xref: /titanic_51/usr/src/cmd/cmd-inet/usr.sbin/snoop/snoop_capture.c (revision 7380b00ccf9fc5638da98d756925bc6d6c002a42)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 #include <stdio.h>
27 #include <string.h>
28 #include <strings.h>
29 #include <errno.h>
30 #include <fcntl.h>
31 #include <setjmp.h>
32 #include <sys/types.h>
33 #include <sys/signal.h>
34 #include <sys/time.h>
35 #include <sys/socket.h>
36 #include <sys/sockio.h>
37 #include <netinet/in.h>
38 #include <netinet/ip.h>
39 #include <sys/pfmod.h>
40 #include <sys/mman.h>
41 #include <sys/stat.h>
42 #include <sys/bufmod.h>
43 
44 #include <unistd.h>
45 #include <stropts.h>
46 #include <stdlib.h>
47 #include <ctype.h>
48 #include <values.h>
49 #include <libdlpi.h>
50 
51 #include "snoop.h"
52 
53 /*
54  * Old header format.
55  * Actually two concatenated structs:  nit_bufhdr + nit_head
56  */
57 struct ohdr {
58 	/* nit_bufhdr */
59 	int	o_msglen;
60 	int	o_totlen;
61 	/* nit_head */
62 	struct timeval o_time;
63 	int	o_drops;
64 	int	o_len;
65 };
66 
67 static void scan(char *, int, int, int, int, void (*)(), int, int, int);
68 void convert_to_network();
69 void convert_from_network();
70 static void convert_old(struct ohdr *);
71 extern sigjmp_buf jmp_env, ojmp_env;
72 static dlpi_info_t dlinfo;
73 static char *bufp;	/* pointer to read buffer */
74 
75 static int strioctl(int, int, int, int, void *);
76 
77 enum { DWA_NONE, DWA_EXISTS, DWA_PLUMBED };
78 
79 typedef struct dlpi_walk_arg {
80 	char	dwa_linkname[MAXLINKNAMELEN];
81 	int	dwa_type;	/* preference type above */
82 	int	dwa_s4;		/* IPv4 socket */
83 	int	dwa_s6;		/* IPv6 socket */
84 } dlpi_walk_arg_t;
85 
86 static boolean_t
87 select_datalink(const char *linkname, void *arg)
88 {
89 	struct lifreq lifr;
90 	dlpi_walk_arg_t *dwap = arg;
91 	int s4 = dwap->dwa_s4;
92 	int s6 = dwap->dwa_s6;
93 
94 	(void) strlcpy(dwap->dwa_linkname, linkname, MAXLINKNAMELEN);
95 	dwap->dwa_type = DWA_EXISTS;
96 
97 	/*
98 	 * See if it's plumbed by IP.  We prefer such links because they're
99 	 * more likely to have interesting traffic.
100 	 */
101 	bzero(&lifr, sizeof (lifr));
102 	(void) strlcpy(lifr.lifr_name, linkname, LIFNAMSIZ);
103 	if ((s4 != -1 && ioctl(s4, SIOCGLIFFLAGS, &lifr) != -1) ||
104 	    (s6 != -1 && ioctl(s6, SIOCGLIFFLAGS, &lifr) != -1)) {
105 		dwap->dwa_type = DWA_PLUMBED;
106 		return (B_TRUE);
107 	}
108 	return (B_FALSE);
109 }
110 
111 /*
112  * Open `linkname' in raw/passive mode (see dlpi_open(3DLPI)).  If `linkname'
113  * is NULL, pick a datalink as per snoop(1M).  Also gather some information
114  * about the datalink useful for building the proper packet filters.
115  */
116 boolean_t
117 open_datalink(dlpi_handle_t *dhp, const char *linkname)
118 {
119 	int retval;
120 	int flags = DLPI_PASSIVE | DLPI_RAW;
121 	dlpi_walk_arg_t dwa;
122 
123 	if (linkname == NULL) {
124 		/*
125 		 * Select a datalink to use by default.  Prefer datalinks that
126 		 * are plumbed by IP.
