1/* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 22/* 23 * Copyright 2009 Sun Microsystems, Inc. All rights reserved. 24 * Use is subject to license terms. 25 */ 26 27#ifndef _SNOOP_H 28#define _SNOOP_H 29 30#include <rpc/types.h> 31#include <sys/pfmod.h> 32#include <sys/time.h> 33#include <sys/types.h> 34#include <sys/socket.h> 35#include <sys/bufmod.h> 36#include <net/if.h> 37#include <netinet/in.h> 38#include <netinet/if_ether.h> 39#include <netinet/in_systm.h> 40#include <netinet/ip.h> 41#include <netinet/ip6.h> 42#include <netinet/ip_icmp.h> 43#include <netinet/icmp6.h> 44#include <net/pppoe.h> 45#include <libdlpi.h> 46 47#ifdef __cplusplus 48extern "C" { 49#endif 50 51/* 52 * Flags to control packet info display 53 */ 54#define F_NOW 0x00000001 /* display in realtime */ 55#define F_SUM 0x00000002 /* display summary line */ 56#define F_ALLSUM 0x00000004 /* display all summary lines */ 57#define F_DTAIL 0x00000008 /* display detail lines */ 58#define F_TIME 0x00000010 /* display time */ 59#define F_ATIME 0x00000020 /* display absolute time */ 60#define F_RTIME 0x00000040 /* display relative time */ 61#define F_DROPS 0x00000080 /* display drops */ 62#define F_LEN 0x00000100 /* display pkt length */ 63#define F_NUM 0x00000200 /* display pkt number */ 64#define F_WHO 0x00000400 /* display src/dst */ 65 66#define MAXLINE (1088) /* max len of detail line */ 67 68/* 69 * The RPC XID cache structure. 70 * When analyzing RPC protocols we 71 * have to cache the xid of the RPC 72 * request together with the program 73 * number, proc, version etc since this 74 * information is missing in the reply 75 * packet. Using the xid in the reply 76 * we can lookup this previously stashed 77 * information in the cache. 78 * 79 * For RPCSEC_GSS flavor, some special processing is 80 * needed for the argument interpretation based on its 81 * control procedure and service type. This information 82 * is stored in the cache table during interpretation of 83 * the rpc header and will be referenced later when the rpc 84 * argument is interpreted. 85 */ 86#define XID_CACHE_SIZE 256 87struct cache_struct { 88 int xid_num; /* RPC transaction id */ 89 int xid_frame; /* Packet number */ 90 int xid_prog; /* RPC program number */ 91 int xid_vers; /* RPC version number */ 92 int xid_proc; /* RPC procedure number */ 93 unsigned int xid_gss_proc; /* control procedure */ 94 int xid_gss_service; /* none, integ, priv */ 95} xid_cache[XID_CACHE_SIZE]; 96 97 98/* 99 * The following macros advance the pointer passed to them. They 100 * assume they are given a char *. 101 */ 102#define GETINT8(v, ptr) { \ 103 (v) = (*(ptr)++); \ 104} 105 106#define GETINT16(v, ptr) { \ 107 (v) = *(ptr)++ << 8; \ 108 (v) |= *(ptr)++; \ 109} 110 111#define GETINT32(v, ptr) { \ 112 (v) = *(ptr)++ << 8; \ 113 (v) |= *(ptr)++; (v) <<= 8; \ 114 (v) |= *(ptr)++; (v) <<= 8; \ 115 (v) |= *(ptr)++; \ 116} 117 118/* 119 * Used to print nested protocol layers. For example, an ip datagram included 120 * in an icmp error, or a PPP packet included in an LCP protocol reject.. 121 */ 122extern char *prot_nest_prefix; 123 124extern char *get_sum_line(void); 125extern char *get_detail_line(int, int); 126extern int want_packet(uchar_t *, int, int); 127extern void set_vlan_id(int); 128extern struct timeval prev_time; 129extern void process_pkt(struct sb_hdr *, char *, int, int); 130extern char *getflag(int, int, char *, char *); 131extern void show_header(char *, char *, int); 132extern void show_count(void); 133extern void xdr_init(char *, int); 134extern char *get_line(int, int); 135extern int get_line_remain(void); 136extern char getxdr_char(void); 137extern char showxdr_char(char *); 138extern uchar_t getxdr_u_char(void); 139extern uchar_t showxdr_u_char(char *); 140extern short getxdr_short(void); 141extern short showxdr_short(char *); 142extern ushort_t getxdr_u_short(void); 143extern ushort_t showxdr_u_short(char *); 144extern long getxdr_long(void); 145extern long showxdr_long(char *); 146extern ulong_t getxdr_u_long(void); 147extern ulong_t showxdr_u_long(char *); 148extern longlong_t getxdr_longlong(void); 149extern longlong_t showxdr_longlong(char *); 150extern u_longlong_t getxdr_u_longlong(void); 