2 * Copyright (c) 1993, 1994, 1995, 1996, 1997
3 * The Regents of the University of California. All rights reserved.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
21 * This code contributed by Atanu Ghosh (atanu@cs.ucl.ac.uk),
22 * University College London, and subsequently modified by
23 * Guy Harris (guy@alum.mit.edu) and Mark Pizzolato
24 * <List-tcpdump-workers@subscriptions.pizzolato.net>.
28 * Packet capture routine for DLPI under SunOS 5, HP-UX 9/10/11, and AIX.
32 * - The DLIOCRAW ioctl() is specific to SunOS.
34 * - There is a bug in bufmod(7) such that setting the snapshot
35 * length results in data being left of the front of the packet.
37 * - It might be desirable to use pfmod(7) to filter packets in the
38 * kernel when possible.
40 * - The HP-UX 10.20 DLPI Programmer's Guide used to be available
43 * http://docs.hp.com/hpux/onlinedocs/B2355-90093/B2355-90093.html
45 * but is no longer available; it can still be found at
47 * http://h21007.www2.hp.com/dspp/files/unprotected/Drivers/Docs/Refs/B2355-90093.pdf
51 * - The HP-UX 11.00 DLPI Programmer's Guide is available at
53 * http://docs.hp.com/hpux/onlinedocs/B2355-90139/B2355-90139.html
57 * http://h21007.www2.hp.com/dspp/files/unprotected/Drivers/Docs/Refs/B2355-90139.pdf
59 * - Both of the HP documents describe raw-mode services, which are
60 * what we use if DL_HP_RAWDLS is defined.
64 static const char rcsid[] _U_ =
65 "@(#) $Header: /tcpdump/master/libpcap/pcap-dlpi.c,v 1.108 2004/10/19 07:06:12 guy Exp $ (LBL)";
72 #include <sys/types.h>
74 #ifdef HAVE_SYS_BUFMOD_H
75 #include <sys/bufmod.h>
78 #ifdef HAVE_SYS_DLPI_EXT_H
79 #include <sys/dlpi_ext.h>
82 #include <sys/socket.h>
87 #include <sys/stream.h>
88 #if defined(HAVE_SOLARIS) && defined(HAVE_SYS_BUFMOD_H)
89 #include <sys/systeminfo.h>
112 #define INT_MAX 2147483647
115 #include "pcap-int.h"
117 #ifdef HAVE_OS_PROTO_H
118 #include "os-proto.h"
121 #ifndef PCAP_DEV_PREFIX
123 #define PCAP_DEV_PREFIX "/dev/dlpi"
125 #define PCAP_DEV_PREFIX "/dev"
129 #define MAXDLBUF 8192
131 #ifdef HAVE_SYS_BUFMOD_H
134 * Size of a bufmod chunk to pass upstream; that appears to be the biggest
135 * value to which you can set it, and setting it to that value (which
136 * is bigger than what appears to be the Solaris default of 8192)
137 * reduces the number of packet drops.
139 #define CHUNKSIZE 65536
142 * Size of the buffer to allocate for packet data we read; it must be
143 * large enough to hold a chunk.
145 #define PKTBUFSIZE CHUNKSIZE
147 #else /* HAVE_SYS_BUFMOD_H */
150 * Size of the buffer to allocate for packet data we read; this is
151 * what the value used to be - there's no particular reason why it
152 * should be tied to MAXDLBUF, but we'll leave it as this for now.
154 #define PKTBUFSIZE (MAXDLBUF * sizeof(bpf_u_int32))
159 static char *split_dname(char *, int *, char *);
160 static int dl_doattach(int, int, char *);
161 static int dlattachreq(int, bpf_u_int32, char *);
162 static int dlbindreq(int, bpf_u_int32, char *);
163 static int dlbindack(int, char *, char *);
164 static int dlpromisconreq(int, bpf_u_int32, char *);
165 static int dlokack(int, const char *, char *, char *);
166 static int dlinforeq(int, char *);
167 static int dlinfoack(int, char *, char *);
169 static int dlrawdatareq(int, const u_char *, int);
171 static int recv_ack(int, int, const char *, char *, char *);
172 static char *dlstrerror(bpf_u_int32);
173 static char *dlprim(bpf_u_int32);
174 #if defined(HAVE_SOLARIS) && defined(HAVE_SYS_BUFMOD_H)
175 static char *get_release(bpf_u_int32 *, bpf_u_int32 *, bpf_u_int32 *);
177 static int send_request(int, char *, int, char *, char *);
178 #ifdef HAVE_SYS_BUFMOD_H
179 static int strioctl(int, int, int, char *);
182 static int dlpi_kread(int, off_t, void *, u_int, char *);
185 static int get_dlpi_ppa(int, const char *, int, char *);
189 pcap_stats_dlpi(pcap_t *p, struct pcap_stat *ps)
193 * "ps_recv" counts packets handed to the filter, not packets
194 * that passed the filter. As filtering is done in userland,
195 * this would not include packets dropped because we ran out
196 * of buffer space; in order to make this more like other
197 * platforms (Linux 2.4 and later, BSDs with BPF), where the
198 * "packets received" count includes packets received but dropped
199 * due to running out of buffer space, and to keep from confusing
200 * applications that, for example, compute packet drop percentages,
201 * we also make it count packets dropped by "bufmod" (otherwise we
202 * might run the risk of the packet drop count being bigger than
203 * the received-packet count).
205 * "ps_drop" counts packets dropped by "bufmod" because of
206 * flow control requirements or resource exhaustion; it doesn't
207 * count packets dropped by the interface driver, or packets
208 * dropped upstream. As filtering is done in userland, it counts
209 * packets regardless of whether they would've passed the filter.
211 * These statistics don't include packets not yet read from
212 * the kernel by libpcap, but they may include packets not
213 * yet read from libpcap by the application.
218 * Add in the drop count, as per the above comment.
