop: WARNING: Mac Type = %x " 162 "not supported\n", dlinfo.di_mactype); 163 } 164 165 /* for backward compatibility, allow known interface mtu_sizes */ 166 if (interface->mtu_size > dlinfo.di_max_sdu) 167 dlinfo.di_max_sdu = interface->mtu_size; 168 169 return (interface->try_kernel_filter); 170 } 171 172 /* 173 * Initialize `dh' for packet capture using the provided arguments. 174 */ 175 void 176 init_datalink(dlpi_handle_t dh, ulong_t snaplen, ulong_t chunksize, 177 struct timeval *timeout, struct Pf_ext_packetfilt *fp) 178 { 179 int retv; 180 int netfd; 181 182 retv = dlpi_bind(dh, DLPI_ANY_SAP, NULL); 183 if (retv != DLPI_SUCCESS) 184 pr_errdlpi(dh, "cannot bind on", retv); 185 186 if (Iflg) { 187 (void) fprintf(stderr, "Using device ipnet/%s ", 188 dlpi_linkname(dh)); 189 } else { 190 (void) fprintf(stderr, "Using device %s ", dlpi_linkname(dh)); 191 } 192 193 /* 194 * If Pflg not set - use physical level 195 * promiscuous mode. Otherwise - just SAP level. 196 */ 197 if (!Pflg) { 198 (void) fprintf(stderr, "(promiscuous mode)\n"); 199 retv = dlpi_promiscon(dh, DL_PROMISC_PHYS); 200 if (retv != DLPI_SUCCESS) { 201 pr_errdlpi(dh, "promiscuous mode(physical) failed", 202 retv); 203 } 204 } else { 205 (void) fprintf(stderr, "(non promiscuous)\n"); 206 retv = dlpi_promiscon(dh, DL_PROMISC_MULTI); 207 if (retv != DLPI_SUCCESS) { 208 pr_errdlpi(dh, "promiscuous mode(multicast) failed", 209 retv); 210 } 211 } 212 213 retv = dlpi_promiscon(dh, DL_PROMISC_SAP); 214 if (retv != DLPI_SUCCESS) 215 pr_errdlpi(dh, "promiscuous mode(SAP) failed", retv); 216 217 netfd = dlpi_fd(dh); 218 219 if (fp) { 220 /* 221 * push and configure the packet filtering module 222 */ 223 if (ioctl(netfd, I_PUSH, "pfmod") < 0) 224 pr_errdlpi(dh, "cannot push \"pfmod\"", DL_SYSERR); 225 226 if (strioctl(netfd, PFIOCSETF, -1, sizeof (*fp), 227 (char *)fp) < 0) 228 pr_errdlpi(dh, "PFIOCSETF", DL_SYSERR); 229 } 230 231 if (ioctl(netfd, I_PUSH, "bufmod") < 0) 232 pr_errdlpi(dh, "cannot push \"bufmod\"", DL_SYSERR); 233 234 if (strioctl(netfd, SBIOCSTIME, -1, sizeof (struct timeval), 235 (char *)timeout) < 0) 236 pr_errdlpi(dh, "SBIOCSTIME", DL_SYSERR); 237 238 if (strioctl(netfd, SBIOCSCHUNK, -1, sizeof (uint_t), 239 (char *)&chunksize) < 0) 240 pr_errdlpi(dh, "SBIOCGCHUNK", DL_SYSERR); 241 242 if (strioctl(netfd, SBIOCSSNAP, -1, sizeof (uint_t), 243 (char *)&snaplen) < 0) 244 pr_errdlpi(dh, "SBIOCSSNAP", DL_SYSERR); 245 246 /* 247 * Flush the read queue, to get rid of anything that 248 * accumulated before the device reached its final configuration. 249 */ 250 if (ioctl(netfd, I_FLUSH, FLUSHR) < 0) 251 pr_errdlpi(dh, "cannot flush \"I_FLUSH\"", DL_SYSERR); 252 } 253 254 /* 255 * Read packets from the network. init_datalink() is called in 256 * here to set up the network interface for reading of 257 * raw ethernet packets in promiscuous mode into a buffer. 