1 /*        $NetBSD: pcap-dlpi.c,v 1.8 2024/09/02 15:33:37 christos Exp $         */
2 
3 /*
4  * Copyright (c) 1993, 1994, 1995, 1996, 1997
5  *        The Regents of the University of California.  All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that: (1) source code distributions
9  * retain the above copyright notice and this paragraph in its entirety, (2)
10  * distributions including binary code include the above copyright notice and
11  * this paragraph in its entirety in the documentation or other materials
12  * provided with the distribution, and (3) all advertising materials mentioning
13  * features or use of this software display the following acknowledgement:
14  * ``This product includes software developed by the University of California,
15  * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
16  * the University nor the names of its contributors may be used to endorse
17  * or promote products derived from this software without specific prior
18  * written permission.
19  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
20  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
21  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
22  *
23  * This code contributed by Atanu Ghosh (atanu@cs.ucl.ac.uk),
24  * University College London, and subsequently modified by
25  * Guy Harris (guy@alum.mit.edu), Mark Pizzolato
26  * <List-tcpdump-workers@subscriptions.pizzolato.net>,
27  * Mark C. Brown (mbrown@hp.com), and Sagun Shakya <Sagun.Shakya@Sun.COM>.
28  */
29 
30 /*
31  * Packet capture routine for DLPI under SunOS 5, HP-UX 9/10/11, and AIX.
32  *
33  * Notes:
34  *
35  *    - The DLIOCRAW ioctl() is specific to SunOS.
36  *
37  *    - There is a bug in bufmod(7) such that setting the snapshot
38  *      length results in data being left of the front of the packet.
39  *
40  *    - It might be desirable to use pfmod(7) to filter packets in the
41  *      kernel when possible.
42  *
43  *    - An older version of the HP-UX DLPI Programmer's Guide, which
44  *      I think was advertised as the 10.20 version, used to be available
45  *      at
46  *
47  *            http://docs.hp.com/hpux/onlinedocs/B2355-90093/B2355-90093.html
48  *
49  *      but is no longer available; it can still be found at
50  *
51  *            http://h21007.www2.hp.com/dspp/files/unprotected/Drivers/Docs/Refs/B2355-90093.pdf
52  *
53  *      in PDF form.
54  *
55  *    - The HP-UX 10.x, 11.0, and 11i v1.6 version of the HP-UX DLPI
56  *      Programmer's Guide, which I think was once advertised as the
57  *      11.00 version is available at
58  *
59  *            http://docs.hp.com/en/B2355-90139/index.html
60  *
61  *    - The HP-UX 11i v2 version of the HP-UX DLPI Programmer's Guide
62  *      is available at
63  *
64  *            http://docs.hp.com/en/B2355-90871/index.html
65  *
66  *    - All of the HP documents describe raw-mode services, which are
67  *      what we use if DL_HP_RAWDLS is defined.  XXX - we use __hpux
68  *      in some places to test for HP-UX, but use DL_HP_RAWDLS in
69  *      other places; do we support any versions of HP-UX without
70  *      DL_HP_RAWDLS?
71  */
72 
73 #include <sys/cdefs.h>
74 __RCSID("$NetBSD: pcap-dlpi.c,v 1.8 2024/09/02 15:33:37 christos Exp $");
75 
76 #include <config.h>
77 
78 #include <sys/types.h>
79 #include <sys/time.h>
80 #ifdef HAVE_SYS_BUFMOD_H
81 #include <sys/bufmod.h>
82 #endif
83 #include <sys/dlpi.h>
84 #ifdef HAVE_SYS_DLPI_EXT_H
85 #include <sys/dlpi_ext.h>
86 #endif
87 #ifdef HAVE_HPUX9
88 #include <sys/socket.h>
89 #endif
90 #ifdef DL_HP_PPA_REQ
91 #include <sys/stat.h>
92 #endif
93 #include <sys/stream.h>
94 #if defined(HAVE_SOLARIS) && defined(HAVE_SYS_BUFMOD_H)
95 #include <sys/systeminfo.h>
96 #endif
97 
98 #ifdef HAVE_HPUX9
99 #include <net/if.h>
100 #endif
101 
102 #ifdef HAVE_HPUX9
103 #include <nlist.h>
104 #endif
105 #include <errno.h>
106 #include <fcntl.h>
107 #include <memory.h>
108 #include <stdio.h>
109 #include <stdlib.h>
110 #include <string.h>
111 #include <stropts.h>
112 #include <unistd.h>
113 #include <limits.h>
114 
115 #include "pcap-int.h"
116 #include "dlpisubs.h"
117 
118 #ifdef HAVE_OS_PROTO_H
119 #include "os-proto.h"
120 #endif
121 
122 #if defined(__hpux)
123   /*
124    * HP-UX has a /dev/dlpi device; you open it and set the PPA of the actual
125    * network device you want.
126    */
127   #define HAVE_DEV_DLPI
128 #elif defined(_AIX)
129   /*
130    * AIX has a /dev/dlpi directory, with devices named after the interfaces
131    * underneath it.
132    */
133   #define PCAP_DEV_PREFIX "/dev/dlpi"
134 #elif defined(HAVE_SOLARIS)
135   /*
136    * Solaris has devices named after the interfaces underneath /dev.
137    */
138   #define PCAP_DEV_PREFIX "/dev"
139 #endif
140 
141 #define   MAXDLBUF  8192
142 
143 /* Forwards */
144 static char *split_dname(char *, u_int *, char *);
145 static int dl_doattach(int, int, char *);
146 #ifdef DL_HP_RAWDLS
147 static int dl_dohpuxbind(int, char *);
148 #endif
149 static int dlpromiscon(pcap_t *, bpf_u_int32);
150 static int dlbindreq(int, bpf_u_int32, char *);
151 static int dlbindack(int, char *, char *, int *);
152 static int dlokack(int, const char *, char *, char *, int *);
153 static int dlinforeq(int, char *);
154 static int dlinfoack(int, char *, char *);
155 
156 #ifdef HAVE_DL_PASSIVE_REQ_T
157 static void dlpassive(int, char *);
158 #endif
159 
160 #ifdef DL_HP_RAWDLS
161 static int dlrawdatareq(int, const u_char *, int);
162 #endif
163 static int recv_ack(int, int, const char *, char *, char *, int *);
164 static char *dlstrerror(char *, size_t, bpf_u_int32);
165 static char *dlprim(char *, size_t, bpf_u_int32);
166 #if defined(HAVE_SOLARIS) && defined(HAVE_SYS_BUFMOD_H)
167 #define GET_RELEASE_BUFSIZE   32
168 static void get_release(char *, size_t, bpf_u_int32 *, bpf_u_int32 *,
169     bpf_u_int32 *);
170 #endif
171 static int send_request(int, char *, int, char *, char *);
172 #ifdef HAVE_HPUX9
173 static int dlpi_kread(int, off_t, void *, u_int, char *);
174 #endif
175 #ifdef HAVE_DEV_DLPI
176 static int get_dlpi_ppa(int, const char *, u_int, u_int *, char *);
177 #endif
178 
179 /*
180  * Cast a buffer to "union DL_primitives" without provoking warnings
181  * from the compiler.
182  */
183 #define MAKE_DL_PRIMITIVES(ptr)         ((union DL_primitives *)(void *)(ptr))
184 
185 static int
pcap_read_dlpi(pcap_t * p,int cnt,pcap_handler callback,u_char * user)186 pcap_read_dlpi(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
187 {
188           int cc;
189           u_char *bp;
190           int flags;
191           bpf_u_int32 ctlbuf[MAXDLBUF];
192           struct strbuf ctl = {
193                     MAXDLBUF,
194                     0,
195                     (char *)ctlbuf
196           };
197           struct strbuf data;
198 
199           flags = 0;
200           cc = p->cc;
201           if (cc == 0) {
202                     data.buf = (char *)p->buffer + p->offset;
203                     data.maxlen = p->bufsize;
204                     data.len = 0;
205                     do {
206                               /*
207                                * Has "pcap_breakloop()" been called?
208                                */
209                               if (p->break_loop) {
210                                         /*
211                                          * Yes - clear the flag that indicates
212                                          * that it has, and return -2 to
213                                          * indicate that we were told to
214                                          * break out of the loop.
215                                          */
216                                         p->break_loop = 0;
217                                         return (-2);
218                               }
219                               /*
220                                * XXX - check for the DLPI primitive, which
221                                * would be DL_HP_RAWDATA_IND on HP-UX
222                                * if we're in raw mode?
