1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2009 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 26 #include <stdio.h> 27 #include <string.h> 28 #include <errno.h> 29 #include <fcntl.h> 30 #include <setjmp.h> 31 #include <sys/types.h> 32 #include <sys/signal.h> 33 #include <sys/time.h> 34 #include <sys/socket.h> 35 #include <sys/sockio.h> 36 #include <net/if.h> 37 #include <netinet/in_systm.h> 38 #include <netinet/in.h> 39 #include <netinet/ip.h> 40 #include <sys/pfmod.h> 41 #include <netinet/if_ether.h> 42 #include <sys/mman.h> 43 #include <sys/stat.h> 44 #include <sys/stropts.h> 45 #include <sys/bufmod.h> 46 47 #include <unistd.h> 48 #include <stropts.h> 49 #include <stdlib.h> 50 #include <ctype.h> 51 #include <values.h> 52 #include <libdlpi.h> 53 #include <sys/dlpi.h> 54 55 #include "snoop.h" 56 57 /* 58 * Old header format. 59 * Actually two concatenated structs: nit_bufhdr + nit_head 60 */ 61 struct ohdr { 62 /* nit_bufhdr */ 63 int o_msglen; 64 int o_totlen; 65 /* nit_head */ 66 struct timeval o_time; 67 int o_drops; 68 int o_len; 69 }; 70 71 static void scan(char *, int, int, int, int, void (*)(), int, int, int); 72 void convert_to_network(); 73 void convert_from_network(); 74 static void convert_old(struct ohdr *); 75 extern sigjmp_buf jmp_env, ojmp_env; 76 static dlpi_info_t dlinfo; 77 static char *bufp; /* pointer to read buffer */ 78 79 static int strioctl(int, int, int, int, void *); 80 81 /* 82 * Open up the device in raw mode and passive mode 83 * (see dlpi_open(3DLPI)) and start finding out something about it, 84 * especially stuff about the data link headers. We need that information 85 * to build the proper packet filters. 86 */ 87 boolean_t 88 check_device(dlpi_handle_t *dhp, char **devicep) 89 { 90 int retval; 91 int flags = DLPI_PASSIVE | DLPI_RAW; 92 93 /* 94 * Determine which network device 95 * to use if none given. 96 * Should get back a value like "le0". 97 */ 98 if (*devicep == NULL) { 99 char *cbuf; 100 static struct ifconf ifc; 101 static struct ifreq *ifr; 102 int s; 103 int n; 104 int numifs; 105 unsigned bufsize; 106 107 if ((s = socket(AF_INET, SOCK_DGRAM, 0)) < 0) 108 pr_err("socket"); 109 110 if (ioctl(s, SIOCGIFNUM, (char *)&numifs) < 0) { 111 pr_err("check_device: ioctl SIOCGIFNUM"); 112 (void) close(s); 113 s = -1; 114 return (B_FALSE); 115 } 116 117 bufsize = numifs * sizeof (struct ifreq); 118 cbuf = (char *)malloc(bufsize); 119 if (cbuf == NULL) { 120 pr_err("out of memory\n"); 121 (void) close(s); 122 s = -1; 123 return (B_FALSE); 124 } 125 ifc.ifc_len = bufsize; 126 ifc.ifc_buf = cbuf; 127 if (ioctl(s, SIOCGIFCONF, (char *)&ifc) < 0) { 128 pr_err("check_device: ioctl SIOCGIFCONF"); 129 (void) close(s); 130 s = -1; 131 (void) free(cbuf); 132 return (B_FALSE); 133 } 134 n = ifc.ifc_len / sizeof (struct ifreq); 135 ifr = ifc.ifc_req; 136 for (; n > 0; n--, ifr++) { 137 if (strchr(ifr->ifr_name, ':') != NULL) 