127 		 */
128 		bzero(&dwa, sizeof (dwa));
129 		dwa.dwa_s4 = socket(AF_INET, SOCK_DGRAM, 0);
130 		dwa.dwa_s6 = socket(AF_INET6, SOCK_DGRAM, 0);
131 		dlpi_walk(select_datalink, &dwa, 0);
132 		(void) close(dwa.dwa_s4);
133 		(void) close(dwa.dwa_s6);
134 
135 		if (dwa.dwa_type == DWA_NONE)
136 			pr_err("no datalinks found");
137 		if (dwa.dwa_type == DWA_EXISTS) {
138 			(void) fprintf(stderr, "snoop: WARNING: "
139 			    "no datalinks plumbed for IP traffic\n");
140 		}
141 		linkname = dwa.dwa_linkname;
142 	}
143 	if (Iflg)
144 		flags |= DLPI_DEVIPNET;
145 	if (Iflg || strcmp(linkname, "lo0") == 0)
146 		flags |= DLPI_IPNETINFO;
147 	if ((retval = dlpi_open(linkname, dhp, flags)) != DLPI_SUCCESS) {
148 		pr_err("cannot open \"%s\": %s", linkname,
149 		    dlpi_strerror(retval));
150 	}
151 
152 	if ((retval = dlpi_info(*dhp, &dlinfo, 0)) != DLPI_SUCCESS)
153 		pr_errdlpi(*dhp, "dlpi_info failed", retval);
154 
155 	for (interface = &INTERFACES[0]; interface->mac_type != -1; interface++)
156 		if (interface->mac_type == dlinfo.di_mactype)
157 			break;
158 
159 	/* allow limited functionality even if interface isn't known */
160 	if (interface->mac_type == -1) {
161 		(void) fprintf(stderr, "snoop: WARNING: Mac Type = %x "
162 		    "not supported\n", dlinfo.di_mactype);
163 	}
164 
165 	/* for backward compatibility, allow known interface mtu_sizes */
166 	if (interface->mtu_size > dlinfo.di_max_sdu)
167 		dlinfo.di_max_sdu = interface->mtu_size;
168 
169 	return (interface->try_kernel_filter);
170 }
171 
172 /*
173  * Initialize `dh' for packet capture using the provided arguments.
174  */
175 void
176 init_datalink(dlpi_handle_t dh, ulong_t snaplen, ulong_t chunksize,
177     struct timeval *timeout, struct Pf_ext_packetfilt *fp)
178 {
179 	int 	retv;
180 	int 	netfd;
181 
182 	retv = dlpi_bind(dh, DLPI_ANY_SAP, NULL);
183 	if (retv != DLPI_SUCCESS)
184 		pr_errdlpi(dh, "cannot bind on", retv);
185 
186 	if (Iflg) {
187 		(void) fprintf(stderr, "Using device ipnet/%s ",
188 		    dlpi_linkname(dh));
189 	} else {
190 		(void) fprintf(stderr, "Using device %s ", dlpi_linkname(dh));
191 	}
192 
193 	/*
194 	 * If Pflg not set - use physical level
195 	 * promiscuous mode.  Otherwise - just SAP level.
