contrib/libpcap/pcap-dag.c

   1 /*
   2  * pcap-dag.c: Packet capture interface for Endace DAG card.
   3  *
   4  * The functionality of this code attempts to mimic that of pcap-linux as much
   5  * as possible.  This code is compiled in several different ways depending on
   6  * whether DAG_ONLY and HAVE_DAG_API are defined.  If HAVE_DAG_API is not
   7  * defined it should not get compiled in, otherwise if DAG_ONLY is defined then
   8  * the 'dag_' function calls are renamed to 'pcap_' equivalents.  If DAG_ONLY
   9  * is not defined then nothing is altered - the dag_ functions will be
  10  * called as required from their pcap-linux/bpf equivalents.
  11  *
  12  * Authors: Richard Littin, Sean Irvine ({richard,sean}@reeltwo.com)
  13  * Modifications: Jesper Peterson, Koryn Grant <support@endace.com>
  14  */
  15
  16 #ifndef lint
  17 static const char rcsid[] _U_ =
  18         "@(#) $Header: /tcpdump/master/libpcap/pcap-dag.c,v 1.21.2.1 2005/05/03 18:54:35 guy Exp $ (LBL)";
  19 #endif
  20
  21 #ifdef HAVE_CONFIG_H
  22 #include "config.h"
  23 #endif
  24
  25 #include <sys/param.h>                  /* optionally get BSD define */
  26
  27 #include <stdlib.h>
  28 #include <string.h>
  29 #include <errno.h>
  30
  31 #include "pcap-int.h"
  32
  33 #include <ctype.h>
  34 #include <netinet/in.h>
  35 #include <sys/mman.h>
  36 #include <sys/socket.h>
  37 #include <sys/types.h>
  38 #include <unistd.h>
  39
  40 struct mbuf;            /* Squelch compiler warnings on some platforms for */
  41 struct rtentry;         /* declarations in <net/if.h> */
  42 #include <net/if.h>
  43
  44 #include "dagnew.h"
  45 #include "dagapi.h"
  46
  47 #define MIN_DAG_SNAPLEN         12
  48 #define MAX_DAG_SNAPLEN         2040
  49 #define ATM_CELL_SIZE           52
  50 #define ATM_HDR_SIZE            4
  51
  52 /* SunATM pseudo header */
  53 struct sunatm_hdr {
  54         unsigned char   flags;          /* destination and traffic type */
  55         unsigned char   vpi;            /* VPI */
  56         unsigned short  vci;            /* VCI */
  57 };
  58
  59 typedef struct pcap_dag_node {
  60         struct pcap_dag_node *next;
  61         pcap_t *p;
  62         pid_t pid;
  63 } pcap_dag_node_t;
  64
  65 static pcap_dag_node_t *pcap_dags = NULL;
  66 static int atexit_handler_installed = 0;
  67 static const unsigned short endian_test_word = 0x0100;
  68
  69 #define IS_BIGENDIAN() (*((unsigned char *)&endian_test_word))
  70
  71 /*
  72  * Swap byte ordering of unsigned long long timestamp on a big endian
  73  * machine.
  74  */
  75 #define SWAP_TS(ull)  ((ull & 0xff00000000000000LL) >> 56) | \
  76                       ((ull & 0x00ff000000000000LL) >> 40) | \
  77                       ((ull & 0x0000ff0000000000LL) >> 24) | \
  78                       ((ull & 0x000000ff00000000LL) >> 8)  | \
  79                       ((ull & 0x00000000ff000000LL) << 8)  | \
  80                       ((ull & 0x0000000000ff0000LL) << 24) | \
  81                       ((ull & 0x000000000000ff00LL) << 40) | \
  82                       ((ull & 0x00000000000000ffLL) << 56)
  83
  84
  85 #ifdef DAG_ONLY
  86 /* This code is required when compiling for a DAG device only. */
  87 #include "pcap-dag.h"
  88
  89 /* Replace dag function names with pcap equivalent. */
  90 #define dag_open_live pcap_open_live
  91 #define dag_platform_finddevs pcap_platform_finddevs
  92 #endif /* DAG_ONLY */
  93
  94 static int dag_setfilter(pcap_t *p, struct bpf_program *fp);
  95 static int dag_stats(pcap_t *p, struct pcap_stat *ps);
  96 static int dag_set_datalink(pcap_t *p, int dlt);
  97 static int dag_get_datalink(pcap_t *p);
  98 static int dag_setnonblock(pcap_t *p, int nonblock, char *errbuf);
  99
 100 static void
 101 delete_pcap_dag(pcap_t *p)
 102 {
 103         pcap_dag_node_t *curr = NULL, *prev = NULL;
 104
 105         for (prev = NULL, curr = pcap_dags; curr != NULL && curr->p != p; prev = curr, curr = curr->next) {
 106                 /* empty */
 107         }
 108
 109         if (curr != NULL && curr->p == p) {
 110                 if (prev != NULL) {
 111                         prev->next = curr->next;
 112                 } else {
 113                         pcap_dags = curr->next;
 114                 }
 115         }
 116 }
 117
 118 /*
 119  * Performs a graceful shutdown of the DAG card, frees dynamic memory held
 120  * in the pcap_t structure, and closes the file descriptor for the DAG card.
