2 * Copyright (c) 2006 Paolo Abeni (Italy)
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 * 3. The name of the author may not be used to endorse or promote
15 * products derived from this software without specific prior written
18 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
19 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
20 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
21 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
22 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
23 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
24 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
25 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
26 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
27 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
28 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
30 * USB sniffing API implementation for Linux platform
31 * By Paolo Abeni <paolo.abeni@email.it>
32 * Modifications: Kris Katterjohn <katterjohn@gmail.com>
41 #include "pcap-usb-linux.h"
44 #ifdef NEED_STRERROR_H
57 #include <netinet/in.h>
58 #include <sys/ioctl.h>
60 #include <sys/utsname.h>
61 #ifdef HAVE_LINUX_USBDEVICE_FS_H
63 * We might need <linux/compiler.h> to define __user for
64 * <linux/usbdevice_fs.h>.
66 #ifdef HAVE_LINUX_COMPILER_H
67 #include <linux/compiler.h>
68 #endif /* HAVE_LINUX_COMPILER_H */
69 #include <linux/usbdevice_fs.h>
70 #endif /* HAVE_LINUX_USBDEVICE_FS_H */
72 #define USB_IFACE "usbmon"
73 #define USB_TEXT_DIR_OLD "/sys/kernel/debug/usbmon"
74 #define USB_TEXT_DIR "/sys/kernel/debug/usb/usbmon"
75 #define SYS_USB_BUS_DIR "/sys/bus/usb/devices"
76 #define PROC_USB_BUS_DIR "/proc/bus/usb"
77 #define USB_LINE_LEN 4096
79 #if __BYTE_ORDER == __LITTLE_ENDIAN
84 #define htols(s) bswap_16(s)
85 #define htoll(l) bswap_32(l)
86 #define htol64(ll) bswap_64(ll)
89 struct mon_bin_stats {
97 size_t data_len; /* Length of data (can be zero) */
100 struct mon_bin_mfetch {
101 int32_t *offvec; /* Vector of events fetched */
102 int32_t nfetch; /* Number of events to fetch (out: fetched) */
103 int32_t nflush; /* Number of events to flush */
106 #define MON_IOC_MAGIC 0x92
108 #define MON_IOCQ_URB_LEN _IO(MON_IOC_MAGIC, 1)
109 #define MON_IOCX_URB _IOWR(MON_IOC_MAGIC, 2, struct mon_bin_hdr)
110 #define MON_IOCG_STATS _IOR(MON_IOC_MAGIC, 3, struct mon_bin_stats)
111 #define MON_IOCT_RING_SIZE _IO(MON_IOC_MAGIC, 4)
112 #define MON_IOCQ_RING_SIZE _IO(MON_IOC_MAGIC, 5)
113 #define MON_IOCX_GET _IOW(MON_IOC_MAGIC, 6, struct mon_bin_get)
114 #define MON_IOCX_MFETCH _IOWR(MON_IOC_MAGIC, 7, struct mon_bin_mfetch)
115 #define MON_IOCH_MFLUSH _IO(MON_IOC_MAGIC, 8)
117 #define MON_BIN_SETUP 0x1 /* setup hdr is present*/
118 #define MON_BIN_SETUP_ZERO 0x2 /* setup buffer is not available */
119 #define MON_BIN_DATA_ZERO 0x4 /* data buffer is not available */
120 #define MON_BIN_ERROR 0x8
123 * Private data for capturing on Linux USB.
125 struct pcap_usb_linux {
126 u_char *mmapbuf; /* memory-mapped region pointer */
127 size_t mmapbuflen; /* size of region */
132 /* forward declaration */
133 static int usb_activate(pcap_t *);
134 static int usb_stats_linux(pcap_t *, struct pcap_stat *);
135 static int usb_stats_linux_bin(pcap_t *, struct pcap_stat *);
136 static int usb_read_linux(pcap_t *, int , pcap_handler , u_char *);
137 static int usb_read_linux_bin(pcap_t *, int , pcap_handler , u_char *);
138 static int usb_read_linux_mmap(pcap_t *, int , pcap_handler , u_char *);
139 static int usb_inject_linux(pcap_t *, const void *, size_t);
140 static int usb_setdirection_linux(pcap_t *, pcap_direction_t);
141 static void usb_cleanup_linux_mmap(pcap_t *);
144 have_binary_usbmon(void)
146 struct utsname utsname;
147 char *version_component, *endp;
148 int major, minor, subminor;
150 if (uname(&utsname) == 0) {
152 * 2.6.21 is the first release with the binary-mode
155 version_component = utsname.release;
156 major = strtol(version_component, &endp, 10);
157 if (endp != version_component && *endp == '.') {
159 * OK, that was a valid major version.