196 	 */
197 	if (!Pflg) {
198 		(void) fprintf(stderr, "(promiscuous mode)\n");
199 		retv = dlpi_promiscon(dh, DL_PROMISC_PHYS);
200 		if (retv != DLPI_SUCCESS) {
201 			pr_errdlpi(dh, "promiscuous mode(physical) failed",
202 			    retv);
203 		}
204 	} else {
205 		(void) fprintf(stderr, "(non promiscuous)\n");
206 		retv = dlpi_promiscon(dh, DL_PROMISC_MULTI);
207 		if (retv != DLPI_SUCCESS) {
208 			pr_errdlpi(dh, "promiscuous mode(multicast) failed",
209 			    retv);
210 		}
211 	}
212 
213 	retv = dlpi_promiscon(dh, DL_PROMISC_SAP);
214 	if (retv != DLPI_SUCCESS)
215 		pr_errdlpi(dh, "promiscuous mode(SAP) failed", retv);
216 
217 	netfd = dlpi_fd(dh);
218 
219 	if (fp) {
220 		/*
221 		 * push and configure the packet filtering module
222 		 */
223 		if (ioctl(netfd, I_PUSH, "pfmod") < 0)
224 			pr_errdlpi(dh, "cannot push \"pfmod\"", DL_SYSERR);
225 
226 		if (strioctl(netfd, PFIOCSETF, -1, sizeof (*fp),
227 		    (char *)fp) < 0)
228 			pr_errdlpi(dh, "PFIOCSETF", DL_SYSERR);
229 	}
230 
231 	if (ioctl(netfd, I_PUSH, "bufmod") < 0)
232 		pr_errdlpi(dh, "cannot push \"bufmod\"", DL_SYSERR);
233 
234 	if (strioctl(netfd, SBIOCSTIME, -1, sizeof (struct timeval),
235 	    (char *)timeout) < 0)
236 		pr_errdlpi(dh, "SBIOCSTIME", DL_SYSERR);
237 
238 	if (strioctl(netfd, SBIOCSCHUNK, -1, sizeof (uint_t),
239 	    (char *)&chunksize) < 0)
240 		pr_errdlpi(dh, "SBIOCGCHUNK", DL_SYSERR);
241 
242 	if (strioctl(netfd, SBIOCSSNAP, -1, sizeof (uint_t),
243 	    (char *)&snaplen) < 0)
244 		pr_errdlpi(dh, "SBIOCSSNAP", DL_SYSERR);
245 
246 	/*
247 	 * Flush the read queue, to get rid of anything that
248 	 * accumulated before the device reached its final configuration.
249 	 */
250 	if (ioctl(netfd, I_FLUSH, FLUSHR) < 0)
251 		pr_errdlpi(dh, "cannot flush \"I_FLUSH\"", DL_SYSERR);
252 }
253 
254 /*
255  * Read packets from the network.  init_datalink() is called in
256  * here to set up the network interface for reading of
257  * raw ethernet packets in promiscuous mode into a buffer.
258  * Packets are read and either written directly to a file
259  * or interpreted for display on the fly.
260  */
261 void
262 net_read(dlpi_handle_t dh, size_t chunksize, int filter, void (*proc)(),
263     int flags)
264 {
265 	int 	retval;
266 	extern int count;
267 	size_t	msglen;
268 
269 	count = 0;
270 
271 	/* allocate a read buffer */
272 	bufp = malloc(chunksize);
273 	if (bufp == NULL)
274 		pr_err("no memory for %d buffer", chunksize);
275 
276 	/*
277 	 * read frames
278 	 */
279 	for (;;) {
280 		msglen = chunksize;
281 		retval = dlpi_recv(dh, NULL, NULL, bufp, &msglen, -1, NULL);
282 
283 		if (retval != DLPI_SUCCESS || quitting)
284 			break;
285 
286 		if (msglen != 0)
287 			scan(bufp, msglen, filter, 0, 0, proc, 0, 0, flags);
288 	}
289 
290 	free(bufp);
291 
292 	if (!quitting)
293 		pr_errdlpi(dh, "network read failed", retval);
294 }
295 
296 #ifdef DEBUG
297 /*
298  * corrupt: simulate packet corruption for debugging interpreters
299  */
300 void
301 corrupt(volatile char *pktp, volatile char *pstop, char *buf,
302 	volatile char *bufstop)
303 {
304 	int c;
305 	int i;
306 	int p;
307 	int li = rand() % (pstop - pktp - 1) + 1;
308 	volatile char *pp = pktp;
309 	volatile char *pe = bufstop < pstop ? bufstop : pstop;
310 
311 	if (pktp < buf || pktp > bufstop)
312 		return;
313 
314 	for (pp = pktp; pp < pe; pp += li) {
315 		c = ((pe - pp) < li ? pe - pp : li);
316 		i = (rand() % c)>>1;
317 		while (--i > 0) {
318 			p = (rand() % c);
319 			pp[p] = (unsigned char)(rand() & 0xFF);
320 		}
321 	}
322 }
323 #endif /* DEBUG */
324 
325 static void
326 scan(char *buf, int len, int filter, int cap, int old, void (*proc)(),
327     int first, int last, int flags)
328 {
329 	volatile char *bp, *bufstop;
330 	volatile struct sb_hdr *hdrp;
331 	volatile struct sb_hdr nhdr, *nhdrp;
332 	volatile char *pktp;
333 	volatile struct timeval last_timestamp;
334 	volatile int header_okay;
335 	extern int count, maxcount;
336 	extern int snoop_nrecover;
337 #ifdef	DEBUG
338 	extern int zflg;
339 #endif	/* DEBUG */
340 
341 	proc(0, 0, 0);
342 	bufstop = buf + len;
343 
344 	/*
345 	 *
346 	 * Loop through each packet in the buffer
347 	 */
348 	last_timestamp.tv_sec = 0;
349 	(void) memcpy((char *)ojmp_env, (char *)jmp_env, sizeof (jmp_env));
350 	for (bp = buf; bp < bufstop; bp += nhdrp->sbh_totlen) {
351 		/*
352 		 * Gracefully exit if user terminates
353 		 */
354 		if (quitting)
355 			break;
356 		/*
357 		 * Global error recocery: Prepare to continue when a corrupt
358 		 * packet or header is encountered.