258 * Packets are read and either written directly to a file 259 * or interpreted for display on the fly. 260 */ 261 void 262 net_read(dlpi_handle_t dh, size_t chunksize, int filter, void (*proc)(), 263 int flags) 264 { 265 int retval; 266 extern int count; 267 size_t msglen; 268 269 count = 0; 270 271 /* allocate a read buffer */ 272 bufp = malloc(chunksize); 273 if (bufp == NULL) 274 pr_err("no memory for %d buffer", chunksize); 275 276 /* 277 * read frames 278 */ 279 for (;;) { 280 msglen = chunksize; 281 retval = dlpi_recv(dh, NULL, NULL, bufp, &msglen, -1, NULL); 282 283 if (retval != DLPI_SUCCESS || quitting) 284 break; 285 286 if (msglen != 0) 287 scan(bufp, msglen, filter, 0, 0, proc, 0, 0, flags); 288 } 289 290 free(bufp); 291 292 if (!quitting) 293 pr_errdlpi(dh, "network read failed", retval); 294 } 295 296 #ifdef DEBUG 297 /* 298 * corrupt: simulate packet corruption for debugging interpreters 299 */ 300 void 301 corrupt(volatile char *pktp, volatile char *pstop, char *buf, 302 volatile char *bufstop) 303 { 304 int c; 305 int i; 306 int p; 307 int li = rand() % (pstop - pktp - 1) + 1; 308 volatile char *pp = pktp; 309 volatile char *pe = bufstop < pstop ? bufstop : pstop; 310 311 if (pktp < buf || pktp > bufstop) 312 return; 313 314 for (pp = pktp; pp < pe; pp += li) { 315 c = ((pe - pp) < li ? pe - pp : li); 316 i = (rand() % c)>>1; 317 while (--i > 0) { 318 p = (rand() % c); 319 pp[p] = (unsigned char)(rand() & 0xFF); 320 } 321 } 322 } 323 #endif /* DEBUG */ 324 325 static void 326 scan(char *buf, int len, int filter, int cap, int old, void (*proc)(), 327 int first, int last, int flags) 328 { 329 volatile char *bp, *bufstop; 330 volatile struct sb_hdr *hdrp; 331 volatile struct sb_hdr nhdr, *nhdrp; 332 volatile char *pktp; 333 volatile struct timeval last_timestamp; 334 volatile int header_okay; 335 extern int count, maxcount; 336 extern int snoop_nrecover; 337 #ifdef DEBUG 338 extern int zflg; 339 #endif /* DEBUG */ 340 341 proc(0, 0, 0); 342 bufstop = buf + len; 343 344 /* 345 * 346 * Loop through each packet in the buffer 347 */ 348 last_timestamp.tv_sec = 0; 349 (void) memcpy((char *)ojmp_env, (char *)jmp_env, sizeof (jmp_env)); 350 for (bp = buf; bp < bufstop; bp += nhdrp->sbh_totlen) { 351 /* 352 * Gracefully exit if user terminates 353 */ 354 if (quitting) 355 break; 356 /* 357 * Global error recocery: Prepare to continue when a corrupt 358 * packet or header is encountered. 359 */ 360 if (sigsetjmp(jmp_env, 1)) { 361 goto err; 362 } 363 364 header_okay = 0; 365 hdrp = (struct sb_hdr *)bp; 366 nhdrp = hdrp; 367 pktp = (char *)hdrp + sizeof (*hdrp); 368 369 /* 370 * If reading a capture file 371 * convert the headers from network 372 * byte order (for little-endians like X86) 373 */ 374 if (cap) { 375 /* 376 * If the packets come from an old 377 * capture file, convert the header. 378 */ 379 if (old) { 380 convert_old((struct ohdr *)hdrp); 381 } 382 383 nhdrp = &nhdr; 384 385 nhdrp->sbh_origlen = ntohl(hdrp->sbh_origlen); 386 nhdrp->sbh_msglen = ntohl(hdrp->sbh_msglen); 387 nhdrp->sbh_totlen = ntohl(hdrp->sbh_totlen); 388 nhdrp->sbh_drops = ntohl(hdrp->sbh_drops); 389 nhdrp->sbh_timestamp.tv_sec = 390 ntohl(hdrp->sbh_timestamp.tv_sec); 391 nhdrp->sbh_timestamp.tv_usec = 392 ntohl(hdrp->sbh_timestamp.tv_usec); 393 } 394 395 /* Enhanced check for valid header */ 396 397 if ((nhdrp->sbh_totlen == 0) || 398 (bp + nhdrp->sbh_totlen) < bp || 399 (bp + nhdrp->sbh_totlen) > bufstop || 400 (nhdrp->sbh_origlen == 0) || 401 (bp + nhdrp->sbh_origlen) < bp || 402 (nhdrp->sbh_msglen == 0) || 403 (bp + nhdrp->sbh_msglen) < bp || 404 (bp + nhdrp->sbh_msglen) > bufstop || 