1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2009 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 * Copyright 2012 Milan Jurik. All rights reserved. 25 */ 26 27 #include <stdio.h> 28 #include <string.h> 29 #include <strings.h> 30 #include <errno.h> 31 #include <fcntl.h> 32 #include <setjmp.h> 33 #include <sys/types.h> 34 #include <sys/signal.h> 35 #include <sys/time.h> 36 #include <sys/socket.h> 37 #include <sys/sockio.h> 38 #include <netinet/in.h> 39 #include <netinet/ip.h> 40 #include <sys/pfmod.h> 41 #include <sys/mman.h> 42 #include <sys/stat.h> 43 #include <sys/bufmod.h> 44 45 #include <unistd.h> 46 #include <stropts.h> 47 #include <stdlib.h> 48 #include <ctype.h> 49 #include <values.h> 50 #include <libdlpi.h> 51 52 #include "snoop.h" 53 54 /* 55 * Old header format. 56 * Actually two concatenated structs: nit_bufhdr + nit_head 57 */ 58 struct ohdr { 59 /* nit_bufhdr */ 60 int o_msglen; 61 int o_totlen; 62 /* nit_head */ 63 struct timeval o_time; 64 int o_drops; 65 int o_len; 66 }; 67 68 static void scan(char *, int, int, int, int, void (*)(), int, int, int); 69 void convert_to_network(); 70 void convert_from_network(); 71 static void convert_old(struct ohdr *); 72 extern sigjmp_buf jmp_env, ojmp_env; 73 static char *bufp; /* pointer to read buffer */ 74 75 static int strioctl(int, int, int, int, void *); 76 77 enum { DWA_NONE, DWA_EXISTS, DWA_PLUMBED }; 78 79 typedef struct dlpi_walk_arg { 80 char dwa_linkname[MAXLINKNAMELEN]; 81 int dwa_type; /* preference type above */ 82 int dwa_s4; /* IPv4 socket */ 83 int dwa_s6; /* IPv6 socket */ 84 } dlpi_walk_arg_t; 85 86 static boolean_t 87 select_datalink(const char *linkname, void *arg) 88 { 89 struct lifreq lifr; 90 dlpi_walk_arg_t *dwap = arg; 91 int s4 = dwap->dwa_s4; 92 int s6 = dwap->dwa_s6; 93 94 (void) strlcpy(dwap->dwa_linkname, linkname, MAXLINKNAMELEN); 95 dwap->dwa_type = DWA_EXISTS; 96 97 /* 98 * See if it's plumbed by IP. We prefer such links because they're 99 * more likely to have interesting traffic. 100 */ 101 bzero(&lifr, sizeof (lifr)); 102 (void) strlcpy(lifr.lifr_name, linkname, LIFNAMSIZ); 103 if ((s4 != -1 && ioctl(s4, SIOCGLIFFLAGS, &lifr) != -1) || 104 (s6 != -1 && ioctl(s6, SIOCGLIFFLAGS, &lifr) != -1)) { 105 dwap->dwa_type = DWA_PLUMBED; 106 return (B_TRUE); 107 } 108 return (B_FALSE); 109 } 110 111 /* 112 * Open `linkname' in raw/passive mode (see dlpi_open(3DLPI)). If `linkname' 113 * is NULL, pick a datalink as per snoop(1M). Also gather some information 114 * about the datalink useful for building the proper packet filters. 115 */ 116 boolean_t 117 open_datalink(dlpi_handle_t *dhp, const char *linkname) 118 { 119 int retval; 120 int flags = DLPI_PASSIVE | DLPI_RAW; 121 dlpi_walk_arg_t dwa; 122 dlpi_info_t dlinfo; 123 124 if (linkname == NULL) { 125 /* 126 * Select a datalink to use by default. Prefer datalinks that 127 * are plumbed by IP. 128 */ 129 bzero(&dwa, sizeof (dwa)); 130 dwa.dwa_s4 = socket(AF_INET, SOCK_DGRAM, 0); 131 dwa.dwa_s6 = socket(AF_INET6, SOCK_DGRAM, 0); 132 dlpi_walk(select_datalink, &dwa, 0); 133 (void) close(dwa.dwa_s4); 134 (void) close(dwa.dwa_s6); 135 136 if (dwa.dwa_type == DWA_NONE) 137 pr_err("no datalinks found"); 138 if (dwa.dwa_type == DWA_EXISTS) { 139 (void) fprintf(stderr, "snoop: WARNING: " 140 "no