220 ps->ps_recv += ps->ps_drop;
224 /* XXX Needed by HP-UX (at least) */
225 static bpf_u_int32 ctlbuf[MAXDLBUF];
226 static struct strbuf ctl = {
233 pcap_read_dlpi(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
235 register int cc, n, caplen, origlen;
236 register u_char *bp, *ep, *pk;
237 register struct bpf_insn *fcode;
238 #ifdef HAVE_SYS_BUFMOD_H
239 register struct sb_hdr *sbp;
246 struct pcap_pkthdr pkthdr;
251 data.buf = (char *)p->buffer + p->offset;
252 data.maxlen = p->bufsize;
256 * Has "pcap_breakloop()" been called?
260 * Yes - clear the flag that indicates
261 * that it has, and return -2 to
262 * indicate that we were told to
263 * break out of the loop.
269 * XXX - check for the DLPI primitive, which
270 * would be DL_HP_RAWDATA_IND on HP-UX
271 * if we're in raw mode?
273 if (getmsg(p->fd, &ctl, &data, &flags) < 0) {
274 /* Don't choke when we get ptraced */
284 strlcpy(p->errbuf, pcap_strerror(errno),
290 bp = p->buffer + p->offset;
294 /* Loop through packets */
295 fcode = p->fcode.bf_insns;
298 #ifdef HAVE_SYS_BUFMOD_H
301 * Has "pcap_breakloop()" been called?
302 * If so, return immediately - if we haven't read any
303 * packets, clear the flag and return -2 to indicate
304 * that we were told to break out of the loop, otherwise
305 * leave the flag set, so that the *next* call will break
306 * out of the loop without having read any packets, and
307 * return the number of packets we've processed so far.
322 memcpy(sbp, bp, sizeof(*sbp));
325 sbp = (struct sb_hdr *)bp;
326 p->md.stat.ps_drop = sbp->sbh_drops;
327 pk = bp + sizeof(*sbp);
328 bp += sbp->sbh_totlen;
329 origlen = sbp->sbh_origlen;
330 caplen = sbp->sbh_msglen;
333 caplen = min(p->snapshot, cc);
337 ++p->md.stat.ps_recv;
338 if (bpf_filter(fcode, pk, origlen, caplen)) {
339 #ifdef HAVE_SYS_BUFMOD_H
340 pkthdr.ts.tv_sec = sbp->sbh_timestamp.tv_sec;
341 pkthdr.ts.tv_usec = sbp->sbh_timestamp.tv_usec;
343 (void)gettimeofday(&pkthdr.ts, NULL);
345 pkthdr.len = origlen;
346 pkthdr.caplen = caplen;
347 /* Insure caplen does not exceed snapshot */
348 if (pkthdr.caplen > p->snapshot)
349 pkthdr.caplen = p->snapshot;
350 (*callback)(user, &pkthdr, pk);
351 if (++n >= cnt && cnt >= 0) {
357 #ifdef HAVE_SYS_BUFMOD_H
365 pcap_inject_dlpi(pcap_t *p, const void *buf, size_t size)
369 #if defined(DLIOCRAW)
370 ret = write(p->fd, buf, size);
372 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "send: %s",
373 pcap_strerror(errno));
376 #elif defined(DL_HP_RAWDLS)
377 if (p->send_fd < 0) {
378 snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
379 "send: Output FD couldn't be opened");
382 ret = dlrawdatareq(p->send_fd, buf, size);
384 snprintf(p->errbuf, PCAP_ERRBUF_SIZE, "send: %s",
385 pcap_strerror(errno));
388 #else /* no raw mode */
390 * XXX - this is a pain, because you might have to extract
391 * the address from the packet and use it in a DL_UNITDATA_REQ
392 * request. That would be dependent on the link-layer type.
394 * I also don't know what SAP you'd have to bind the descriptor
395 * to, or whether you'd need separate "receive" and "send" FDs,
396 * nor do I know whether you'd need different bindings for
397 * D/I/X Ethernet and 802.3, or for {FDDI,Token Ring} plus
398 * 802.2 and {FDDI,Token Ring} plus 802.2 plus SNAP.
400 * So, for now, we just return a "you can't send" indication,
401 * and leave it up to somebody with a DLPI-based system lacking
402 * both DLIOCRAW and DL_HP_RAWDLS to supply code to implement
403 * packet transmission on that system. If they do, they should
404 * send it to us - but should not send us code that assumes
405 * Ethernet; if the code doesn't work on non-Ethernet interfaces,
406 * it should check "p->linktype" and reject the send request if
407 * it's anything other than DLT_EN10MB.
409 strlcpy(p->errbuf, "send: Not supported on this version of this OS",
412 #endif /* raw mode */
417 #define DL_IPATM 0x12 /* ATM Classical IP interface */
425 #define A_GET_UNITS (('A'<<8)|118)
426 #endif /* A_GET_UNITS */
427 #ifndef A_PROMISCON_REQ
428 #define A_PROMISCON_REQ (('A'<<8)|121)
429 #endif /* A_PROMISCON_REQ */
430 #endif /* HAVE_SOLARIS */
433 pcap_close_dlpi(pcap_t *p)
435 pcap_close_common(p);
441 pcap_open_live(const char *device, int snaplen, int promisc, int to_ms,
450 register dl_info_ack_t *infop;
451 #ifdef HAVE_SYS_BUFMOD_H
452 bpf_u_int32 ss, chunksize;
454 register char *release;
455 bpf_u_int32 osmajor, osminor, osmicro;
458 bpf_u_int32 buf[MAXDLBUF];
460 #ifndef HAVE_DEV_DLPI
464 p = (pcap_t *)malloc(sizeof(*p));
466 strlcpy(ebuf, pcap_strerror(errno), PCAP_ERRBUF_SIZE);
469 memset(p, 0, sizeof(*p));
470 p->fd = -1; /* indicate that it hasn't been opened yet */
475 ** Remove any "/dev/" on the front of the device.
477 cp = strrchr(device, '/');
479 strlcpy(dname, device, sizeof(dname));
481 strlcpy(dname, cp + 1, sizeof(dname));
484 * Split the device name into a device type name and a unit number;
485 * chop off the unit number, so "dname" is just a device type name.