151extern u_longlong_t showxdr_u_longlong(char *); 152extern char *getxdr_opaque(char *, int); 153extern char *getxdr_string(char *, int); 154extern char *showxdr_string(int, char *); 155extern char *getxdr_bytes(uint_t *); 156extern void xdr_skip(int); 157extern int getxdr_pos(void); 158extern void setxdr_pos(int); 159extern char *getxdr_context(char *, int); 160extern char *showxdr_context(char *); 161extern enum_t getxdr_enum(void); 162extern void show_space(void); 163extern void show_trailer(void); 164extern char *getxdr_date(void); 165extern char *showxdr_date(char *); 166extern char *getxdr_date_ns(void); 167char *format_time(int64_t sec, uint32_t nsec); 168extern char *showxdr_date_ns(char *); 169extern char *getxdr_hex(int); 170extern char *showxdr_hex(int, char *); 171extern bool_t getxdr_bool(void); 172extern bool_t showxdr_bool(char *); 173extern char *concat_args(char **, int); 174extern int pf_compile(char *, int); 175extern void compile(char *, int); 176extern void load_names(char *); 177extern void cap_write(struct sb_hdr *, char *, int, int); 178extern void cap_open_read(const char *); 179extern void cap_open_write(const char *); 180extern void cap_read(int, int, int, void (*)(), int); 181extern void cap_close(void); 182extern boolean_t open_datalink(dlpi_handle_t *, const char *); 183extern void init_datalink(dlpi_handle_t, ulong_t, ulong_t, struct timeval *, 184 struct Pf_ext_packetfilt *); 185extern void net_read(dlpi_handle_t, size_t, int, void (*)(), int); 186extern void click(int); 187extern void show_pktinfo(int, int, char *, char *, struct timeval *, 188 struct timeval *, int, int); 189extern void show_line(char *); 190extern char *getxdr_time(void); 191extern char *showxdr_time(char *); 192extern char *addrtoname(int, const void *); 193extern char *show_string(const char *, int, int); 194extern void pr_err(const char *, ...); 195extern void pr_errdlpi(dlpi_handle_t, const char *, int); 196extern void check_retransmit(char *, ulong_t); 197extern char *nameof_prog(int); 198extern char *getproto(int); 199extern uint8_t print_ipv6_extensions(int, uint8_t **, uint8_t *, int *, int *); 200extern void protoprint(int, int, ulong_t, int, int, int, char *, int); 201extern char *getportname(int, in_port_t); 202 203extern void interpret_arp(int, struct arphdr *, int); 204extern void interpret_bparam(int, int, int, int, int, char *, int); 205extern void interpret_dns(int, int, const uchar_t *, int, int); 206extern void interpret_mount(int, int, int, int, int, char *, int); 207extern void interpret_nfs(int, int, int, int, int, char *, int); 208extern void interpret_nfs3(int, int, int, int, int, char *, int); 209extern void interpret_nfs4(int, int, int, int, int, char *, int); 210extern void interpret_nfs4_cb(int, int, int, int, int, char *, int); 211extern void interpret_nfs_acl(int, int, int, int, int, char *, int); 212extern void interpret_nis(int, int, int, int, int, char *, int); 213extern void interpret_nisbind(int, int, int, int, int, char *, int); 214extern void interpret_nlm(int, int, int, int, int, char *, int); 215extern void interpret_pmap(int, int, int, int, int, char *, int); 216extern int interpret_reserved(int, int, in_port_t, in_port_t, char *, int); 217extern void interpret_rquota(int, int, int, int, int, char *, int); 218extern void interpret_rstat(int, int, int, int, int, char *, int); 219extern void interpret_solarnet_fw(int, int, int, int, int, char *, int); 220extern void interpret_ldap(int, char *, int, int, int); 221extern void interpret_icmp(int, struct icmp *, int, int); 222extern void interpret_icmpv6(int, icmp6_t *, int, int); 223extern int interpret_ip(int, const struct ip *, int); 224extern int interpret_ipv6(int, const ip6_t *, int); 225extern int interpret_ppp(int, uchar_t *, int); 226extern int interpret_pppoe(int, poep_t *, int); 227struct tcphdr; 228extern int interpret_tcp(int, struct tcphdr *, int, int); 229struct udphdr; 230extern int interpret_udp(int, struct udphdr *, int, int); 231extern int interpret_esp(int, uint8_t *, int, int); 232extern int interpret_ah(int, uint8_t *, int, int); 233struct sctp_hdr; 234extern void interpret_sctp(int, struct sctp_hdr *, int, int); 235extern void