 121  */
 122
 123 static void
 124 dag_platform_close(pcap_t *p)
 125 {
 126
 127 #ifdef linux
 128         if (p != NULL && p->md.device != NULL) {
 129                 if(dag_stop(p->fd) < 0)
 130                         fprintf(stderr,"dag_stop %s: %s\n", p->md.device, strerror(errno));
 131                 if(dag_close(p->fd) < 0)
 132                         fprintf(stderr,"dag_close %s: %s\n", p->md.device, strerror(errno));
 133
 134                 free(p->md.device);
 135         }
 136 #else
 137         if (p != NULL) {
 138                 if(dag_stop(p->fd) < 0)
 139                         fprintf(stderr,"dag_stop: %s\n", strerror(errno));
 140                 if(dag_close(p->fd) < 0)
 141                         fprintf(stderr,"dag_close: %s\n", strerror(errno));
 142         }
 143 #endif
 144         delete_pcap_dag(p);
 145         /* Note: don't need to call close(p->fd) here as dag_close(p->fd) does this. */
 146 }
 147
 148 static void
 149 atexit_handler(void)
 150 {
 151         while (pcap_dags != NULL) {
 152                 if (pcap_dags->pid == getpid()) {
 153                         dag_platform_close(pcap_dags->p);
 154                 } else {
 155                         delete_pcap_dag(pcap_dags->p);
 156                 }
 157         }
 158 }
 159
 160 static int
 161 new_pcap_dag(pcap_t *p)
 162 {
 163         pcap_dag_node_t *node = NULL;
 164
 165         if ((node = malloc(sizeof(pcap_dag_node_t))) == NULL) {
 166                 return -1;
 167         }
 168
 169         if (!atexit_handler_installed) {
 170                 atexit(atexit_handler);
 171                 atexit_handler_installed = 1;
 172         }
 173
 174         node->next = pcap_dags;
 175         node->p = p;
 176         node->pid = getpid();
 177
 178         pcap_dags = node;
 179
 180         return 0;
 181 }
 182
 183 /*
 184  *  Read at most max_packets from the capture stream and call the callback
 185  *  for each of them. Returns the number of packets handled, -1 if an
 186  *  error occured, or -2 if we were told to break out of the loop.
 187  */
 188 static int
 189 dag_read(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
 190 {
 191         unsigned int processed = 0;
 192         int flags = p->md.dag_offset_flags;
 193         unsigned int nonblocking = flags & DAGF_NONBLOCK;
 194
 195         for (;;)
 196         {
 197                 /* Get the next bufferful of packets (if necessary). */
 198                 while (p->md.dag_mem_top - p->md.dag_mem_bottom < dag_record_size) {
 199
 200                         /*
 201                          * Has "pcap_breakloop()" been called?
 202                          */
 203                         if (p->break_loop) {
 204                                 /*
 205                                  * Yes - clear the flag that indicates that
 206                                  * it has, and return -2 to indicate that
 207                                  * we were told to break out of the loop.