160 * Is it 3 or greater? If so, we have binary
167 * Is it 1 or less? If so, we don't have binary
168 * mode support. (In fact, we don't have any
169 * USB monitoring....)
176 * OK, this is a 2.x kernel.
177 * What's the minor version?
179 version_component = endp + 1;
180 minor = strtol(version_component, &endp, 10);
181 if (endp != version_component &&
182 (*endp == '.' || *endp == '\0')) {
184 * OK, that was a valid minor version.
185 * Is is 2.6 or later? (There shouldn't be a
186 * "later", as 2.6.x went to 3.x, but we'll
191 * No, so no binary support (did 2.4 have
192 * any USB monitoring at all?)
198 * OK, this is a 2.6.x kernel.
199 * What's the subminor version?
201 version_component = endp + 1;
202 subminor = strtol(version_component, &endp, 10);
203 if (endp != version_component &&
204 (*endp == '.' || *endp == '\0')) {
206 * OK, that was a valid subminor version.
207 * Is it 21 or greater?
209 if (subminor >= 21) {
211 * Yes - we have binary mode
221 * Either uname() failed, in which case we just say "no binary
222 * mode support", or we don't have binary mode support.
227 /* facility to add an USB device to the device list*/
229 usb_dev_add(pcap_if_list_t *devlistp, int n, char *err_str)
233 pcap_snprintf(dev_name, 10, USB_IFACE"%d", n);
235 * XXX - is there any notion of "up" and "running"?
239 * As this refers to all buses, there's no notion of
240 * "connected" vs. "disconnected", as that's a property
241 * that would apply to a particular USB interface.
243 if (add_dev(devlistp, dev_name,
244 PCAP_IF_CONNECTION_STATUS_NOT_APPLICABLE,
245 "Raw USB traffic, all USB buses", err_str) == NULL)
249 * XXX - is there a way to determine whether anything's
250 * plugged into this bus interface or not, and set
251 * PCAP_IF_CONNECTION_STATUS_CONNECTED or
252 * PCAP_IF_CONNECTION_STATUS_DISCONNECTED?
254 pcap_snprintf(dev_descr, 30, "Raw USB traffic, bus number %d", n);
255 if (add_dev(devlistp, dev_name, 0, dev_descr, err_str) == NULL)
263 usb_findalldevs(pcap_if_list_t *devlistp, char *err_str)
265 char usb_mon_dir[PATH_MAX];
266 char *usb_mon_prefix;
267 size_t usb_mon_prefix_len;
275 if (have_binary_usbmon()) {
277 * We have binary-mode support.
278 * What do the device names look like?
279 * Split LINUX_USB_MON_DEV into a directory that we'll
280 * scan and a file name prefix that we'll check for.
282 pcap_strlcpy(usb_mon_dir, LINUX_USB_MON_DEV, sizeof usb_mon_dir);
283 usb_mon_prefix = strrchr(usb_mon_dir, '/');
284 if (usb_mon_prefix == NULL) {
286 * This "shouldn't happen". Just give up if it
291 *usb_mon_prefix++ = '\0';
292 usb_mon_prefix_len = strlen(usb_mon_prefix);
295 * Open the directory and scan it.
297 dir = opendir(usb_mon_dir);
299 while ((ret == 0) && ((data = readdir(dir)) != 0)) {
303 * Is this a usbmon device?
305 if (strncmp(name, usb_mon_prefix, usb_mon_prefix_len) != 0)
309 * What's the device number?
311 if (sscanf(&name[usb_mon_prefix_len], "%d", &n) == 0)
312 continue; /* failed */
314 ret = usb_dev_add(devlistp, n, err_str);
322 * We have only text mode support.
323 * We don't look for the text devices because we can't
324 * look for them without root privileges, and we don't
325 * want to require root privileges to enumerate devices
326 * (we want to let the user to try a device and get
327 * an error, rather than seeing no devices and asking
328 * "why am I not seeing devices" and forcing a long
329 * process of poking to figure out whether it's "no
330 * privileges" or "your kernel is too old" or "the
331 * usbmon module isn't loaded" or...).
333 * Instead, we look to see what buses we have.
334 * If the kernel is so old that it doesn't have
335 * binary-mode support, it's also so old that
336 * it doesn't have a "scan all buses" device.
338 * First, try scanning sysfs USB bus directory.
340 dir = opendir(SYS_USB_BUS_DIR);
342 while ((ret == 0) && ((data = readdir(dir)) != 0)) {
345 if (strncmp(name, "usb", 3) != 0)
348 if (sscanf(&name[3], "%d", &n) == 0)
351 ret = usb_dev_add(devlistp, n, err_str);
358 /* That didn't work; try scanning procfs USB bus directory. */
359 dir = opendir(PROC_USB_BUS_DIR);
361 while ((ret == 0) && ((data = readdir(dir)) != 0)) {
365 /* if this file name does not end with a number it's not of our interest */
366 if ((len < 1) || !isdigit(name[--len]))
368 while (isdigit(name[--len]));
369 if (sscanf(&name[len+1], "%d", &n) != 1)
372 ret = usb_dev_add(devlistp, n, err_str);
379 /* neither of them worked */
385 * Matches what's in mon_bin.c in the Linux kernel.