223                                */
224                               ctl.buf = (char *)ctlbuf;
225                               ctl.maxlen = MAXDLBUF;
226                               ctl.len = 0;
227                               if (getmsg(p->fd, &ctl, &data, &flags) < 0) {
228                                         /* Don't choke when we get ptraced */
229                                         switch (errno) {
230 
231                                         case EINTR:
232                                                   cc = 0;
233                                                   continue;
234 
235                                         case EAGAIN:
236                                                   return (0);
237                                         }
238                                         pcapint_fmt_errmsg_for_errno(p->errbuf,
239                                             sizeof(p->errbuf), errno, "getmsg");
240                                         return (-1);
241                               }
242                               cc = data.len;
243                     } while (cc == 0);
244                     bp = (u_char *)p->buffer + p->offset;
245           } else
246                     bp = p->bp;
247 
248           return (pcap_process_pkts(p, callback, user, cnt, bp, cc));
249 }
250 
251 static int
pcap_inject_dlpi(pcap_t * p,const void * buf,int size)252 pcap_inject_dlpi(pcap_t *p, const void *buf, int size)
253 {
254 #ifdef DL_HP_RAWDLS
255           struct pcap_dlpi *pd = p->priv;
256 #endif
257           int ret;
258 
259 #if defined(DLIOCRAW)
260           ret = write(p->fd, buf, size);
261           if (ret == -1) {
262                     pcapint_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE,
263                         errno, "send");
264                     return (-1);
265           }
266 #elif defined(DL_HP_RAWDLS)
267           if (pd->send_fd < 0) {
268                     snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
269                         "send: Output FD couldn't be opened");
270                     return (-1);
271           }
272           ret = dlrawdatareq(pd->send_fd, buf, size);
273           if (ret == -1) {
274                     pcapint_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE,
275                         errno, "send");
276                     return (-1);
277           }
278           /*
279            * putmsg() returns either 0 or -1; it doesn't indicate how
280            * many bytes were written (presumably they were all written
281            * or none of them were written).  OpenBSD's pcap_inject()
282            * returns the number of bytes written, so, for API compatibility,
283            * we return the number of bytes we were told to write.
284            */
285           ret = size;
286 #else /* no raw mode */
287           /*
288            * XXX - this is a pain, because you might have to extract
289            * the address from the packet and use it in a DL_UNITDATA_REQ
290            * request.  That would be dependent on the link-layer type.
291            *
292            * I also don't know what SAP you'd have to bind the descriptor
293            * to, or whether you'd need separate "receive" and "send" FDs,
294            * nor do I know whether you'd need different bindings for
295            * D/I/X Ethernet and 802.3, or for {FDDI,Token Ring} plus
296            * 802.2 and {FDDI,Token Ring} plus 802.2 plus SNAP.
297            *
298            * So, for now, we just return a "you can't send" indication,
299            * and leave it up to somebody with a DLPI-based system lacking
300            * both DLIOCRAW and DL_HP_RAWDLS to supply code to implement
301            * packet transmission on that system.  If they do, they should
302            * send it to us - but should not send us code that assumes
303            * Ethernet; if the code doesn't work on non-Ethernet interfaces,
304            * it should check "p->linktype" and reject the send request if
305            * it's anything other than DLT_EN10MB.
306            */
307           pcapint_strlcpy(p->errbuf, "send: Not supported on this version of this OS",
308               PCAP_ERRBUF_SIZE);
309           ret = -1;
310 #endif /* raw mode */
311           return (ret);
312 }
313 
314 #ifndef DL_IPATM
315 #define DL_IPATM    0x12      /* ATM Classical IP interface */
316 #endif
317 
318 #ifdef HAVE_SOLARIS
319 /*
320  * For SunATM.
321  */
322 #ifndef A_GET_UNITS
323 #define A_GET_UNITS (('A'<<8)|118)
324 #endif /* A_GET_UNITS */
325 #ifndef A_PROMISCON_REQ
326 #define A_PROMISCON_REQ       (('A'<<8)|121)
327 #endif /* A_PROMISCON_REQ */
328 #endif /* HAVE_SOLARIS */
329 
330 static void
pcap_cleanup_dlpi(pcap_t * p)331 pcap_cleanup_dlpi(pcap_t *p)
332 {
333 #ifdef DL_HP_RAWDLS
334           struct pcap_dlpi *pd = p->priv;
335 
336           if (pd->send_fd >= 0) {
337                     close(pd->send_fd);
338                     pd->send_fd = -1;
339           }
340 #endif
341           pcapint_cleanup_live_common(p);
342 }
343 
344 static int
open_dlpi_device(const char * name,u_int * ppa,char * errbuf)345 open_dlpi_device(const char *name, u_int *ppa, char *errbuf)
346 {
347           int status;
348           char dname[100];
349           char *cp;
350           int fd;
351 #ifdef HAVE_DEV_DLPI
352           u_int unit;
353 #else
354           char dname2[100];
355 #endif
356 
357 #ifdef HAVE_DEV_DLPI
358           /*
359           ** Remove any "/dev/" on the front of the device.
360           */
361           cp = strrchr(name, '/');
362           if (cp == NULL)
363                     pcapint_strlcpy(dname, name, sizeof(dname));
364           else
365                     pcapint_strlcpy(dname, cp + 1, sizeof(dname));
366 
367           /*
368            * Split the device name into a device type name and a unit number;
369            * chop off the unit number, so "dname" is just a device type name.
370            */
371           cp = split_dname(dname, &unit, errbuf);
372           if (cp == NULL) {
373                     /*
374                      * split_dname() has filled in the error message.
375                      */
376                     return (PCAP_ERROR_NO_SUCH_DEVICE);
377           }
378           *cp = '\0';
379 
380           /*
381            * Use "/dev/dlpi" as the device.
382            *
383            * XXX - HP's DLPI Programmer's Guide for HP-UX 11.00 says that
384            * the "dl_mjr_num" field is for the "major number of interface
385            * driver"; that's the major of "/dev/dlpi" on the system on
386            * which I tried this, but there may be DLPI devices that
387            * use a different driver, in which case we may need to
388            * search "/dev" for the appropriate device with that major
389            * device number, rather than hardwiring "/dev/dlpi".
390            */
391           cp = "/dev/dlpi";
392           if ((fd = open(cp, O_RDWR)) < 0) {
393                     if (errno == EPERM || errno == EACCES) {
394                               status = PCAP_ERROR_PERM_DENIED;
395                               snprintf(errbuf, PCAP_ERRBUF_SIZE,
396                                   "Attempt to open %s failed with %s - root privilege may be required",
397                                   cp, (errno == EPERM) ? "EPERM" : "EACCES");
398                     } else {
399                               status = PCAP_ERROR;
400                               pcapint_fmt_errmsg_for_errno(errbuf, PCAP_ERRBUF_SIZE,
401                                   errno, "Attempt to open %s failed", cp);
402                     }
403                     return (status);
404           }
405 
406           /*
407            * Get a table of all PPAs for that device, and search that
408            * table for the specified device type name and unit number.
409            */
410           status = get_dlpi_ppa(fd, dname, unit, ppa, errbuf);
411           if (status < 0) {
412                     close(fd);
413                     return (status);
414           }
415 #else
416           /*
417            * If the device name begins with "/", assume it begins with
418            * the pathname of the directory containing the device to open;
419            * otherwise, concatenate the device directory name and the
420            * device name.
421            */
422           if (*name == '/')
423                     pcapint_strlcpy(dname, name, sizeof(dname));
424           else
425                     snprintf(dname, sizeof(dname), "%s/%s", PCAP_DEV_PREFIX,
426                         name);
427 
428           /*
429            * Get the unit number, and a pointer to the end of the device
430            * type name.
431            */
432           cp = split_dname(dname, ppa, errbuf);
433           if (cp == NULL) {
434                     /*
435                      * split_dname() has filled in the error message.
436                      */
437                     return (PCAP_ERROR_NO_SUCH_DEVICE);
438           }
439 
440           /*
441            * Make a copy of the device pathname, and then remove the unit
442            * number from the device pathname.
443            */
444           pcapint_strlcpy(dname2, dname, sizeof(dname));
445           *cp = '\0';
446 
447           /* Try device without unit number */
448           if ((fd = open(dname, O_RDWR)) < 0) {
449                     if (errno != ENOENT) {
450                               if (errno == EPERM || errno == EACCES) {
451                                         status = PCAP_ERROR_PERM_DENIED;
452                                         snprintf(errbuf, PCAP_ERRBUF_SIZE,
453                                             "Attempt to open %s failed with %s - root privilege may be required",
454                                             dname,
455                                             (errno == EPERM) ? "EPERM" : "EACCES");
456                               } else {
457                                         status = PCAP_ERROR;
458                                         pcapint_fmt_errmsg_for_errno(errbuf,
459                                             PCAP_ERRBUF_SIZE, errno,
460                                             "Attempt to open %s failed", dname);
461                               }
462                               return (status);
463                     }
464 
465                     /* Try again with unit number */
466                     if ((fd = open(dname2, O_RDWR)) < 0) {
467                               if (errno == ENOENT) {
468                                         status = PCAP_ERROR_NO_SUCH_DEVICE;
469 
470                                         /*
471                                          * We provide an error message even
472                                          * for this error, for diagnostic
473                                          * purposes (so that, for example,
474                                          * the app can show the message if the
475                                          * user requests it).
476                                          *
477                                          * In it, we just report "No DLPI device
478                                          * found" with the device name, so people
479                                          * don't get confused and think, for example,
480                                          * that if they can't capture on "lo0"
481                                          * on Solaris prior to Solaris 11 the fix
482                                          * is to change libpcap (or the application
483                                          * that uses it) to look for something other
484                                          * than "/dev/lo0", as the fix is to use
485                                          * Solaris 11 or some operating system
486                                          * other than Solaris - you just *can't*
487                                          * capture on a loopback interface
488                                          * on Solaris prior to Solaris 11, the lack
489                                          * of a DLPI device for the loopback
490                                          * interface is just a symptom of that
491                                          * inability.