 208                                  */
 209                                 p->break_loop = 0;
 210                                 return -2;
 211                         }
 212
 213                         p->md.dag_mem_top = dag_offset(p->fd, &(p->md.dag_mem_bottom), flags);
 214                         if (nonblocking && (p->md.dag_mem_top - p->md.dag_mem_bottom < dag_record_size))
 215                         {
 216                                 /* Pcap is configured to process only available packets, and there aren't any. */
 217                                 return 0;
 218                         }
 219                 }
 220
 221                 /* Process the packets. */
 222                 while (p->md.dag_mem_top - p->md.dag_mem_bottom >= dag_record_size) {
 223
 224                         unsigned short packet_len = 0;
 225                         int caplen = 0;
 226                         struct pcap_pkthdr      pcap_header;
 227
 228                         dag_record_t *header = (dag_record_t *)(p->md.dag_mem_base + p->md.dag_mem_bottom);
 229                         u_char *dp = ((u_char *)header) + dag_record_size;
 230                         unsigned short rlen;
 231
 232                         /*
 233                          * Has "pcap_breakloop()" been called?
 234                          */
 235                         if (p->break_loop) {
 236                                 /*
 237                                  * Yes - clear the flag that indicates that
 238                                  * it has, and return -2 to indicate that
 239                                  * we were told to break out of the loop.
 240                                  */
 241                                 p->break_loop = 0;
 242                                 return -2;
 243                         }
 244
 245                                 rlen = ntohs(header->rlen);
 246                         if (rlen < dag_record_size)
 247                         {
 248                                 strncpy(p->errbuf, "dag_read: record too small", PCAP_ERRBUF_SIZE);
 249                                 return -1;
 250                         }
 251                         p->md.dag_mem_bottom += rlen;
 252
 253                         switch(header->type) {
 254                         case TYPE_AAL5:
 255                         case TYPE_ATM:
 256                                 if (header->type == TYPE_AAL5) {
 257                                                 packet_len = ntohs(header->wlen);
 258                                         caplen = rlen - dag_record_size;
 259                                 } else {
 260                                         caplen = packet_len = ATM_CELL_SIZE;
 261                                 }
 262                                 if (p->linktype == DLT_SUNATM) {
 263                                         struct sunatm_hdr *sunatm = (struct sunatm_hdr *)dp;
 264                                         unsigned long rawatm;
 265
 266                                                 rawatm = ntohl(*((unsigned long *)dp));
 267                                                 sunatm->vci = htons((rawatm >>  4) & 0xffff);
 268                                         sunatm->vpi = (rawatm >> 20) & 0x00ff;
 269                                         sunatm->flags = ((header->flags.iface & 1) ? 0x80 : 0x00) |
 270                                                 ((sunatm->vpi == 0 && sunatm->vci == htons(5)) ? 6 :
 271                                                 ((sunatm->vpi == 0 && sunatm->vci == htons(16)) ? 5 :
 272                                                 ((dp[ATM_HDR_SIZE] == 0xaa &&
 273                                                         dp[ATM_HDR_SIZE+1] == 0xaa &&
 274                                                         dp[ATM_HDR_SIZE+2] == 0x03) ? 2 : 1)));
 275
 276                                 } else {
 277                                         packet_len -= ATM_HDR_SIZE;
 278                                         caplen -= ATM_HDR_SIZE;
 279                                         dp += ATM_HDR_SIZE;
 280                                 }
 281                                 break;
 282
 283                         case TYPE_ETH:
 284                                         packet_len = ntohs(header->wlen);
 285                                 packet_len -= (p->md.dag_fcs_bits >> 3);
 286                                 caplen = rlen - dag_record_size - 2;
 287                                 if (caplen > packet_len) {
 288                                         caplen = packet_len;
 289                                 }
 290                                 dp += 2;
 291                                 break;
 292
 293                         case TYPE_HDLC_POS:
 294                                         packet_len = ntohs(header->wlen);
 295                                 packet_len -= (p->md.dag_fcs_bits >> 3);
 296                                 caplen = rlen - dag_record_size;
 297                                 if (caplen > packet_len) {
 298                                         caplen = packet_len;
 299                                 }
 300                                 break;
 301                         }
 302
 303                         if (caplen > p->snapshot)
 304                                 caplen = p->snapshot;
 305
 306                         /* Count lost packets. */
 307                         if (header->lctr) {
 308                                 if (p->md.stat.ps_drop > (UINT_MAX - ntohs(header->lctr))) {
 309                                         p->md.stat.ps_drop = UINT_MAX;
 310                                 } else {
 311                                         p->md.stat.ps_drop += ntohs(header->lctr);
 312                                 }
 313                         }
 314
 315                         /* Run the packet filter if there is one. */
 316                         if ((p->fcode.bf_insns == NULL) || bpf_filter(p->fcode.bf_insns, dp, packet_len, caplen)) {
 317
 318                                 /* convert between timestamp formats */
 319                                 register unsigned long long ts;
 320
 321                                 if (IS_BIGENDIAN()) {
 322                                         ts = SWAP_TS(header->ts);
 323                                 } else {
 324                                         ts = header->ts;
 325                                 }
 326
 327                                 pcap_header.ts.tv_sec = ts >> 32;
 328                                 ts = (ts & 0xffffffffULL) * 1000000;
 329                                 ts += 0x80000000; /* rounding */
 330                                 pcap_header.ts.tv_usec = ts >> 32;
 331                                 if (pcap_header.ts.tv_usec >= 1000000) {
 332                                         pcap_header.ts.tv_usec -= 1000000;
 333                                         pcap_header.ts.tv_sec++;
 334                                 }
 335
 336                                 /* Fill in our own header data */
 337                                 pcap_header.caplen = caplen;
 338                                 pcap_header.len = packet_len;
 339
 340                                 /* Count the packet. */
 341                                 p->md.stat.ps_recv++;
 342
 343                                 /* Call the user supplied callback function */
 344                                 callback(user, &pcap_header, dp);
 345
 346                                 /* Only count packets that pass the filter, for consistency with standard Linux behaviour. */
 347                                 processed++;
 348                                 if (processed == cnt)
 349                                 {
 350                                         /* Reached the user-specified limit. */
 351                                         return cnt;
 352                                 }
 353                         }
 354                 }
 355
 356                 if (nonblocking || processed)
 357                 {
 358                         return processed;
 359                 }
 360         }
 361
 362         return processed;
 363 }
 364
 365 static int
 366 dag_inject(pcap_t *p, const void *buf _U_, size_t size _U_)
 367 {
 368         strlcpy(p->errbuf, "Sending packets isn't supported on DAG cards",
 369             PCAP_ERRBUF_SIZE);
 370         return (-1);
 371 }
 372
 373 /*
 374  *  Get a handle for a live capture from the given DAG device.  Passing a NULL
 375  *  device will result in a failure.  The promisc flag is ignored because DAG
 376  *  cards are always promiscuous.  The to_ms parameter is also ignored as it is
 377  *  not supported in hardware.
 378  *
 379  *  See also pcap(3).
 380  */
 381 pcap_t *
 382 dag_open_live(const char *device, int snaplen, int promisc, int to_ms, char *ebuf)
 383 {
 384         char conf[30]; /* dag configure string */
 385         pcap_t *handle;
 386         char *s;
 387         int n;
 388         daginf_t* daginf;
 389
 390         if (device == NULL) {
 391                 snprintf(ebuf, PCAP_ERRBUF_SIZE, "device is NULL: %s", pcap_strerror(errno));
 392                 return NULL;
 393         }
 394         /* Allocate a handle for this session. */
 395
 396         handle = malloc(sizeof(*handle));
 397         if (handle == NULL) {
 398                 snprintf(ebuf, PCAP_ERRBUF_SIZE, "malloc %s: %s", device, pcap_strerror(errno));
 399                 return NULL;
 400         }
 401
 402         /* Initialize some components of the pcap structure. */