405 (nhdrp->sbh_msglen > nhdrp->sbh_origlen) || 406 (nhdrp->sbh_totlen < nhdrp->sbh_msglen) || 407 (nhdrp->sbh_timestamp.tv_sec == 0)) { 408 if (cap) { 409 (void) fprintf(stderr, "(warning) bad packet " 410 "header in capture file"); 411 } else { 412 (void) fprintf(stderr, "(warning) bad packet " 413 "header in buffer"); 414 } 415 (void) fprintf(stderr, " offset %d: length=%d\n", 416 bp - buf, nhdrp->sbh_totlen); 417 goto err; 418 } 419 420 if (nhdrp->sbh_totlen > 421 (dlinfo.di_max_sdu + MAX_HDRTRAILER)) { 422 if (cap) 423 (void) fprintf(stderr, "(warning) packet length" 424 " greater than MTU in capture file"); 425 else 426 (void) fprintf(stderr, "(warning) packet length" 427 " greater than MTU in buffer"); 428 429 (void) fprintf(stderr, " offset %d: length=%d\n", 430 bp - buf, nhdrp->sbh_totlen); 431 } 432 433 /* 434 * Check for incomplete packet. We are conservative here, 435 * since we don't know how good the checking is in other 436 * parts of the code. We pass a partial packet, with 437 * a warning. 438 */ 439 if (pktp + nhdrp->sbh_msglen > bufstop) { 440 (void) fprintf(stderr, "truncated packet buffer\n"); 441 nhdrp->sbh_msglen = bufstop - pktp; 442 } 443 444 #ifdef DEBUG 445 if (zflg) 446 corrupt(pktp, pktp + nhdrp->sbh_msglen, buf, bufstop); 447 #endif /* DEBUG */ 448 449 header_okay = 1; 450 if (!filter || 451 want_packet((uchar_t *)pktp, 452 nhdrp->sbh_msglen, 453 nhdrp->sbh_origlen)) { 454 count++; 455 456 /* 457 * Start deadman timer for interpreter processing 458 */ 459 (void) snoop_alarm(SNOOP_ALARM_GRAN*SNOOP_MAXRECOVER, 460 NULL); 461 462 encap_levels = 0; 463 if (!cap || count >= first) 464 proc(nhdrp, pktp, count, flags); 465 466 if (cap && count >= last) { 467 (void) snoop_alarm(0, NULL); 468 break; 469 } 470 471 if (maxcount && count >= maxcount) { 472 (void) fprintf(stderr, "%d packets captured\n", 473 count); 474 exit(0); 475 } 476 477 snoop_nrecover = 0; /* success */ 478 (void) snoop_alarm(0, NULL); 479 last_timestamp = hdrp->sbh_timestamp; /* save stamp */ 480 } 481 continue; 482 err: 483 /* 484 * Corruption has been detected. Reset errors. 485 */ 486 snoop_recover(); 487 488 /* 489 * packet header was apparently okay. Continue. 490 */ 491 if (header_okay) 492 continue; 493 494 /* 495 * Otherwise try to scan forward to the next packet, using 496 * the last known timestamp if it is available. 497 */ 498 nhdrp = &nhdr; 499 nhdrp->sbh_totlen = 0; 500 if (last_timestamp.tv_sec == 0) { 501 bp += sizeof (int); 502 } else { 503 for (bp += sizeof (int); bp <= bufstop; 504 bp += sizeof (int)) { 505 hdrp = (struct sb_hdr *)bp; 506 /* An approximate timestamp located */ 507 if ((hdrp->sbh_timestamp.tv_sec >> 8) == 508 (last_timestamp.tv_sec >> 8)) 509 break; 510 } 511 } 512 } 513 /* reset jmp_env for program exit */ 514 (void) memcpy((char *)jmp_env, (char *)ojmp_env, sizeof (jmp_env)); 515 proc(0, -1, 0); 516 } 517 518 /* 519 * Called if nwrite() encounters write problems. 520 */ 521 static void 522 cap_write_error(const char *msgtype) 523 { 524 (void) fprintf(stderr, 525 "snoop: cannot write %s to capture file: %s\n", 526 msgtype, strerror(errno)); 527 exit(1); 528 } 529 530 /* 531 * Writes target buffer to the open file descriptor. Upon detection of a short 532 * write, an attempt to process the remaining bytes occurs until all anticipated 533 * bytes are written. An error status is returned to indicate any serious write 534 * failures. 