387 #define MIN_RING_SIZE (8*1024)
388 #define MAX_RING_SIZE (1200*1024)
391 usb_set_ring_size(pcap_t* handle, int header_size)
394 * A packet from binary usbmon has:
396 * 1) a fixed-length header, of size header_size;
397 * 2) descriptors, for isochronous transfers;
400 * The kernel buffer has a size, defaulting to 300KB, with a
401 * minimum of 8KB and a maximum of 1200KB. The size is set with
402 * the MON_IOCT_RING_SIZE ioctl; the size passed in is rounded up
405 * No more than {buffer size}/5 bytes worth of payload is saved.
406 * Therefore, if we subtract the fixed-length size from the
407 * snapshot length, we have the biggest payload we want (we
408 * don't worry about the descriptors - if we have descriptors,
409 * we'll just discard the last bit of the payload to get it
410 * to fit). We multiply that result by 5 and set the buffer
411 * size to that value.
415 if (handle->snapshot < header_size)
416 handle->snapshot = header_size;
417 /* The maximum snapshot size is small enough that this won't overflow */
418 ring_size = (handle->snapshot - header_size) * 5;
421 * Will this get an error?
422 * (There's no wqy to query the minimum or maximum, so we just
423 * copy the value from the kernel source. We don't round it
424 * up to a multiple of the page size.)
426 if (ring_size > MAX_RING_SIZE) {
428 * Yes. Lower the ring size to the maximum, and set the
429 * snapshot length to the value that would give us a
432 ring_size = MAX_RING_SIZE;
433 handle->snapshot = header_size + (MAX_RING_SIZE/5);
434 } else if (ring_size < MIN_RING_SIZE) {
436 * Yes. Raise the ring size to the minimum, but leave
437 * the snapshot length unchanged, so we show the
438 * callback no more data than specified by the
441 ring_size = MIN_RING_SIZE;
444 if (ioctl(handle->fd, MON_IOCT_RING_SIZE, ring_size) == -1) {
445 pcap_fmt_errmsg_for_errno(handle->errbuf, PCAP_ERRBUF_SIZE,
446 errno, "Can't set ring size from fd %d", handle->fd);
453 int usb_mmap(pcap_t* handle)
455 struct pcap_usb_linux *handlep = handle->priv;
459 * Attempt to set the ring size as appropriate for the snapshot
460 * length, reducing the snapshot length if that'd make the ring
461 * bigger than the kernel supports.
463 len = usb_set_ring_size(handle, (int)sizeof(pcap_usb_header_mmapped));
465 /* Failed. Fall back on non-memory-mapped access. */
469 handlep->mmapbuflen = len;
470 handlep->mmapbuf = mmap(0, handlep->mmapbuflen, PROT_READ,
471 MAP_SHARED, handle->fd, 0);
472 if (handlep->mmapbuf == MAP_FAILED) {
474 * Failed. We don't treat that as a fatal error, we
475 * just try to fall back on non-memory-mapped access.
482 #ifdef HAVE_LINUX_USBDEVICE_FS_H
484 #define CTRL_TIMEOUT (5*1000) /* milliseconds */
486 #define USB_DIR_IN 0x80
487 #define USB_TYPE_STANDARD 0x00
488 #define USB_RECIP_DEVICE 0x00
490 #define USB_REQ_GET_DESCRIPTOR 6
492 #define USB_DT_DEVICE 1
494 /* probe the descriptors of the devices attached to the bus */
495 /* the descriptors will end up in the captured packet stream */
496 /* and be decoded by external apps like wireshark */
497 /* without these identifying probes packet data can't be fully decoded */
499 probe_devices(int bus)
501 struct usbdevfs_ctrltransfer ctrl;
504 char buf[sizeof("/dev/bus/usb/000/") + NAME_MAX];
507 /* scan usb bus directories for device nodes */
508 pcap_snprintf(buf, sizeof(buf), "/dev/bus/usb/%03d", bus);
513 while ((ret >= 0) && ((data = readdir(dir)) != 0)) {
515 char* name = data->d_name;
520 pcap_snprintf(buf, sizeof(buf), "/dev/bus/usb/%03d/%s", bus, data->d_name);
522 fd = open(buf, O_RDWR);
527 * Sigh. Different kernels have different member names
528 * for this structure.
