1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  *
26  * Copyright 2011 Nexenta Systems, Inc.  All rights reserved.
27  * Copyright 2021 Joyent, Inc.
28  * Copyright 2023 RackTop Systems, Inc.
29  */
30 
31 #ifndef	_SNOOP_H
32 #define	_SNOOP_H
33 
34 #include <rpc/types.h>
35 #include <sys/pfmod.h>
36 #include <sys/time.h>
37 #include <sys/types.h>
38 #include <sys/socket.h>
39 #include <sys/bufmod.h>
40 #include <net/if.h>
41 #include <netinet/in.h>
42 #include <netinet/if_ether.h>
43 #include <netinet/in_systm.h>
44 #include <netinet/ip.h>
45 #include <netinet/ip6.h>
46 #include <netinet/ip_icmp.h>
47 #include <netinet/icmp6.h>
48 #include <net/pppoe.h>
49 #include <libdlpi.h>
50 #include <note.h>
51 
52 #ifdef __cplusplus
53 extern "C" {
54 #endif
55 
56 /*
57  * Flags to control packet info display
58  */
59 #define	F_NOW		0x00000001	/* display in realtime */
60 #define	F_SUM		0x00000002	/* display summary line */
61 #define	F_ALLSUM	0x00000004	/* display all summary lines */
62 #define	F_DTAIL		0x00000008	/* display detail lines */
63 #define	F_TIME		0x00000010	/* display time */
64 #define	F_ATIME		0x00000020	/* display absolute time */
65 #define	F_RTIME		0x00000040	/* display relative time */
66 #define	F_DROPS		0x00000080	/* display drops */
67 #define	F_LEN		0x00000100	/* display pkt length */
68 #define	F_NUM		0x00000200	/* display pkt number */
69 #define	F_WHO		0x00000400	/* display src/dst */
70 
71 #define	MAXLINE		(1088)		/* max len of detail line */
72 
73 /*
74  * Transient port structure. See TFTP interpreter.
75  */
76 struct ttable {
77 	int t_port;
78 	int blksize;
79 	int (*t_proc)(int, void *, int);
80 };
81 
82 extern int add_transient(int port, int (*proc)(int, void *, int));
83 extern struct ttable *is_transient(int port);
84 extern void del_transient(int port);
85 
86 /*
87  * The RPC XID cache structure.
88  * When analyzing RPC protocols we
89  * have to cache the xid of the RPC
90  * request together with the program
91  * number, proc, version etc since this
92  * information is missing in the reply
93  * packet.  Using the xid in the reply
94  * we can lookup this previously stashed
95  * information in the cache.
96  *
97  * For RPCSEC_GSS flavor, some special processing is
98  * needed for the argument interpretation based on its
99  * control procedure and service type.  This information
100  * is stored in the cache table during interpretation of
101  * the rpc header and will be referenced later when the rpc
102  * argument is interpreted.
103  */
104 #define	XID_CACHE_SIZE 256
105 extern struct cache_struct {
106 	int xid_num;	/* RPC transaction id */
107 	int xid_frame;	/* Packet number */
108 	int xid_prog;	/* RPC program number */
109 	int xid_vers;	/* RPC version number */
110 	int xid_proc;	/* RPC procedure number */
111 	unsigned int xid_gss_proc; /* control procedure */
112 	int xid_gss_service; /* none, integ, priv */
113 } xid_cache[XID_CACHE_SIZE];
114 
115 extern char *tkp, *sav_tkp;
116 extern char *token;
117 extern enum tokentype {
118 	EOL,
119 	ALPHA,
120 	NUMBER,
121 	FIELD,
122 	ADDR_IP,
123 	ADDR_ETHER,
124 	SPECIAL,
125 	ADDR_IP6,
126 	ADDR_AT
127 } tokentype;
128 extern uint_t tokenval;
129 
130 enum direction { ANY, TO, FROM };
131 extern enum direction dir;
132 
133 extern int eaddr;	/* need ethernet addr */
134 extern int opstack;	/* operand stack depth */
135 
136 /*
137  * The following macros advance the pointer passed to them.  They
138  * assume they are given a char *.