 403
 404         memset(handle, 0, sizeof(*handle));
 405
 406         if (strstr(device, "/dev") == NULL) {
 407                 char * newDev = (char *)malloc(strlen(device) + 6);
 408                 newDev[0] = '\0';
 409                 strcat(newDev, "/dev/");
 410                 strcat(newDev,device);
 411                 device = newDev;
 412         } else {
 413                 device = strdup(device);
 414         }
 415
 416         if (device == NULL) {
 417                 snprintf(ebuf, PCAP_ERRBUF_SIZE, "str_dup: %s\n", pcap_strerror(errno));
 418                 goto fail;
 419         }
 420
 421         /* setup device parameters */
 422         if((handle->fd = dag_open((char *)device)) < 0) {
 423                 snprintf(ebuf, PCAP_ERRBUF_SIZE, "dag_open %s: %s", device, pcap_strerror(errno));
 424                 goto fail;
 425         }
 426
 427         /* set the card snap length to the specified snaplen parameter */
 428         if (snaplen == 0 || snaplen > MAX_DAG_SNAPLEN) {
 429                 snaplen = MAX_DAG_SNAPLEN;
 430         } else if (snaplen < MIN_DAG_SNAPLEN) {
 431                 snaplen = MIN_DAG_SNAPLEN;
 432         }
 433         /* snap len has to be a multiple of 4 */
 434         snprintf(conf, 30, "varlen slen=%d", (snaplen + 3) & ~3);
 435
 436         if(dag_configure(handle->fd, conf) < 0) {
 437                 snprintf(ebuf, PCAP_ERRBUF_SIZE,"dag_configure %s: %s\n", device, pcap_strerror(errno));
 438                 goto fail;
 439         }
 440
 441         if((handle->md.dag_mem_base = dag_mmap(handle->fd)) == MAP_FAILED) {
 442                 snprintf(ebuf, PCAP_ERRBUF_SIZE,"dag_mmap %s: %s\n", device, pcap_strerror(errno));
 443                 goto fail;
 444         }
 445
 446         if(dag_start(handle->fd) < 0) {
 447                 snprintf(ebuf, PCAP_ERRBUF_SIZE, "dag_start %s: %s\n", device, pcap_strerror(errno));
 448                 goto fail;
 449         }
 450
 451         /*
 452          * Important! You have to ensure bottom is properly
 453          * initialized to zero on startup, it won't give you
 454          * a compiler warning if you make this mistake!
 455          */
 456         handle->md.dag_mem_bottom = 0;
 457         handle->md.dag_mem_top = 0;
 458         handle->md.dag_fcs_bits = 32;
 459
 460         /* Query the card first for special cases. */
 461         daginf = dag_info(handle->fd);
 462         if ((0x4200 == daginf->device_code) || (0x4230 == daginf->device_code))
 463         {
 464                 /* DAG 4.2S and 4.23S already strip the FCS.  Stripping the final word again truncates the packet. */
 465                 handle->md.dag_fcs_bits = 0;
 466         }
 467
 468         /* Then allow an environment variable to override. */
 469         if ((s = getenv("ERF_FCS_BITS")) != NULL) {
 470                 if ((n = atoi(s)) == 0 || n == 16|| n == 32) {
 471                         handle->md.dag_fcs_bits = n;
 472                 } else {
 473                         snprintf(ebuf, PCAP_ERRBUF_SIZE,
 474                                 "pcap_open_live %s: bad ERF_FCS_BITS value (%d) in environment\n", device, n);
 475                         goto fail;
 476                 }
 477         }
 478
 479         handle->snapshot        = snaplen;
 480         /*handle->md.timeout    = to_ms; */
 481
 482         handle->linktype = -1;
 483         if (dag_get_datalink(handle) < 0) {
 484                 strcpy(ebuf, handle->errbuf);
 485                 goto fail;
 486         }
 487
 488         handle->bufsize = 0;
 489
 490         if (new_pcap_dag(handle) < 0) {
 491                 snprintf(ebuf, PCAP_ERRBUF_SIZE, "new_pcap_dag %s: %s\n", device, pcap_strerror(errno));
 492                 goto fail;
 493         }
 494
 495         /*
 496          * "select()" and "poll()" don't (yet) work on DAG device descriptors.
 497          */
 498         handle->selectable_fd = -1;
 499
 500 #ifdef linux
 501         handle->md.device = (char *)device;
 502 #else
 503         free((char *)device);
 504         device = NULL;
 505 #endif
 506
 507         handle->read_op = dag_read;
 508         handle->inject_op = dag_inject;
 509         handle->setfilter_op = dag_setfilter;
 510         handle->setdirection_op = NULL; /* Not implemented.*/
 511         handle->set_datalink_op = dag_set_datalink;
 512         handle->getnonblock_op = pcap_getnonblock_fd;
 513         handle->setnonblock_op = dag_setnonblock;
 514         handle->stats_op = dag_stats;
 515         handle->close_op = dag_platform_close;
 516
 517         return handle;
 518
 519 fail:
 520         if (device != NULL) {
 521                 free((char *)device);
 522         }
 523         if (handle != NULL) {
 524                 /*
 525                  * Get rid of any link-layer type list we allocated.