datalinks plumbed for IP traffic\n"); 141 } 142 linkname = dwa.dwa_linkname; 143 } 144 if (Iflg) 145 flags |= DLPI_DEVIPNET; 146 if (Iflg || strcmp(linkname, "lo0") == 0) 147 flags |= DLPI_IPNETINFO; 148 if ((retval = dlpi_open(linkname, dhp, flags)) != DLPI_SUCCESS) { 149 pr_err("cannot open \"%s\": %s", linkname, 150 dlpi_strerror(retval)); 151 } 152 153 if ((retval = dlpi_info(*dhp, &dlinfo, 0)) != DLPI_SUCCESS) 154 pr_errdlpi(*dhp, "dlpi_info failed", retval); 155 156 for (interface = &INTERFACES[0]; interface->mac_type != -1; interface++) 157 if (interface->mac_type == dlinfo.di_mactype) 158 break; 159 160 /* allow limited functionality even if interface isn't known */ 161 if (interface->mac_type == -1) { 162 (void) fprintf(stderr, "snoop: WARNING: Mac Type = %x " 163 "not supported\n", dlinfo.di_mactype); 164 } 165 166 return (interface->try_kernel_filter); 167 } 168 169 /* 170 * Initialize `dh' for packet capture using the provided arguments. 171 */ 172 void 173 init_datalink(dlpi_handle_t dh, ulong_t snaplen, ulong_t chunksize, 174 struct timeval *timeout, struct Pf_ext_packetfilt *fp) 175 { 176 int retv; 177 int netfd; 178 179 retv = dlpi_bind(dh, DLPI_ANY_SAP, NULL); 180 if (retv != DLPI_SUCCESS) 181 pr_errdlpi(dh, "cannot bind on", retv); 182 183 if (Iflg) { 184 (void) fprintf(stderr, "Using device ipnet/%s ", 185 dlpi_linkname(dh)); 186 } else { 187 (void) fprintf(stderr, "Using device %s ", dlpi_linkname(dh)); 188 } 189 190 /* 191 * If Pflg not set - use physical level 192 * promiscuous mode. Otherwise - just SAP level. 193 */ 194 if (!Pflg) { 195 (void) fprintf(stderr, "(promiscuous mode)\n"); 196 retv = dlpi_promiscon(dh, DL_PROMISC_PHYS); 197 if (retv != DLPI_SUCCESS) { 198 pr_errdlpi(dh, "promiscuous mode(physical) failed", 199 retv); 200 } 201 } else { 202 (void) fprintf(stderr, "(non promiscuous)\n"); 203 retv = dlpi_promiscon(dh, DL_PROMISC_MULTI); 204 if (retv != DLPI_SUCCESS) { 205 pr_errdlpi(dh, "promiscuous mode(multicast) failed", 206 retv); 207 } 208 } 209 210 retv = dlpi_promiscon(dh, DL_PROMISC_SAP); 211 if (retv != DLPI_SUCCESS) 212 pr_errdlpi(dh, "promiscuous mode(SAP) failed", retv); 213 214 netfd = dlpi_fd(dh); 215 216 if (fp) { 217 /* 218 * push and configure the packet filtering module 219 */ 220 if (ioctl(netfd, I_PUSH, "pfmod") < 0) 221 pr_errdlpi(dh, "cannot push \"pfmod\"", DL_SYSERR); 222 223 if (strioctl(netfd, PFIOCSETF, -1, sizeof (*fp), 224 (char *)fp) < 0) 225 pr_errdlpi(dh, "PFIOCSETF", DL_SYSERR); 226 } 227 228 if (ioctl(netfd, I_PUSH, "bufmod") < 0) 229 pr_errdlpi(dh, "cannot push \"bufmod\"", DL_SYSERR); 230 231 if (strioctl(netfd, SBIOCSTIME, -1, sizeof (struct timeval), 232 (char *)timeout) < 0) 233 pr_errdlpi(dh, "SBIOCSTIME", DL_SYSERR); 234 235 if (strioctl(netfd, SBIOCSCHUNK, -1, sizeof (uint_t), 236 (char *)&chunksize) < 0) 237 pr_errdlpi(dh, "SBIOCGCHUNK", DL_SYSERR); 238 239 if (strioctl(netfd, SBIOCSSNAP, -1, sizeof (uint_t), 240 (char *)&snaplen) < 0) 241 pr_errdlpi(dh, "SBIOCSSNAP", DL_SYSERR); 242 243 /* 244 * Flush the read queue, to get rid of anything that 245 * accumulated before the device reached its final configuration. 