138 continue; 139 if (ioctl(s, SIOCGIFFLAGS, (char *)ifr) < 0) 140 pr_err("ioctl SIOCGIFFLAGS"); 141 if ((ifr->ifr_flags & 142 (IFF_VIRTUAL|IFF_IPMP|IFF_UP| 143 IFF_RUNNING)) == (IFF_UP|IFF_RUNNING)) 144 break; 145 } 146 147 if (n == 0) 148 pr_err("No network interface devices found"); 149 150 *devicep = ifr->ifr_name; 151 (void) close(s); 152 } 153 if (Iflg) 154 flags |= DLPI_DEVIPNET; 155 if (Iflg || strcmp(*devicep, "lo0") == 0) 156 flags |= DLPI_IPNETINFO; 157 if ((retval = dlpi_open(*devicep, dhp, flags)) != DLPI_SUCCESS) { 158 pr_err("cannot open \"%s\": %s", *devicep, 159 dlpi_strerror(retval)); 160 } 161 162 if ((retval = dlpi_info(*dhp, &dlinfo, 0)) != DLPI_SUCCESS) 163 pr_errdlpi(*dhp, "dlpi_info failed", retval); 164 165 for (interface = &INTERFACES[0]; interface->mac_type != -1; interface++) 166 if (interface->mac_type == dlinfo.di_mactype) 167 break; 168 169 /* allow limited functionality even if interface isn't known */ 170 if (interface->mac_type == -1) { 171 (void) fprintf(stderr, "snoop: WARNING: Mac Type = %x " 172 "not supported\n", dlinfo.di_mactype); 173 } 174 175 /* for backward compatibility, allow known interface mtu_sizes */ 176 if (interface->mtu_size > dlinfo.di_max_sdu) 177 dlinfo.di_max_sdu = interface->mtu_size; 178 179 return (interface->try_kernel_filter); 180 } 181 182 /* 183 * Do whatever is necessary to initialize the interface 184 * for packet capture. Bind the device opened in check_device(), set 185 * promiscuous mode, push the streams buffer module and packet filter 186 * module, set various buffer parameters. 187 */ 188 void 189 initdevice(dlpi_handle_t dh, ulong_t snaplen, ulong_t chunksize, 190 struct timeval *timeout, struct Pf_ext_packetfilt *fp) 191 { 192 int retv; 193 int netfd; 194 int val = 1; 195 196 retv = dlpi_bind(dh, DLPI_ANY_SAP, NULL); 197 if (retv != DLPI_SUCCESS) 198 pr_errdlpi(dh, "cannot bind on", retv); 199 200 if (Iflg) { 201 (void) fprintf(stderr, "Using device ipnet/%s ", 202 dlpi_linkname(dh)); 203 } else { 204 (void) fprintf(stderr, "Using device %s ", dlpi_linkname(dh)); 205 } 206 207 /* 208 * If Pflg not set - use physical level 209 * promiscuous mode. Otherwise - just SAP level. 210 */ 211 if (!Pflg) { 212 (void) fprintf(stderr, "(promiscuous mode)\n"); 213 retv = dlpi_promiscon(dh, DL_PROMISC_PHYS); 214 if (retv != DLPI_SUCCESS) { 215 pr_errdlpi(dh, "promiscuous mode(physical) failed", 216 retv); 217 } 218 } else { 219 (void) fprintf(stderr, "(non promiscuous)\n"); 220 retv = dlpi_promiscon(dh, DL_PROMISC_MULTI); 221 if (retv != DLPI_SUCCESS) { 222 pr_errdlpi(dh, "promiscuous mode(multicast) failed", 223 retv); 224 } 225 } 226 227 retv = dlpi_promiscon(dh, DL_PROMISC_SAP); 228 if (retv != DLPI_SUCCESS) 229 pr_errdlpi(dh, "promiscuous mode(SAP) failed", retv); 230 231 netfd = dlpi_fd(dh); 232 233 if (fp) { 234 /* 235 * push and configure the packet filtering module 236 */ 237 if (ioctl(netfd, I_PUSH, "pfmod") < 0) 238 pr_errdlpi(dh, "cannot push \"pfmod\"", DL_SYSERR); 239 240 if (strioctl(netfd, PFIOCSETF, -1, sizeof (*fp), 241 (char *)fp) < 0) 242 pr_errdlpi(dh, "PFIOCSETF", DL_SYSERR); 243 } 244 245 if (ioctl(netfd, I_PUSH, "bufmod") < 0) 246 pr_errdlpi(dh, "cannot push \"bufmod\"", DL_SYSERR); 247 248 if (strioctl(netfd, SBIOCSTIME, -1, sizeof (struct timeval), 249 (char *)timeout) < 0) 250 pr_errdlpi(dh, "SBIOCSTIME", DL_SYSERR); 251 252 if (strioctl(netfd, SBIOCSCHUNK, -1, sizeof (uint_t), 253 (char *)&chunksize) < 0) 254 pr_errdlpi(dh, "SBIOCGCHUNK", DL_SYSERR); 255 256 if (strioctl(netfd, SBIOCSSNAP, -1, sizeof (uint_t), 257 (char *)&snaplen) < 0) 258 pr_errdlpi(dh, "SBIOCSSNAP", DL_SYSERR); 259 260 /* 261 * Flush the read queue, to get rid of anything that 262 * accumulated before the device reached its final configuration. 263 */ 264 if (ioctl(netfd, I_FLUSH, FLUSHR) < 0) 265 pr_errdlpi(dh, "cannot flush \"I_FLUSH\"", DL_SYSERR); 266 } 267 268 /* 269 * Read packets from the network. Initdevice is called in 270 * here to set up the network interface for reading of 271 * raw ethernet packets in promiscuous mode into a buffer. 272 * Packets are read and either written directly to a file 273 * or interpreted for display on the fly. 274 */ 275 void 276 net_read(dlpi_handle_t dh, size_t chunksize, int filter, void (*proc)(), 277 int flags) 278 { 279 int retval; 280 extern int count; 281 size_t msglen; 282 283 count = 0; 284 285 /* allocate a read buffer */ 286 bufp = malloc(chunksize); 287 if (bufp == NULL) 288 pr_err("no memory for %d buffer", chunksize); 289 290 /* 291 * read frames 292 */ 293 for (;;) { 294 msglen = chunksize; 295 retval = dlpi_recv(dh, NULL, NULL, bufp, &msglen, -1, NULL); 296 297 if (retval != DLPI_SUCCESS || quitting) 298 break; 299 300 if (msglen != 0) 301 scan(bufp, msglen, filter, 0, 0, proc, 0, 0, flags); 302 } 303 304 free(bufp); 305 306 if (!quitting) 307 pr_errdlpi(dh, "network read failed", retval); 308 } 309 310 #ifdef DEBUG 311 /* 312 * corrupt: simulate packet corruption for debugging interpreters 313 */ 314 void 315 corrupt(volatile char *pktp, volatile char *pstop, char *buf, 316 volatile char *bufstop) 317 { 318 int c; 319 int i; 320 int p; 321 int li = rand() % (pstop - pktp - 1) + 1; 322 volatile char *pp = pktp; 323 volatile char *pe = bufstop < pstop ? bufstop : pstop; 324 325 if (pktp < buf || pktp > bufstop) 326 return; 327 328 for (pp = pktp; pp < pe; pp += li) { 329 c = ((pe - pp) < li ? pe - pp : li); 330 i = (rand() % c)>>1; 331 while (--i > 0) { 332 p = (rand() % c); 333 pp[p] = (unsigned char)(rand() & 0xFF); 334 } 335 } 336 } 337 #endif /* DEBUG */ 338 339 static void 340 scan(char *buf, int len, int filter, int cap, int old, void (*proc)(), 341 int first, int last, int flags) 342 { 343 volatile char *bp, *bufstop; 344 volatile struct sb_hdr *hdrp; 345 volatile struct sb_hdr nhdr, *nhdrp; 346 volatile