1/*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21/*
22 * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
23 * Use is subject to license terms.
24 * Copyright 2012 Milan Jurik. All rights reserved.
25 */
26
27#include <stdio.h>
28#include <string.h>
29#include <strings.h>
30#include <errno.h>
31#include <fcntl.h>
32#include <setjmp.h>
33#include <sys/types.h>
34#include <sys/signal.h>
35#include <sys/time.h>
36#include <sys/socket.h>
37#include <sys/sockio.h>
38#include <netinet/in.h>
39#include <netinet/ip.h>
40#include <sys/pfmod.h>
41#include <sys/mman.h>
42#include <sys/stat.h>
43#include <sys/bufmod.h>
44
45#include <unistd.h>
46#include <stropts.h>
47#include <stdlib.h>
48#include <ctype.h>
49#include <values.h>
50#include <libdlpi.h>
51
52#include "snoop.h"
53
54/*
55 * Old header format.
56 * Actually two concatenated structs:  nit_bufhdr + nit_head
57 */
58struct ohdr {
59	/* nit_bufhdr */
60	int	o_msglen;
61	int	o_totlen;
62	/* nit_head */
63	struct timeval o_time;
64	int	o_drops;
65	int	o_len;
66};
67
68static void scan(char *, int, int, int, int, void (*)(), int, int, int);
69void convert_to_network();
70void convert_from_network();
71static void convert_old(struct ohdr *);
72extern sigjmp_buf jmp_env, ojmp_env;
73static char *bufp;	/* pointer to read buffer */
74
75static int strioctl(int, int, int, int, void *);
76
77enum { DWA_NONE, DWA_EXISTS, DWA_PLUMBED };
78
79typedef struct dlpi_walk_arg {
80	char	dwa_linkname[MAXLINKNAMELEN];
81	int	dwa_type;	/* preference type above */
82	int	dwa_s4;		/* IPv4 socket */
83	int	dwa_s6;		/* IPv6 socket */
84} dlpi_walk_arg_t;
85
86static boolean_t
87select_datalink(const char *linkname, void *arg)
88{
89	struct lifreq lifr;
90	dlpi_walk_arg_t *dwap = arg;
91	int s4 = dwap->dwa_s4;
92	int s6 = dwap->dwa_s6;
93
94	(void) strlcpy(dwap->dwa_linkname, linkname, MAXLINKNAMELEN);
95	dwap->dwa_type = DWA_EXISTS;
96
97	/*
98	 * See if it's plumbed by IP.  We prefer such links because they're
99	 * more likely to have interesting traffic.
100	 */
101	bzero(&lifr, sizeof (lifr));
102	(void) strlcpy(lifr.lifr_name, linkname, LIFNAMSIZ);
103	if ((s4 != -1 && ioctl(s4, SIOCGLIFFLAGS, &lifr) != -1) ||
104	    (s6 != -1 && ioctl(s6, SIOCGLIFFLAGS, &lifr) != -1)) {
105		dwap->dwa_type = DWA_PLUMBED;
106		return (B_TRUE);
107	}
108	return (B_FALSE);
109}
110
111/*
112 * Open `linkname' in raw/passive mode (see dlpi_open(3DLPI)).  If `linkname'
113 * is NULL, pick a datalink as per snoop(1M).  Also gather some information
114 * about the datalink useful for building the proper packet filters.
115 */
116boolean_t
117open_datalink(dlpi_handle_t *dhp, const char *linkname)
118{
119	int retval;
120	int flags = DLPI_PASSIVE | DLPI_RAW;
121	dlpi_walk_arg_t dwa;
122	dlpi_info_t dlinfo;
123
124	if (linkname == NULL) {
125		/*
126		 * Select a datalink to use by default.  Prefer datalinks that
127		 * are plumbed by IP.