139  */
140 #define	GETINT8(v, ptr) { \
141 	(v) = (*(ptr)++); \
142 }
143 
144 #define	GETINT16(v, ptr) { \
145 	(v) = *(ptr)++ << 8; \
146 	(v) |= *(ptr)++; \
147 }
148 
149 #define	GETINT32(v, ptr) { \
150 	(v) = *(ptr)++ << 8; \
151 	(v) |= *(ptr)++; (v) <<= 8; \
152 	(v) |= *(ptr)++; (v) <<= 8; \
153 	(v) |= *(ptr)++; \
154 }
155 
156 /*
157  * Used to print nested protocol layers.  For example, an ip datagram included
158  * in an icmp error, or a PPP packet included in an LCP protocol reject..
159  */
160 extern char *prot_nest_prefix;
161 
162 extern char *get_sum_line(void);
163 extern char *get_detail_line(int, int);
164 extern int want_packet(uchar_t *, int, int);
165 extern void set_vlan_id(int);
166 extern struct timeval prev_time;
167 extern void process_pkt(struct sb_hdr *, char *, int, int);
168 extern char *getflag(int, int, char *, char *);
169 extern void show_header(char *, char *, int);
170 extern void show_count(void);
171 extern void xdr_init(char *, int);
172 extern char *get_line(int, int);
173 extern int get_line_remain(void);
174 extern char getxdr_char(void);
175 extern char showxdr_char(char *);
176 extern uchar_t getxdr_u_char(void);
177 extern uchar_t showxdr_u_char(char *);
178 extern short getxdr_short(void);
179 extern short showxdr_short(char *);
180 extern ushort_t getxdr_u_short(void);
181 extern ushort_t showxdr_u_short(char *);
182 extern long getxdr_long(void);
183 extern long showxdr_long(char *);
184 extern ulong_t getxdr_u_long(void);
185 extern ulong_t showxdr_u_long(char *);
186 extern longlong_t getxdr_longlong(void);
187 extern longlong_t showxdr_longlong(char *);
188 extern u_longlong_t getxdr_u_longlong(void);
189 extern u_longlong_t showxdr_u_longlong(char *);
190 extern char *getxdr_opaque(char *, int);
191 extern char *getxdr_string(char *, int);
192 extern char *showxdr_string(int, char *);
193 extern char *getxdr_bytes(uint_t *);
194 extern void xdr_skip(int);
195 extern int getxdr_pos(void);
196 extern void setxdr_pos(int);
197 extern char *getxdr_context(char *, int);
198 extern char *showxdr_context(char *);
199 extern enum_t getxdr_enum(void);
200 extern void show_space(void);
201 extern void show_trailer(void);
202 extern char *getxdr_date(void);
203 extern char *showxdr_date(char *);
204 extern char *getxdr_date_ns(void);
205 char *format_time(int64_t sec, uint32_t nsec);
206 extern char *showxdr_date_ns(char *);
207 extern char *getxdr_hex(int);
208 extern char *showxdr_hex(int, char *);
209 extern bool_t getxdr_bool(void);
210 extern bool_t showxdr_bool(char *);
211 extern char *concat_args(char **, int);
212 extern int pf_compile(char *, int);
213 extern void compile(char *, int);
214 extern void load_names(char *);
215 extern void cap_write(struct sb_hdr *, char *, int, int);
216 extern void cap_open_read(const char *);
217 extern void cap_open_write(const char *);
218 extern void cap_open_wr_multi(const char *, size_t, off_t);
219 extern void cap_read(int, int, int, void (*)(), int);
220 extern void cap_close(void);
221 extern boolean_t open_datalink(dlpi_handle_t *, const char *);
222 extern void init_datalink(dlpi_handle_t, ulong_t, ulong_t, struct timeval *,
223     struct Pf_ext_packetfilt *);
224 extern void net_read(dlpi_handle_t, size_t, int, void (*)(), int);
225 extern void click(int);
226 extern void show_pktinfo(int, int, char *, char *, struct timeval *,
227 		struct timeval *, int, int);
228 extern void show_line(char *);
229 /*PRINTFLIKE1*/
230 extern void show_printf(char *fmt, ...)