char *pktp; 347 volatile struct timeval last_timestamp; 348 volatile int header_okay; 349 extern int count, maxcount; 350 extern int snoop_nrecover; 351 #ifdef DEBUG 352 extern int zflg; 353 #endif /* DEBUG */ 354 355 proc(0, 0, 0); 356 bufstop = buf + len; 357 358 /* 359 * 360 * Loop through each packet in the buffer 361 */ 362 last_timestamp.tv_sec = 0; 363 (void) memcpy((char *)ojmp_env, (char *)jmp_env, sizeof (jmp_env)); 364 for (bp = buf; bp < bufstop; bp += nhdrp->sbh_totlen) { 365 /* 366 * Gracefully exit if user terminates 367 */ 368 if (quitting) 369 break; 370 /* 371 * Global error recocery: Prepare to continue when a corrupt 372 * packet or header is encountered. 373 */ 374 if (sigsetjmp(jmp_env, 1)) { 375 goto err; 376 } 377 378 header_okay = 0; 379 hdrp = (struct sb_hdr *)bp; 380 nhdrp = hdrp; 381 pktp = (char *)hdrp + sizeof (*hdrp); 382 383 /* 384 * If reading a capture file 385 * convert the headers from network 386 * byte order (for little-endians like X86) 387 */ 388 if (cap) { 389 /* 390 * If the packets come from an old 391 * capture file, convert the header. 392 */ 393 if (old) { 394 convert_old((struct ohdr *)hdrp); 395 } 396 397 nhdrp = &nhdr; 398 399 nhdrp->sbh_origlen = ntohl(hdrp->sbh_origlen); 400 nhdrp->sbh_msglen = ntohl(hdrp->sbh_msglen); 401 nhdrp->sbh_totlen = ntohl(hdrp->sbh_totlen); 402 nhdrp->sbh_drops = ntohl(hdrp->sbh_drops); 403 nhdrp->sbh_timestamp.tv_sec = 404 ntohl(hdrp->sbh_timestamp.tv_sec); 405 nhdrp->sbh_timestamp.tv_usec = 406 ntohl(hdrp->sbh_timestamp.tv_usec); 407 } 408 409 /* Enhanced check for valid header */ 410 411 if ((nhdrp->sbh_totlen == 0) || 412 (bp + nhdrp->sbh_totlen) < bp || 413 (bp + nhdrp->sbh_totlen) > bufstop || 414 (nhdrp->sbh_origlen == 0) || 415 (bp + nhdrp->sbh_origlen) < bp || 416 (nhdrp->sbh_msglen == 0) || 417 (bp + nhdrp->sbh_msglen) < bp || 418 (bp + nhdrp->sbh_msglen) > bufstop || 419 (nhdrp->sbh_msglen > nhdrp->sbh_origlen) || 420 (nhdrp->sbh_totlen < nhdrp->sbh_msglen) || 421 (nhdrp->sbh_timestamp.tv_sec == 0)) { 422 if (cap) { 423 (void) fprintf(stderr, "(warning) bad packet " 424 "header in capture file"); 425 } else { 426 (void) fprintf(stderr, "(warning) bad packet " 427 "header in buffer"); 428 } 429 (void) fprintf(stderr, " offset %d: length=%d\n", 430 bp - buf, nhdrp->sbh_totlen); 431 goto err; 432 } 433 434 if (nhdrp->sbh_totlen > 435 (dlinfo.di_max_sdu + MAX_HDRTRAILER)) { 436 if (cap) 437 (void) fprintf(stderr, "(warning) packet length" 438 " greater than MTU in capture file"); 439 else 440 (void) fprintf(stderr, "(warning) packet length" 441 " greater than MTU in buffer"); 442 443 (void) fprintf(stderr, " offset %d: length=%d\n", 444 bp - buf, nhdrp->sbh_totlen); 445 } 446 447 /* 448 * Check for incomplete packet. We are conservative here, 449 * since we don't know how good the checking is in other 450 * parts of the code. We pass a partial packet, with 451 * a warning. 