359 		 */
360 		if (sigsetjmp(jmp_env, 1)) {
361 			goto err;
362 		}
363 
364 		header_okay = 0;
365 		hdrp = (struct sb_hdr *)bp;
366 		nhdrp = hdrp;
367 		pktp = (char *)hdrp + sizeof (*hdrp);
368 
369 		/*
370 		 * If reading a capture file
371 		 * convert the headers from network
372 		 * byte order (for little-endians like X86)
373 		 */
374 		if (cap) {
375 			/*
376 			 * If the packets come from an old
377 			 * capture file, convert the header.
378 			 */
379 			if (old) {
380 				convert_old((struct ohdr *)hdrp);
381 			}
382 
383 			nhdrp = &nhdr;
384 
385 			nhdrp->sbh_origlen = ntohl(hdrp->sbh_origlen);
386 			nhdrp->sbh_msglen = ntohl(hdrp->sbh_msglen);
387 			nhdrp->sbh_totlen = ntohl(hdrp->sbh_totlen);
388 			nhdrp->sbh_drops = ntohl(hdrp->sbh_drops);
389 			nhdrp->sbh_timestamp.tv_sec =
390 			    ntohl(hdrp->sbh_timestamp.tv_sec);
391 			nhdrp->sbh_timestamp.tv_usec =
392 			    ntohl(hdrp->sbh_timestamp.tv_usec);
393 		}
394 
395 		/* Enhanced check for valid header */
396 
397 		if ((nhdrp->sbh_totlen == 0) ||
398 		    (bp + nhdrp->sbh_totlen) < bp ||
399 		    (bp + nhdrp->sbh_totlen) > bufstop ||
400 		    (nhdrp->sbh_origlen == 0) ||
401 		    (bp + nhdrp->sbh_origlen) < bp ||
402 		    (nhdrp->sbh_msglen == 0) ||
403 		    (bp + nhdrp->sbh_msglen) < bp ||
404 		    (bp + nhdrp->sbh_msglen) > bufstop ||
405 		    (nhdrp->sbh_msglen > nhdrp->sbh_origlen) ||
406 		    (nhdrp->sbh_totlen < nhdrp->sbh_msglen) ||
407 		    (nhdrp->sbh_timestamp.tv_sec == 0)) {
408 			if (cap) {
409 				(void) fprintf(stderr, "(warning) bad packet "
410 				    "header in capture file");
411 			} else {
412 				(void) fprintf(stderr, "(warning) bad packet "
413 				    "header in buffer");
414 			}
415 			(void) fprintf(stderr, " offset %d: length=%d\n",
416 			    bp - buf, nhdrp->sbh_totlen);
417 			goto err;
418 		}
419 
420 		if (nhdrp->sbh_totlen >
421 		    (dlinfo.di_max_sdu + MAX_HDRTRAILER)) {
422 			if (cap)
423 				(void) fprintf(stderr, "(warning) packet length"
424 				    " greater than MTU in capture file");
425 			else
426 				(void) fprintf(stderr, "(warning) packet length"
427 				    " greater than MTU in buffer");
428 
429 			(void) fprintf(stderr, " offset %d: length=%d\n",
430 			    bp - buf, nhdrp->sbh_totlen);
431 		}
432 
433 		/*
434 		 * Check for incomplete packet.  We are conservative here,
435 		 * since we don't know how good the checking is in other
436 		 * parts of the code.  We pass a partial packet, with
437 		 * a warning.