246 */ 247 if (ioctl(netfd, I_FLUSH, FLUSHR) < 0) 248 pr_errdlpi(dh, "cannot flush \"I_FLUSH\"", DL_SYSERR); 249 } 250 251 /* 252 * Read packets from the network. init_datalink() is called in 253 * here to set up the network interface for reading of 254 * raw ethernet packets in promiscuous mode into a buffer. 255 * Packets are read and either written directly to a file 256 * or interpreted for display on the fly. 257 */ 258 void 259 net_read(dlpi_handle_t dh, size_t chunksize, int filter, void (*proc)(), 260 int flags) 261 { 262 int retval; 263 extern int count; 264 size_t msglen; 265 266 count = 0; 267 268 /* allocate a read buffer */ 269 bufp = malloc(chunksize); 270 if (bufp == NULL) 271 pr_err("no memory for %d buffer", chunksize); 272 273 /* 274 * read frames 275 */ 276 for (;;) { 277 msglen = chunksize; 278 retval = dlpi_recv(dh, NULL, NULL, bufp, &msglen, -1, NULL); 279 280 if (retval != DLPI_SUCCESS || quitting) 281 break; 282 283 if (msglen != 0) 284 scan(bufp, msglen, filter, 0, 0, proc, 0, 0, flags); 285 } 286 287 free(bufp); 288 289 if (!quitting) 290 pr_errdlpi(dh, "network read failed", retval); 291 } 292 293 #ifdef DEBUG 294 /* 295 * corrupt: simulate packet corruption for debugging interpreters 296 */ 297 void 298 corrupt(volatile char *pktp, volatile char *pstop, char *buf, 299 volatile char *bufstop) 300 { 301 int c; 302 int i; 303 int p; 304 int li = rand() % (pstop - pktp - 1) + 1; 305 volatile char *pp = pktp; 306 volatile char *pe = bufstop < pstop ? bufstop : pstop; 307 308 if (pktp < buf || pktp > bufstop) 309 return; 310 311 for (pp = pktp; pp < pe; pp += li) { 312 c = ((pe - pp) < li ? pe - pp : li); 313 i = (rand() % c)>>1; 314 while (--i > 0) { 315 p = (rand() % c); 316 pp[p] = (unsigned char)(rand() & 0xFF); 317 } 318 } 319 } 320 #endif /* DEBUG */ 321 322 static void 323 scan(char *buf, int len, int filter, int cap, int old, void (*proc)(), 324 int first, int last, int flags) 325 { 326 volatile char *bp, *bufstop; 327 volatile struct sb_hdr *hdrp; 328 volatile struct sb_hdr nhdr, *nhdrp; 329 volatile char *pktp; 330 volatile struct timeval last_timestamp; 331 volatile int header_okay; 332 extern int count, maxcount; 333 extern int snoop_nrecover; 334 #ifdef DEBUG 335 extern int zflg; 336 #endif /* DEBUG */ 337 338 proc(0, 0, 0); 339 bufstop = buf + len; 340 341 /* 342 * 343 * Loop through each packet in the buffer 344 */ 345 last_timestamp.tv_sec = 0; 346 (void) memcpy((char *)ojmp_env, (char *)jmp_env, sizeof (jmp_env)); 347 for (bp = buf; bp < bufstop; bp += nhdrp->sbh_totlen) { 348 /* 349 * Gracefully exit if user terminates 350 */ 351 if (quitting) 352 break; 353 /* 354 * Global error recocery: Prepare to continue when a corrupt 355 * packet or header is encountered. 356 */ 357 if (sigsetjmp(jmp_env, 1)) { 358 goto err; 359 } 360 361 header_okay = 0; 362 hdrp = (struct sb_hdr *)bp; 363 nhdrp = hdrp; 364 pktp = (char *)hdrp + sizeof (*hdrp); 365 366 /* 367 * If reading a capture file 368 * convert the headers from network 369 * byte order (for little-endians like X86) 370 */ 371 if (cap) { 372 /* 373 * If the packets come from an old 374 * capture file, convert the header. 