1 /*
2 * Copyright (c) 2006 Paolo Abeni (Italy)
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 *
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 * 3. The name of the author may not be used to endorse or promote
15 * products derived from this software without specific prior written
16 * permission.
17 *
18 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
19 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
20 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
21 * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
22 * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
23 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
24 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
25 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
26 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
27 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
28 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
29 *
30 * USB sniffing API implementation for Linux platform
31 * By Paolo Abeni <paolo.abeni@email.it>
32 * Modifications: Kris Katterjohn <katterjohn@gmail.com>
33 *
34 */
35
36 #ifdef HAVE_CONFIG_H
37 #include <config.h>
38 #endif
39
40 #include "pcap-int.h"
41 #include "pcap-usb-linux.h"
42 #include "pcap/usb.h"
43
44 #ifdef NEED_STRERROR_H
45 #include "strerror.h"
46 #endif
47
48 #include <ctype.h>
49 #include <errno.h>
50 #include <stdlib.h>
51 #include <unistd.h>
52 #include <fcntl.h>
53 #include <string.h>
54 #include <dirent.h>
55 #include <byteswap.h>
56 #include <netinet/in.h>
57 #include <sys/ioctl.h>
58 #include <sys/mman.h>
59 #include <sys/utsname.h>
60 #ifdef HAVE_LINUX_USBDEVICE_FS_H
61 /*
62 * We might need <linux/compiler.h> to define __user for
63 * <linux/usbdevice_fs.h>.
64 */
65 #ifdef HAVE_LINUX_COMPILER_H
66 #include <linux/compiler.h>
67 #endif /* HAVE_LINUX_COMPILER_H */
68 #include <linux/usbdevice_fs.h>
69 #endif /* HAVE_LINUX_USBDEVICE_FS_H */
70
71 #define USB_IFACE "usbmon"
72 #define USB_TEXT_DIR_OLD "/sys/kernel/debug/usbmon"
73 #define USB_TEXT_DIR "/sys/kernel/debug/usb/usbmon"
74 #define SYS_USB_BUS_DIR "/sys/bus/usb/devices"
75 #define PROC_USB_BUS_DIR "/proc/bus/usb"
76 #define USB_LINE_LEN 4096
77
78 #if __BYTE_ORDER == __LITTLE_ENDIAN
79 #define htols(s) s
80 #define htoll(l) l
81 #define htol64(ll) ll
82 #else
83 #define htols(s) bswap_16(s)
84 #define htoll(l) bswap_32(l)
85 #define htol64(ll) bswap_64(ll)
86 #endif
87
88 struct mon_bin_stats {
89 uint32_t queued;
90 uint32_t dropped;
91 };
92
93 struct mon_bin_get {
94 pcap_usb_header *hdr;
95 void *data;
96 size_t data_len; /* Length of data (can be zero) */
97 };
98
99 struct mon_bin_mfetch {
100 int32_t *offvec; /* Vector of events fetched */
101 int32_t nfetch; /* Number of events to fetch (out: fetched) */
102 int32_t nflush; /* Number of events to flush */
103 };
104
105 #define MON_IOC_MAGIC 0x92
106
107 #define MON_IOCQ_URB_LEN _IO(MON_IOC_MAGIC, 1)
108 #define MON_IOCX_URB _IOWR(MON_IOC_MAGIC, 2, struct mon_bin_hdr)
109 #define MON_IOCG_STATS _IOR(MON_IOC_MAGIC, 3, struct mon_bin_stats)
110 #define MON_IOCT_RING_SIZE _IO(MON_IOC_MAGIC, 4)
111 #define MON_IOCQ_RING_SIZE _IO(MON_IOC_MAGIC, 5)
112 #define MON_IOCX_GET _IOW(MON_IOC_MAGIC, 6, struct mon_bin_get)
113 #define MON_IOCX_MFETCH _IOWR(MON_IOC_MAGIC, 7, struct mon_bin_mfetch)
114 #define MON_IOCH_MFLUSH _IO(MON_IOC_MAGIC, 8)
115
116 #define MON_BIN_SETUP 0x1 /* setup hdr is present*/
117 #define MON_BIN_SETUP_ZERO 0x2 /* setup buffer is not available */
118 #define MON_BIN_DATA_ZERO 0x4 /* data buffer is not available */
119 #define MON_BIN_ERROR 0x8
120
121 /*
122 * Private data for capturing on Linux USB.