487 cp = split_dname(dname, &ppa, ebuf);
493 * Use "/dev/dlpi" as the device.
495 * XXX - HP's DLPI Programmer's Guide for HP-UX 11.00 says that
496 * the "dl_mjr_num" field is for the "major number of interface
497 * driver"; that's the major of "/dev/dlpi" on the system on
498 * which I tried this, but there may be DLPI devices that
499 * use a different driver, in which case we may need to
500 * search "/dev" for the appropriate device with that major
501 * device number, rather than hardwiring "/dev/dlpi".
504 if ((p->fd = open(cp, O_RDWR)) < 0) {
505 snprintf(ebuf, PCAP_ERRBUF_SIZE,
506 "%s: %s", cp, pcap_strerror(errno));
512 * XXX - HP-UX 10.20 and 11.xx don't appear to support sending and
513 * receiving packets on the same descriptor - you have to bind the
514 * descriptor on which you receive to a SAP of 22 and bind the
515 * descriptor on which you send to a SAP of 24.
517 * If the open fails, we just leave -1 in "p->send_fd" and reject
518 * attempts to send packets, just as if, in pcap-bpf.c, we fail
519 * to open the BPF device for reading and writing, we just try
520 * to open it for reading only and, if that succeeds, just let
521 * the send attempts fail.
523 p->send_fd = open(cp, O_RDWR);
527 * Get a table of all PPAs for that device, and search that
528 * table for the specified device type name and unit number.
530 ppa = get_dlpi_ppa(p->fd, dname, ppa, ebuf);
535 * If the device name begins with "/", assume it begins with
536 * the pathname of the directory containing the device to open;
537 * otherwise, concatenate the device directory name and the
541 strlcpy(dname, device, sizeof(dname));
543 snprintf(dname, sizeof(dname), "%s/%s", PCAP_DEV_PREFIX,
547 * Get the unit number, and a pointer to the end of the device
550 cp = split_dname(dname, &ppa, ebuf);
555 * Make a copy of the device pathname, and then remove the unit
556 * number from the device pathname.
558 strlcpy(dname2, dname, sizeof(dname));
561 /* Try device without unit number */
562 if ((p->fd = open(dname, O_RDWR)) < 0) {
563 if (errno != ENOENT) {
564 snprintf(ebuf, PCAP_ERRBUF_SIZE, "%s: %s", dname,
565 pcap_strerror(errno));
569 /* Try again with unit number */
570 if ((p->fd = open(dname2, O_RDWR)) < 0) {
571 if (errno == ENOENT) {
573 * We just report "No DLPI device found"
574 * with the device name, so people don't
575 * get confused and think, for example,
576 * that if they can't capture on "lo0"
577 * on Solaris the fix is to change libpcap
578 * (or the application that uses it) to
579 * look for something other than "/dev/lo0",
580 * as the fix is to look for an operating
581 * system other than Solaris - you just
582 * *can't* capture on a loopback interface
583 * on Solaris, the lack of a DLPI device
584 * for the loopback interface is just a
585 * symptom of that inability.
587 snprintf(ebuf, PCAP_ERRBUF_SIZE,
588 "%s: No DLPI device found", device);
590 snprintf(ebuf, PCAP_ERRBUF_SIZE, "%s: %s",
591 dname2, pcap_strerror(errno));
595 /* XXX Assume unit zero */
600 p->snapshot = snaplen;
603 ** Attach if "style 2" provider
605 if (dlinforeq(p->fd, ebuf) < 0 ||
606 dlinfoack(p->fd, (char *)buf, ebuf) < 0)
608 infop = &((union DL_primitives *)buf)->info_ack;
610 if (infop->dl_mac_type == DL_IPATM)
613 if (infop->dl_provider_style == DL_STYLE2) {
614 if (dl_doattach(p->fd, ppa, ebuf) < 0)
617 if (p->send_fd >= 0) {
618 if (dl_doattach(p->send_fd, ppa, ebuf) < 0)
625 ** Bind (defer if using HP-UX 9 or HP-UX 10.20, totally skip if
628 #if !defined(HAVE_HPUX9) && !defined(HAVE_HPUX10_20) && !defined(sinix)
630 /* According to IBM's AIX Support Line, the dl_sap value
631 ** should not be less than 0x600 (1536) for standard Ethernet.
632 ** However, we seem to get DL_BADADDR - "DLSAP addr in improper
633 ** format or invalid" - errors if we use 1537 on the "tr0"
634 ** device, which, given that its name starts with "tr" and that
635 ** it's IBM, probably means a Token Ring device. (Perhaps we
636 ** need to use 1537 on "/dev/dlpi/en" because that device is for
637 ** D/I/X Ethernet, the "SAP" is actually an Ethernet type, and
638 ** it rejects invalid Ethernet types.)
640 ** So if 1537 fails, we try 2, as Hyung Sik Yoon of IBM Korea
641 ** says that works on Token Ring (he says that 0 does *not*
642 ** work; perhaps that's considered an invalid LLC SAP value - I
643 ** assume the SAP value in a DLPI bind is an LLC SAP for network
644 ** types that use 802.2 LLC).
646 if ((dlbindreq(p->fd, 1537, ebuf) < 0 &&
647 dlbindreq(p->fd, 2, ebuf) < 0) ||
648 dlbindack(p->fd, (char *)buf, ebuf) < 0)
650 #elif defined(DL_HP_RAWDLS)
652 ** This is the descriptor on which we receive packets; we
653 ** bind it to 22, as that's INSAP, as per the HP-UX DLPI
654 ** Programmer's Guide.
656 if (dlbindreq(p->fd, 22, ebuf) < 0 ||
657 dlbindack(p->fd, (char *)buf, ebuf) < 0)
660 if (p->send_fd >= 0) {
662 ** This is the descriptor on which we send packets; we
663 ** bind it to 24, as that's OUTSAP, as per the HP-UX
664 ** DLPI Programmer's Guide.