452 */ 453 if (pktp + nhdrp->sbh_msglen > bufstop) { 454 (void) fprintf(stderr, "truncated packet buffer\n"); 455 nhdrp->sbh_msglen = bufstop - pktp; 456 } 457 458 #ifdef DEBUG 459 if (zflg) 460 corrupt(pktp, pktp + nhdrp->sbh_msglen, buf, bufstop); 461 #endif /* DEBUG */ 462 463 header_okay = 1; 464 if (!filter || 465 want_packet(pktp, 466 nhdrp->sbh_msglen, 467 nhdrp->sbh_origlen)) { 468 count++; 469 470 /* 471 * Start deadman timer for interpreter processing 472 */ 473 (void) snoop_alarm(SNOOP_ALARM_GRAN*SNOOP_MAXRECOVER, 474 NULL); 475 476 encap_levels = 0; 477 if (!cap || count >= first) 478 proc(nhdrp, pktp, count, flags); 479 480 if (cap && count >= last) { 481 (void) snoop_alarm(0, NULL); 482 break; 483 } 484 485 if (maxcount && count >= maxcount) { 486 (void) fprintf(stderr, "%d packets captured\n", 487 count); 488 exit(0); 489 } 490 491 snoop_nrecover = 0; /* success */ 492 (void) snoop_alarm(0, NULL); 493 last_timestamp = hdrp->sbh_timestamp; /* save stamp */ 494 } 495 continue; 496 err: 497 /* 498 * Corruption has been detected. Reset errors. 499 */ 500 snoop_recover(); 501 502 /* 503 * packet header was apparently okay. Continue. 504 */ 505 if (header_okay) 506 continue; 507 508 /* 509 * Otherwise try to scan forward to the next packet, using 510 * the last known timestamp if it is available. 511 */ 512 nhdrp = &nhdr; 513 nhdrp->sbh_totlen = 0; 514 if (last_timestamp.tv_sec == 0) { 515 bp += sizeof (int); 516 } else { 517 for (bp += sizeof (int); bp <= bufstop; 518 bp += sizeof (int)) { 519 hdrp = (struct sb_hdr *)bp; 520 /* An approximate timestamp located */ 521 if ((hdrp->sbh_timestamp.tv_sec >> 8) == 522 (last_timestamp.tv_sec >> 8)) 523 break; 524 } 525 } 526 } 527 /* reset jmp_env for program exit */ 528 (void) memcpy((char *)jmp_env, (char *)ojmp_env, sizeof (jmp_env)); 529 proc(0, -1, 0); 530 } 531 532 /* 533 * Called if nwrite() encounters write problems. 534 */ 535 static void 536 cap_write_error(const char *msgtype) 537 { 538 (void) fprintf(stderr, 539 "snoop: cannot write %s to capture file: %s\n", 540 msgtype, strerror(errno)); 541 exit(1); 542 } 543 544 /* 545 * Writes target buffer to the open file descriptor. Upon detection of a short 546 * write, an attempt to process the remaining bytes occurs until all anticipated 547 * bytes are written. An error status is returned to indicate any serious write 548 * failures. 549 */ 550 static int 551 nwrite(int fd, const void *buffer, size_t buflen) 552 { 553 size_t nwritten; 554 ssize_t nbytes = 0; 555 const char *buf = buffer; 556 557 for (nwritten = 0; nwritten < buflen; nwritten += nbytes) { 558 nbytes = write(fd, &buf[nwritten], buflen - nwritten); 559 if (nbytes == -1) 560 return (-1); 561 if (nbytes == 0) { 562 errno = EIO; 563 return (-1); 564 } 565 } 566 return (0); 567 } 568 569 /* 570 * Routines for opening, closing, reading and writing 571 * a capture file of packets saved with the -o option. 