492                                          */
493                                         snprintf(errbuf, PCAP_ERRBUF_SIZE,
494                                             "%s: No DLPI device found", name);
495                               } else {
496                                         if (errno == EPERM || errno == EACCES) {
497                                                   status = PCAP_ERROR_PERM_DENIED;
498                                                   snprintf(errbuf, PCAP_ERRBUF_SIZE,
499                                                       "Attempt to open %s failed with %s - root privilege may be required",
500                                                       dname2,
501                                                       (errno == EPERM) ? "EPERM" : "EACCES");
502                                         } else {
503                                                   status = PCAP_ERROR;
504                                                   pcapint_fmt_errmsg_for_errno(errbuf,
505                                                       PCAP_ERRBUF_SIZE, errno,
506                                                       "Attempt to open %s failed",
507                                                       dname2);
508                                         }
509                               }
510                               return (status);
511                     }
512                     /* XXX Assume unit zero */
513                     *ppa = 0;
514           }
515 #endif
516           return (fd);
517 }
518 
519 static int
pcap_activate_dlpi(pcap_t * p)520 pcap_activate_dlpi(pcap_t *p)
521 {
522 #ifdef DL_HP_RAWDLS
523           struct pcap_dlpi *pd = p->priv;
524 #endif
525           int status = 0;
526           int retv;
527           u_int ppa;
528 #ifdef HAVE_SOLARIS
529           int isatm = 0;
530 #endif
531           register dl_info_ack_t *infop;
532 #ifdef HAVE_SYS_BUFMOD_H
533           bpf_u_int32 ss;
534 #ifdef HAVE_SOLARIS
535           char release[GET_RELEASE_BUFSIZE];
536           bpf_u_int32 osmajor, osminor, osmicro;
537 #endif
538 #endif
539           bpf_u_int32 buf[MAXDLBUF];
540 
541           p->fd = open_dlpi_device(p->opt.device, &ppa, p->errbuf);
542           if (p->fd < 0) {
543                     status = p->fd;
544                     goto bad;
545           }
546 
547 #ifdef DL_HP_RAWDLS
548           /*
549            * XXX - HP-UX 10.20 and 11.xx don't appear to support sending and
550            * receiving packets on the same descriptor - you need separate
551            * descriptors for sending and receiving, bound to different SAPs.
552            *
553            * If the open fails, we just leave -1 in "pd->send_fd" and reject
554            * attempts to send packets, just as if, in pcap-bpf.c, we fail
555            * to open the BPF device for reading and writing, we just try
556            * to open it for reading only and, if that succeeds, just let
557            * the send attempts fail.
558            */
559           pd->send_fd = open("/dev/dlpi", O_RDWR);
560 #endif
561 
562           /*
563           ** Attach if "style 2" provider
564           */
565           if (dlinforeq(p->fd, p->errbuf) < 0 ||
566               dlinfoack(p->fd, (char *)buf, p->errbuf) < 0) {
567                     status = PCAP_ERROR;
568                     goto bad;
569           }
570           infop = &(MAKE_DL_PRIMITIVES(buf))->info_ack;
571 #ifdef HAVE_SOLARIS
572           if (infop->dl_mac_type == DL_IPATM)
573                     isatm = 1;
574 #endif
575           if (infop->dl_provider_style == DL_STYLE2) {
576                     retv = dl_doattach(p->fd, ppa, p->errbuf);
577                     if (retv < 0) {
578                               status = retv;
579                               goto bad;
580                     }
581 #ifdef DL_HP_RAWDLS
582                     if (pd->send_fd >= 0) {
583                               retv = dl_doattach(pd->send_fd, ppa, p->errbuf);
584                               if (retv < 0) {
585                                         status = retv;
586                                         goto bad;
587                               }
588                     }
589 #endif
590           }
591 
592           if (p->opt.rfmon) {
593                     /*
594                      * This device exists, but we don't support monitor mode
595                      * any platforms that support DLPI.
596                      */
597                     status = PCAP_ERROR_RFMON_NOTSUP;
598                     goto bad;
599           }
600 
601 #ifdef HAVE_DL_PASSIVE_REQ_T
602           /*
603            * Enable Passive mode to be able to capture on aggregated link.
604            * Not supported in all Solaris versions.
605            */
606           dlpassive(p->fd, p->errbuf);
607 #endif
608           /*
609           ** Bind (defer if using HP-UX 9 or HP-UX 10.20 or later, totally
610           ** skip if using SINIX)
611           */
612 #if !defined(HAVE_HPUX9) && !defined(HAVE_HPUX10_20_OR_LATER) && !defined(sinix)
613 #ifdef _AIX
614           /*
615           ** AIX.
616           ** According to IBM's AIX Support Line, the dl_sap value
617           ** should not be less than 0x600 (1536) for standard Ethernet.
618           ** However, we seem to get DL_BADADDR - "DLSAP addr in improper
619           ** format or invalid" - errors if we use 1537 on the "tr0"
620           ** device, which, given that its name starts with "tr" and that
621           ** it's IBM, probably means a Token Ring device.  (Perhaps we
622           ** need to use 1537 on "/dev/dlpi/en" because that device is for
623           ** D/I/X Ethernet, the "SAP" is actually an Ethernet type, and
624           ** it rejects invalid Ethernet types.)
625           **
626           ** So if 1537 fails, we try 2, as Hyung Sik Yoon of IBM Korea
627           ** says that works on Token Ring (he says that 0 does *not*
628           ** work; perhaps that's considered an invalid LLC SAP value - I
629           ** assume the SAP value in a DLPI bind is an LLC SAP for network
630           ** types that use 802.2 LLC).
631           */
632           if ((dlbindreq(p->fd, 1537, p->errbuf) < 0 &&
633                dlbindreq(p->fd, 2, p->errbuf) < 0) ||
634                dlbindack(p->fd, (char *)buf, p->errbuf, NULL) < 0) {
635                     status = PCAP_ERROR;
636                     goto bad;
637           }
638 #elif defined(DL_HP_RAWDLS)
639           /*
640           ** HP-UX 10.0x and 10.1x.
641           */
642           if (dl_dohpuxbind(p->fd, p->errbuf) < 0) {
643                     status = PCAP_ERROR;
644                     goto bad;
645           }
646           if (pd->send_fd >= 0) {
647                     /*
648                     ** XXX - if this fails, just close send_fd and
649                     ** set it to -1, so that you can't send but can
650                     ** still receive?
651                     */
652                     if (dl_dohpuxbind(pd->send_fd, p->errbuf) < 0) {
653                               status = PCAP_ERROR;
654                               goto bad;
655                     }
656           }
657 #else /* neither AIX nor HP-UX */
658           /*
659           ** Not Sinix, and neither AIX nor HP-UX - Solaris, and any other
660           ** OS using DLPI.
661           **/
662           if (dlbindreq(p->fd, 0, p->errbuf) < 0 ||
663               dlbindack(p->fd, (char *)buf, p->errbuf, NULL) < 0) {
664                     status = PCAP_ERROR;
665                     goto bad;
666           }
667 #endif /* AIX vs. HP-UX vs. other */
668 #endif /* !HP-UX 9 and !HP-UX 10.20 or later and !SINIX */
669 
670           /*
671            * Turn a negative snapshot value (invalid), a snapshot value of
672            * 0 (unspecified), or a value bigger than the normal maximum
673            * value, into the maximum allowed value.
674            *
675            * If some application really *needs* a bigger snapshot
676            * length, we should just increase MAXIMUM_SNAPLEN.
677            */
678           if (p->snapshot <= 0 || p->snapshot > MAXIMUM_SNAPLEN)
679                     p->snapshot = MAXIMUM_SNAPLEN;
680 
681 #ifdef HAVE_SOLARIS
682           if (isatm) {
683                     /*
684                     ** Have to turn on some special ATM promiscuous mode
685                     ** for SunATM.
686                     ** Do *NOT* turn regular promiscuous mode on; it doesn't
687                     ** help, and may break things.
688                     */
689                     if (strioctl(p->fd, A_PROMISCON_REQ, 0, NULL) < 0) {
690                               status = PCAP_ERROR;
691                               pcapint_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE,
692                                   errno, "A_PROMISCON_REQ");
693                               goto bad;
694                     }
695           } else
696 #endif
697           if (p->opt.promisc) {
698                     /*
699                     ** Enable promiscuous (not necessary on send FD)
700                     */
701                     retv = dlpromiscon(p, DL_PROMISC_PHYS);
702                     if (retv < 0) {
703                               if (retv == PCAP_ERROR_PERM_DENIED)
704                                         status = PCAP_ERROR_PROMISC_PERM_DENIED;
705                               else
706                                         status = retv;
707                               goto bad;
708                     }
709 
710                     /*
711                     ** Try to enable multicast (you would have thought
712                     ** promiscuous would be sufficient). (Skip if using
713                     ** HP-UX or SINIX) (Not necessary on send FD)
714                     */
715 #if !defined(__hpux) && !defined(sinix)
716                     retv = dlpromiscon(p, DL_PROMISC_MULTI);
717                     if (retv < 0)
718                               status = PCAP_WARNING;
719 #endif
720           }
721           /*
722           ** Try to enable SAP promiscuity (when not in promiscuous mode
723           ** when using HP-UX, when not doing SunATM on Solaris, and never
724           ** under SINIX) (Not necessary on send FD)
725           */
726 #ifndef sinix
727 #if defined(__hpux)
728           /* HP-UX - only do this when not in promiscuous mode */
729           if (!p->opt.promisc) {
730 #elif defined(HAVE_SOLARIS)
731           /* Solaris - don't do this on SunATM devices */
732           if (!isatm) {
733 #else
734           /* Everything else (except for SINIX) - always do this */
735           {
736 #endif
737                     retv = dlpromiscon(p, DL_PROMISC_SAP);
738                     if (retv < 0) {
739                               if (p->opt.promisc) {
740                                         /*
741                                          * Not fatal, since the DL_PROMISC_PHYS mode
742                                          * worked.