128		 */
129		bzero(&dwa, sizeof (dwa));
130		dwa.dwa_s4 = socket(AF_INET, SOCK_DGRAM, 0);
131		dwa.dwa_s6 = socket(AF_INET6, SOCK_DGRAM, 0);
132		dlpi_walk(select_datalink, &dwa, 0);
133		(void) close(dwa.dwa_s4);
134		(void) close(dwa.dwa_s6);
135
136		if (dwa.dwa_type == DWA_NONE)
137			pr_err("no datalinks found");
138		if (dwa.dwa_type == DWA_EXISTS) {
139			(void) fprintf(stderr, "snoop: WARNING: "
140			    "no datalinks plumbed for IP traffic\n");
141		}
142		linkname = dwa.dwa_linkname;
143	}
144	if (Iflg)
145		flags |= DLPI_DEVIPNET;
146	if (Iflg || strcmp(linkname, "lo0") == 0)
147		flags |= DLPI_IPNETINFO;
148	if ((retval = dlpi_open(linkname, dhp, flags)) != DLPI_SUCCESS) {
149		pr_err("cannot open \"%s\": %s", linkname,
150		    dlpi_strerror(retval));
151	}
152
153	if ((retval = dlpi_info(*dhp, &dlinfo, 0)) != DLPI_SUCCESS)
154		pr_errdlpi(*dhp, "dlpi_info failed", retval);
155
156	for (interface = &INTERFACES[0]; interface->mac_type != -1; interface++)
157		if (interface->mac_type == dlinfo.di_mactype)
158			break;
159
160	/* allow limited functionality even if interface isn't known */
161	if (interface->mac_type == -1) {
162		(void) fprintf(stderr, "snoop: WARNING: Mac Type = %x "
163		    "not supported\n", dlinfo.di_mactype);
164	}
165
166	return (interface->try_kernel_filter);
167}
168
169/*
170 * Initialize `dh' for packet capture using the provided arguments.
171 */
172void
173init_datalink(dlpi_handle_t dh, ulong_t snaplen, ulong_t chunksize,
174    struct timeval *timeout, struct Pf_ext_packetfilt *fp)
175{
176	int 	retv;
177	int 	netfd;
178
179	retv = dlpi_bind(dh, DLPI_ANY_SAP, NULL);
180	if (retv != DLPI_SUCCESS)
181		pr_errdlpi(dh, "cannot bind on", retv);
182
183	if (Iflg) {
184		(void) fprintf(stderr, "Using device ipnet/%s ",
185		    dlpi_linkname(dh));
186	} else {
187		(void) fprintf(stderr, "Using device %s ", dlpi_linkname(dh));
188	}
189
190	/*
191	 * If Pflg not set - use physical level
192	 * promiscuous mode.  Otherwise - just SAP level.
193	 */
194	if (!Pflg) {
195		(void) fprintf(stderr, "(promiscuous mode)\n");
196		retv = dlpi_promiscon(dh, DL_PROMISC_PHYS);
197		if (retv != DLPI_SUCCESS) {
198			pr_errdlpi(dh, "promiscuous mode(physical) failed",
199			    retv);
200		}
201	} else {
202		(void) fprintf(stderr, "(non promiscuous)\n");
203		retv = dlpi_promiscon(dh, DL_PROMISC_MULTI);
204		if (retv != DLPI_SUCCESS) {
205			pr_errdlpi(dh, "promiscuous mode(multicast) failed",
206			    retv);
207		}
208	}
209
210	retv = dlpi_promiscon(dh, DL_PROMISC_SAP);
211	if (retv != DLPI_SUCCESS)
212		pr_errdlpi(dh, "promiscuous mode(SAP) failed", retv);
213
214	netfd = dlpi_fd(dh);
215
216	if (fp) {
217		/*
218		 * push and configure the packet filtering module
219		 */
220		if (ioctl(netfd, I_PUSH, "pfmod") < 0)
221			pr_errdlpi(dh, "cannot push \"pfmod\"", DL_SYSERR);
222
223		if (strioctl(netfd, PFIOCSETF, -1, sizeof (*fp),
224		    (char *)fp) < 0)
225			pr_errdlpi(dh, "PFIOCSETF", DL_SYSERR);
226	}
227
228	if (ioctl(netfd, I_PUSH, "bufmod") < 0)
229		pr_errdlpi(dh, "cannot push \"bufmod\"", DL_SYSERR);
230
231	if (strioctl(netfd, SBIOCSTIME, -1, sizeof (struct timeval),
232	    (char *)timeout) < 0)
233		pr_errdlpi(dh, "SBIOCSTIME", DL_SYSERR);
234
235	if (strioctl(netfd, SBIOCSCHUNK, -1, sizeof (uint_t),
236	    (char *)&chunksize) < 0)
237		pr_errdlpi(dh, "SBIOCGCHUNK", DL_SYSERR);
238
239	if (strioctl(netfd, SBIOCSSNAP, -1, sizeof (uint_t),
240	    (char *)&snaplen) < 0)
241		pr_errdlpi(dh, "SBIOCSSNAP", DL_SYSERR);
242
243	/*
244	 * Flush the read queue, to get rid of anything that
245	 * accumulated before the device reached its final configuration.