438 		 */
439 		if (pktp + nhdrp->sbh_msglen > bufstop) {
440 			(void) fprintf(stderr, "truncated packet buffer\n");
441 			nhdrp->sbh_msglen = bufstop - pktp;
442 		}
443 
444 #ifdef DEBUG
445 		if (zflg)
446 			corrupt(pktp, pktp + nhdrp->sbh_msglen, buf, bufstop);
447 #endif /* DEBUG */
448 
449 		header_okay = 1;
450 		if (!filter ||
451 		    want_packet((uchar_t *)pktp,
452 		    nhdrp->sbh_msglen,
453 		    nhdrp->sbh_origlen)) {
454 			count++;
455 
456 			/*
457 			 * Start deadman timer for interpreter processing
458 			 */
459 			(void) snoop_alarm(SNOOP_ALARM_GRAN*SNOOP_MAXRECOVER,
460 			    NULL);
461 
462 			encap_levels = 0;
463 			if (!cap || count >= first)
464 				proc(nhdrp, pktp, count, flags);
465 
466 			if (cap && count >= last) {
467 				(void) snoop_alarm(0, NULL);
468 				break;
469 			}
470 
471 			if (maxcount && count >= maxcount) {
472 				(void) fprintf(stderr, "%d packets captured\n",
473 				    count);
474 				exit(0);
475 			}
476 
477 			snoop_nrecover = 0;			/* success */
478 			(void) snoop_alarm(0, NULL);
479 			last_timestamp = hdrp->sbh_timestamp;	/* save stamp */
480 		}
481 		continue;
482 err:
483 		/*
484 		 * Corruption has been detected. Reset errors.
485 		 */
486 		snoop_recover();
487 
488 		/*
489 		 * packet header was apparently okay. Continue.
490 		 */
491 		if (header_okay)
492 			continue;
493 
494 		/*
495 		 * Otherwise try to scan forward to the next packet, using
496 		 * the last known timestamp if it is available.
497 		 */
498 		nhdrp = &nhdr;
499 		nhdrp->sbh_totlen = 0;
500 		if (last_timestamp.tv_sec == 0) {
501 			bp += sizeof (int);
502 		} else {
503 			for (bp += sizeof (int); bp <= bufstop;
504 			    bp += sizeof (int)) {
505 				hdrp = (struct sb_hdr *)bp;
506 				/* An approximate timestamp located */
507 				if ((hdrp->sbh_timestamp.tv_sec >> 8) ==
508 				    (last_timestamp.tv_sec >> 8))
509 					break;
510 			}
511 		}
512 	}
513 	/* reset jmp_env for program exit */
514 	(void) memcpy((char *)jmp_env, (char *)ojmp_env, sizeof (jmp_env));
515 	proc(0, -1, 0);
516 }
517 
518 /*
519  * Called if nwrite() encounters write problems.
520  */
521 static void
522 cap_write_error(const char *msgtype)
523 {
524 	(void) fprintf(stderr,
525 	    "snoop: cannot write %s to capture file: %s\n",
526 	    msgtype, strerror(errno));
527 	exit(1);
528 }
529 
530 /*
531  * Writes target buffer to the open file descriptor. Upon detection of a short
532  * write, an attempt to process the remaining bytes occurs until all anticipated
533  * bytes are written. An error status is returned to indicate any serious write
534  * failures.
535  */
536 static int
537 nwrite(int fd, const void *buffer, size_t buflen)
538 {
539 	size_t nwritten;
540 	ssize_t nbytes = 0;
541 	const char *buf = buffer;
542 
543 	for (nwritten = 0; nwritten < buflen; nwritten += nbytes) {
544 		nbytes = write(fd, &buf[nwritten], buflen - nwritten);
545 		if (nbytes == -1)
546 			return (-1);
547 		if (nbytes == 0) {
548 			errno = EIO;
549 			return (-1);
550 		}
551 	}
552 	return (0);
553 }
554 
555 /*
556  * Routines for opening, closing, reading and writing
557  * a capture file of packets saved with the -o option.