375 */ 376 if (old) { 377 convert_old((struct ohdr *)hdrp); 378 } 379 380 nhdrp = &nhdr; 381 382 nhdrp->sbh_origlen = ntohl(hdrp->sbh_origlen); 383 nhdrp->sbh_msglen = ntohl(hdrp->sbh_msglen); 384 nhdrp->sbh_totlen = ntohl(hdrp->sbh_totlen); 385 nhdrp->sbh_drops = ntohl(hdrp->sbh_drops); 386 nhdrp->sbh_timestamp.tv_sec = 387 ntohl(hdrp->sbh_timestamp.tv_sec); 388 nhdrp->sbh_timestamp.tv_usec = 389 ntohl(hdrp->sbh_timestamp.tv_usec); 390 } 391 392 /* Enhanced check for valid header */ 393 394 if ((nhdrp->sbh_totlen == 0) || 395 (bp + nhdrp->sbh_totlen) < bp || 396 (bp + nhdrp->sbh_totlen) > bufstop || 397 (nhdrp->sbh_origlen == 0) || 398 (bp + nhdrp->sbh_origlen) < bp || 399 (nhdrp->sbh_msglen == 0) || 400 (bp + nhdrp->sbh_msglen) < bp || 401 (bp + nhdrp->sbh_msglen) > bufstop || 402 (nhdrp->sbh_msglen > nhdrp->sbh_origlen) || 403 (nhdrp->sbh_totlen < nhdrp->sbh_msglen) || 404 (nhdrp->sbh_timestamp.tv_sec == 0)) { 405 if (cap) { 406 (void) fprintf(stderr, "(warning) bad packet " 407 "header in capture file"); 408 } else { 409 (void) fprintf(stderr, "(warning) bad packet " 410 "header in buffer"); 411 } 412 (void) fprintf(stderr, " offset %d: length=%d\n", 413 bp - buf, nhdrp->sbh_totlen); 414 goto err; 415 } 416 417 /* 418 * Check for incomplete packet. We are conservative here, 419 * since we don't know how good the checking is in other 420 * parts of the code. We pass a partial packet, with 421 * a warning. 422 */ 423 if (pktp + nhdrp->sbh_msglen > bufstop) { 424 (void) fprintf(stderr, "truncated packet buffer\n"); 425 nhdrp->sbh_msglen = bufstop - pktp; 426 } 427 428 #ifdef DEBUG 429 if (zflg) 430 corrupt(pktp, pktp + nhdrp->sbh_msglen, buf, bufstop); 431 #endif /* DEBUG */ 432 433 header_okay = 1; 434 if (!filter || 435 want_packet((uchar_t *)pktp, 436 nhdrp->sbh_msglen, 437 nhdrp->sbh_origlen)) { 438 count++; 439 440 /* 441 * Start deadman timer for interpreter processing 442 */ 443 (void) snoop_alarm(SNOOP_ALARM_GRAN*SNOOP_MAXRECOVER, 444 NULL); 445 446 encap_levels = 0; 447 if (!cap || count >= first) 448 proc(nhdrp, pktp, count, flags); 449 450 if (cap && count >= last) { 451 (void) snoop_alarm(0, NULL); 452 break; 453 } 454 455 if (maxcount && count >= maxcount) { 456 (void) fprintf(stderr, "%d packets captured\n", 457 count); 458 exit(0); 459 } 460 461 snoop_nrecover = 0; /* success */ 462 (void) snoop_alarm(0, NULL); 463 last_timestamp = hdrp->sbh_timestamp; /* save stamp */ 464 } 465 continue; 466 err: 467 /* 468 * Corruption has been detected. Reset errors. 469 */ 470 snoop_recover(); 471 472 /* 473 * packet header was apparently okay. Continue. 474 */ 475 if (header_okay) 476 continue; 477 478 /* 479 * Otherwise try to scan forward to the next packet, using 480 * the last known timestamp if it is available. 481 */ 482 nhdrp = &nhdr; 483 nhdrp->sbh_totlen = 0; 484 if (last_timestamp.tv_sec == 0) { 485 bp += sizeof (int); 486 } else { 487 for (bp += sizeof (int); bp <= bufstop; 488 bp += sizeof (int)) { 489 hdrp = (struct sb_hdr *)bp; 490 /* An approximate timestamp located */ 491 if ((hdrp->sbh_timestamp.tv_sec >> 8) == 492 (last_timestamp.tv_sec >> 8)) 493 break; 494 } 495 } 496 } 497 /* reset jmp_env for program exit */ 498 (void) memcpy((char *)jmp_env, (char *)ojmp_env, sizeof (jmp_env)); 499 proc(0, -1, 0); 500 } 501 502 /* 503 * Called if nwrite() encounters write problems. 