246	 */
247	if (ioctl(netfd, I_FLUSH, FLUSHR) < 0)
248		pr_errdlpi(dh, "cannot flush \"I_FLUSH\"", DL_SYSERR);
249}
250
251/*
252 * Read packets from the network.  init_datalink() is called in
253 * here to set up the network interface for reading of
254 * raw ethernet packets in promiscuous mode into a buffer.
255 * Packets are read and either written directly to a file
256 * or interpreted for display on the fly.
257 */
258void
259net_read(dlpi_handle_t dh, size_t chunksize, int filter, void (*proc)(),
260    int flags)
261{
262	int 	retval;
263	extern int count;
264	size_t	msglen;
265
266	count = 0;
267
268	/* allocate a read buffer */
269	bufp = malloc(chunksize);
270	if (bufp == NULL)
271		pr_err("no memory for %d buffer", chunksize);
272
273	/*
274	 * read frames
275	 */
276	for (;;) {
277		msglen = chunksize;
278		retval = dlpi_recv(dh, NULL, NULL, bufp, &msglen, -1, NULL);
279
280		if (retval != DLPI_SUCCESS || quitting)
281			break;
282
283		if (msglen != 0)
284			scan(bufp, msglen, filter, 0, 0, proc, 0, 0, flags);
285	}
286
287	free(bufp);
288
289	if (!quitting)
290		pr_errdlpi(dh, "network read failed", retval);
291}
292
293#ifdef DEBUG
294/*
295 * corrupt: simulate packet corruption for debugging interpreters
296 */
297void
298corrupt(volatile char *pktp, volatile char *pstop, char *buf,
299	volatile char *bufstop)
300{
301	int c;
302	int i;
303	int p;
304	int li = rand() % (pstop - pktp - 1) + 1;
305	volatile char *pp = pktp;
306	volatile char *pe = bufstop < pstop ? bufstop : pstop;
307
308	if (pktp < buf || pktp > bufstop)
309		return;
310
311	for (pp = pktp; pp < pe; pp += li) {
312		c = ((pe - pp) < li ? pe - pp : li);
313		i = (rand() % c)>>1;
314		while (--i > 0) {
315			p = (rand() % c);
316			pp[p] = (unsigned char)(rand() & 0xFF);
317		}
318	}
319}
320#endif /* DEBUG */
321
322static void
323scan(char *buf, int len, int filter, int cap, int old, void (*proc)(),
324    int first, int last, int flags)
325{
326	volatile char *bp, *bufstop;
327	volatile struct sb_hdr *hdrp;
328	volatile struct sb_hdr nhdr, *nhdrp;
329	volatile char *pktp;
330	volatile struct timeval last_timestamp;
331	volatile int header_okay;
332	extern int count, maxcount;
333	extern int snoop_nrecover;
334#ifdef	DEBUG
335	extern int zflg;
336#endif	/* DEBUG */
337
338	proc(0, 0, 0);
339	bufstop = buf + len;
340
341	/*
342	 *
343	 * Loop through each packet in the buffer
344	 */
345	last_timestamp.tv_sec = 0;
346	(void) memcpy((char *)ojmp_env, (char *)jmp_env, sizeof (jmp_env));
347	for (bp = buf; bp < bufstop; bp += nhdrp->sbh_totlen) {
348		/*
349		 * Gracefully exit if user terminates
350		 */
351		if (quitting)
352			break;
353		/*
354		 * Global error recocery: Prepare to continue when a corrupt
355		 * packet or header is encountered.
356		 */
357		if (sigsetjmp(jmp_env, 1)) {
358			goto err;
359		}
360
361		header_okay = 0;
362		hdrp = (struct sb_hdr *)bp;
363		nhdrp = hdrp;
364		pktp = (char *)hdrp + sizeof (*hdrp);
365
366		/*
367		 * If reading a capture file
368		 * convert the headers from network
369		 * byte order (for little-endians like X86)
370		 */
371		if (cap) {
372			/*
373			 * If the packets come from an old
374			 * capture file, convert the header.