743                                          *
744                                          * Report it as a warning, however.
745                                          */
746                                         status = PCAP_WARNING;
747                               } else {
748                                         /*
749                                          * Fatal.
750                                          */
751                                         status = retv;
752                                         goto bad;
753                               }
754                     }
755           }
756 #endif /* sinix */
757 
758           /*
759           ** HP-UX 9, and HP-UX 10.20 or later, must bind after setting
760           ** promiscuous options.
761           */
762 #if defined(HAVE_HPUX9) || defined(HAVE_HPUX10_20_OR_LATER)
763           if (dl_dohpuxbind(p->fd, p->errbuf) < 0) {
764                     status = PCAP_ERROR;
765                     goto bad;
766           }
767           /*
768           ** We don't set promiscuous mode on the send FD, but we'll defer
769           ** binding it anyway, just to keep the HP-UX 9/10.20 or later
770           ** code together.
771           */
772           if (pd->send_fd >= 0) {
773                     /*
774                     ** XXX - if this fails, just close send_fd and
775                     ** set it to -1, so that you can't send but can
776                     ** still receive?
777                     */
778                     if (dl_dohpuxbind(pd->send_fd, p->errbuf) < 0) {
779                               status = PCAP_ERROR;
780                               goto bad;
781                     }
782           }
783 #endif
784 
785           /*
786           ** Determine link type
787           ** XXX - get SAP length and address length as well, for use
788           ** when sending packets.
789           */
790           if (dlinforeq(p->fd, p->errbuf) < 0 ||
791               dlinfoack(p->fd, (char *)buf, p->errbuf) < 0) {
792                     status = PCAP_ERROR;
793                     goto bad;
794           }
795 
796           infop = &(MAKE_DL_PRIMITIVES(buf))->info_ack;
797           if (pcap_process_mactype(p, infop->dl_mac_type) != 0) {
798                     status = PCAP_ERROR;
799                     goto bad;
800           }
801 
802 #ifdef    DLIOCRAW
803           /*
804           ** This is a non standard SunOS hack to get the full raw link-layer
805           ** header.
806           */
807           if (strioctl(p->fd, DLIOCRAW, 0, NULL) < 0) {
808                     status = PCAP_ERROR;
809                     pcapint_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE,
810                         errno, "DLIOCRAW");
811                     goto bad;
812           }
813 #endif
814 
815 #ifdef HAVE_SYS_BUFMOD_H
816           ss = p->snapshot;
817 
818           /*
819           ** There is a bug in bufmod(7). When dealing with messages of
820           ** less than snaplen size it strips data from the beginning not
821           ** the end.
822           **
823           ** This bug is fixed in 5.3.2. Also, there is a patch available.
824           ** Ask for bugid 1149065.
825           */
826 #ifdef HAVE_SOLARIS
827           get_release(release, sizeof (release), &osmajor, &osminor, &osmicro);
828           if (osmajor == 5 && (osminor <= 2 || (osminor == 3 && osmicro < 2)) &&
829               getenv("BUFMOD_FIXED") == NULL) {
830                     snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
831                     "WARNING: bufmod is broken in SunOS %s; ignoring snaplen.",
832                         release);
833                     ss = 0;
834                     status = PCAP_WARNING;
835           }
836 #endif
837 
838           /* Push and configure bufmod. */
839           if (pcap_conf_bufmod(p, ss) != 0) {
840                     status = PCAP_ERROR;
841                     goto bad;
842           }
843 #endif
844 
845           /*
846           ** As the last operation flush the read side.
847           */
848           if (ioctl(p->fd, I_FLUSH, FLUSHR) != 0) {
849                     status = PCAP_ERROR;
850                     pcapint_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE,
851                         errno, "FLUSHR");
852                     goto bad;
853           }
854 
855           /* Allocate data buffer. */
856           if (pcap_alloc_databuf(p) != 0) {
857                     status = PCAP_ERROR;
858                     goto bad;
859           }
860 
861           /*
862            * Success.
863            *
864            * "p->fd" is an FD for a STREAMS device, so "select()" and
865            * "poll()" should work on it.
866            */
867           p->selectable_fd = p->fd;
868 
869           p->read_op = pcap_read_dlpi;
870           p->inject_op = pcap_inject_dlpi;
871           p->setfilter_op = pcapint_install_bpf_program;    /* no kernel filtering */
872           p->setdirection_op = NULL;    /* Not implemented.*/
873           p->set_datalink_op = NULL;    /* can't change data link type */
874           p->getnonblock_op = pcapint_getnonblock_fd;
875           p->setnonblock_op = pcapint_setnonblock_fd;
876           p->stats_op = pcap_stats_dlpi;
877           p->cleanup_op = pcap_cleanup_dlpi;
878 
879           return (status);
880 bad:
881           pcap_cleanup_dlpi(p);
882           return (status);
883 }
884 
885 /*
886  * Split a device name into a device type name and a unit number;
887  * return the a pointer to the beginning of the unit number, which
888  * is the end of the device type name, and set "*unitp" to the unit
889  * number.
890  *
891  * Returns NULL on error, and fills "ebuf" with an error message.
892  */
893 static char *
894 split_dname(char *device, u_int *unitp, char *ebuf)
895 {
896           char *cp;
897           char *eos;
898           long unit;
899 
900           /*
901            * Look for a number at the end of the device name string.
902            */
903           cp = device + strlen(device) - 1;
904           if (*cp < '0' || *cp > '9') {
905                     snprintf(ebuf, PCAP_ERRBUF_SIZE, "%s missing unit number",
906                         device);
907                     return (NULL);
908           }
909 
910           /* Digits at end of string are unit number */
911           while (cp-1 >= device && *(cp-1) >= '0' && *(cp-1) <= '9')
912                     cp--;
913 
914           errno = 0;
915           unit = strtol(cp, &eos, 10);
916           if (*eos != '\0') {
917                     snprintf(ebuf, PCAP_ERRBUF_SIZE, "%s bad unit number", device);
918                     return (NULL);
919           }
920           if (errno == ERANGE || unit > INT_MAX) {
921                     snprintf(ebuf, PCAP_ERRBUF_SIZE, "%s unit number too large",
922                         device);
923                     return (NULL);
924           }
925           if (unit < 0) {
926                     snprintf(ebuf, PCAP_ERRBUF_SIZE, "%s unit number is negative",
927                         device);
928                     return (NULL);
929           }
930           *unitp = (u_int)unit;
931           return (cp);
932 }
933 
934 static int
935 dl_doattach(int fd, int ppa, char *ebuf)
936 {
937           dl_attach_req_t     req;
938           bpf_u_int32 buf[MAXDLBUF];
939           int err;
940 
941           req.dl_primitive = DL_ATTACH_REQ;
942           req.dl_ppa = ppa;
943           if (send_request(fd, (char *)&req, sizeof(req), "attach", ebuf) < 0)
944                     return (PCAP_ERROR);
945 
946           err = dlokack(fd, "attach", (char *)buf, ebuf, NULL);
947           if (err < 0)
948                     return (err);
949           return (0);
950 }
951 
952 #ifdef DL_HP_RAWDLS
953 static int
954 dl_dohpuxbind(int fd, char *ebuf)
955 {
956           int hpsap;
957           int uerror;
958           bpf_u_int32 buf[MAXDLBUF];
959 
960           /*
961            * XXX - we start at 22 because we used to use only 22, but
962            * that was just because that was the value used in some
963            * sample code from HP.  With what value *should* we start?
964            * Does it matter, given that we're enabling SAP promiscuity
965            * on the input FD?
966            */
967           hpsap = 22;
968           for (;;) {
969                     if (dlbindreq(fd, hpsap, ebuf) < 0)
970                               return (-1);
971                     if (dlbindack(fd, (char *)buf, ebuf, &uerror) >= 0)
972                               break;
973                     /*
974                      * For any error other than a UNIX EBUSY, give up.
975                      */
976                     if (uerror != EBUSY) {
977                               /*
978                                * dlbindack() has already filled in ebuf for
979                                * this error.
980                                */
981                               return (-1);
982                     }
983 
984                     /*
985                      * For EBUSY, try the next SAP value; that means that
986                      * somebody else is using that SAP.  Clear ebuf so
987                      * that application doesn't report the "Device busy"
988                      * error as a warning.