530 #ifdef HAVE_STRUCT_USBDEVFS_CTRLTRANSFER_BREQUESTTYPE
531 ctrl.bRequestType = USB_DIR_IN | USB_TYPE_STANDARD | USB_RECIP_DEVICE;
532 ctrl.bRequest = USB_REQ_GET_DESCRIPTOR;
533 ctrl.wValue = USB_DT_DEVICE << 8;
535 ctrl.wLength = sizeof(buf);
537 ctrl.requesttype = USB_DIR_IN | USB_TYPE_STANDARD | USB_RECIP_DEVICE;
538 ctrl.request = USB_REQ_GET_DESCRIPTOR;
539 ctrl.value = USB_DT_DEVICE << 8;
541 ctrl.length = sizeof(buf);
544 ctrl.timeout = CTRL_TIMEOUT;
546 ret = ioctl(fd, USBDEVFS_CONTROL, &ctrl);
552 #endif /* HAVE_LINUX_USBDEVICE_FS_H */
555 usb_create(const char *device, char *ebuf, int *is_ours)
562 /* Does this look like a USB monitoring device? */
563 cp = strrchr(device, '/');
566 /* Does it begin with USB_IFACE? */
567 if (strncmp(cp, USB_IFACE, sizeof USB_IFACE - 1) != 0) {
568 /* Nope, doesn't begin with USB_IFACE */
572 /* Yes - is USB_IFACE followed by a number? */
573 cp += sizeof USB_IFACE - 1;
574 devnum = strtol(cp, &cpend, 10);
575 if (cpend == cp || *cpend != '\0') {
576 /* Not followed by a number. */
581 /* Followed by a non-valid number. */
586 /* OK, it's probably ours. */
589 p = pcap_create_common(ebuf, sizeof (struct pcap_usb_linux));
593 p->activate_op = usb_activate;
598 usb_activate(pcap_t* handle)
600 struct pcap_usb_linux *handlep = handle->priv;
601 char full_path[USB_LINE_LEN];
605 * Turn a negative snapshot value (invalid), a snapshot value of
606 * 0 (unspecified), or a value bigger than the normal maximum
607 * value, into the maximum allowed value.
609 * If some application really *needs* a bigger snapshot
610 * length, we should just increase MAXIMUM_SNAPLEN.
612 if (handle->snapshot <= 0 || handle->snapshot > MAXIMUM_SNAPLEN)
613 handle->snapshot = MAXIMUM_SNAPLEN;
615 /* Initialize some components of the pcap structure. */
616 handle->bufsize = handle->snapshot;
618 handle->linktype = DLT_USB_LINUX;
620 handle->inject_op = usb_inject_linux;
621 handle->setfilter_op = install_bpf_program; /* no kernel filtering */
622 handle->setdirection_op = usb_setdirection_linux;
623 handle->set_datalink_op = NULL; /* can't change data link type */
624 handle->getnonblock_op = pcap_getnonblock_fd;
625 handle->setnonblock_op = pcap_setnonblock_fd;
627 /*get usb bus index from device name */
628 if (sscanf(handle->opt.device, USB_IFACE"%d", &handlep->bus_index) != 1)
630 pcap_snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
631 "Can't get USB bus index from %s", handle->opt.device);
635 if (have_binary_usbmon())
638 * We have binary-mode support.
639 * Try to open the binary interface.
641 pcap_snprintf(full_path, USB_LINE_LEN, LINUX_USB_MON_DEV"%d", handlep->bus_index);
642 handle->fd = open(full_path, O_RDONLY, 0);
646 * The attempt failed; why?
652 * The device doesn't exist.
653 * That could either mean that there's
654 * no support for monitoring USB buses
655 * (which probably means "the usbmon
656 * module isn't loaded") or that there
657 * is but that *particular* device
658 * doesn't exist (no "scan all buses"
659 * device if the bus index is 0, no
660 * such bus if the bus index isn't 0).
662 return PCAP_ERROR_NO_SUCH_DEVICE;
666 * We didn't have permission to open it.
668 return PCAP_ERROR_PERM_DENIED;
672 * Something went wrong.
674 pcap_fmt_errmsg_for_errno(handle->errbuf,
675 PCAP_ERRBUF_SIZE, errno,
676 "Can't open USB bus file %s", full_path);
681 if (handle->opt.rfmon)
684 * Monitor mode doesn't apply to USB devices.
687 return PCAP_ERROR_RFMON_NOTSUP;
690 /* try to use fast mmap access */
691 if (usb_mmap(handle))
694 handle->linktype = DLT_USB_LINUX_MMAPPED;
695 handle->stats_op = usb_stats_linux_bin;
696 handle->read_op = usb_read_linux_mmap;
697 handle->cleanup_op = usb_cleanup_linux_mmap;
698 #ifdef HAVE_LINUX_USBDEVICE_FS_H
699 probe_devices(handlep->bus_index);
703 * "handle->fd" is a real file, so
704 * "select()" and "poll()" work on it.