375			 */
376			if (old) {
377				convert_old((struct ohdr *)hdrp);
378			}
379
380			nhdrp = &nhdr;
381
382			nhdrp->sbh_origlen = ntohl(hdrp->sbh_origlen);
383			nhdrp->sbh_msglen = ntohl(hdrp->sbh_msglen);
384			nhdrp->sbh_totlen = ntohl(hdrp->sbh_totlen);
385			nhdrp->sbh_drops = ntohl(hdrp->sbh_drops);
386			nhdrp->sbh_timestamp.tv_sec =
387			    ntohl(hdrp->sbh_timestamp.tv_sec);
388			nhdrp->sbh_timestamp.tv_usec =
389			    ntohl(hdrp->sbh_timestamp.tv_usec);
390		}
391
392		/* Enhanced check for valid header */
393
394		if ((nhdrp->sbh_totlen == 0) ||
395		    (bp + nhdrp->sbh_totlen) < bp ||
396		    (bp + nhdrp->sbh_totlen) > bufstop ||
397		    (nhdrp->sbh_origlen == 0) ||
398		    (bp + nhdrp->sbh_origlen) < bp ||
399		    (nhdrp->sbh_msglen == 0) ||
400		    (bp + nhdrp->sbh_msglen) < bp ||
401		    (bp + nhdrp->sbh_msglen) > bufstop ||
402		    (nhdrp->sbh_msglen > nhdrp->sbh_origlen) ||
403		    (nhdrp->sbh_totlen < nhdrp->sbh_msglen) ||
404		    (nhdrp->sbh_timestamp.tv_sec == 0)) {
405			if (cap) {
406				(void) fprintf(stderr, "(warning) bad packet "
407				    "header in capture file");
408			} else {
409				(void) fprintf(stderr, "(warning) bad packet "
410				    "header in buffer");
411			}
412			(void) fprintf(stderr, " offset %d: length=%d\n",
413			    bp - buf, nhdrp->sbh_totlen);
414			goto err;
415		}
416
417		/*
418		 * Check for incomplete packet.  We are conservative here,
419		 * since we don't know how good the checking is in other
420		 * parts of the code.  We pass a partial packet, with
421		 * a warning.
422		 */
423		if (pktp + nhdrp->sbh_msglen > bufstop) {
424			(void) fprintf(stderr, "truncated packet buffer\n");
425			nhdrp->sbh_msglen = bufstop - pktp;
426		}
427
428#ifdef DEBUG
429		if (zflg)
430			corrupt(pktp, pktp + nhdrp->sbh_msglen, buf, bufstop);
431#endif /* DEBUG */
432
433		header_okay = 1;
434		if (!filter ||
435		    want_packet((uchar_t *)pktp,
436		    nhdrp->sbh_msglen,
437		    nhdrp->sbh_origlen)) {
438			count++;
439
440			/*
441			 * Start deadman timer for interpreter processing
442			 */
443			(void) snoop_alarm(SNOOP_ALARM_GRAN*SNOOP_MAXRECOVER,
444			    NULL);
445
446			encap_levels = 0;
447			if (!cap || count >= first)
448				proc(nhdrp, pktp, count, flags);
449
450			if (cap && count >= last) {
451				(void) snoop_alarm(0, NULL);
452				break;
453			}
454
455			if (maxcount && count >= maxcount) {
456				(void) fprintf(stderr, "%d packets captured\n",
457				    count);
458				exit(0);
459			}
460
461			snoop_nrecover = 0;			/* success */
462			(void) snoop_alarm(0, NULL);
463			last_timestamp = hdrp->sbh_timestamp;	/* save stamp */
464		}
465		continue;
466err:
467		/*
468		 * Corruption has been detected. Reset errors.
469		 */
470		snoop_recover();
471
472		/*
473		 * packet header was apparently okay. Continue.
474		 */
475		if (header_okay)
476			continue;
477
478		/*
479		 * Otherwise try to scan forward to the next packet, using
480		 * the last known timestamp if it is available.
481		 */
482		nhdrp = &nhdr;
483		nhdrp->sbh_totlen = 0;
484		if (last_timestamp.tv_sec == 0) {
485			bp += sizeof (int);
486		} else {
487			for (bp += sizeof (int); bp <= bufstop;
488			    bp += sizeof (int)) {
489				hdrp = (struct sb_hdr *)bp;
490				/* An approximate timestamp located */
491				if ((hdrp->sbh_timestamp.tv_sec >> 8) ==
492				    (last_timestamp.tv_sec >> 8))
493					break;
494			}
495		}
496	}
497	/* reset jmp_env for program exit */
498	(void) memcpy((char *)jmp_env, (char *)ojmp_env, sizeof (jmp_env));
499	proc(0, -1, 0);
500}
501
502/*
503 * Called if nwrite() encounters write problems.