989                      */
990                     *ebuf = '\0';
991                     hpsap++;
992                     if (hpsap > 100) {
993                               pcapint_strlcpy(ebuf,
994                                   "All SAPs from 22 through 100 are in use",
995                                   PCAP_ERRBUF_SIZE);
996                               return (-1);
997                     }
998           }
999           return (0);
1000 }
1001 #endif
1002 
1003 #define STRINGIFY(n)          #n
1004 
1005 static int
1006 dlpromiscon(pcap_t *p, bpf_u_int32 level)
1007 {
1008           dl_promiscon_req_t req;
1009           bpf_u_int32 buf[MAXDLBUF];
1010           int err;
1011           int uerror;
1012 
1013           req.dl_primitive = DL_PROMISCON_REQ;
1014           req.dl_level = level;
1015           if (send_request(p->fd, (char *)&req, sizeof(req), "promiscon",
1016               p->errbuf) < 0)
1017                     return (PCAP_ERROR);
1018           err = dlokack(p->fd, "promiscon" STRINGIFY(level), (char *)buf,
1019               p->errbuf, &uerror);
1020           if (err < 0) {
1021                     if (err == PCAP_ERROR_PERM_DENIED) {
1022                               snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1023                                   "Attempt to set promiscuous mode failed with %s - root privilege may be required",
1024                                   (uerror == EPERM) ? "EPERM" : "EACCES");
1025                               err = PCAP_ERROR_PROMISC_PERM_DENIED;
1026                     }
1027                     return (err);
1028           }
1029           return (0);
1030 }
1031 
1032 /*
1033  * Not all interfaces are DLPI interfaces, and thus not all interfaces
1034  * can be opened with DLPI (for example, the loopback interface is not
1035  * a DLPI interface on Solaris prior to Solaris 11), so try to open
1036  * the specified interface; return 0 if we fail with PCAP_ERROR_NO_SUCH_DEVICE
1037  * and 1 otherwise.
1038  */
1039 static int
1040 is_dlpi_interface(const char *name)
1041 {
1042           int fd;
1043           u_int ppa;
1044           char errbuf[PCAP_ERRBUF_SIZE];
1045 
1046           fd = open_dlpi_device(name, &ppa, errbuf);
1047           if (fd < 0) {
1048                     /*
1049                      * Error - was it PCAP_ERROR_NO_SUCH_DEVICE?
1050                      */
1051                     if (fd == PCAP_ERROR_NO_SUCH_DEVICE) {
1052                               /*
1053                                * Yes, so we can't open this because it's
1054                                * not a DLPI interface.
1055                                */
1056                               return (0);
1057                     }
1058                     /*
1059                      * No, so, in the case where there's a single DLPI
1060                      * device for all interfaces of this type ("style
1061                      * 2" providers?), we don't know whether it's a DLPI
1062                      * interface or not, as we didn't try an attach.
1063                      * Say it is a DLPI device, so that the user can at
1064                      * least try to open it and report the error (which
1065                      * is probably "you don't have permission to open that
1066                      * DLPI device"; reporting those interfaces means
1067                      * users will ask "why am I getting a permissions error
1068                      * when I try to capture" rather than "why am I not
1069                      * seeing any interfaces", making the underlying problem
1070                      * clearer).
1071                      */
1072                     return (1);
1073           }
1074 
1075           /*
1076            * Success.
1077            */
1078           close(fd);
1079           return (1);
1080 }
1081 
1082 static int
1083 get_if_flags(const char *name _U_, bpf_u_int32 *flags _U_, char *errbuf _U_)
1084 {
1085           /*
1086            * Nothing we can do other than mark loopback devices as "the
1087            * connected/disconnected status doesn't apply".
1088            *
1089            * XXX - on Solaris, can we do what the dladm command does,
1090            * i.e. get a connected/disconnected indication from a kstat?
1091            * (Note that you can also get the link speed, and possibly
1092            * other information, from a kstat as well.)
1093            */
1094           if (*flags & PCAP_IF_LOOPBACK) {
1095                     /*
1096                      * Loopback devices aren't wireless, and "connected"/
1097                      * "disconnected" doesn't apply to them.
1098                      */
1099                     *flags |= PCAP_IF_CONNECTION_STATUS_NOT_APPLICABLE;
1100                     return (0);
1101           }
1102           return (0);
1103 }
1104 
1105 int
1106 pcapint_platform_finddevs(pcap_if_list_t *devlistp, char *errbuf)
1107 {
1108 #ifdef HAVE_SOLARIS
1109           int fd;
1110           union {
1111                     u_int nunits;
1112                     char pad[516];      /* XXX - must be at least 513; is 516
1113                                            in "atmgetunits" */
1114           } buf;
1115           char baname[2+1+1];
1116           u_int i;
1117 #endif
1118 
1119           /*
1120            * Get the list of regular interfaces first.
1121            */
1122           if (pcapint_findalldevs_interfaces(devlistp, errbuf, is_dlpi_interface,
1123               get_if_flags) == -1)
1124                     return (-1);        /* failure */
1125 
1126 #ifdef HAVE_SOLARIS
1127           /*
1128            * We may have to do special magic to get ATM devices.
1129            */
1130           if ((fd = open("/dev/ba", O_RDWR)) < 0) {
1131                     /*
1132                      * We couldn't open the "ba" device.
1133                      * For now, just give up; perhaps we should
1134                      * return an error if the problem is neither
1135                      * a "that device doesn't exist" error (ENOENT,
1136                      * ENXIO, etc.) or a "you're not allowed to do
1137                      * that" error (EPERM, EACCES).
1138                      */
1139                     return (0);
1140           }
1141 
1142           if (strioctl(fd, A_GET_UNITS, sizeof(buf), (char *)&buf) < 0) {
1143                     pcapint_fmt_errmsg_for_errno(errbuf, PCAP_ERRBUF_SIZE,
1144                         errno, "A_GET_UNITS");
1145                     return (-1);
1146           }
1147           for (i = 0; i < buf.nunits; i++) {
1148                     snprintf(baname, sizeof baname, "ba%u", i);
1149                     /*
1150                      * XXX - is there a notion of "up" and "running"?
1151                      * And is there a way to determine whether the
1152                      * interface is plugged into a network?
1153                      */
1154                     if (pcapint_add_dev(devlistp, baname, 0, NULL, errbuf) == NULL)
1155                               return (-1);
1156           }
1157 #endif
1158 
1159           return (0);
1160 }
1161 
1162 static int
1163 send_request(int fd, char *ptr, int len, char *what, char *ebuf)
1164 {
1165           struct    strbuf    ctl;
1166           int       flags;
1167 
1168           ctl.maxlen = 0;
1169           ctl.len = len;
1170           ctl.buf = ptr;
1171 
1172           flags = 0;
1173           if (putmsg(fd, &ctl, (struct strbuf *) NULL, flags) < 0) {
1174                     pcapint_fmt_errmsg_for_errno(ebuf, PCAP_ERRBUF_SIZE,
1175                         errno, "send_request: putmsg \"%s\"", what);
1176                     return (-1);
1177           }
1178           return (0);
1179 }
1180 
1181 static int
1182 recv_ack(int fd, int size, const char *what, char *bufp, char *ebuf, int *uerror)
1183 {
1184           union     DL_primitives       *dlp;
1185           struct    strbuf    ctl;
1186           int       flags;
1187           char      errmsgbuf[PCAP_ERRBUF_SIZE];
1188           char      dlprimbuf[64];
1189 
1190           /*
1191            * Clear out "*uerror", so it's only set for DL_ERROR_ACK/DL_SYSERR,
1192            * making that the only place where EBUSY is treated specially.
1193            */
1194           if (uerror != NULL)
1195                     *uerror = 0;
1196 
1197           ctl.maxlen = MAXDLBUF;
1198           ctl.len = 0;
1199           ctl.buf = bufp;
1200 
1201           flags = 0;
1202           if (getmsg(fd, &ctl, (struct strbuf*)NULL, &flags) < 0) {
1203                     pcapint_fmt_errmsg_for_errno(ebuf, PCAP_ERRBUF_SIZE,
1204                         errno, "recv_ack: %s getmsg", what);
1205                     return (PCAP_ERROR);
1206           }
1207 
1208           dlp = MAKE_DL_PRIMITIVES(ctl.buf);
1209           switch (dlp->dl_primitive) {
1210 
1211           case DL_INFO_ACK:
1212           case DL_BIND_ACK:
1213           case DL_OK_ACK:
1214 #ifdef DL_HP_PPA_ACK
1215           case DL_HP_PPA_ACK:
1216 #endif
1217                     /* These are OK */
1218                     break;
1219 
1220           case DL_ERROR_ACK:
1221                     switch (dlp->error_ack.dl_errno) {
1222 
1223                     case DL_SYSERR:
1224                               if (uerror != NULL)
1225                                         *uerror = dlp->error_ack.dl_unix_errno;
1226                               pcapint_fmt_errmsg_for_errno(ebuf, PCAP_ERRBUF_SIZE,
1227                                   dlp->error_ack.dl_unix_errno,
1228                                   "recv_ack: %s: UNIX error", what);
1229                               if (dlp->error_ack.dl_unix_errno == EPERM ||
1230                                   dlp->error_ack.dl_unix_errno == EACCES)
1231                                         return (PCAP_ERROR_PERM_DENIED);
1232                               break;
1233 
1234                     default:
1235                               /*
1236                                * Neither EPERM nor EACCES.