706 handle->selectable_fd = handle->fd;
711 * We failed; try plain binary interface access.
713 * Attempt to set the ring size as appropriate for
714 * the snapshot length, reducing the snapshot length
715 * if that'd make the ring bigger than the kernel
718 if (usb_set_ring_size(handle, (int)sizeof(pcap_usb_header)) == -1) {
723 handle->stats_op = usb_stats_linux_bin;
724 handle->read_op = usb_read_linux_bin;
725 #ifdef HAVE_LINUX_USBDEVICE_FS_H
726 probe_devices(handlep->bus_index);
731 * We don't have binary mode support.
732 * Try opening the text-mode device.
734 pcap_snprintf(full_path, USB_LINE_LEN, USB_TEXT_DIR"/%dt", handlep->bus_index);
735 handle->fd = open(full_path, O_RDONLY, 0);
741 * Not found at the new location; try
744 pcap_snprintf(full_path, USB_LINE_LEN, USB_TEXT_DIR_OLD"/%dt", handlep->bus_index);
745 handle->fd = open(full_path, O_RDONLY, 0);
747 if (handle->fd < 0) {
751 * The problem is that the file
752 * doesn't exist. Report that as
753 * "no such device". (That could
754 * mean "no such USB bus" or
755 * "monitoring not supported".)
757 ret = PCAP_ERROR_NO_SUCH_DEVICE;
759 else if (errno == EACCES)
762 * The problem is that we don't
763 * have sufficient permission to
764 * open the file. Report that.
766 ret = PCAP_ERROR_PERM_DENIED;
775 pcap_fmt_errmsg_for_errno(handle->errbuf,
776 PCAP_ERRBUF_SIZE, errno,
777 "Can't open USB bus file %s",
783 if (handle->opt.rfmon)
786 * Monitor mode doesn't apply to USB devices.
789 return PCAP_ERROR_RFMON_NOTSUP;
792 handle->stats_op = usb_stats_linux;
793 handle->read_op = usb_read_linux;
797 * "handle->fd" is a real file, so "select()" and "poll()"
800 handle->selectable_fd = handle->fd;
802 /* for plain binary access and text access we need to allocate the read
804 handle->buffer = malloc(handle->bufsize);
805 if (!handle->buffer) {
806 pcap_fmt_errmsg_for_errno(handle->errbuf, PCAP_ERRBUF_SIZE,
817 return c < 'A' ? c- '0': ((c<'a') ? c - 'A' + 10: c-'a'+10);
821 * see <linux-kernel-source>/Documentation/usb/usbmon.txt and
822 * <linux-kernel-source>/drivers/usb/mon/mon_text.c for urb string
826 usb_read_linux(pcap_t *handle, int max_packets _U_, pcap_handler callback, u_char *user)
829 * /usr/src/linux/Documentation/usb/usbmon.txt
832 struct pcap_usb_linux *handlep = handle->priv;
834 int tag, cnt, ep_num, dev_addr, dummy, ret, urb_len, data_len;
835 char etype, pipeid1, pipeid2, status[16], urb_tag, line[USB_LINE_LEN];
837 u_char * rawdata = handle->buffer;
838 struct pcap_pkthdr pkth;
839 pcap_usb_header* uhdr = (pcap_usb_header*)handle->buffer;
840 u_char urb_transfer=0;
843 /* ignore interrupt system call errors */
845 ret = read(handle->fd, line, USB_LINE_LEN - 1);
846 if (handle->break_loop)
848 handle->break_loop = 0;
851 } while ((ret == -1) && (errno == EINTR));
855 return 0; /* no data there */
857 pcap_fmt_errmsg_for_errno(handle->errbuf, PCAP_ERRBUF_SIZE,
858 errno, "Can't read from fd %d", handle->fd);
862 /* read urb header; %n argument may increment return value, but it's
863 * not mandatory, so does not count on it*/
865 ret = sscanf(string, "%x %d %c %c%c:%d:%d %s%n", &tag, ×tamp, &etype,
866 &pipeid1, &pipeid2, &dev_addr, &ep_num, status,
870 pcap_snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
871 "Can't parse USB bus message '%s', too few tokens (expected 8 got %d)",
876 uhdr->device_address = dev_addr;
877 uhdr->bus_id = handlep->bus_index;
881 /* don't use usbmon provided timestamp, since it have low precision*/
882 if (gettimeofday(&pkth.ts, NULL) < 0)
884 pcap_fmt_errmsg_for_errno(handle->errbuf, PCAP_ERRBUF_SIZE,
885 errno, "Can't get timestamp for message '%s'", string);
888 uhdr->ts_sec = pkth.ts.tv_sec;
889 uhdr->ts_usec = pkth.ts.tv_usec;
891 /* parse endpoint information */
893 urb_transfer = URB_CONTROL;
894 else if (pipeid1 == 'Z')
895 urb_transfer = URB_ISOCHRONOUS;
896 else if (pipeid1 == 'I')
897 urb_transfer = URB_INTERRUPT;
898 else if (pipeid1 == 'B')
899 urb_transfer = URB_BULK;
900 if (pipeid2 == 'i') {
901 ep_num |= URB_TRANSFER_IN;
905 incoming = !incoming;
910 if (handle->direction == PCAP_D_OUT)
914 if (handle->direction == PCAP_D_IN)