504 */
505static void
506cap_write_error(const char *msgtype)
507{
508	(void) fprintf(stderr,
509	    "snoop: cannot write %s to capture file: %s\n",
510	    msgtype, strerror(errno));
511	exit(1);
512}
513
514/*
515 * Writes target buffer to the open file descriptor. Upon detection of a short
516 * write, an attempt to process the remaining bytes occurs until all anticipated
517 * bytes are written. An error status is returned to indicate any serious write
518 * failures.
519 */
520static int
521nwrite(int fd, const void *buffer, size_t buflen)
522{
523	size_t nwritten;
524	ssize_t nbytes = 0;
525	const char *buf = buffer;
526
527	for (nwritten = 0; nwritten < buflen; nwritten += nbytes) {
528		nbytes = write(fd, &buf[nwritten], buflen - nwritten);
529		if (nbytes == -1)
530			return (-1);
531		if (nbytes == 0) {
532			errno = EIO;
533			return (-1);
534		}
535	}
536	return (0);
537}
538
539/*
540 * Routines for opening, closing, reading and writing
541 * a capture file of packets saved with the -o option.
542 */
543static int capfile_out;
544
545/*
546 * The snoop capture file has a header to identify
547 * it as a capture file and record its version.
548 * A file without this header is assumed to be an
549 * old format snoop file.
550 *
551 * A version 1 header looks like this:
552 *
553 *   0   1   2   3   4   5   6   7   8   9  10  11
554 * +---+---+---+---+---+---+---+---+---+---+---+---+---+
555 * | s | n | o | o | p | \0| \0| \0|    version    |  data
556 * +---+---+---+---+---+---+---+---+---+---+---+---+---+
557 * |	 word 0	   |	 word 1	   |	 word 2	   |
558 *
559 *
560 * A version 2 header adds a word that identifies the MAC type.
561 * This allows for capture files from FDDI etc.
562 *
563 *   0   1   2   3   4   5   6   7   8   9  10  11  12  13  14  15
564 * +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
565 * | s | n | o | o | p | \0| \0| \0|    version    |    MAC type   | data
566 * +---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
567 * |	 word 0	   |	 word 1	   |	 word 2	   |	 word 3
568 *
569 */
570static const char *snoop_id = "snoop\0\0\0";
571static const int snoop_idlen = 8;
572static const int snoop_version = 2;
573
574void
575cap_open_write(const char *name)
576{
577	int vers;
578
579	capfile_out = open(name, O_CREAT | O_TRUNC | O_RDWR, 0666);
580	if (capfile_out < 0)
581		pr_err("%s: %m", name);
582
583	vers = htonl(snoop_version);
584	if (nwrite(capfile_out, snoop_id, snoop_idlen) == -1)
585		cap_write_error("snoop_id");
586
587	if (nwrite(capfile_out, &vers, sizeof (int)) == -1)
588		cap_write_error("version");
589}
590
591
592void
593cap_close(void)
594{
595	(void) close(capfile_out);
596}
597
598static char *cap_buffp = NULL;
599static int cap_len = 0;
600static int cap_new;
601
602void
603cap_open_read(const char *name)
604{
605	struct stat st;
606	int cap_vers;
607	int *word;
608	int device_mac_type = -1;
609	int capfile_in;
610
611	capfile_in = open(name, O_RDONLY);
612	if (capfile_in < 0)
613		pr_err("couldn't open %s: %m", name);
614
615	if (fstat(capfile_in, &st) < 0)
616		pr_err("couldn't stat %s: %m", name);
617	cap_len = st.st_size;
618
619	cap_buffp = mmap(0, cap_len, PROT_READ, MAP_PRIVATE, capfile_in, 0);
620	(void) close(capfile_in);
621	if ((int)cap_buffp == -1)
622		pr_err("couldn't mmap %s: %m", name);
623
624	/* Check if new snoop capture file format */
625
626	cap_new = bcmp(cap_buffp, snoop_id, snoop_idlen) == 0;
627
628	/*