666 if (dlbindreq(p->send_fd, 24, ebuf) < 0 ||
667 dlbindack(p->send_fd, (char *)buf, ebuf) < 0)
670 #else /* neither AIX nor HP-UX */
671 if (dlbindreq(p->fd, 0, ebuf) < 0 ||
672 dlbindack(p->fd, (char *)buf, ebuf) < 0)
674 #endif /* SAP to bind to */
675 #endif /* HP-UX 9 or 10.20 or SINIX */
680 ** Have to turn on some special ATM promiscuous mode
682 ** Do *NOT* turn regular promiscuous mode on; it doesn't
683 ** help, and may break things.
685 if (strioctl(p->fd, A_PROMISCON_REQ, 0, NULL) < 0) {
686 snprintf(ebuf, PCAP_ERRBUF_SIZE, "A_PROMISCON_REQ: %s",
687 pcap_strerror(errno));
694 ** Enable promiscuous (not necessary on send FD)
696 if (dlpromisconreq(p->fd, DL_PROMISC_PHYS, ebuf) < 0 ||
697 dlokack(p->fd, "promisc_phys", (char *)buf, ebuf) < 0)
701 ** Try to enable multicast (you would have thought
702 ** promiscuous would be sufficient). (Skip if using
703 ** HP-UX or SINIX) (Not necessary on send FD)
705 #if !defined(__hpux) && !defined(sinix)
706 if (dlpromisconreq(p->fd, DL_PROMISC_MULTI, ebuf) < 0 ||
707 dlokack(p->fd, "promisc_multi", (char *)buf, ebuf) < 0)
709 "WARNING: DL_PROMISC_MULTI failed (%s)\n", ebuf);
713 ** Try to enable sap (when not in promiscuous mode when using
714 ** using HP-UX, when not doing SunATM on Solaris, and never
715 ** under SINIX) (Not necessary on send FD)
725 (dlpromisconreq(p->fd, DL_PROMISC_SAP, ebuf) < 0 ||
726 dlokack(p->fd, "promisc_sap", (char *)buf, ebuf) < 0)) {
727 /* Not fatal if promisc since the DL_PROMISC_PHYS worked */
730 "WARNING: DL_PROMISC_SAP failed (%s)\n", ebuf);
737 ** HP-UX 9 and HP-UX 10.20 must bind after setting promiscuous
740 #if defined(HAVE_HPUX9) || defined(HAVE_HPUX10_20)
741 if (dlbindreq(p->fd, 0, ebuf) < 0 ||
742 dlbindack(p->fd, (char *)buf, ebuf) < 0)
747 ** Determine link type
748 ** XXX - get SAP length and address length as well, for use
749 ** when sending packets.
751 if (dlinforeq(p->fd, ebuf) < 0 ||
752 dlinfoack(p->fd, (char *)buf, ebuf) < 0)
755 infop = &((union DL_primitives *)buf)->info_ack;
756 switch (infop->dl_mac_type) {
760 p->linktype = DLT_EN10MB;
763 * This is (presumably) a real Ethernet capture; give it a
764 * link-layer-type list with DLT_EN10MB and DLT_DOCSIS, so
765 * that an application can let you choose it, in case you're
766 * capturing DOCSIS traffic that a Cisco Cable Modem
767 * Termination System is putting out onto an Ethernet (it
768 * doesn't put an Ethernet header onto the wire, it puts raw
769 * DOCSIS frames out on the wire inside the low-level
772 p->dlt_list = (u_int *) malloc(sizeof(u_int) * 2);
774 * If that fails, just leave the list empty.
776 if (p->dlt_list != NULL) {
777 p->dlt_list[0] = DLT_EN10MB;
778 p->dlt_list[1] = DLT_DOCSIS;
784 p->linktype = DLT_FDDI;
790 * XXX - what about DL_TPB? Is that Token Bus?
792 p->linktype = DLT_IEEE802;
798 p->linktype = DLT_SUNATM;
799 p->offset = 0; /* works for LANE and LLC encapsulation */
804 snprintf(ebuf, PCAP_ERRBUF_SIZE, "unknown mac type %lu",
805 (unsigned long)infop->dl_mac_type);
811 ** This is a non standard SunOS hack to get the full raw link-layer
814 if (strioctl(p->fd, DLIOCRAW, 0, NULL) < 0) {
815 snprintf(ebuf, PCAP_ERRBUF_SIZE, "DLIOCRAW: %s",
816 pcap_strerror(errno));
821 #ifdef HAVE_SYS_BUFMOD_H
823 ** Another non standard call to get the data nicely buffered
825 if (ioctl(p->fd, I_PUSH, "bufmod") != 0) {
826 snprintf(ebuf, PCAP_ERRBUF_SIZE, "I_PUSH bufmod: %s",
827 pcap_strerror(errno));
832 ** Now that the bufmod is pushed lets configure it.
834 ** There is a bug in bufmod(7). When dealing with messages of
835 ** less than snaplen size it strips data from the beginning not
838 ** This bug is supposed to be fixed in 5.3.2. Also, there is a
839 ** patch available. Ask for bugid 1149065.
843 release = get_release(&osmajor, &osminor, &osmicro);
844 if (osmajor == 5 && (osminor <= 2 || (osminor == 3 && osmicro < 2)) &&
845 getenv("BUFMOD_FIXED") == NULL) {
847 "WARNING: bufmod is broken in SunOS %s; ignoring snaplen.\n",
853 strioctl(p->fd, SBIOCSSNAP, sizeof(ss), (char *)&ss) != 0) {
854 snprintf(ebuf, PCAP_ERRBUF_SIZE, "SBIOCSSNAP: %s",
855 pcap_strerror(errno));
860 ** Set up the bufmod timeout
865 to.tv_sec = to_ms / 1000;
866 to.tv_usec = (to_ms * 1000) % 1000000;
867 if (strioctl(p->fd, SBIOCSTIME, sizeof(to), (char *)&to) != 0) {
868 snprintf(ebuf, PCAP_ERRBUF_SIZE, "SBIOCSTIME: %s",
869 pcap_strerror(errno));
875 ** Set the chunk length.