572 */ 573 static int capfile_out; 574 575 /* 576 * The snoop capture file has a header to identify 577 * it as a capture file and record its version. 578 * A file without this header is assumed to be an 579 * old format snoop file. 580 * 581 * A version 1 header looks like this: 582 * 583 * 0 1 2 3 4 5 6 7 8 9 10 11 584 * +---+---+---+---+---+---+---+---+---+---+---+---+---+ 585 * | s | n | o | o | p | \0| \0| \0| version | data 586 * +---+---+---+---+---+---+---+---+---+---+---+---+---+ 587 * | word 0 | word 1 | word 2 | 588 * 589 * 590 * A version 2 header adds a word that identifies the MAC type. 591 * This allows for capture files from FDDI etc. 592 * 593 * 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 594 * +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+ 595 * | s | n | o | o | p | \0| \0| \0| version | MAC type | data 596 * +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+ 597 * | word 0 | word 1 | word 2 | word 3 598 * 599 */ 600 static const char *snoop_id = "snoop\0\0\0"; 601 static const int snoop_idlen = 8; 602 static const int snoop_version = 2; 603 604 void 605 cap_open_write(const char *name) 606 { 607 int vers; 608 609 capfile_out = open(name, O_CREAT | O_TRUNC | O_RDWR, 0666); 610 if (capfile_out < 0) 611 pr_err("%s: %m", name); 612 613 vers = htonl(snoop_version); 614 if (nwrite(capfile_out, snoop_id, snoop_idlen) == -1) 615 cap_write_error("snoop_id"); 616 617 if (nwrite(capfile_out, &vers, sizeof (int)) == -1) 618 cap_write_error("version"); 619 } 620 621 622 void 623 cap_close(void) 624 { 625 (void) close(capfile_out); 626 } 627 628 static char *cap_buffp = NULL; 629 static int cap_len = 0; 630 static int cap_new; 631 632 void 633 cap_open_read(const char *name) 634 { 635 struct stat st; 636 int cap_vers; 637 int *word, device_mac_type; 638 int capfile_in; 639 640 capfile_in = open(name, O_RDONLY); 641 if (capfile_in < 0) 642 pr_err("couldn't open %s: %m", name); 643 644 if (fstat(capfile_in, &st) < 0) 645 pr_err("couldn't stat %s: %m", name); 646 cap_len = st.st_size; 647 648 cap_buffp = mmap(0, cap_len, PROT_READ, MAP_PRIVATE, capfile_in, 0); 649 (void) close(capfile_in); 650 if ((int)cap_buffp == -1) 651 pr_err("couldn't mmap %s: %m", name); 652 653 /* Check if new snoop capture file format */ 654 655 cap_new = bcmp(cap_buffp, snoop_id, snoop_idlen) == 0; 656 657 /* 658 * If new file - check version and 659 * set buffer pointer to point at first packet 660 */ 661 if (cap_new) { 662 cap_vers = ntohl(*(int *)(cap_buffp + snoop_idlen)); 663 cap_buffp += snoop_idlen + sizeof (int); 664 cap_len -= snoop_idlen + sizeof (int); 665 666 switch (cap_vers) { 667 case 1: 668 device_mac_type = DL_ETHER; 669 break; 670 671 case 2: 672 device_mac_type = ntohl(*((int *)cap_buffp)); 673 cap_buffp += sizeof (int); 674 cap_len -= sizeof (int); 675 break; 676 677 default: 678 pr_err("capture file: %s: Version %d unrecognized\n", 679 name, cap_vers); 680 } 681 682 for (interface = &INTERFACES[0]; interface->mac_type != -1; 683 interface++) 684 if (interface->mac_type == device_mac_type) 685 break; 686 687 if (interface->mac_type == -1) 688 pr_err("Mac Type = %x is not supported\n", 689 device_mac_type); 690 } else { 691 /* Use heuristic to check if it's an old-style file */ 692 693 device_mac_type = DL_ETHER; 694 word = (int *)cap_buffp; 695 696 if (!