504 */ 505 static void 506 cap_write_error(const char *msgtype) 507 { 508 (void) fprintf(stderr, 509 "snoop: cannot write %s to capture file: %s\n", 510 msgtype, strerror(errno)); 511 exit(1); 512 } 513 514 /* 515 * Writes target buffer to the open file descriptor. Upon detection of a short 516 * write, an attempt to process the remaining bytes occurs until all anticipated 517 * bytes are written. An error status is returned to indicate any serious write 518 * failures. 519 */ 520 static int 521 nwrite(int fd, const void *buffer, size_t buflen) 522 { 523 size_t nwritten; 524 ssize_t nbytes = 0; 525 const char *buf = buffer; 526 527 for (nwritten = 0; nwritten < buflen; nwritten += nbytes) { 528 nbytes = write(fd, &buf[nwritten], buflen - nwritten); 529 if (nbytes == -1) 530 return (-1); 531 if (nbytes == 0) { 532 errno = EIO; 533 return (-1); 534 } 535 } 536 return (0); 537 } 538 539 /* 540 * Routines for opening, closing, reading and writing 541 * a capture file of packets saved with the -o option. 542 */ 543 static int capfile_out; 544 545 /* 546 * The snoop capture file has a header to identify 547 * it as a capture file and record its version. 548 * A file without this header is assumed to be an 549 * old format snoop file. 550 * 551 * A version 1 header looks like this: 552 * 553 * 0 1 2 3 4 5 6 7 8 9 10 11 554 * +---+---+---+---+---+---+---+---+---+---+---+---+---+ 555 * | s | n | o | o | p | \0| \0| \0| version | data 556 * +---+---+---+---+---+---+---+---+---+---+---+---+---+ 557 * | word 0 | word 1 | word 2 | 558 * 559 * 560 * A version 2 header adds a word that identifies the MAC type. 561 * This allows for capture files from FDDI etc. 562 * 563 * 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 564 * +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+ 565 * | s | n | o | o | p | \0| \0| \0| version | MAC type | data 566 * +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+ 567 * | word 0 | word 1 | word 2 | word 3 568 * 569 */ 570 static const char *snoop_id = "snoop\0\0\0"; 571 static const int snoop_idlen = 8; 572 static const int snoop_version = 2; 573 574 void 575 cap_open_write(const char *name) 576 { 577 int vers; 578 579 capfile_out = open(name, O_CREAT | O_TRUNC | O_RDWR, 0666); 580 if (capfile_out < 0) 581 pr_err("%s: %m", name); 582 583 vers = htonl(snoop_version); 584 if (nwrite(capfile_out, snoop_id, snoop_idlen) == -1) 585 cap_write_error("snoop_id"); 586 587 if (nwrite(capfile_out, &vers, sizeof (int)) == -1) 588 cap_write_error("version"); 589 } 590 591 592 void 593 cap_close(void) 594 { 595 (void) close(capfile_out); 596 } 597 598 static char *cap_buffp = NULL; 599 static int cap_len = 0; 600 static int cap_new; 601 602 void 603 cap_open_read(const char *name) 604 { 605 struct stat st; 606 int cap_vers; 607 int *word; 608 int device_mac_type = -1; 609 int capfile_in; 610 611 capfile_in = open(name, O_RDONLY); 612 if (capfile_in < 0) 613 pr_err("couldn't open %s: %m", name); 614 615 if (fstat(capfile_in, &st) < 0) 616 pr_err("couldn't stat %s: %m", name); 617 cap_len = st.st_size; 618 619 cap_buffp = mmap(0, cap_len, PROT_READ, MAP_PRIVATE, capfile_in, 0); 620 (void) close(capfile_in); 621 if ((int)cap_buffp == -1) 622 pr_err("couldn't mmap %s: %m", name); 623 624 /* Check if new snoop capture file format */ 625 626 cap_new = bcmp(cap_buffp, snoop_id, snoop_idlen) == 0; 627 628 /* 629 * If new file - check version and 630 * set buffer pointer to point at first packet 631 */ 632 if (cap_new) { 