877 chunksize = CHUNKSIZE;
878 if (strioctl(p->fd, SBIOCSCHUNK, sizeof(chunksize), (char *)&chunksize)
880 snprintf(ebuf, PCAP_ERRBUF_SIZE, "SBIOCSCHUNKP: %s",
881 pcap_strerror(errno));
887 ** As the last operation flush the read side.
889 if (ioctl(p->fd, I_FLUSH, FLUSHR) != 0) {
890 snprintf(ebuf, PCAP_ERRBUF_SIZE, "FLUSHR: %s",
891 pcap_strerror(errno));
895 /* Allocate data buffer */
896 p->bufsize = PKTBUFSIZE;
897 p->buffer = (u_char *)malloc(p->bufsize + p->offset);
898 if (p->buffer == NULL) {
899 strlcpy(ebuf, pcap_strerror(errno), PCAP_ERRBUF_SIZE);
904 * "p->fd" is an FD for a STREAMS device, so "select()" and
905 * "poll()" should work on it.
907 p->selectable_fd = p->fd;
909 p->read_op = pcap_read_dlpi;
910 p->inject_op = pcap_inject_dlpi;
911 p->setfilter_op = install_bpf_program; /* no kernel filtering */
912 p->set_datalink_op = NULL; /* can't change data link type */
913 p->getnonblock_op = pcap_getnonblock_fd;
914 p->setnonblock_op = pcap_setnonblock_fd;
915 p->stats_op = pcap_stats_dlpi;
916 p->close_op = pcap_close_dlpi;
925 * Get rid of any link-layer type list we allocated.
927 if (p->dlt_list != NULL)
934 * Split a device name into a device type name and a unit number;
935 * return the a pointer to the beginning of the unit number, which
936 * is the end of the device type name, and set "*unitp" to the unit
939 * Returns NULL on error, and fills "ebuf" with an error message.
942 split_dname(char *device, int *unitp, char *ebuf)
949 * Look for a number at the end of the device name string.
951 cp = device + strlen(device) - 1;
952 if (*cp < '0' || *cp > '9') {
953 snprintf(ebuf, PCAP_ERRBUF_SIZE, "%s missing unit number",
958 /* Digits at end of string are unit number */
959 while (cp-1 >= device && *(cp-1) >= '0' && *(cp-1) <= '9')
963 unit = strtol(cp, &eos, 10);
965 snprintf(ebuf, PCAP_ERRBUF_SIZE, "%s bad unit number", device);
968 if (errno == ERANGE || unit > INT_MAX) {
969 snprintf(ebuf, PCAP_ERRBUF_SIZE, "%s unit number too large",
974 snprintf(ebuf, PCAP_ERRBUF_SIZE, "%s unit number is negative",
983 dl_doattach(int fd, int ppa, char *ebuf)
985 bpf_u_int32 buf[MAXDLBUF];
987 if (dlattachreq(fd, ppa, ebuf) < 0 ||
988 dlokack(fd, "attach", (char *)buf, ebuf) < 0)
994 pcap_platform_finddevs(pcap_if_t **alldevsp, char *errbuf)
1000 char pad[516]; /* XXX - must be at least 513; is 516
1007 * We may have to do special magic to get ATM devices.
1009 if ((fd = open("/dev/ba", O_RDWR)) < 0) {
1011 * We couldn't open the "ba" device.
1012 * For now, just give up; perhaps we should
1013 * return an error if the problem is neither
1014 * a "that device doesn't exist" error (ENOENT,
1015 * ENXIO, etc.) or a "you're not allowed to do
1016 * that" error (EPERM, EACCES).
1021 if (strioctl(fd, A_GET_UNITS, sizeof(buf), (char *)&buf) < 0) {
1022 snprintf(errbuf, PCAP_ERRBUF_SIZE, "A_GET_UNITS: %s",
1023 pcap_strerror(errno));
1026 for (i = 0; i < buf.nunits; i++) {
1027 snprintf(baname, sizeof baname, "ba%u", i);
1028 if (pcap_add_if(alldevsp, baname, 0, NULL, errbuf) < 0)
1037 send_request(int fd, char *ptr, int len, char *what, char *ebuf)
1047 if (putmsg(fd, &ctl, (struct strbuf *) NULL, flags) < 0) {
1048 snprintf(ebuf, PCAP_ERRBUF_SIZE,
1049 "send_request: putmsg \"%s\": %s",
1050 what, pcap_strerror(errno));
1057 recv_ack(int fd, int size, const char *what, char *bufp, char *ebuf)
1059 union DL_primitives *dlp;
1063 ctl.maxlen = MAXDLBUF;
1068 if (getmsg(fd, &ctl, (struct strbuf*)NULL, &flags) < 0) {
1069 snprintf(ebuf, PCAP_ERRBUF_SIZE, "recv_ack: %s getmsg: %s",
1070 what, pcap_strerror(errno));
1074 dlp = (union DL_primitives *) ctl.buf;
1075 switch (dlp->dl_primitive) {
1080 #ifdef DL_HP_PPA_ACK
1087 switch (dlp->error_ack.dl_errno) {
1090 snprintf(ebuf, PCAP_ERRBUF_SIZE,
1091 "recv_ack: %s: UNIX error - %s",
1092 what, pcap_strerror(dlp->error_ack.dl_unix_errno));
1096 snprintf(ebuf, PCAP_ERRBUF_SIZE, "recv_ack: %s: %s",
1097 what, dlstrerror(dlp->error_ack.dl_errno));
1103 snprintf(ebuf, PCAP_ERRBUF_SIZE,
1104 "recv_ack: %s: Unexpected primitive ack %s",
1105 what, dlprim(dlp->dl_primitive));
1109 if (ctl.len < size) {
1110 snprintf(ebuf, PCAP_ERRBUF_SIZE,
1111 "recv_ack: %s: Ack too small (%d < %d)",
1112 what, ctl.len, size);
1119 dlstrerror(bpf_u_int32 dl_errno)
1121 static char errstring[6+2+8+1];
1126 return ("Improper permissions for request");
1129 return ("DLSAP addr in improper format or invalid");
1132 return ("Seq number not from outstand DL_CONN_IND");
1135 return ("User data exceeded provider limit");
1138 #ifdef HAVE_DEV_DLPI
1140 * With a single "/dev/dlpi" device used for all
1141 * DLPI providers, PPAs have nothing to do with
1144 return ("Specified PPA was invalid");
1147 * We have separate devices for separate devices;
1148 * the PPA is just the unit number.