535 */ 536 static int 537 nwrite(int fd, const void *buffer, size_t buflen) 538 { 539 size_t nwritten; 540 ssize_t nbytes = 0; 541 const char *buf = buffer; 542 543 for (nwritten = 0; nwritten < buflen; nwritten += nbytes) { 544 nbytes = write(fd, &buf[nwritten], buflen - nwritten); 545 if (nbytes == -1) 546 return (-1); 547 if (nbytes == 0) { 548 errno = EIO; 549 return (-1); 550 } 551 } 552 return (0); 553 } 554 555 /* 556 * Routines for opening, closing, reading and writing 557 * a capture file of packets saved with the -o option. 558 */ 559 static int capfile_out; 560 561 /* 562 * The snoop capture file has a header to identify 563 * it as a capture file and record its version. 564 * A file without this header is assumed to be an 565 * old format snoop file. 566 * 567 * A version 1 header looks like this: 568 * 569 * 0 1 2 3 4 5 6 7 8 9 10 11 570 * +---+---+---+---+---+---+---+---+---+---+---+---+---+ 571 * | s | n | o | o | p | \0| \0| \0| version | data 572 * +---+---+---+---+---+---+---+---+---+---+---+---+---+ 573 * | word 0 | word 1 | word 2 | 574 * 575 * 576 * A version 2 header adds a word that identifies the MAC type. 577 * This allows for capture files from FDDI etc. 578 * 579 * 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 580 * +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+ 581 * | s | n | o | o | p | \0| \0| \0| version | MAC type | data 582 * +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+ 583 * | word 0 | word 1 | word 2 | word 3 584 * 585 */ 586 static const char *snoop_id = "snoop\0\0\0"; 587 static const int snoop_idlen = 8; 588 static const int snoop_version = 2; 589 590 void 591 cap_open_write(const char *name) 592 { 593 int vers; 594 595 capfile_out = open(name, O_CREAT | O_TRUNC | O_RDWR, 0666); 596 if (capfile_out < 0) 597 pr_err("%s: %m", name); 598 599 vers = htonl(snoop_version); 600 if (nwrite(capfile_out, snoop_id, snoop_idlen) == -1) 601 cap_write_error("snoop_id"); 602 603 if (nwrite(capfile_out, &vers, sizeof (int)) == -1) 604 cap_write_error("version"); 605 } 606 607 608 void 609 cap_close(void) 610 { 611 (void) close(capfile_out); 612 } 613 614 static char *cap_buffp = NULL; 615 static int cap_len = 0; 616 static int cap_new; 617 618 void 619 cap_open_read(const char *name) 620 { 621 struct stat st; 622 int cap_vers; 623 int *word, device_mac_type; 624 int capfile_in; 625 626 capfile_in = open(name, O_RDONLY); 627 if (capfile_in < 0) 628 pr_err("couldn't open %s: %m", name); 629 630 if (fstat(capfile_in, &st) < 0) 631 pr_err("couldn't stat %s: %m", name); 632 cap_len = st.st_size; 633 634 cap_buffp = mmap(0, cap_len, PROT_READ, MAP_PRIVATE, capfile_in, 0); 635 (void) close(capfile_in); 636 if ((int)cap_buffp == -1) 637 pr_err("couldn't mmap %s: %m", name); 638 639 /* Check if new snoop capture file format */ 640 641 cap_new = bcmp(cap_buffp, snoop_id, snoop_idlen) == 0; 642 643 /* 644 * If new file - check version and 645 * set buffer pointer to point at first packet 646 */ 647 if (cap_new) { 648 cap_vers = ntohl(*(int *)(cap_buffp + snoop_idlen)); 649 cap_buffp += snoop_idlen + sizeof (int); 650 cap_len -= snoop_idlen + sizeof (int); 651 652 switch (cap_vers) { 653 case 1: 654 device_mac_type = DL_ETHER; 655 break; 656 657 case 2: 658 device_mac_type = ntohl(*((int *)cap_buffp)); 659 cap_buffp += sizeof (int); 660 cap_len -= sizeof (int); 661 break; 662 663 default: 664 pr_err("capture file: %s: Version %d unrecognized\n", 665 name, cap_vers); 666 } 667 668 for (interface = &INTERFACES[0]; interface->mac_type != -1; 669 interface++) 670 if (interface->mac_type == device_mac_type) 671 break; 672 673 if (interface->mac_type == -1) 674 pr_err("Mac Type = %x is not supported\n", 675 device_mac_type); 676 } else { 677 /* Use heuristic to check if it's an old-style file */ 678 679 device_mac_type = DL_ETHER; 680 word = (int *)cap_buffp; 681 682 if (!((word[0] < 1600 && word[1] < 1600) && 683 (word[0] < word[1]) && 684 (word[2] > 610000000 && word[2] < 770000000))) 685 pr_err("not a capture file: %s", name); 686 687 /* Change protection so's we can fix the headers */ 688 689 if (mprotect(cap_buffp, cap_len, PROT_READ | PROT_WRITE) < 0) 690 pr_err("mprotect: %s: %m", name); 691 } 692 dlinfo.di_max_sdu = MAXINT; /* Decode any stored packet. */ 693 } 694 695 void 696 cap_read(int first, int last, int filter, void (*proc)(), int flags) 697 { 698 extern int count; 699 700 count = 0; 701 702 scan(cap_buffp, cap_len, filter, 1, !cap_new, proc, first, last, flags); 703 704 (void) munmap(cap_buffp, cap_len); 705 } 706 707 /* ARGSUSED */ 708 void 709 cap_write(struct sb_hdr *hdrp, char *pktp, int num, int flags) 710 { 711 int pktlen, mac; 712 static int first = 1; 713 struct sb_hdr nhdr; 714 extern boolean_t qflg; 715 716 if (hdrp == NULL) 717 return; 718 719 if (first) { 720 first = 0; 721 mac = htonl(interface->mac_type); 722 if (nwrite(capfile_out, &mac, sizeof (int)) == -1) 723 cap_write_error("mac_type"); 724 } 725 726 pktlen = hdrp->sbh_totlen - sizeof (*hdrp); 727 728 /* 729 * Convert sb_hdr to network byte order 730 */ 731 nhdr.sbh_origlen = htonl(hdrp->sbh_origlen); 732 nhdr.sbh_msglen = htonl(hdrp->sbh_msglen); 733 nhdr.sbh_totlen = htonl(hdrp->sbh_totlen); 734 nhdr.sbh_drops = htonl(hdrp->sbh_drops); 735 nhdr.sbh_timestamp.tv_sec = htonl(hdrp->sbh_timestamp.tv_sec); 736 nhdr.sbh_timestamp.tv_usec = htonl(hdrp->sbh_timestamp.tv_usec); 737 738 if (nwrite(capfile_out, &nhdr, sizeof (nhdr)) == -1) 739 cap_write_error("packet header"); 740 741 if (nwrite(capfile_out, pktp, pktlen) == -1) 742 cap_write_error("packet"); 743 744 if (! qflg) 745 show_count(); 746 } 747 748 /* 749 * Convert a packet header from 750 * old to new format. 751 */ 752 static void 753 convert_old(struct ohdr *ohdrp) 754 { 755 struct sb_hdr nhdr; 756 757 nhdr.sbh_origlen = ohdrp->o_len; 758 nhdr.sbh_msglen = ohdrp->o_msglen; 759 nhdr.sbh_totlen = ohdrp->o_totlen; 760 nhdr.sbh_drops = ohdrp->o_drops; 761 nhdr.sbh_timestamp = ohdrp->o_time; 762 763 *(struct sb_hdr *)ohdrp = nhdr; 764 } 765 766 static int 767 strioctl(int fd, int cmd, int timout, int len, void *dp) 768 { 769 struct strioctl sioc; 770 int rc; 771 772 sioc.ic_cmd = cmd; 773 sioc.ic_timout = timout; 774 sioc.ic_len = len; 775 sioc.ic_dp = dp; 776 rc = ioctl(fd, I_STR, &sioc); 777 778 if (rc < 0) 779 return (rc); 780 else 781 return (sioc.ic_len); 782 } 783