((word[0] < 1600 && word[1] < 1600) && 697 (word[0] < word[1]) && 698 (word[2] > 610000000 && word[2] < 770000000))) 699 pr_err("not a capture file: %s", name); 700 701 /* Change protection so's we can fix the headers */ 702 703 if (mprotect(cap_buffp, cap_len, PROT_READ | PROT_WRITE) < 0) 704 pr_err("mprotect: %s: %m", name); 705 } 706 dlinfo.di_max_sdu = MAXINT; /* Decode any stored packet. */ 707 } 708 709 void 710 cap_read(int first, int last, int filter, void (*proc)(), int flags) 711 { 712 extern int count; 713 714 count = 0; 715 716 scan(cap_buffp, cap_len, filter, 1, !cap_new, proc, first, last, flags); 717 718 (void) munmap(cap_buffp, cap_len); 719 } 720 721 /* ARGSUSED */ 722 void 723 cap_write(struct sb_hdr *hdrp, char *pktp, int num, int flags) 724 { 725 int pktlen, mac; 726 static int first = 1; 727 struct sb_hdr nhdr; 728 extern boolean_t qflg; 729 730 if (hdrp == NULL) 731 return; 732 733 if (first) { 734 first = 0; 735 mac = htonl(interface->mac_type); 736 if (nwrite(capfile_out, &mac, sizeof (int)) == -1) 737 cap_write_error("mac_type"); 738 } 739 740 pktlen = hdrp->sbh_totlen - sizeof (*hdrp); 741 742 /* 743 * Convert sb_hdr to network byte order 744 */ 745 nhdr.sbh_origlen = htonl(hdrp->sbh_origlen); 746 nhdr.sbh_msglen = htonl(hdrp->sbh_msglen); 747 nhdr.sbh_totlen = htonl(hdrp->sbh_totlen); 748 nhdr.sbh_drops = htonl(hdrp->sbh_drops); 749 nhdr.sbh_timestamp.tv_sec = htonl(hdrp->sbh_timestamp.tv_sec); 750 nhdr.sbh_timestamp.tv_usec = htonl(hdrp->sbh_timestamp.tv_usec); 751 752 if (nwrite(capfile_out, &nhdr, sizeof (nhdr)) == -1) 753 cap_write_error("packet header"); 754 755 if (nwrite(capfile_out, pktp, pktlen) == -1) 756 cap_write_error("packet"); 757 758 if (! qflg) 759 show_count(); 760 } 761 762 /* 763 * Convert a packet header from 764 * old to new format. 765 */ 766 static void 767 convert_old(struct ohdr *ohdrp) 768 { 769 struct sb_hdr nhdr; 770 771 nhdr.sbh_origlen = ohdrp->o_len; 772 nhdr.sbh_msglen = ohdrp->o_msglen; 773 nhdr.sbh_totlen = ohdrp->o_totlen; 774 nhdr.sbh_drops = ohdrp->o_drops; 775 nhdr.sbh_timestamp = ohdrp->o_time; 776 777 *(struct sb_hdr *)ohdrp = nhdr; 778 } 779 780 static int 781 strioctl(int fd, int cmd, int timout, int len, void *dp) 782 { 783 struct strioctl sioc; 784 int rc; 785 786 sioc.ic_cmd = cmd; 787 sioc.ic_timout = timout; 788 sioc.ic_len = len; 789 sioc.ic_dp = dp; 790 rc = ioctl(fd, I_STR, &sioc); 791 792 if (rc < 0) 793 return (rc); 794 else 795 return (sioc.ic_len); 796 } 797