1150 return ("Specified PPA (device unit) was invalid");
1154 return ("Primitive received not known by provider");
1156 case DL_BADQOSPARAM:
1157 return ("QOS parameters contained invalid values");
1160 return ("QOS structure type is unknown/unsupported");
1163 return ("Bad LSAP selector");
1166 return ("Token used not an active stream");
1169 return ("Attempted second bind with dl_max_conind");
1172 return ("Physical link initialization failed");
1175 return ("Provider couldn't allocate alternate address");
1178 return ("Physical link not initialized");
1181 return ("Primitive issued in improper state");
1184 return ("UNIX system error occurred");
1186 case DL_UNSUPPORTED:
1187 return ("Requested service not supplied by provider");
1189 case DL_UNDELIVERABLE:
1190 return ("Previous data unit could not be delivered");
1192 case DL_NOTSUPPORTED:
1193 return ("Primitive is known but not supported");
1196 return ("Limit exceeded");
1199 return ("Promiscuous mode not enabled");
1202 return ("Other streams for PPA in post-attached");
1205 return ("Automatic handling XID&TEST not supported");
1208 return ("Automatic handling of XID not supported");
1211 return ("Automatic handling of TEST not supported");
1214 return ("Automatic handling of XID response");
1217 return ("Automatic handling of TEST response");
1220 return ("Pending outstanding connect indications");
1223 sprintf(errstring, "Error %02x", dl_errno);
1229 dlprim(bpf_u_int32 prim)
1231 static char primbuf[80];
1236 return ("DL_INFO_REQ");
1239 return ("DL_INFO_ACK");
1242 return ("DL_ATTACH_REQ");
1245 return ("DL_DETACH_REQ");
1248 return ("DL_BIND_REQ");
1251 return ("DL_BIND_ACK");
1254 return ("DL_UNBIND_REQ");
1257 return ("DL_OK_ACK");
1260 return ("DL_ERROR_ACK");
1262 case DL_SUBS_BIND_REQ:
1263 return ("DL_SUBS_BIND_REQ");
1265 case DL_SUBS_BIND_ACK:
1266 return ("DL_SUBS_BIND_ACK");
1268 case DL_UNITDATA_REQ:
1269 return ("DL_UNITDATA_REQ");
1271 case DL_UNITDATA_IND:
1272 return ("DL_UNITDATA_IND");
1274 case DL_UDERROR_IND:
1275 return ("DL_UDERROR_IND");
1278 return ("DL_UDQOS_REQ");
1280 case DL_CONNECT_REQ:
1281 return ("DL_CONNECT_REQ");
1283 case DL_CONNECT_IND:
1284 return ("DL_CONNECT_IND");
1286 case DL_CONNECT_RES:
1287 return ("DL_CONNECT_RES");
1289 case DL_CONNECT_CON:
1290 return ("DL_CONNECT_CON");
1293 return ("DL_TOKEN_REQ");
1296 return ("DL_TOKEN_ACK");
1298 case DL_DISCONNECT_REQ:
1299 return ("DL_DISCONNECT_REQ");
1301 case DL_DISCONNECT_IND:
1302 return ("DL_DISCONNECT_IND");
1305 return ("DL_RESET_REQ");
1308 return ("DL_RESET_IND");
1311 return ("DL_RESET_RES");
1314 return ("DL_RESET_CON");
1317 (void) sprintf(primbuf, "unknown primitive 0x%x", prim);
1323 dlattachreq(int fd, bpf_u_int32 ppa, char *ebuf)
1325 dl_attach_req_t req;
1327 req.dl_primitive = DL_ATTACH_REQ;
1330 return (send_request(fd, (char *)&req, sizeof(req), "attach", ebuf));
1334 dlbindreq(int fd, bpf_u_int32 sap, char *ebuf)
1339 memset((char *)&req, 0, sizeof(req));
1340 req.dl_primitive = DL_BIND_REQ;
1342 req.dl_max_conind = 1; /* XXX magic number */
1343 /* 22 is INSAP as per the HP-UX DLPI Programmer's Guide */
1345 req.dl_service_mode = DL_HP_RAWDLS;
1349 req.dl_service_mode = DL_CLDLS;
1353 return (send_request(fd, (char *)&req, sizeof(req), "bind", ebuf));
1357 dlbindack(int fd, char *bufp, char *ebuf)
1360 return (recv_ack(fd, DL_BIND_ACK_SIZE, "bind", bufp, ebuf));
1364 dlpromisconreq(int fd, bpf_u_int32 level, char *ebuf)
1366 dl_promiscon_req_t req;
1368 req.dl_primitive = DL_PROMISCON_REQ;
1369 req.dl_level = level;
1371 return (send_request(fd, (char *)&req, sizeof(req), "promiscon", ebuf));
1375 dlokack(int fd, const char *what, char *bufp, char *ebuf)
1378 return (recv_ack(fd, DL_OK_ACK_SIZE, what, bufp, ebuf));
1383 dlinforeq(int fd, char *ebuf)
1387 req.dl_primitive = DL_INFO_REQ;
1389 return (send_request(fd, (char *)&req, sizeof(req), "info", ebuf));
1393 dlinfoack(int fd, char *bufp, char *ebuf)
1396 return (recv_ack(fd, DL_INFO_ACK_SIZE, "info", bufp, ebuf));
1401 * There's an ack *if* there's an error.