558  */
559 static int capfile_out;
560 
561 /*
562  * The snoop capture file has a header to identify
563  * it as a capture file and record its version.
564  * A file without this header is assumed to be an
565  * old format snoop file.
566  *
567  * A version 1 header looks like this:
568  *
569  *   0   1   2   3   4   5   6   7   8   9  10  11
570  * +---+---+---+---+---+---+---+---+---+---+---+---+---+
571  * | s | n | o | o | p | \0| \0| \0|    version    |  data
572  * +---+---+---+---+---+---+---+---+---+---+---+---+---+
573  * |	 word 0	   |	 word 1	   |	 word 2	   |
574  *
575  *
576  * A version 2 header adds a word that identifies the MAC type.
577  * This allows for capture files from FDDI etc.
578  *
579  *   0   1   2   3   4   5   6   7   8   9  10  11  12  13  14  15
580  * +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
581  * | s | n | o | o | p | \0| \0| \0|    version    |    MAC type   | data
582  * +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
583  * |	 word 0	   |	 word 1	   |	 word 2	   |	 word 3
584  *
585  */
586 static const char *snoop_id = "snoop\0\0\0";
587 static const int snoop_idlen = 8;
588 static const int snoop_version = 2;
589 
590 void
591 cap_open_write(const char *name)
592 {
593 	int vers;
594 
595 	capfile_out = open(name, O_CREAT | O_TRUNC | O_RDWR, 0666);
596 	if (capfile_out < 0)
597 		pr_err("%s: %m", name);
598 
599 	vers = htonl(snoop_version);
600 	if (nwrite(capfile_out, snoop_id, snoop_idlen) == -1)
601 		cap_write_error("snoop_id");
602 
603 	if (nwrite(capfile_out, &vers, sizeof (int)) == -1)
604 		cap_write_error("version");
605 }
606 
607 
608 void
609 cap_close(void)
610 {
611 	(void) close(capfile_out);
612 }
613 
614 static char *cap_buffp = NULL;
615 static int cap_len = 0;
616 static int cap_new;
617 
618 void
619 cap_open_read(const char *name)
620 {
621 	struct stat st;
622 	int cap_vers;
623 	int *word, device_mac_type;
624 	int capfile_in;
625 
626 	capfile_in = open(name, O_RDONLY);
627 	if (capfile_in < 0)
628 		pr_err("couldn't open %s: %m", name);
629 
630 	if (fstat(capfile_in, &st) < 0)
631 		pr_err("couldn't stat %s: %m", name);
632 	cap_len = st.st_size;
633 
634 	cap_buffp = mmap(0, cap_len, PROT_READ, MAP_PRIVATE, capfile_in, 0);
635 	(void) close(capfile_in);
636 	if ((int)cap_buffp == -1)
637 		pr_err("couldn't mmap %s: %m", name);
638 
639 	/* Check if new snoop capture file format */
640 
641 	cap_new = bcmp(cap_buffp, snoop_id, snoop_idlen) == 0;
642 
643 	/*
644 	 * If new file - check version and
645 	 * set buffer pointer to point at first packet
646 	 */
647 	if (cap_new) {
648 		cap_vers = ntohl(*(int *)(cap_buffp + snoop_idlen));
649 		cap_buffp += snoop_idlen + sizeof (int);
650 		cap_len   -= snoop_idlen + sizeof (int);
651 
652 		switch (cap_vers) {
653 		case 1:
654 			device_mac_type = DL_ETHER;
655 			break;
656 
657 		case 2:
658 			device_mac_type = ntohl(*((int *)cap_buffp));
659 			cap_buffp += sizeof (int);
660 			cap_len   -= sizeof (int);
661 			break;
662 
663 		default:
664 			pr_err("capture file: %s: Version %d unrecognized\n",