629	 * If new file - check version and
630	 * set buffer pointer to point at first packet
631	 */
632	if (cap_new) {
633		cap_vers = ntohl(*(int *)(cap_buffp + snoop_idlen));
634		cap_buffp += snoop_idlen + sizeof (int);
635		cap_len   -= snoop_idlen + sizeof (int);
636
637		switch (cap_vers) {
638		case 1:
639			device_mac_type = DL_ETHER;
640			break;
641
642		case 2:
643			device_mac_type = ntohl(*((int *)cap_buffp));
644			cap_buffp += sizeof (int);
645			cap_len   -= sizeof (int);
646			break;
647
648		default:
649			pr_err("capture file: %s: Version %d unrecognized\n",
650			    name, cap_vers);
651		}
652
653		for (interface = &INTERFACES[0]; interface->mac_type != -1;
654		    interface++)
655			if (interface->mac_type == device_mac_type)
656				break;
657
658		if (interface->mac_type == -1)
659			pr_err("Mac Type = %x is not supported\n",
660			    device_mac_type);
661	} else {
662		/* Use heuristic to check if it's an old-style file */
663
664		device_mac_type = DL_ETHER;
665		word = (int *)cap_buffp;
666
667		if (!((word[0] < 1600 && word[1] < 1600) &&
668		    (word[0] < word[1]) &&
669		    (word[2] > 610000000 && word[2] < 770000000)))
670			pr_err("not a capture file: %s", name);
671
672		/* Change protection so's we can fix the headers */
673
674		if (mprotect(cap_buffp, cap_len, PROT_READ | PROT_WRITE) < 0)
675			pr_err("mprotect: %s: %m", name);
676	}
677}
678
679void
680cap_read(int first, int last, int filter, void (*proc)(), int flags)
681{
682	extern int count;
683
684	count = 0;
685
686	scan(cap_buffp, cap_len, filter, 1, !cap_new, proc, first, last, flags);
687
688	(void) munmap(cap_buffp, cap_len);
689}
690
691/* ARGSUSED */
692void
693cap_write(struct sb_hdr *hdrp, char *pktp, int num, int flags)
694{
695	int pktlen, mac;
696	static int first = 1;
697	struct sb_hdr nhdr;
698	extern boolean_t qflg;
699
700	if (hdrp == NULL)
701		return;
702
703	if (first) {
704		first = 0;
705		mac = htonl(interface->mac_type);
706		if (nwrite(capfile_out, &mac, sizeof (int)) == -1)
707			cap_write_error("mac_type");
708	}
709
710	pktlen = hdrp->sbh_totlen - sizeof (*hdrp);
711
712	/*
713	 * Convert sb_hdr to network byte order
714	 */
715	nhdr.sbh_origlen = htonl(hdrp->sbh_origlen);
716	nhdr.sbh_msglen = htonl(hdrp->sbh_msglen);
717	nhdr.sbh_totlen = htonl(hdrp->sbh_totlen);
718	nhdr.sbh_drops = htonl(hdrp->sbh_drops);
719	nhdr.sbh_timestamp.tv_sec = htonl(hdrp->sbh_timestamp.tv_sec);
720	nhdr.sbh_timestamp.tv_usec = htonl(hdrp->sbh_timestamp.tv_usec);
721
722	if (nwrite(capfile_out, &nhdr, sizeof (nhdr)) == -1)
723		cap_write_error("packet header");
724
725	if (nwrite(capfile_out, pktp, pktlen) == -1)
726		cap_write_error("packet");
727
728	if (! qflg)
729		show_count();
730}
731
732/*
733 * Convert a packet header from
734 * old to new format.
735 */
736static void
737convert_old(struct ohdr *ohdrp)
738{
739	struct sb_hdr nhdr;
740
741	nhdr.sbh_origlen = ohdrp->o_len;
742	nhdr.sbh_msglen  = ohdrp->o_msglen;
743	nhdr.sbh_totlen  = ohdrp->o_totlen;
744	nhdr.sbh_drops   = ohdrp->o_drops;
745	nhdr.sbh_timestamp = ohdrp->o_time;
746
747	*(struct sb_hdr *)ohdrp = nhdr;
748}
749
750static int
751strioctl(int fd, int cmd, int timout, int len, void *dp)
752{
753	struct	strioctl	sioc;
754	int	rc;
755
756	sioc.ic_cmd = cmd;
757	sioc.ic_timout = timout;
758	sioc.ic_len = len;
759	sioc.ic_dp = dp;
760	rc = ioctl(fd, I_STR, &sioc);
761
762	if (rc < 0)
763		return (rc);
764	else
765		return (sioc.ic_len);
766}
767