1404 dlrawdatareq(int fd, const u_char *datap, int datalen)
1406 struct strbuf ctl, data;
1407 long buf[MAXDLBUF]; /* XXX - char? */
1408 union DL_primitives *dlp;
1411 dlp = (union DL_primitives*) buf;
1413 dlp->dl_primitive = DL_HP_RAWDATA_REQ;
1414 dlen = DL_HP_RAWDATA_REQ_SIZE;
1417 * HP's documentation doesn't appear to show us supplying any
1418 * address pointed to by the control part of the message.
1419 * I think that's what raw mode means - you just send the raw
1420 * packet, you don't specify where to send it to, as that's
1421 * implied by the destination address.
1425 ctl.buf = (void *)buf;
1429 data.buf = (void *)datap;
1431 return (putmsg(fd, &ctl, &data, 0));
1433 #endif /* DL_HP_RAWDLS */
1435 #ifdef HAVE_SYS_BUFMOD_H
1437 strioctl(int fd, int cmd, int len, char *dp)
1439 struct strioctl str;
1446 rc = ioctl(fd, I_STR, &str);
1451 return (str.ic_len);
1455 #if defined(HAVE_SOLARIS) && defined(HAVE_SYS_BUFMOD_H)
1457 get_release(bpf_u_int32 *majorp, bpf_u_int32 *minorp, bpf_u_int32 *microp)
1460 static char buf[32];
1465 if (sysinfo(SI_RELEASE, buf, sizeof(buf)) < 0)
1468 if (!isdigit((unsigned char)*cp))
1470 *majorp = strtol(cp, &cp, 10);
1473 *minorp = strtol(cp, &cp, 10);
1476 *microp = strtol(cp, &cp, 10);
1481 #ifdef DL_HP_PPA_REQ
1483 * Under HP-UX 10 and HP-UX 11, we can ask for the ppa
1488 * Determine ppa number that specifies ifname.
1490 * If the "dl_hp_ppa_info_t" doesn't have a "dl_module_id_1" member,
1491 * the code that's used here is the old code for HP-UX 10.x.
1493 * However, HP-UX 10.20, at least, appears to have such a member
1494 * in its "dl_hp_ppa_info_t" structure, so the new code is used.
1495 * The new code didn't work on an old 10.20 system on which Rick
1496 * Jones of HP tried it, but with later patches installed, it
1497 * worked - it appears that the older system had those members but
1498 * didn't put anything in them, so, if the search by name fails, we
1499 * do the old search.
1501 * Rick suggests that making sure your system is "up on the latest
1502 * lancommon/DLPI/driver patches" is probably a good idea; it'd fix
1503 * that problem, as well as allowing libpcap to see packets sent
1504 * from the system on which the libpcap application is being run.
1505 * (On 10.20, in addition to getting the latest patches, you need
1506 * to turn the kernel "lanc_outbound_promisc_flag" flag on with ADB;
1507 * a posting to "comp.sys.hp.hpux" at
1509 * http://www.deja.com/[ST_rn=ps]/getdoc.xp?AN=558092266
1511 * says that, to see the machine's outgoing traffic, you'd need to
1512 * apply the right patches to your system, and also set that variable
1515 echo 'lanc_outbound_promisc_flag/W1' | /usr/bin/adb -w /stand/vmunix /dev/kmem
1517 * which could be put in, for example, "/sbin/init.d/lan".
1519 * Setting the variable is not necessary on HP-UX 11.x.
1522 get_dlpi_ppa(register int fd, register const char *device, register int unit,
1523 register char *ebuf)
1525 register dl_hp_ppa_ack_t *ap;
1526 register dl_hp_ppa_info_t *ipstart, *ip;
1529 register u_long majdev;
1530 struct stat statbuf;
1531 dl_hp_ppa_req_t req;
1534 dl_hp_ppa_ack_t *dlp;
1539 memset((char *)&req, 0, sizeof(req));
1540 req.dl_primitive = DL_HP_PPA_REQ;
1542 memset((char *)buf, 0, sizeof(buf));
1543 if (send_request(fd, (char *)&req, sizeof(req), "hpppa", ebuf) < 0)
1546 ctl.maxlen = DL_HP_PPA_ACK_SIZE;
1548 ctl.buf = (char *)buf;
1552 * DLPI may return a big chunk of data for a DL_HP_PPA_REQ. The normal
1553 * recv_ack will fail because it set the maxlen to MAXDLBUF (8192)
1554 * which is NOT big enough for a DL_HP_PPA_REQ.
1556 * This causes libpcap applications to fail on a system with HP-APA
1559 * To figure out how big the returned data is, we first call getmsg
1560 * to get the small head and peek at the head to get the actual data
1561 * length, and then issue another getmsg to get the actual PPA data.
1563 /* get the head first */
1564 if (getmsg(fd, &ctl, (struct strbuf *)NULL, &flags) < 0) {
1565 snprintf(ebuf, PCAP_ERRBUF_SIZE,
1566 "get_dlpi_ppa: hpppa getmsg: %s", pcap_strerror(errno));
1570 dlp = (dl_hp_ppa_ack_t *)ctl.buf;
1571 if (dlp->dl_primitive != DL_HP_PPA_ACK) {
1572 snprintf(ebuf, PCAP_ERRBUF_SIZE,
1573 "get_dlpi_ppa: hpppa unexpected primitive ack 0x%x",
1574 (bpf_u_int32)dlp->dl_primitive);
1578 if (ctl.len < DL_HP_PPA_ACK_SIZE) {
1579 snprintf(ebuf, PCAP_ERRBUF_SIZE,
1580 "get_dlpi_ppa: hpppa ack too small (%d < %lu)",
1581 ctl.len, (unsigned long)DL_HP_PPA_ACK_SIZE);
1585 /* allocate buffer */
1586 if ((ppa_data_buf = (char *)malloc(dlp->dl_length)) == NULL) {
1587 snprintf(ebuf, PCAP_ERRBUF_SIZE,
1588 "get_dlpi_ppa: hpppa malloc: %s", pcap_strerror(errno));
1591 ctl.maxlen = dlp->dl_length;
1593 ctl.buf = (char *)ppa_data_buf;
1595 if (getmsg(fd, &ctl, (struct strbuf *)NULL, &flags) < 0) {
1596 snprintf(ebuf, PCAP_ERRBUF_SIZE,
1597 "get_dlpi_ppa: hpppa getmsg: %s", pcap_strerror(errno));
1601 if (ctl.len < dlp->dl_length) {
1602 snprintf(ebuf, PCAP_ERRBUF_SIZE,
1603 "get_dlpi_ppa: hpppa ack too small (%d < %d)",
1604 ctl.len, dlp->dl_length);
1609 ap = (dl_hp_ppa_ack_t *)buf;
1610 ipstart = (dl_hp_ppa_info_t *)ppa_data_buf;
1613 #ifdef HAVE_HP_PPA_INFO_T_DL_MODULE_ID_1
1615 * The "dl_hp_ppa_info_t" structure has a "dl_module_id_1"
1616 * member that should, in theory, contain the part of the
1617 * name for the device that comes before the unit number,
1618 * and should also have a "dl_module_id_2" member that may
1619 * contain an alternate name (e.g., I think Ethernet devices
1620 * have both "lan", for "lanN", and "snap", for "snapN", with
1621 * the former being for Ethernet packets and the latter being
1622 * for 802.3/802.2 packets).