665 			    name, cap_vers);
666 		}
667 
668 		for (interface = &INTERFACES[0]; interface->mac_type != -1;
669 		    interface++)
670 			if (interface->mac_type == device_mac_type)
671 				break;
672 
673 		if (interface->mac_type == -1)
674 			pr_err("Mac Type = %x is not supported\n",
675 			    device_mac_type);
676 	} else {
677 		/* Use heuristic to check if it's an old-style file */
678 
679 		device_mac_type = DL_ETHER;
680 		word = (int *)cap_buffp;
681 
682 		if (!((word[0] < 1600 && word[1] < 1600) &&
683 		    (word[0] < word[1]) &&
684 		    (word[2] > 610000000 && word[2] < 770000000)))
685 			pr_err("not a capture file: %s", name);
686 
687 		/* Change protection so's we can fix the headers */
688 
689 		if (mprotect(cap_buffp, cap_len, PROT_READ | PROT_WRITE) < 0)
690 			pr_err("mprotect: %s: %m", name);
691 	}
692 	dlinfo.di_max_sdu = MAXINT;	/* Decode any stored packet. */
693 }
694 
695 void
696 cap_read(int first, int last, int filter, void (*proc)(), int flags)
697 {
698 	extern int count;
699 
700 	count = 0;
701 
702 	scan(cap_buffp, cap_len, filter, 1, !cap_new, proc, first, last, flags);
703 
704 	(void) munmap(cap_buffp, cap_len);
705 }
706 
707 /* ARGSUSED */
708 void
709 cap_write(struct sb_hdr *hdrp, char *pktp, int num, int flags)
710 {
711 	int pktlen, mac;
712 	static int first = 1;
713 	struct sb_hdr nhdr;
714 	extern boolean_t qflg;
715 
716 	if (hdrp == NULL)
717 		return;
718 
719 	if (first) {
720 		first = 0;
721 		mac = htonl(interface->mac_type);
722 		if (nwrite(capfile_out, &mac, sizeof (int)) == -1)
723 			cap_write_error("mac_type");
724 	}
725 
726 	pktlen = hdrp->sbh_totlen - sizeof (*hdrp);
727 
728 	/*
729 	 * Convert sb_hdr to network byte order
730 	 */
731 	nhdr.sbh_origlen = htonl(hdrp->sbh_origlen);
732 	nhdr.sbh_msglen = htonl(hdrp->sbh_msglen);
733 	nhdr.sbh_totlen = htonl(hdrp->sbh_totlen);
734 	nhdr.sbh_drops = htonl(hdrp->sbh_drops);
735 	nhdr.sbh_timestamp.tv_sec = htonl(hdrp->sbh_timestamp.tv_sec);
736 	nhdr.sbh_timestamp.tv_usec = htonl(hdrp->sbh_timestamp.tv_usec);
737 
738 	if (nwrite(capfile_out, &nhdr, sizeof (nhdr)) == -1)
739 		cap_write_error("packet header");
740 
741 	if (nwrite(capfile_out, pktp, pktlen) == -1)
742 		cap_write_error("packet");
743 
744 	if (! qflg)
745 		show_count();
746 }
747 
748 /*
749  * Convert a packet header from
750  * old to new format.
751  */
752 static void
753 convert_old(struct ohdr *ohdrp)
754 {
755 	struct sb_hdr nhdr;
756 
757 	nhdr.sbh_origlen = ohdrp->o_len;
758 	nhdr.sbh_msglen  = ohdrp->o_msglen;
759 	nhdr.sbh_totlen  = ohdrp->o_totlen;
760 	nhdr.sbh_drops   = ohdrp->o_drops;
761 	nhdr.sbh_timestamp = ohdrp->o_time;
762 
763 	*(struct sb_hdr *)ohdrp = nhdr;
764 }
765 
766 static int
767 strioctl(int fd, int cmd, int timout, int len, void *dp)
768 {
769 	struct	strioctl	sioc;
770 	int	rc;
771 
772 	sioc.ic_cmd = cmd;
773 	sioc.ic_timout = timout;
774 	sioc.ic_len = len;
775 	sioc.ic_dp = dp;
776 	rc = ioctl(fd, I_STR, &sioc);
777 
778 	if (rc < 0)
779 		return (rc);
780 	else
781 		return (sioc.ic_len);
782 }
783