1237                                */
1238                               snprintf(ebuf, PCAP_ERRBUF_SIZE,
1239                                   "recv_ack: %s: %s", what,
1240                                   dlstrerror(errmsgbuf, sizeof (errmsgbuf), dlp->error_ack.dl_errno));
1241                               if (dlp->error_ack.dl_errno == DL_BADPPA)
1242                                         return (PCAP_ERROR_NO_SUCH_DEVICE);
1243                               else if (dlp->error_ack.dl_errno == DL_ACCESS)
1244                                         return (PCAP_ERROR_PERM_DENIED);
1245                               break;
1246                     }
1247                     return (PCAP_ERROR);
1248 
1249           default:
1250                     snprintf(ebuf, PCAP_ERRBUF_SIZE,
1251                         "recv_ack: %s: Unexpected primitive ack %s",
1252                         what, dlprim(dlprimbuf, sizeof (dlprimbuf), dlp->dl_primitive));
1253                     return (PCAP_ERROR);
1254           }
1255 
1256           if (ctl.len < size) {
1257                     snprintf(ebuf, PCAP_ERRBUF_SIZE,
1258                         "recv_ack: %s: Ack too small (%d < %d)",
1259                         what, ctl.len, size);
1260                     return (PCAP_ERROR);
1261           }
1262           return (ctl.len);
1263 }
1264 
1265 static char *
1266 dlstrerror(char *errbuf, size_t errbufsize, bpf_u_int32 dl_errno)
1267 {
1268           switch (dl_errno) {
1269 
1270           case DL_ACCESS:
1271                     return ("Improper permissions for request");
1272 
1273           case DL_BADADDR:
1274                     return ("DLSAP addr in improper format or invalid");
1275 
1276           case DL_BADCORR:
1277                     return ("Seq number not from outstand DL_CONN_IND");
1278 
1279           case DL_BADDATA:
1280                     return ("User data exceeded provider limit");
1281 
1282           case DL_BADPPA:
1283 #ifdef HAVE_DEV_DLPI
1284                     /*
1285                      * With a single "/dev/dlpi" device used for all
1286                      * DLPI providers, PPAs have nothing to do with
1287                      * unit numbers.
1288                      */
1289                     return ("Specified PPA was invalid");
1290 #else
1291                     /*
1292                      * We have separate devices for separate devices;
1293                      * the PPA is just the unit number.
1294                      */
1295                     return ("Specified PPA (device unit) was invalid");
1296 #endif
1297 
1298           case DL_BADPRIM:
1299                     return ("Primitive received not known by provider");
1300 
1301           case DL_BADQOSPARAM:
1302                     return ("QOS parameters contained invalid values");
1303 
1304           case DL_BADQOSTYPE:
1305                     return ("QOS structure type is unknown/unsupported");
1306 
1307           case DL_BADSAP:
1308                     return ("Bad LSAP selector");
1309 
1310           case DL_BADTOKEN:
1311                     return ("Token used not an active stream");
1312 
1313           case DL_BOUND:
1314                     return ("Attempted second bind with dl_max_conind");
1315 
1316           case DL_INITFAILED:
1317                     return ("Physical link initialization failed");
1318 
1319           case DL_NOADDR:
1320                     return ("Provider couldn't allocate alternate address");
1321 
1322           case DL_NOTINIT:
1323                     return ("Physical link not initialized");
1324 
1325           case DL_OUTSTATE:
1326                     return ("Primitive issued in improper state");
1327 
1328           case DL_SYSERR:
1329                     return ("UNIX system error occurred");
1330 
1331           case DL_UNSUPPORTED:
1332                     return ("Requested service not supplied by provider");
1333 
1334           case DL_UNDELIVERABLE:
1335                     return ("Previous data unit could not be delivered");
1336 
1337           case DL_NOTSUPPORTED:
1338                     return ("Primitive is known but not supported");
1339 
1340           case DL_TOOMANY:
1341                     return ("Limit exceeded");
1342 
1343           case DL_NOTENAB:
1344                     return ("Promiscuous mode not enabled");
1345 
1346           case DL_BUSY:
1347                     return ("Other streams for PPA in post-attached");
1348 
1349           case DL_NOAUTO:
1350                     return ("Automatic handling XID&TEST not supported");
1351 
1352           case DL_NOXIDAUTO:
1353                     return ("Automatic handling of XID not supported");
1354 
1355           case DL_NOTESTAUTO:
1356                     return ("Automatic handling of TEST not supported");
1357 
1358           case DL_XIDAUTO:
1359                     return ("Automatic handling of XID response");
1360 
1361           case DL_TESTAUTO:
1362                     return ("Automatic handling of TEST response");
1363 
1364           case DL_PENDING:
1365                     return ("Pending outstanding connect indications");
1366 
1367           default:
1368                     snprintf(errbuf, errbufsize, "Error %02x", dl_errno);
1369                     return (errbuf);
1370           }
1371 }
1372 
1373 static char *
1374 dlprim(char *primbuf, size_t primbufsize, bpf_u_int32 prim)
1375 {
1376           switch (prim) {
1377 
1378           case DL_INFO_REQ:
1379                     return ("DL_INFO_REQ");
1380 
1381           case DL_INFO_ACK:
1382                     return ("DL_INFO_ACK");
1383 
1384           case DL_ATTACH_REQ:
1385                     return ("DL_ATTACH_REQ");
1386 
1387           case DL_DETACH_REQ:
1388                     return ("DL_DETACH_REQ");
1389 
1390           case DL_BIND_REQ:
1391                     return ("DL_BIND_REQ");
1392 
1393           case DL_BIND_ACK:
1394                     return ("DL_BIND_ACK");
1395 
1396           case DL_UNBIND_REQ:
1397                     return ("DL_UNBIND_REQ");
1398 
1399           case DL_OK_ACK:
1400                     return ("DL_OK_ACK");
1401 
1402           case DL_ERROR_ACK:
1403                     return ("DL_ERROR_ACK");
1404 
1405           case DL_SUBS_BIND_REQ:
1406                     return ("DL_SUBS_BIND_REQ");
1407 
1408           case DL_SUBS_BIND_ACK:
1409                     return ("DL_SUBS_BIND_ACK");
1410 
1411           case DL_UNITDATA_REQ:
1412                     return ("DL_UNITDATA_REQ");
1413 
1414           case DL_UNITDATA_IND:
1415                     return ("DL_UNITDATA_IND");
1416 
1417           case DL_UDERROR_IND:
1418                     return ("DL_UDERROR_IND");
1419 
1420           case DL_UDQOS_REQ:
1421                     return ("DL_UDQOS_REQ");
1422 
1423           case DL_CONNECT_REQ:
1424                     return ("DL_CONNECT_REQ");
1425 
1426           case DL_CONNECT_IND:
1427                     return ("DL_CONNECT_IND");
1428 
1429           case DL_CONNECT_RES:
1430                     return ("DL_CONNECT_RES");
1431 
1432           case DL_CONNECT_CON:
1433                     return ("DL_CONNECT_CON");
1434 
1435           case DL_TOKEN_REQ:
1436                     return ("DL_TOKEN_REQ");
1437 
1438           case DL_TOKEN_ACK:
1439                     return ("DL_TOKEN_ACK");
1440 
1441           case DL_DISCONNECT_REQ:
1442                     return ("DL_DISCONNECT_REQ");
1443 
1444           case DL_DISCONNECT_IND:
1445                     return ("DL_DISCONNECT_IND");
1446 
1447           case DL_RESET_REQ:
1448                     return ("DL_RESET_REQ");
1449 
1450           case DL_RESET_IND:
1451                     return ("DL_RESET_IND");
1452 
1453           case DL_RESET_RES:
1454                     return ("DL_RESET_RES");
1455 
1456           case DL_RESET_CON:
1457                     return ("DL_RESET_CON");
1458 
1459           default:
1460                     snprintf(primbuf, primbufsize, "unknown primitive 0x%x",
1461                         prim);
1462                     return (primbuf);
1463           }
1464 }
1465 
1466 static int
1467 dlbindreq(int fd, bpf_u_int32 sap, char *ebuf)
1468 {
1469 
1470           dl_bind_req_t       req;
1471 
1472           memset((char *)&req, 0, sizeof(req));
1473           req.dl_primitive = DL_BIND_REQ;
1474           /* XXX - what if neither of these are defined? */
1475 #if defined(DL_HP_RAWDLS)
1476           req.dl_max_conind = 1;                            /* XXX magic number */
1477           req.dl_service_mode = DL_HP_RAWDLS;
1478 #elif defined(DL_CLDLS)
1479           req.dl_service_mode = DL_CLDLS;
1480 #endif
1481           req.dl_sap = sap;
1482 
1483           return (send_request(fd, (char *)&req, sizeof(req), "bind", ebuf));
1484 }
1485 
1486 static int
1487 dlbindack(int fd, char *bufp, char *ebuf, int *uerror)
1488 {
1489 
1490           return (recv_ack(fd, DL_BIND_ACK_SIZE, "bind", bufp, ebuf, uerror));
1491 }
1492 
1493 static int
1494 dlokack(int fd, const char *what, char *bufp, char *ebuf, int *uerror)
1495 {
1496 
1497           return (recv_ack(fd, DL_OK_ACK_SIZE, what, bufp, ebuf, uerror));
1498 }
1499 
1500 
1501 static int
1502 dlinforeq(int fd, char *ebuf)
1503 {
1504           dl_info_req_t req;
1505 
1506           req.dl_primitive = DL_INFO_REQ;
1507 
1508           return (send_request(fd, (char *)&req, sizeof(req), "info", ebuf));
1509 }
1510 
1511 static int
1512 dlinfoack(int fd, char *bufp, char *ebuf)
1513 {
1514 
1515           return (recv_ack(fd, DL_INFO_ACK_SIZE, "info", bufp, ebuf, NULL));
1516 }
1517 
1518 #ifdef HAVE_DL_PASSIVE_REQ_T
1519 /*
1520  * Enable DLPI passive mode. We do not care if this request fails, as this
1521  * indicates the underlying DLPI device does not support link aggregation.