interpret_mip_cntrlmsg(int, uchar_t *, int); 236struct dhcp; 237extern int interpret_dhcp(int, struct dhcp *, int); 238extern int interpret_dhcpv6(int, const uint8_t *, int); 239struct tftphdr; 240extern int interpret_tftp(int, struct tftphdr *, int); 241extern int interpret_http(int, char *, int); 242struct ntpdata; 243extern int interpret_ntp(int, struct ntpdata *, int); 244extern void interpret_netbios_ns(int, uchar_t *, int); 245extern void interpret_netbios_datagram(int, uchar_t *, int); 246extern void interpret_netbios_ses(int, uchar_t *, int); 247extern void interpret_slp(int, char *, int); 248struct rip; 249extern int interpret_rip(int, struct rip *, int); 250struct rip6; 251extern int interpret_rip6(int, struct rip6 *, int); 252extern int interpret_socks_call(int, char *, int); 253extern int interpret_socks_reply(int, char *, int); 254extern int interpret_trill(int, struct ether_header **, char *, int *); 255extern int interpret_isis(int, char *, int, boolean_t); 256extern int interpret_bpdu(int, char *, int); 257extern void init_ldap(void); 258extern boolean_t arp_for_ether(char *, struct ether_addr *); 259extern char *ether_ouiname(uint32_t); 260extern char *tohex(char *p, int len); 261extern char *printether(struct ether_addr *); 262extern char *print_ethertype(int); 263extern const char *arp_htype(int); 264extern int valid_rpc(char *, int); 265 266/* 267 * Describes characteristics of the Media Access Layer. 268 * The mac_type is one of the supported DLPI media 269 * types (see <sys/dlpi.h>). 270 * The mtu_size is the size of the largest frame. 271 * network_type_offset is where the network type 272 * is located in the link layer header. 273 * The header length is returned by a function to 274 * allow for variable header size - for ethernet it's 275 * just a constant 14 octets. 276 * The interpreter is the function that "knows" how 277 * to interpret the frame. 278 * try_kernel_filter tells snoop to first try a kernel 279 * filter (because the header size is fixed, or if it could 280 * be of variable size where the variable size is easy for a kernel 281 * filter to handle, for example, Ethernet and VLAN tags) 282 * and only use a user space filter if the filter expression 283 * cannot be expressed in kernel space. 284 */ 285typedef uint_t (interpreter_fn_t)(int, char *, int, int); 286typedef uint_t (headerlen_fn_t)(char *, size_t); 287typedef struct interface { 288 uint_t mac_type; 289 uint_t mtu_size; 290 uint_t network_type_offset; 291 size_t network_type_len; 292 uint_t network_type_ip; 293 uint_t network_type_ipv6; 294 headerlen_fn_t *header_len; 295 interpreter_fn_t *interpreter; 296 boolean_t try_kernel_filter; 297} interface_t; 298 299extern interface_t INTERFACES[], *interface; 300extern char *dlc_header; 301extern char *src_name, *dst_name; 302extern char *prot_prefix; 303extern char *prot_nest_prefix; 304extern char *prot_title; 305 306/* Keep track of how many nested IP headers we have. */ 307extern unsigned int encap_levels, total_encap_levels; 308 309extern int quitting; 310extern boolean_t Iflg, Pflg, rflg; 311 312/* 313 * Global error recovery routine: used to reset snoop variables after 314 * catastrophic failure. 315 */ 316void snoop_recover(void); 317 318/* 319 * Global alarm handler structure for managing multiple alarms within 320 * snoop. 321 */ 322typedef struct snoop_handler { 323 struct snoop_handler *s_next; /* next alarm handler */ 324 time_t s_time; /* time to fire */ 325 void (*s_handler)(); /* alarm handler */ 326} snoop_handler_t; 327 328#define SNOOP_MAXRECOVER 20 /* maxium number of recoveries */ 329#define SNOOP_ALARM_GRAN 3 /* alarm() timeout multiplier */ 330 331/* 332 * Global alarm handler management routine. 333 */ 334extern int snoop_alarm(int s_sec, void (*s_handler)()); 335 336/* 337 * The next two definitions do not take into account the length 338 * of the underlying link header. In order to use them, you must 339 * add link_header_len to them. The reason it is not done here is 340 * that later these macros are used to initialize a table. 341 */ 342#define IPV4_TYPE_HEADER_OFFSET 9 343#define IPV6_TYPE_HEADER_OFFSET 6 344 345#ifdef __cplusplus 346} 347#endif 348 349#endif /* _SNOOP_H */ 350