1624 * Search for the device that has the specified name and
1627 for (i = 0; i < ap->dl_count; i++) {
1628 if ((strcmp((const char *)ip->dl_module_id_1, device) == 0 ||
1629 strcmp((const char *)ip->dl_module_id_2, device) == 0) &&
1630 ip->dl_instance_num == unit)
1633 ip = (dl_hp_ppa_info_t *)((u_char *)ipstart + ip->dl_next_offset);
1637 * We don't have that member, so the search is impossible; make it
1638 * look as if the search failed.
1643 if (i == ap->dl_count) {
1645 * Well, we didn't, or can't, find the device by name.
1647 * HP-UX 10.20, whilst it has "dl_module_id_1" and
1648 * "dl_module_id_2" fields in the "dl_hp_ppa_info_t",
1649 * doesn't seem to fill them in unless the system is
1650 * at a reasonably up-to-date patch level.
1652 * Older HP-UX 10.x systems might not have those fields
1655 * Therefore, we'll search for the entry with the major
1656 * device number of a device with the name "/dev/<dev><unit>",
1657 * if such a device exists, as the old code did.
1659 snprintf(dname, sizeof(dname), "/dev/%s%d", device, unit);
1660 if (stat(dname, &statbuf) < 0) {
1661 snprintf(ebuf, PCAP_ERRBUF_SIZE, "stat: %s: %s",
1662 dname, pcap_strerror(errno));
1665 majdev = major(statbuf.st_rdev);
1669 for (i = 0; i < ap->dl_count; i++) {
1670 if (ip->dl_mjr_num == majdev &&
1671 ip->dl_instance_num == unit)
1674 ip = (dl_hp_ppa_info_t *)((u_char *)ipstart + ip->dl_next_offset);
1677 if (i == ap->dl_count) {
1678 snprintf(ebuf, PCAP_ERRBUF_SIZE,
1679 "can't find /dev/dlpi PPA for %s%d", device, unit);
1682 if (ip->dl_hdw_state == HDW_DEAD) {
1683 snprintf(ebuf, PCAP_ERRBUF_SIZE,
1684 "%s%d: hardware state: DOWN\n", device, unit);
1696 * Under HP-UX 9, there is no good way to determine the ppa.
1697 * So punt and read it from /dev/kmem.
1699 static struct nlist nl[] = {
1705 static char path_vmunix[] = "/hp-ux";
1707 /* Determine ppa number that specifies ifname */
1709 get_dlpi_ppa(register int fd, register const char *ifname, register int unit,
1710 register char *ebuf)
1712 register const char *cp;
1716 char if_name[sizeof(ifnet.if_name) + 1];
1718 cp = strrchr(ifname, '/');
1721 if (nlist(path_vmunix, &nl) < 0) {
1722 snprintf(ebuf, PCAP_ERRBUF_SIZE, "nlist %s failed",
1726 if (nl[NL_IFNET].n_value == 0) {
1727 snprintf(ebuf, PCAP_ERRBUF_SIZE,
1728 "could't find %s kernel symbol",
1729 nl[NL_IFNET].n_name);
1732 kd = open("/dev/kmem", O_RDONLY);
1734 snprintf(ebuf, PCAP_ERRBUF_SIZE, "kmem open: %s",
1735 pcap_strerror(errno));
1738 if (dlpi_kread(kd, nl[NL_IFNET].n_value,
1739 &addr, sizeof(addr), ebuf) < 0) {
1743 for (; addr != NULL; addr = ifnet.if_next) {
1744 if (dlpi_kread(kd, (off_t)addr,
1745 &ifnet, sizeof(ifnet), ebuf) < 0 ||
1746 dlpi_kread(kd, (off_t)ifnet.if_name,
1747 if_name, sizeof(ifnet.if_name), ebuf) < 0) {
1751 if_name[sizeof(ifnet.if_name)] = '\0';
1752 if (strcmp(if_name, ifname) == 0 && ifnet.if_unit == unit)
1753 return (ifnet.if_index);
1756 snprintf(ebuf, PCAP_ERRBUF_SIZE, "Can't find %s", ifname);
1761 dlpi_kread(register int fd, register off_t addr,
1762 register void *buf, register u_int len, register char *ebuf)
1766 if (lseek(fd, addr, SEEK_SET) < 0) {
1767 snprintf(ebuf, PCAP_ERRBUF_SIZE, "lseek: %s",
1768 pcap_strerror(errno));
1771 cc = read(fd, buf, len);
1773 snprintf(ebuf, PCAP_ERRBUF_SIZE, "read: %s",
1774 pcap_strerror(errno));
1776 } else if (cc != len) {
1777 snprintf(ebuf, PCAP_ERRBUF_SIZE, "short read (%d != %d)", cc,