916 uhdr->event_type = etype;
917 uhdr->transfer_type = urb_transfer;
918 uhdr->endpoint_number = ep_num;
919 pkth.caplen = sizeof(pcap_usb_header);
920 rawdata += sizeof(pcap_usb_header);
922 /* check if this is a setup packet */
923 ret = sscanf(status, "%d", &dummy);
926 /* this a setup packet, setup data can be filled with underscore if
927 * usbmon has not been able to read them, so we must parse this fields as
929 pcap_usb_setup* shdr;
930 char str1[3], str2[3], str3[5], str4[5], str5[5];
931 ret = sscanf(string, "%s %s %s %s %s%n", str1, str2, str3, str4,
935 pcap_snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
936 "Can't parse USB bus message '%s', too few tokens (expected 5 got %d)",
942 /* try to convert to corresponding integer */
944 shdr->bmRequestType = strtoul(str1, 0, 16);
945 shdr->bRequest = strtoul(str2, 0, 16);
946 shdr->wValue = htols(strtoul(str3, 0, 16));
947 shdr->wIndex = htols(strtoul(str4, 0, 16));
948 shdr->wLength = htols(strtoul(str5, 0, 16));
950 uhdr->setup_flag = 0;
953 uhdr->setup_flag = 1;
956 ret = sscanf(string, " %d%n", &urb_len, &cnt);
959 pcap_snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
960 "Can't parse urb length from '%s'", string);
965 /* urb tag is not present if urb length is 0, so we can stop here
967 pkth.len = urb_len+pkth.caplen;
968 uhdr->urb_len = urb_len;
971 if (uhdr->urb_len == 0)
974 /* check for data presence; data is present if and only if urb tag is '=' */
975 if (sscanf(string, " %c", &urb_tag) != 1)
977 pcap_snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
978 "Can't parse urb tag from '%s'", string);
985 /* skip urb tag and following space */
988 /* if we reach this point we got some urb data*/
991 /* read all urb data; if urb length is greater then the usbmon internal
992 * buffer length used by the kernel to spool the URB, we get only
993 * a partial information.
994 * At least until linux 2.6.17 there is no way to set usbmon intenal buffer
995 * length and default value is 130. */
996 while ((string[0] != 0) && (string[1] != 0) && (pkth.caplen < (bpf_u_int32)handle->snapshot))
998 rawdata[0] = ascii_to_int(string[0]) * 16 + ascii_to_int(string[1]);
1001 if (string[0] == ' ')
1008 uhdr->data_len = data_len;
1009 if (pkth.caplen > (bpf_u_int32)handle->snapshot)
1010 pkth.caplen = (bpf_u_int32)handle->snapshot;
1012 if (handle->fcode.bf_insns == NULL ||
1013 bpf_filter(handle->fcode.bf_insns, handle->buffer,
1014 pkth.len, pkth.caplen)) {
1015 handlep->packets_read++;
1016 callback(user, &pkth, handle->buffer);
1019 return 0; /* didn't pass filter */
1023 usb_inject_linux(pcap_t *handle, const void *buf _U_, size_t size _U_)
1025 pcap_snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
1026 "Packet injection is not supported on USB devices");
1031 usb_stats_linux(pcap_t *handle, struct pcap_stat *stats)
1033 struct pcap_usb_linux *handlep = handle->priv;
1034 int dummy, ret, consumed, cnt;
1035 char string[USB_LINE_LEN];
1036 char token[USB_LINE_LEN];
1037 char * ptr = string;
1040 pcap_snprintf(string, USB_LINE_LEN, USB_TEXT_DIR"/%ds", handlep->bus_index);
1041 fd = open(string, O_RDONLY, 0);
1044 if (errno == ENOENT)
1047 * Not found at the new location; try the old
1050 pcap_snprintf(string, USB_LINE_LEN, USB_TEXT_DIR_OLD"/%ds", handlep->bus_index);
1051 fd = open(string, O_RDONLY, 0);
1054 pcap_fmt_errmsg_for_errno(handle->errbuf,
1055 PCAP_ERRBUF_SIZE, errno,
1056 "Can't open USB stats file %s", string);
1061 /* read stats line */
1063 ret = read(fd, string, USB_LINE_LEN-1);
1064 } while ((ret == -1) && (errno == EINTR));
1069 pcap_snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
1070 "Can't read stats from fd %d ", fd);
1075 stats->ps_recv = handlep->packets_read;
1076 stats->ps_drop = 0; /* unless we find text_lost */
1077 stats->ps_ifdrop = 0;
1079 /* extract info on dropped urbs */
1080 for (consumed=0; consumed < ret; ) {
1081 /* from the sscanf man page:
1082 * The C standard says: "Execution of a %n directive does
1083 * not increment the assignment count returned at the completion
1084 * of execution" but the Corrigendum seems to contradict this.