 526                  */
 527                 if (handle->dlt_list != NULL) {
 528                         free(handle->dlt_list);
 529                 }
 530                 free(handle);
 531         }
 532
 533         return NULL;
 534 }
 535
 536 static int
 537 dag_stats(pcap_t *p, struct pcap_stat *ps) {
 538         /* This needs to be filled out correctly.  Hopefully a dagapi call will
 539                  provide all necessary information.
 540         */
 541         /*p->md.stat.ps_recv = 0;*/
 542         /*p->md.stat.ps_drop = 0;*/
 543
 544         *ps = p->md.stat;
 545
 546         return 0;
 547 }
 548
 549 /*
 550  * Get from "/proc/dag" all interfaces listed there; if they're
 551  * already in the list of interfaces we have, that won't add another
 552  * instance, but if they're not, that'll add them.
 553  *
 554  * We don't bother getting any addresses for them.
 555  *
 556  * We also don't fail if we couldn't open "/proc/dag"; we just leave
 557  * the list of interfaces as is.
 558  */
 559 int
 560 dag_platform_finddevs(pcap_if_t **devlistp, char *errbuf)
 561 {
 562         FILE *proc_dag_f;
 563         char linebuf[512];
 564         int linenum;
 565         unsigned char *p;
 566         char name[512]; /* XXX - pick a size */
 567         char *q;
 568         int ret = 0;
 569
 570         /* Quick exit if /proc/dag not readable */
 571         proc_dag_f = fopen("/proc/dag", "r");
 572         if (proc_dag_f == NULL)
 573         {
 574                 int i;
 575                 char dev[16] = "dagx";
 576
 577                 for (i = '0'; ret == 0 && i <= '9'; i++) {
 578                         dev[3] = i;
 579                         if (pcap_add_if(devlistp, dev, 0, NULL, errbuf) == -1) {
 580                                 /*
 581                                  * Failure.
 582                                  */
 583                                 ret = -1;
 584                         }
 585                 }
 586
 587                 return (ret);
 588         }
 589
 590         for (linenum = 1; fgets(linebuf, sizeof linebuf, proc_dag_f) != NULL; linenum++) {
 591
 592                 /*
 593                  * Skip the first two lines - they're headers.
 594                  */
 595                 if (linenum <= 2)
 596                         continue;
 597
 598                 p = &linebuf[0];
 599
 600                 if (*p == '\0' || *p == '\n' || *p != 'D')
 601                         continue;  /* not a Dag line */
 602
 603                 /*
 604                  * Get the interface name.
 605                  */
 606                 q = &name[0];
 607                 while (*p != '\0' && *p != ':') {
 608                         if (*p != ' ')
 609                                 *q++ = tolower(*p++);
 610                         else
 611                                 p++;
 612                 }
 613                 *q = '\0';
 614
 615                 /*
 616                  * Add an entry for this interface, with no addresses.
 617                  */
 618                 p[strlen(p) - 1] = '\0'; /* get rid of \n */
 619                 if (pcap_add_if(devlistp, name, 0, strdup(p + 2), errbuf) == -1) {
 620                         /*
 621                          * Failure.
 622                          */
 623                         ret = -1;
 624                         break;
 625                 }
 626         }
 627         if (ret != -1) {
 628                 /*
 629                  * Well, we didn't fail for any other reason; did we
 630                  * fail due to an error reading the file?
 631                  */
 632                 if (ferror(proc_dag_f)) {
 633                         (void)snprintf(errbuf, PCAP_ERRBUF_SIZE,
 634                                   "Error reading /proc/dag: %s",
 635                                   pcap_strerror(errno));
 636                         ret = -1;
 637                 }
 638         }
 639
 640         (void)fclose(proc_dag_f);
 641         return (ret);
 642 }
 643
 644 /*
 645  * Installs the given bpf filter program in the given pcap structure.  There is
 646  * no attempt to store the filter in kernel memory as that is not supported
 647  * with DAG cards.