1522  */
1523 static void
1524 dlpassive(int fd, char *ebuf)
1525 {
1526           dl_passive_req_t req;
1527           bpf_u_int32 buf[MAXDLBUF];
1528 
1529           req.dl_primitive = DL_PASSIVE_REQ;
1530 
1531           if (send_request(fd, (char *)&req, sizeof(req), "dlpassive", ebuf) == 0)
1532               (void) dlokack(fd, "dlpassive", (char *)buf, ebuf, NULL);
1533 }
1534 #endif
1535 
1536 #ifdef DL_HP_RAWDLS
1537 /*
1538  * There's an ack *if* there's an error.
1539  */
1540 static int
1541 dlrawdatareq(int fd, const u_char *datap, int datalen)
1542 {
1543           struct strbuf ctl, data;
1544           long buf[MAXDLBUF]; /* XXX - char? */
1545           union DL_primitives *dlp;
1546           int dlen;
1547 
1548           dlp = MAKE_DL_PRIMITIVES(buf);
1549 
1550           dlp->dl_primitive = DL_HP_RAWDATA_REQ;
1551           dlen = DL_HP_RAWDATA_REQ_SIZE;
1552 
1553           /*
1554            * HP's documentation doesn't appear to show us supplying any
1555            * address pointed to by the control part of the message.
1556            * I think that's what raw mode means - you just send the raw
1557            * packet, you don't specify where to send it to, as that's
1558            * implied by the destination address.
1559            */
1560           ctl.maxlen = 0;
1561           ctl.len = dlen;
1562           ctl.buf = (void *)buf;
1563 
1564           data.maxlen = 0;
1565           data.len = datalen;
1566           data.buf = (void *)datap;
1567 
1568           return (putmsg(fd, &ctl, &data, 0));
1569 }
1570 #endif /* DL_HP_RAWDLS */
1571 
1572 #if defined(HAVE_SOLARIS) && defined(HAVE_SYS_BUFMOD_H)
1573 static void
1574 get_release(char *buf, size_t bufsize, bpf_u_int32 *majorp,
1575     bpf_u_int32 *minorp, bpf_u_int32 *microp)
1576 {
1577           char *cp;
1578 
1579           *majorp = 0;
1580           *minorp = 0;
1581           *microp = 0;
1582           if (sysinfo(SI_RELEASE, buf, bufsize) < 0) {
1583                     pcapint_strlcpy(buf, "?", bufsize);
1584                     return;
1585           }
1586           cp = buf;
1587           if (!PCAP_ISDIGIT((unsigned char)*cp))
1588                     return;
1589           *majorp = strtol(cp, &cp, 10);
1590           if (*cp++ != '.')
1591                     return;
1592           *minorp =  strtol(cp, &cp, 10);
1593           if (*cp++ != '.')
1594                     return;
1595           *microp =  strtol(cp, &cp, 10);
1596 }
1597 #endif
1598 
1599 #ifdef DL_HP_PPA_REQ
1600 /*
1601  * Under HP-UX 10 and HP-UX 11, we can ask for the ppa
1602  */
1603 
1604 
1605 /*
1606  * Determine ppa number that specifies ifname.
1607  *
1608  * If the "dl_hp_ppa_info_t" doesn't have a "dl_module_id_1" member,
1609  * the code that's used here is the old code for HP-UX 10.x.
1610  *
1611  * However, HP-UX 10.20, at least, appears to have such a member
1612  * in its "dl_hp_ppa_info_t" structure, so the new code is used.
1613  * The new code didn't work on an old 10.20 system on which Rick
1614  * Jones of HP tried it, but with later patches installed, it
1615  * worked - it appears that the older system had those members but
1616  * didn't put anything in them, so, if the search by name fails, we
1617  * do the old search.
1618  *
1619  * Rick suggests that making sure your system is "up on the latest
1620  * lancommon/DLPI/driver patches" is probably a good idea; it'd fix
1621  * that problem, as well as allowing libpcap to see packets sent
1622  * from the system on which the libpcap application is being run.
1623  * (On 10.20, in addition to getting the latest patches, you need
1624  * to turn the kernel "lanc_outbound_promisc_flag" flag on with ADB;
1625  * a posting to "comp.sys.hp.hpux" at
1626  *
1627  *        http://www.deja.com/[ST_rn=ps]/getdoc.xp?AN=558092266
1628  *
1629  * says that, to see the machine's outgoing traffic, you'd need to
1630  * apply the right patches to your system, and also set that variable
1631  * with:
1632 
1633 echo 'lanc_outbound_promisc_flag/W1' | /usr/bin/adb -w /stand/vmunix /dev/kmem
1634 
1635  * which could be put in, for example, "/sbin/init.d/lan".
1636  *
1637  * Setting the variable is not necessary on HP-UX 11.x.
1638  */
1639 static int
1640 get_dlpi_ppa(register int fd, register const char *device, register u_int unit,
1641     u_int *ppa, register char *ebuf)
1642 {
1643           register dl_hp_ppa_ack_t *ap;
1644           register dl_hp_ppa_info_t *ipstart, *ip;
1645           register u_int i;
1646           char dname[100];
1647           register u_long majdev;
1648           struct stat statbuf;
1649           dl_hp_ppa_req_t     req;
1650           char buf[MAXDLBUF];
1651           char *ppa_data_buf;
1652           dl_hp_ppa_ack_t     *dlp;
1653           struct strbuf ctl;
1654           int flags;
1655 
1656           memset((char *)&req, 0, sizeof(req));
1657           req.dl_primitive = DL_HP_PPA_REQ;
1658 
1659           memset((char *)buf, 0, sizeof(buf));
1660           if (send_request(fd, (char *)&req, sizeof(req), "hpppa", ebuf) < 0)
1661                     return (PCAP_ERROR);
1662 
1663           ctl.maxlen = DL_HP_PPA_ACK_SIZE;
1664           ctl.len = 0;
1665           ctl.buf = (char *)buf;
1666 
1667           flags = 0;
1668           /*
1669            * DLPI may return a big chunk of data for a DL_HP_PPA_REQ. The normal
1670            * recv_ack will fail because it set the maxlen to MAXDLBUF (8192)
1671            * which is NOT big enough for a DL_HP_PPA_REQ.
1672            *
1673            * This causes libpcap applications to fail on a system with HP-APA
1674            * installed.
1675            *
1676            * To figure out how big the returned data is, we first call getmsg
1677            * to get the small head and peek at the head to get the actual data
1678            * length, and  then issue another getmsg to get the actual PPA data.
1679            */
1680           /* get the head first */
1681           if (getmsg(fd, &ctl, (struct strbuf *)NULL, &flags) < 0) {
1682                     pcapint_fmt_errmsg_for_errno(ebuf, PCAP_ERRBUF_SIZE,
1683                         errno, "get_dlpi_ppa: hpppa getmsg");
1684                     return (PCAP_ERROR);
1685           }
1686           if (ctl.len == -1) {
1687                     snprintf(ebuf, PCAP_ERRBUF_SIZE,
1688                         "get_dlpi_ppa: hpppa getmsg: control buffer has no data");
1689                     return (PCAP_ERROR);
1690           }
1691 
1692           dlp = (dl_hp_ppa_ack_t *)ctl.buf;
1693           if (dlp->dl_primitive != DL_HP_PPA_ACK) {
1694                     snprintf(ebuf, PCAP_ERRBUF_SIZE,
1695                         "get_dlpi_ppa: hpppa unexpected primitive ack 0x%x",
1696                         (bpf_u_int32)dlp->dl_primitive);
1697                     return (PCAP_ERROR);
1698           }
1699 
1700           if ((size_t)ctl.len < DL_HP_PPA_ACK_SIZE) {
1701                     snprintf(ebuf, PCAP_ERRBUF_SIZE,
1702                         "get_dlpi_ppa: hpppa ack too small (%d < %lu)",
1703                          ctl.len, (unsigned long)DL_HP_PPA_ACK_SIZE);
1704                     return (PCAP_ERROR);
1705           }
1706 
1707           /* allocate buffer */
1708           if ((ppa_data_buf = (char *)malloc(dlp->dl_length)) == NULL) {
1709                     pcapint_fmt_errmsg_for_errno(ebuf, PCAP_ERRBUF_SIZE,
1710                         errno, "get_dlpi_ppa: hpppa malloc");
1711                     return (PCAP_ERROR);
1712           }
1713           ctl.maxlen = dlp->dl_length;
1714           ctl.len = 0;
1715           ctl.buf = (char *)ppa_data_buf;
1716           /* get the data */
1717           if (getmsg(fd, &ctl, (struct strbuf *)NULL, &flags) < 0) {
1718                     pcapint_fmt_errmsg_for_errno(ebuf, PCAP_ERRBUF_SIZE,
1719                         errno, "get_dlpi_ppa: hpppa getmsg");
1720                     free(ppa_data_buf);
1721                     return (PCAP_ERROR);
1722           }
1723           if (ctl.len == -1) {
1724                     snprintf(ebuf, PCAP_ERRBUF_SIZE,
1725                         "get_dlpi_ppa: hpppa getmsg: control buffer has no data");
1726                     return (PCAP_ERROR);
1727           }
1728           if ((u_int)ctl.len < dlp->dl_length) {
1729                     snprintf(ebuf, PCAP_ERRBUF_SIZE,
1730                         "get_dlpi_ppa: hpppa ack too small (%d < %lu)",
1731                         ctl.len, (unsigned long)dlp->dl_length);
1732                     free(ppa_data_buf);
1733                     return (PCAP_ERROR);
1734           }
1735 
1736           ap = (dl_hp_ppa_ack_t *)buf;
1737           ipstart = (dl_hp_ppa_info_t *)ppa_data_buf;
1738           ip = ipstart;
1739 
1740 #ifdef HAVE_DL_HP_PPA_INFO_T_DL_MODULE_ID_1
1741           /*
1742            * The "dl_hp_ppa_info_t" structure has a "dl_module_id_1"
1743            * member that should, in theory, contain the part of the
1744            * name for the device that comes before the unit number,
1745            * and should also have a "dl_module_id_2" member that may
1746            * contain an alternate name (e.g., I think Ethernet devices
1747            * have both "lan", for "lanN", and "snap", for "snapN", with
1748            * the former being for Ethernet packets and the latter being
1749            * for 802.3/802.2 packets).