231     __PRINTFLIKE(1);
232 extern char *getxdr_time(void);
233 extern char *showxdr_time(char *);
234 extern char *addrtoname(int, const void *);
235 extern char *show_string(const char *, int, int);
236 extern void pr_err(const char *, ...);
237 extern void pr_errdlpi(dlpi_handle_t, const char *, int);
238 extern void check_retransmit(char *, ulong_t);
239 extern char *nameof_prog(int);
240 extern char *getproto(int);
241 extern uint8_t print_ipv6_extensions(int, uint8_t **, uint8_t *, int *, int *);
242 extern void protoprint(int, int, ulong_t, int, int, int, char *, int);
243 extern char *getportname(int, in_port_t);
244 
245 extern void interpret_arp(int, struct arphdr *, int);
246 extern void interpret_bparam(int, int, int, int, int, char *, int);
247 extern void interpret_dns(int, int, const uchar_t *, int, int);
248 extern void interpret_mount(int, int, int, int, int, char *, int);
249 extern void interpret_nfs(int, int, int, int, int, char *, int);
250 extern void interpret_nfs3(int, int, int, int, int, char *, int);
251 extern void interpret_nfs4(int, int, int, int, int, char *, int);
252 extern void interpret_nfs4_cb(int, int, int, int, int, char *, int);
253 extern void interpret_nfs_acl(int, int, int, int, int, char *, int);
254 extern void interpret_nis(int, int, int, int, int, char *, int);
255 extern void interpret_nisbind(int, int, int, int, int, char *, int);
256 extern void interpret_nlm(int, int, int, int, int, char *, int);
257 extern void interpret_pmap(int, int, int, int, int, char *, int);
258 extern int interpret_reserved(int, int, in_port_t, in_port_t, char *, int);
259 extern void interpret_rquota(int, int, int, int, int, char *, int);
260 extern void interpret_rstat(int, int, int, int, int, char *, int);
261 extern void interpret_solarnet_fw(int, int, int, int, int, char *, int);
262 extern void interpret_ldap(int, char *, int, int, int);
263 extern void interpret_icmp(int, struct icmp *, int, int);
264 extern void interpret_icmpv6(int, icmp6_t *, int, int);
265 extern int interpret_ip(int, const struct ip *, int);
266 extern int interpret_ipv6(int, const ip6_t *, int);
267 extern int interpret_ppp(int, uchar_t *, int);
268 extern int interpret_pppoe(int, poep_t *, int);
269 struct tcphdr;
270 extern int interpret_tcp(int, struct tcphdr *, int, int);
271 struct udphdr;
272 extern int interpret_udp(int, struct udphdr *, int, int);
273 extern int interpret_esp(int, uint8_t *, int, int);
274 extern int interpret_ah(int, uint8_t *, int, int);
275 struct sctp_hdr;
276 extern void interpret_sctp(int, struct sctp_hdr *, int, int);
277 extern void interpret_mip_cntrlmsg(int, uchar_t *, int);
278 struct dhcp;
279 extern int interpret_dhcp(int, struct dhcp *, int);
280 extern int interpret_dhcpv6(int, const uint8_t *, int);
281 struct tftphdr;
282 extern int interpret_tftp(int, void *, int);
283 extern int interpret_http(int, char *, int);
284 struct ntpdata;
285 extern int interpret_ntp(int, struct ntpdata *, int);
286 extern void interpret_netbios_ns(int, uchar_t *, int);
287 extern void interpret_netbios_datagram(int, uchar_t *, int);
288 extern void interpret_netbios_ses(int, uchar_t *, int);
289 extern int interpret_slp(int, void *, int);
290 struct rip;
291 extern int interpret_rip(int, struct rip *, int);
292 struct rip6;
293 extern int interpret_rip6(int, struct rip6 *, int);
294 extern int interpret_socks_call(int, char *, int);
295 extern int interpret_socks_reply(int, char *, int);
296 extern int interpret_trill(int, struct ether_header **, char *, int *);
297 extern int interpret_isis(int, char *, int, boolean_t);
298 extern int interpret_bpdu(int, char *, int);
299 extern int interpret_vxlan(int, char *, int);
300 extern void init_ldap(void);
301 extern boolean_t arp_for_ether(char *, struct ether_addr *);
302 extern char *ether_ouiname(uint32_t);
303 extern char *tohex(char *p, int len);
304 extern char *printether(struct ether_addr *);
305 extern char *print_ethertype(int);
306 extern const char *arp_htype(int);
307 extern int valid_rpc(char *, int);
308 
309 /*
310  * Describes characteristics of the Media Access Layer.