 648  */
 649 static int
 650 dag_setfilter(pcap_t *p, struct bpf_program *fp)
 651 {
 652         if (!p)
 653                 return -1;
 654         if (!fp) {
 655                 strncpy(p->errbuf, "setfilter: No filter specified",
 656                         sizeof(p->errbuf));
 657                 return -1;
 658         }
 659
 660         /* Make our private copy of the filter */
 661
 662         if (install_bpf_program(p, fp) < 0)
 663                 return -1;
 664
 665         p->md.use_bpf = 0;
 666
 667         return (0);
 668 }
 669
 670 static int
 671 dag_set_datalink(pcap_t *p, int dlt)
 672 {
 673         p->linktype = dlt;
 674
 675         return (0);
 676 }
 677
 678 static int
 679 dag_setnonblock(pcap_t *p, int nonblock, char *errbuf)
 680 {
 681         /*
 682          * Set non-blocking mode on the FD.
 683          * XXX - is that necessary?  If not, don't bother calling it,
 684          * and have a "dag_getnonblock()" function that looks at
 685          * "p->md.dag_offset_flags".
 686          */
 687         if (pcap_setnonblock_fd(p, nonblock, errbuf) < 0)
 688                 return (-1);
 689
 690         if (nonblock) {
 691                 p->md.dag_offset_flags |= DAGF_NONBLOCK;
 692         } else {
 693                 p->md.dag_offset_flags &= ~DAGF_NONBLOCK;
 694         }
 695         return (0);
 696 }
 697
 698 static int
 699 dag_get_datalink(pcap_t *p)
 700 {
 701         int daglinktype;
 702
 703         if (p->dlt_list == NULL && (p->dlt_list = malloc(2*sizeof(*(p->dlt_list)))) == NULL) {
 704                 (void)snprintf(p->errbuf, sizeof(p->errbuf), "malloc: %s", pcap_strerror(errno));
 705                 return (-1);
 706         }
 707
 708         /* Check the type through a dagapi call. */
 709         daglinktype = dag_linktype(p->fd);
 710
 711         switch(daglinktype) {
 712
 713         case TYPE_HDLC_POS:
 714                 if (p->dlt_list != NULL) {
 715                         p->dlt_count = 2;
 716                         p->dlt_list[0] = DLT_CHDLC;
 717                         p->dlt_list[1] = DLT_PPP_SERIAL;
 718                 }
 719                 p->linktype = DLT_CHDLC;
 720                 break;
 721
 722         case TYPE_ETH:
 723                 /*
 724                  * This is (presumably) a real Ethernet capture; give it a
 725                  * link-layer-type list with DLT_EN10MB and DLT_DOCSIS, so
 726                  * that an application can let you choose it, in case you're
 727                  * capturing DOCSIS traffic that a Cisco Cable Modem
 728                  * Termination System is putting out onto an Ethernet (it
 729                  * doesn't put an Ethernet header onto the wire, it puts raw
 730                  * DOCSIS frames out on the wire inside the low-level
 731                  * Ethernet framing).
 732                  */
 733                 if (p->dlt_list != NULL) {
 734                         p->dlt_count = 2;
 735                         p->dlt_list[0] = DLT_EN10MB;
 736                         p->dlt_list[1] = DLT_DOCSIS;
 737                 }
 738                 p->linktype = DLT_EN10MB;
 739                 break;
 740
 741         case TYPE_AAL5:
 742         case TYPE_ATM:
 743                 if (p->dlt_list != NULL) {
 744                         p->dlt_count = 2;
 745                         p->dlt_list[0] = DLT_ATM_RFC1483;
 746                         p->dlt_list[1] = DLT_SUNATM;
 747                 }
 748                 p->linktype = DLT_ATM_RFC1483;
 749                 break;
 750
 751
 752         case TYPE_LEGACY:
 753                 p->linktype = DLT_NULL;
 754                 break;
 755
 756         default:
 757                 snprintf(p->errbuf, sizeof(p->errbuf), "unknown DAG linktype %d\n", daglinktype);
 758                 return (-1);
 759
 760         }
 761
 762         return p->linktype;
 763 }