4 * (C)opyright 1992-1998 Darren Reed. (from tcplog)
6 * See the IPFILTER.LICENCE file for details on licencing.
16 #include <sys/types.h>
18 #include <sys/timeb.h>
19 #include <sys/socket.h>
21 #include <sys/ioctl.h>
22 #include <sys/stropts.h>
24 #include <sys/pfmod.h>
25 #include <sys/bufmod.h>
29 #include <netinet/in.h>
30 #include <netinet/in_systm.h>
31 #include <netinet/ip.h>
32 #include <netinet/if_ether.h>
33 #include <netinet/ip_var.h>
34 #include <netinet/udp.h>
35 #include <netinet/udp_var.h>
36 #include <netinet/tcp.h>
37 #include <netinet/tcpip.h>
39 #include "ip_compat.h"
42 static char snitid[] = "%W% %G% (C)1995 Darren Reed";
45 #define BUFSPACE 32768
50 * Be careful to only include those defined in the flags option for the
51 * interface are included in the header size.
70 tcp = (tcphdr_t *)(ip + 1);
71 bcopy(ep, (char *)ip, sizeof(*ip));
72 bcopy(ep + (ip->ip_hl << 2), (char *)tcp, sizeof(*tcp));
74 if (ip->ip_off & 0x1fff != 0)
76 if (0 == detect(ip, tcp))
82 int readloop(fd, port, dst)
86 static u_char buf[BUFSPACE];
87 register u_char *bp, *cp, *bufend;
88 register struct sb_hdr *hp;
92 time_t now = time(NULL);
93 int flags = 0, i, done = 0;
98 dbuf.maxlen = sizeof(buf);
100 * no control data buffer...
103 (void) signal(SIGALRM, nullbell);
105 i = getmsg(fd, NULL, &dbuf, &flags);
107 (void) signal(SIGALRM, nullbell);
110 if ((time(NULL) - now) > timeout)
120 * loop through each snapshot in the chunk
122 while (bp < bufend) {
124 * get past bufmod header
126 hp = (struct sb_hdr *)bp;
127 cp = (u_char *)((char *)bp + sizeof(*hp));
128 bcopy(cp, (char *)&eh, sizeof(eh));
132 bp += hp->sbh_totlen;
133 cc -= hp->sbh_totlen;
135 if (eh.ether_type != ETHERTYPE_IP)
139 done += ack_recv(cp);
147 int initdevice(device, tout)
154 struct packetfilt pfil;
156 u_short *fwp = pfil.Pf_Filter;
157 char devname[16], *s, buf[256];
158 int i, offset, fd, snaplen= 58, chunksize = BUFSPACE;
160 (void) sprintf(devname, "/dev/%s", device);
163 while (*s && !ISDIGIT(*s))
167 fprintf(stderr, "bad device name %s\n", devname);
175 if ((fd = open(devname, O_RDWR)) < 0)
177 fprintf(stderr, "O_RDWR(0) ");
181 if (dlattachreq(fd, i) == -1 || dlokack(fd, buf) == -1)
183 fprintf(stderr, "DLPI error\n");
186 dlbindreq(fd, ETHERTYPE_IP, 0, DL_CLDLS, 0, 0);
191 if (strioctl(fd, DLIOCRAW, -1, 0, NULL) == -1)
193 fprintf(stderr, "DLIOCRAW error\n");
197 * Create some filter rules for our TCP watcher. We only want ethernet
198 * pacets which are IP protocol and only the TCP packets from IP.
201 *fwp++ = ENF_PUSHWORD + offset;
202 *fwp++ = ENF_PUSHLIT | ENF_CAND;
203 *fwp++ = htons(ETHERTYPE_IP);
204 *fwp++ = ENF_PUSHWORD + sizeof(struct ether_header)/sizeof(short)+4;
205 *fwp++ = ENF_PUSHLIT | ENF_AND;
206 *fwp++ = htons(0x00ff);
207 *fwp++ = ENF_PUSHLIT | ENF_COR;
208 *fwp++ = htons(IPPROTO_TCP);
209 *fwp++ = ENF_PUSHWORD + sizeof(struct ether_header)/sizeof(short)+4;
210 *fwp++ = ENF_PUSHLIT | ENF_AND;
211 *fwp++ = htons(0x00ff);
212 *fwp++ = ENF_PUSHLIT | ENF_CAND;
213 *fwp++ = htons(IPPROTO_UDP);
214 pfil.Pf_FilterLen = (fwp - &pfil.Pf_Filter[0]);
216 * put filter in place.
219 if (ioctl(fd, I_PUSH, "pfmod") == -1)
221 perror("ioctl: I_PUSH pf");
224 if (strioctl(fd, PFIOCSETF, -1, sizeof(pfil), (char *)&pfil) == -1)
226 perror("ioctl: PFIOCSETF");
231 * arrange to get messages from the NIT STREAM and use NIT_BUF option
233 if (ioctl(fd, I_PUSH, "bufmod") == -1)
235 perror("ioctl: I_PUSH bufmod");
239 strioctl(fd, SBIOCSSNAP, -1, sizeof(i), (char *)&i);
245 if (strioctl(fd, SBIOCSTIME, -1, sizeof(to), (char *)&to) == -1)
247 perror("strioctl(SBIOCSTIME)");
253 if (ioctl(fd, I_FLUSH, FLUSHR) == -1)