1750            *
1751            * Search for the device that has the specified name and
1752            * instance number.
1753            */
1754           for (i = 0; i < ap->dl_count; i++) {
1755                     if ((strcmp((const char *)ip->dl_module_id_1, device) == 0 ||
1756                          strcmp((const char *)ip->dl_module_id_2, device) == 0) &&
1757                         ip->dl_instance_num == unit)
1758                               break;
1759 
1760                     ip = (dl_hp_ppa_info_t *)((u_char *)ipstart + ip->dl_next_offset);
1761           }
1762 #else
1763           /*
1764            * We don't have that member, so the search is impossible; make it
1765            * look as if the search failed.
1766            */
1767           i = ap->dl_count;
1768 #endif
1769 
1770           if (i == ap->dl_count) {
1771                     /*
1772                      * Well, we didn't, or can't, find the device by name.
1773                      *
1774                      * HP-UX 10.20, whilst it has "dl_module_id_1" and
1775                      * "dl_module_id_2" fields in the "dl_hp_ppa_info_t",
1776                      * doesn't seem to fill them in unless the system is
1777                      * at a reasonably up-to-date patch level.
1778                      *
1779                      * Older HP-UX 10.x systems might not have those fields
1780                      * at all.
1781                      *
1782                      * Therefore, we'll search for the entry with the major
1783                      * device number of a device with the name "/dev/<dev><unit>",
1784                      * if such a device exists, as the old code did.
1785                      */
1786                     snprintf(dname, sizeof(dname), "/dev/%s%u", device, unit);
1787                     if (stat(dname, &statbuf) < 0) {
1788                               pcapint_fmt_errmsg_for_errno(ebuf, PCAP_ERRBUF_SIZE,
1789                                   errno, "stat: %s", dname);
1790                               return (PCAP_ERROR);
1791                     }
1792                     majdev = major(statbuf.st_rdev);
1793 
1794                     ip = ipstart;
1795 
1796                     for (i = 0; i < ap->dl_count; i++) {
1797                               if (ip->dl_mjr_num == majdev &&
1798                                   ip->dl_instance_num == unit)
1799                                         break;
1800 
1801                               ip = (dl_hp_ppa_info_t *)((u_char *)ipstart + ip->dl_next_offset);
1802                     }
1803           }
1804           if (i == ap->dl_count) {
1805                     snprintf(ebuf, PCAP_ERRBUF_SIZE,
1806                         "can't find /dev/dlpi PPA for %s%u", device, unit);
1807                     return (PCAP_ERROR_NO_SUCH_DEVICE);
1808           }
1809           if (ip->dl_hdw_state == HDW_DEAD) {
1810                     snprintf(ebuf, PCAP_ERRBUF_SIZE,
1811                         "%s%d: hardware state: DOWN\n", device, unit);
1812                     free(ppa_data_buf);
1813                     return (PCAP_ERROR);
1814           }
1815           *ppa = ip->dl_ppa;
1816           free(ppa_data_buf);
1817           return (0);
1818 }
1819 #endif
1820 
1821 #ifdef HAVE_HPUX9
1822 /*
1823  * Under HP-UX 9, there is no good way to determine the ppa.
1824  * So punt and read it from /dev/kmem.
1825  */
1826 static struct nlist nl[] = {
1827 #define NL_IFNET 0
1828           { "ifnet" },
1829           { "" }
1830 };
1831 
1832 static char path_vmunix[] = "/hp-ux";
1833 
1834 /* Determine ppa number that specifies ifname */
1835 static int
1836 get_dlpi_ppa(register int fd, register const char *ifname, register u_int unit,
1837     u_int *ppa, register char *ebuf)
1838 {
1839           register const char *cp;
1840           register int kd;
1841           void *addr;
1842           struct ifnet ifnet;
1843           char if_name[sizeof(ifnet.if_name) + 1];
1844 
1845           cp = strrchr(ifname, '/');
1846           if (cp != NULL)
1847                     ifname = cp + 1;
1848           if (nlist(path_vmunix, &nl) < 0) {
1849                     snprintf(ebuf, PCAP_ERRBUF_SIZE, "nlist %s failed",
1850                         path_vmunix);
1851                     return (PCAP_ERROR);
1852           }
1853           if (nl[NL_IFNET].n_value == 0) {
1854                     snprintf(ebuf, PCAP_ERRBUF_SIZE,
1855                         "couldn't find %s kernel symbol",
1856                         nl[NL_IFNET].n_name);
1857                     return (PCAP_ERROR);
1858           }
1859           kd = open("/dev/kmem", O_RDONLY);
1860           if (kd < 0) {
1861                     pcapint_fmt_errmsg_for_errno(ebuf, PCAP_ERRBUF_SIZE,
1862                         errno, "kmem open");
1863                     return (PCAP_ERROR);
1864           }
1865           if (dlpi_kread(kd, nl[NL_IFNET].n_value,
1866               &addr, sizeof(addr), ebuf) < 0) {
1867                     close(kd);
1868                     return (PCAP_ERROR);
1869           }
1870           for (; addr != NULL; addr = ifnet.if_next) {
1871                     if (dlpi_kread(kd, (off_t)addr,
1872                         &ifnet, sizeof(ifnet), ebuf) < 0 ||
1873                         dlpi_kread(kd, (off_t)ifnet.if_name,
1874                         if_name, sizeof(ifnet.if_name), ebuf) < 0) {
1875                               (void)close(kd);
1876                               return (PCAP_ERROR);
1877                     }
1878                     if_name[sizeof(ifnet.if_name)] = '\0';
1879                     if (strcmp(if_name, ifname) == 0 && ifnet.if_unit == unit) {
1880                               *ppa = ifnet.if_index;
1881                               return (0);
1882                     }
1883           }
1884 
1885           snprintf(ebuf, PCAP_ERRBUF_SIZE, "Can't find %s", ifname);
1886           return (PCAP_ERROR_NO_SUCH_DEVICE);
1887 }
1888 
1889 static int
1890 dlpi_kread(register int fd, register off_t addr,
1891     register void *buf, register u_int len, register char *ebuf)
1892 {
1893           register int cc;
1894 
1895           if (lseek(fd, addr, SEEK_SET) < 0) {
1896                     pcapint_fmt_errmsg_for_errno(ebuf, PCAP_ERRBUF_SIZE,
1897                         errno, "lseek");
1898                     return (-1);
1899           }
1900           cc = read(fd, buf, len);
1901           if (cc < 0) {
1902                     pcapint_fmt_errmsg_for_errno(ebuf, PCAP_ERRBUF_SIZE,
1903                         errno, "read");
1904                     return (-1);
1905           } else if (cc != len) {
1906                     snprintf(ebuf, PCAP_ERRBUF_SIZE, "short read (%d != %d)", cc,
1907                         len);
1908                     return (-1);
1909           }
1910           return (cc);
1911 }
1912 #endif
1913 
1914 pcap_t *
1915 pcapint_create_interface(const char *device _U_, char *ebuf)
1916 {
1917           pcap_t *p;
1918 #ifdef DL_HP_RAWDLS
1919           struct pcap_dlpi *pd;
1920 #endif
1921 
1922           p = PCAP_CREATE_COMMON(ebuf, struct pcap_dlpi);
1923           if (p == NULL)
1924                     return (NULL);
1925 
1926 #ifdef DL_HP_RAWDLS
1927           pd = p->priv;
1928           pd->send_fd = -1;   /* it hasn't been opened yet */
1929 #endif
1930 
1931           p->activate_op = pcap_activate_dlpi;
1932           return (p);
1933 }
1934 
1935 /*
1936  * Libpcap version string.
1937  */
1938 const char *
1939 pcap_lib_version(void)
1940 {
1941           return (PCAP_VERSION_STRING);
1942 }
1943