2 * (C)opyright 1992-1998 Darren Reed. (from tcplog)
4 * See the IPFILTER.LICENCE file for details on licencing.
6 * The author of this software makes no garuntee about the
7 * performance of this package or its suitability to fulfill any purpose.
16 #include <sys/types.h>
18 #include <sys/timeb.h>
19 #include <sys/socket.h>
21 #include <sys/ioctl.h>
23 #include <sys/fcntlcom.h>
25 #include <net/nit_if.h>
26 #include <net/nit_pf.h>
27 #include <net/nit_buf.h>
28 #include <net/packetfilt.h>
29 #include <sys/stropts.h>
32 #include <netinet/in.h>
33 #include <netinet/in_systm.h>
34 #include <netinet/ip.h>
35 #include <netinet/if_ether.h>
36 #include <netinet/ip_var.h>
37 #include <netinet/udp.h>
38 #include <netinet/udp_var.h>
39 #include <netinet/tcp.h>
40 #include <netinet/tcpip.h>
43 static char snitid[] = "@(#)snit.c 1.2 12/3/95 (C)1995 Darren Reed";
46 #define BUFSPACE 32768
49 * Be careful to only include those defined in the flags option for the
50 * interface are included in the header size.
52 #define BUFHDR_SIZE (sizeof(struct nit_bufhdr))
53 #define NIT_HDRSIZE (BUFHDR_SIZE)
65 ip = (struct ip *)&tip;
66 tcp = (struct tcphdr *)(ip + 1);
67 bcopy(ep + 14, (char *)ip, sizeof(*ip));
68 bcopy(ep + 14 + (ip->ip_hl << 2), (char *)tcp, sizeof(*tcp));
69 if (ip->ip_off & 0x1fff != 0)
71 if (0 == detect(ip, tcp))
81 static u_char buf[BUFSPACE];
82 register u_char *bp, *cp, *bufend;
83 register struct nit_bufhdr *hp;
85 time_t now = time(NULL);
88 while ((cc = read(fd, buf, BUFSPACE-1)) >= 0) {
90 if ((time(NULL) - now) > timeout)
97 * loop through each snapshot in the chunk
100 cp = (u_char *)((char *)bp + NIT_HDRSIZE);
102 * get past NIT buffer
104 hp = (struct nit_bufhdr *)bp;
108 bp += hp->nhb_totlen;
109 done += ack_recv(cp);
117 int initdevice(device, tout)
124 struct packetfilt pfil;
126 u_short *fwp = pfil.Pf_Filter;
127 int ret, offset, fd, snaplen= 76, chunksize = BUFSPACE;
129 if ((fd = open("/dev/nit", O_RDWR)) < 0)
136 * Create some filter rules for our TCP watcher. We only want ethernet
137 * pacets which are IP protocol and only the TCP packets from IP.
140 *fwp++ = ENF_PUSHWORD + offset;
141 *fwp++ = ENF_PUSHLIT | ENF_CAND;
142 *fwp++ = htons(ETHERTYPE_IP);
143 *fwp++ = ENF_PUSHWORD + sizeof(struct ether_header)/sizeof(short)+4;
144 *fwp++ = ENF_PUSHLIT | ENF_AND;
145 *fwp++ = htons(0x00ff);
146 *fwp++ = ENF_PUSHLIT | ENF_COR;
147 *fwp++ = htons(IPPROTO_TCP);
148 *fwp++ = ENF_PUSHWORD + sizeof(struct ether_header)/sizeof(short)+4;
149 *fwp++ = ENF_PUSHLIT | ENF_AND;
150 *fwp++ = htons(0x00ff);
151 *fwp++ = ENF_PUSHLIT | ENF_CAND;
152 *fwp++ = htons(IPPROTO_UDP);
153 pfil.Pf_FilterLen = fwp - &pfil.Pf_Filter[0];
155 * put filter in place.
157 if (ioctl(fd, I_PUSH, "pf") == -1)
159 perror("ioctl: I_PUSH pf");
162 if (ioctl(fd, NIOCSETF, &pfil) == -1)
164 perror("ioctl: NIOCSETF");
168 * arrange to get messages from the NIT STREAM and use NIT_BUF option
170 ioctl(fd, I_SRDOPT, (char*)RMSGD);
171 ioctl(fd, I_PUSH, "nbuf");
179 si.ic_cmd = NIOCSTIME;
180 si.ic_len = sizeof(to);
181 si.ic_dp = (char*)&to;
182 if (ioctl(fd, I_STR, (char*)&si) == -1)
184 perror("ioctl: NIT timeout");
190 si.ic_cmd = NIOCSCHUNK;
191 si.ic_len = sizeof(chunksize);
192 si.ic_dp = (char*)&chunksize;
193 if (ioctl(fd, I_STR, (char*)&si) == -1)
194 perror("ioctl: NIT chunksize");
195 if (ioctl(fd, NIOCGCHUNK, (char*)&chunksize) == -1)
197 perror("ioctl: NIT chunksize");
200 printf("NIT buffer size: %d\n", chunksize);
203 * request the interface
205 strncpy(ifr.ifr_name, device, sizeof(ifr.ifr_name));
206 ifr.ifr_name[sizeof(ifr.ifr_name) - 1] = ' ';
207 si.ic_cmd = NIOCBIND;
208 si.ic_len = sizeof(ifr);
209 si.ic_dp = (char*)𝔦
210 if (ioctl(fd, I_STR, (char*)&si) == -1)
212 perror(ifr.ifr_name);
217 * set the snapshot length
219 si.ic_cmd = NIOCSSNAP;
220 si.ic_len = sizeof(snaplen);
221 si.ic_dp = (char*)&snaplen;
222 if (ioctl(fd, I_STR, (char*)&si) == -1)
224 perror("ioctl: NIT snaplen");
227 (void) ioctl(fd, I_FLUSH, (char*)FLUSHR);