1085 * Do not make any assumptions on the effect of %n conversions
1086 * on the return value and explicitly check for cnt assignmet*/
1090 ntok = sscanf(ptr, "%s%n", token, &cnt);
1091 if ((ntok < 1) || (cnt < 0))
1095 if (strcmp(token, "text_lost") == 0)
1096 ntok = sscanf(ptr, "%d%n", &stats->ps_drop, &cnt);
1098 ntok = sscanf(ptr, "%d%n", &dummy, &cnt);
1099 if ((ntok != 1) || (cnt < 0))
1109 usb_setdirection_linux(pcap_t *p, pcap_direction_t d)
1117 usb_stats_linux_bin(pcap_t *handle, struct pcap_stat *stats)
1119 struct pcap_usb_linux *handlep = handle->priv;
1121 struct mon_bin_stats st;
1122 ret = ioctl(handle->fd, MON_IOCG_STATS, &st);
1125 pcap_fmt_errmsg_for_errno(handle->errbuf, PCAP_ERRBUF_SIZE,
1126 errno, "Can't read stats from fd %d", handle->fd);
1130 stats->ps_recv = handlep->packets_read + st.queued;
1131 stats->ps_drop = st.dropped;
1132 stats->ps_ifdrop = 0;
1137 * see <linux-kernel-source>/Documentation/usb/usbmon.txt and
1138 * <linux-kernel-source>/drivers/usb/mon/mon_bin.c binary ABI
1141 usb_read_linux_bin(pcap_t *handle, int max_packets _U_, pcap_handler callback, u_char *user)
1143 struct pcap_usb_linux *handlep = handle->priv;
1144 struct mon_bin_get info;
1146 struct pcap_pkthdr pkth;
1147 u_int clen = handle->snapshot - sizeof(pcap_usb_header);
1149 /* the usb header is going to be part of 'packet' data*/
1150 info.hdr = (pcap_usb_header*) handle->buffer;
1151 info.data = (u_char *)handle->buffer + sizeof(pcap_usb_header);
1152 info.data_len = clen;
1154 /* ignore interrupt system call errors */
1156 ret = ioctl(handle->fd, MON_IOCX_GET, &info);
1157 if (handle->break_loop)
1159 handle->break_loop = 0;
1162 } while ((ret == -1) && (errno == EINTR));
1165 if (errno == EAGAIN)
1166 return 0; /* no data there */
1168 pcap_fmt_errmsg_for_errno(handle->errbuf, PCAP_ERRBUF_SIZE,
1169 errno, "Can't read from fd %d", handle->fd);
1174 * info.hdr->data_len is the number of bytes of isochronous
1175 * descriptors (if any) plus the number of bytes of data
1176 * provided. There are no isochronous descriptors here,
1177 * because we're using the old 48-byte header.
1179 * If info.hdr->data_flag is non-zero, there's no URB data;
1180 * info.hdr->urb_len is the size of the buffer into which
1181 * data is to be placed; it does not represent the amount
1182 * of data transferred. If info.hdr->data_flag is zero,
1183 * there is URB data, and info.hdr->urb_len is the number
1184 * of bytes transmitted or received; it doesn't include
1185 * isochronous descriptors.
1187 * The kernel may give us more data than the snaplen; if it did,
1188 * reduce the data length so that the total number of bytes we
1189 * tell our client we have is not greater than the snaplen.
1191 if (info.hdr->data_len < clen)
1192 clen = info.hdr->data_len;
1193 info.hdr->data_len = clen;
1194 pkth.caplen = sizeof(pcap_usb_header) + clen;
1195 if (info.hdr->data_flag) {
1197 * No data; just base the on-the-wire length on
1198 * info.hdr->data_len (so that it's >= the captured
1201 pkth.len = sizeof(pcap_usb_header) + info.hdr->data_len;
1204 * We got data; base the on-the-wire length on
1205 * info.hdr->urb_len, so that it includes data
1206 * discarded by the USB monitor device due to
1207 * its buffer being too small.