633 cap_vers = ntohl(*(int *)(cap_buffp + snoop_idlen)); 634 cap_buffp += snoop_idlen + sizeof (int); 635 cap_len -= snoop_idlen + sizeof (int); 636 637 switch (cap_vers) { 638 case 1: 639 device_mac_type = DL_ETHER; 640 break; 641 642 case 2: 643 device_mac_type = ntohl(*((int *)cap_buffp)); 644 cap_buffp += sizeof (int); 645 cap_len -= sizeof (int); 646 break; 647 648 default: 649 pr_err("capture file: %s: Version %d unrecognized\n", 650 name, cap_vers); 651 } 652 653 for (interface = &INTERFACES[0]; interface->mac_type != -1; 654 interface++) 655 if (interface->mac_type == device_mac_type) 656 break; 657 658 if (interface->mac_type == -1) 659 pr_err("Mac Type = %x is not supported\n", 660 device_mac_type); 661 } else { 662 /* Use heuristic to check if it's an old-style file */ 663 664 device_mac_type = DL_ETHER; 665 word = (int *)cap_buffp; 666 667 if (!((word[0] < 1600 && word[1] < 1600) && 668 (word[0] < word[1]) && 669 (word[2] > 610000000 && word[2] < 770000000))) 670 pr_err("not a capture file: %s", name); 671 672 /* Change protection so's we can fix the headers */ 673 674 if (mprotect(cap_buffp, cap_len, PROT_READ | PROT_WRITE) < 0) 675 pr_err("mprotect: %s: %m", name); 676 } 677 } 678 679 void 680 cap_read(int first, int last, int filter, void (*proc)(), int flags) 681 { 682 extern int count; 683 684 count = 0; 685 686 scan(cap_buffp, cap_len, filter, 1, !cap_new, proc, first, last, flags); 687 688 (void) munmap(cap_buffp, cap_len); 689 } 690 691 /* ARGSUSED */ 692 void 693 cap_write(struct sb_hdr *hdrp, char *pktp, int num, int flags) 694 { 695 int pktlen, mac; 696 static int first = 1; 697 struct sb_hdr nhdr; 698 extern boolean_t qflg; 699 700 if (hdrp == NULL) 701 return; 702 703 if (first) { 704 first = 0; 705 mac = htonl(interface->mac_type); 706 if (nwrite(capfile_out, &mac, sizeof (int)) == -1) 707 cap_write_error("mac_type"); 708 } 709 710 pktlen = hdrp->sbh_totlen - sizeof (*hdrp); 711 712 /* 713 * Convert sb_hdr to network byte order 714 */ 715 nhdr.sbh_origlen = htonl(hdrp->sbh_origlen); 716 nhdr.sbh_msglen = htonl(hdrp->sbh_msglen); 717 nhdr.sbh_totlen = htonl(hdrp->sbh_totlen); 718 nhdr.sbh_drops = htonl(hdrp->sbh_drops); 719 nhdr.sbh_timestamp.tv_sec = htonl(hdrp->sbh_timestamp.tv_sec); 720 nhdr.sbh_timestamp.tv_usec = htonl(hdrp->sbh_timestamp.tv_usec); 721 722 if (nwrite(capfile_out, &nhdr, sizeof (nhdr)) == -1) 723 cap_write_error("packet header"); 724 725 if (nwrite(capfile_out, pktp, pktlen) == -1) 726 cap_write_error("packet"); 727 728 if (! qflg) 729 show_count(); 730 } 731 732 /* 733 * Convert a packet header from 734 * old to new format. 735 */ 736 static void 737 convert_old(struct ohdr *ohdrp) 738 { 739 struct sb_hdr nhdr; 740 741 nhdr.sbh_origlen = ohdrp->o_len; 742 nhdr.sbh_msglen = ohdrp->o_msglen; 743 nhdr.sbh_totlen = ohdrp->o_totlen; 744 nhdr.sbh_drops = ohdrp->o_drops; 745 nhdr.sbh_timestamp = ohdrp->o_time; 746 747 *(struct sb_hdr *)ohdrp = nhdr; 748 } 749 750 static int 751 strioctl(int fd, int cmd, int timout, int len, void *dp) 752 { 753 struct strioctl sioc; 754 int rc; 755 756 sioc.ic_cmd = cmd; 757 sioc.ic_timout = timout; 758 sioc.ic_len = len; 759 sioc.ic_dp = dp; 760 rc = ioctl(fd, I_STR, &sioc); 761 762 if (rc < 0) 763 return (rc); 764 else 765 return (sioc.ic_len); 766 } 767