311  * The mac_type is one of the supported DLPI media
312  * types (see <sys/dlpi.h>).
313  * The mtu_size is the size of the largest frame.
314  * network_type_offset is where the network type
315  * is located in the link layer header.
316  * The header length is returned by a function to
317  * allow for variable header size - for ethernet it's
318  * just a constant 14 octets.
319  * The interpreter is the function that "knows" how
320  * to interpret the frame.
321  * try_kernel_filter tells snoop to first try a kernel
322  * filter (because the header size is fixed, or if it could
323  * be of variable size where the variable size is easy for a kernel
324  * filter to handle, for example, Ethernet and VLAN tags)
325  * and only use a user space filter if the filter expression
326  * cannot be expressed in kernel space.
327  */
328 typedef uint_t (interpreter_fn_t)(int, char *, int, int);
329 typedef uint_t (headerlen_fn_t)(char *, size_t);
330 typedef struct interface {
331 	uint_t		mac_type;
332 	uint_t		mtu_size;
333 	uint_t		network_type_offset;
334 	size_t		network_type_len;
335 	uint_t		network_type_ip;
336 	uint_t		network_type_ipv6;
337 	headerlen_fn_t	*header_len;
338 	interpreter_fn_t *interpreter;
339 	boolean_t	try_kernel_filter;
340 } interface_t;
341 
342 extern interface_t INTERFACES[], *interface;
343 extern char *dlc_header;
344 extern char *src_name, *dst_name;
345 extern char *prot_prefix;
346 extern char *prot_nest_prefix;
347 extern char *prot_title;
348 
349 /* Keep track of how many nested IP headers we have. */
350 extern unsigned int encap_levels, total_encap_levels;
351 
352 extern int quitting;
353 extern boolean_t Iflg, Pflg, fflg, rflg;
354 
355 /*
356  * Global error recovery routine: used to reset snoop variables after
357  * catastrophic failure.
358  */
359 void snoop_recover(void);
360 
361 /*
362  * Global alarm handler structure for managing multiple alarms within
363  * snoop.
364  */
365 typedef struct snoop_handler {
366 	struct snoop_handler *s_next;		/* next alarm handler */
367 	time_t s_time;				/* time to fire */
368 	void (*s_handler)();			/* alarm handler */
369 } snoop_handler_t;
370 
371 #define	SNOOP_MAXRECOVER	20	/* maxium number of recoveries */
372 #define	SNOOP_ALARM_GRAN	3	/* alarm() timeout multiplier */
373 
374 /*
375  * Global alarm handler management routine.
376  */
377 extern int snoop_alarm(int s_sec, void (*s_handler)());
378 
379 /*
380  * The next two definitions do not take into account the length
381  * of the underlying link header.  In order to use them, you must
382  * add link_header_len to them.  The reason it is not done here is
383  * that later these macros are used to initialize a table.
384  */
385 #define	IPV4_TYPE_HEADER_OFFSET 9
386 #define	IPV6_TYPE_HEADER_OFFSET 6
387 
388 #ifdef __cplusplus
389 }
390 #endif
391 
392 #endif	/* _SNOOP_H */
393