1209 pkth.len = sizeof(pcap_usb_header) + info.hdr->urb_len;
1211 pkth.ts.tv_sec = info.hdr->ts_sec;
1212 pkth.ts.tv_usec = info.hdr->ts_usec;
1214 if (handle->fcode.bf_insns == NULL ||
1215 bpf_filter(handle->fcode.bf_insns, handle->buffer,
1216 pkth.len, pkth.caplen)) {
1217 handlep->packets_read++;
1218 callback(user, &pkth, handle->buffer);
1222 return 0; /* didn't pass filter */
1226 * see <linux-kernel-source>/Documentation/usb/usbmon.txt and
1227 * <linux-kernel-source>/drivers/usb/mon/mon_bin.c binary ABI
1231 usb_read_linux_mmap(pcap_t *handle, int max_packets, pcap_handler callback, u_char *user)
1233 struct pcap_usb_linux *handlep = handle->priv;
1234 struct mon_bin_mfetch fetch;
1235 int32_t vec[VEC_SIZE];
1236 struct pcap_pkthdr pkth;
1237 pcap_usb_header_mmapped* hdr;
1240 u_int clen, max_clen;
1242 max_clen = handle->snapshot - sizeof(pcap_usb_header_mmapped);
1246 int limit = max_packets - packets;
1249 if (limit > VEC_SIZE)
1252 /* try to fetch as many events as possible*/
1254 fetch.nfetch = limit;
1255 fetch.nflush = nflush;
1256 /* ignore interrupt system call errors */
1258 ret = ioctl(handle->fd, MON_IOCX_MFETCH, &fetch);
1259 if (handle->break_loop)
1261 handle->break_loop = 0;
1264 } while ((ret == -1) && (errno == EINTR));
1267 if (errno == EAGAIN)
1268 return 0; /* no data there */
1270 pcap_fmt_errmsg_for_errno(handle->errbuf,
1271 PCAP_ERRBUF_SIZE, errno, "Can't mfetch fd %d",
1276 /* keep track of processed events, we will flush them later */
1277 nflush = fetch.nfetch;
1278 for (i=0; i<fetch.nfetch; ++i) {
1279 /* discard filler */
1280 hdr = (pcap_usb_header_mmapped*) &handlep->mmapbuf[vec[i]];
1281 if (hdr->event_type == '@')
1285 * hdr->data_len is the number of bytes of
1286 * isochronous descriptors (if any) plus the
1287 * number of bytes of data provided.
1289 * If hdr->data_flag is non-zero, there's no
1290 * URB data; hdr->urb_len is the size of the
1291 * buffer into which data is to be placed; it does
1292 * not represent the amount of data transferred.
1293 * If hdr->data_flag is zero, there is URB data,
1294 * and hdr->urb_len is the number of bytes
1295 * transmitted or received; it doesn't include
1296 * isochronous descriptors.
1298 * The kernel may give us more data than the
1299 * snaplen; if it did, reduce the data length
1300 * so that the total number of bytes we
1301 * tell our client we have is not greater than
1305 if (hdr->data_len < clen)
1306 clen = hdr->data_len;
1307 pkth.caplen = sizeof(pcap_usb_header_mmapped) + clen;
1308 if (hdr->data_flag) {
1310 * No data; just base the on-the-wire length
1311 * on hdr->data_len (so that it's >= the
1314 pkth.len = sizeof(pcap_usb_header_mmapped) +
1318 * We got data; base the on-the-wire length
1319 * on hdr->urb_len, so that it includes
1320 * data discarded by the USB monitor device
1321 * due to its buffer being too small.
1323 pkth.len = sizeof(pcap_usb_header_mmapped) +
1324 (hdr->ndesc * sizeof (usb_isodesc)) + hdr->urb_len;
1326 pkth.ts.tv_sec = hdr->ts_sec;
1327 pkth.ts.tv_usec = hdr->ts_usec;
1329 if (handle->fcode.bf_insns == NULL ||
1330 bpf_filter(handle->fcode.bf_insns, (u_char*) hdr,
1331 pkth.len, pkth.caplen)) {
1332 handlep->packets_read++;
1333 callback(user, &pkth, (u_char*) hdr);
1338 /* with max_packets specifying "unlimited" we stop afer the first chunk*/
1339 if (PACKET_COUNT_IS_UNLIMITED(max_packets) || (packets == max_packets))
1343 /* flush pending events*/
1344 if (ioctl(handle->fd, MON_IOCH_MFLUSH, nflush) == -1) {
1345 pcap_fmt_errmsg_for_errno(handle->errbuf, PCAP_ERRBUF_SIZE,
1346 errno, "Can't mflush fd %d", handle->fd);
1353 usb_cleanup_linux_mmap(pcap_t* handle)
1355 struct pcap_usb_linux *handlep = handle->priv;
1357 /* if we have a memory-mapped buffer, unmap it */
1358 if (handlep->mmapbuf != NULL) {
1359 munmap(handlep->mmapbuf, handlep->mmapbuflen);
1360 handlep->mmapbuf = NULL;
1362 pcap_cleanup_live_common(handle);