123 */
124 struct pcap_usb_linux {
125 u_char *mmapbuf; /* memory-mapped region pointer */
126 size_t mmapbuflen; /* size of region */
127 int bus_index;
128 u_int packets_read;
129 };
130
131 /* forward declaration */
132 static int usb_activate(pcap_t *);
133 static int usb_stats_linux(pcap_t *, struct pcap_stat *);
134 static int usb_stats_linux_bin(pcap_t *, struct pcap_stat *);
135 static int usb_read_linux(pcap_t *, int , pcap_handler , u_char *);
136 static int usb_read_linux_bin(pcap_t *, int , pcap_handler , u_char *);
137 static int usb_read_linux_mmap(pcap_t *, int , pcap_handler , u_char *);
138 static int usb_inject_linux(pcap_t *, const void *, size_t);
139 static int usb_setdirection_linux(pcap_t *, pcap_direction_t);
140 static void usb_cleanup_linux_mmap(pcap_t *);
141
142 static int
have_binary_usbmon(void)143 have_binary_usbmon(void)
144 {
145 struct utsname utsname;
146 char *version_component, *endp;
147 int major, minor, subminor;
148
149 if (uname(&utsname) == 0) {
150 /*
151 * 2.6.21 is the first release with the binary-mode
152 * USB monitoring.
153 */
154 version_component = utsname.release;
155 major = strtol(version_component, &endp, 10);
156 if (endp != version_component && *endp == '.') {
157 /*
158 * OK, that was a valid major version.
159 * Is it 3 or greater? If so, we have binary
160 * mode support.
161 */
162 if (major >= 3)
163 return 1;
164
165 /*
166 * Is it 1 or less? If so, we don't have binary
167 * mode support. (In fact, we don't have any
168 * USB monitoring....)
169 */
170 if (major <= 1)
171 return 0;
172 }
173
174 /*
175 * OK, this is a 2.x kernel.
176 * What's the minor version?
177 */
178 version_component = endp + 1;
179 minor = strtol(version_component, &endp, 10);
180 if (endp != version_component &&
181 (*endp == '.' || *endp == '\0')) {
182 /*
183 * OK, that was a valid minor version.
184 * Is is 2.6 or later? (There shouldn't be a
185 * "later", as 2.6.x went to 3.x, but we'll
186 * check anyway.)
187 */
188 if (minor < 6) {
189 /*
190 * No, so no binary support (did 2.4 have
191 * any USB monitoring at all?)
192 */
193 return 0;
194 }
195
196 /*
197 * OK, this is a 2.6.x kernel.
198 * What's the subminor version?
199 */
200 version_component = endp + 1;
201 subminor = strtol(version_component, &endp, 10);
202 if (endp != version_component &&
203 (*endp == '.' || *endp == '\0')) {
204 /*
205 * OK, that was a valid subminor version.
206 * Is it 21 or greater?
207 */
208 if (subminor >= 21) {
209 /*
210 * Yes - we have binary mode
211 * support.
212 */
213 return 1;
214 }
215 }
216 }
217 }
218
219 /*
220 * Either uname() failed, in which case we just say "no binary
221 * mode support", or we don't have binary mode support.
222 */
223 return 0;
224 }
225
226 /* facility to add an USB device to the device list*/
227 static int
usb_dev_add(pcap_if_list_t * devlistp,int n,char * err_str)228 usb_dev_add(pcap_if_list_t *devlistp, int n, char *err_str)
229 {
230 char dev_name[10];
231 char dev_descr[30];
232 pcap_snprintf(dev_name, 10, USB_IFACE"%d", n);
233 /*
234 * XXX - is there any notion of "up" and "running"?
235 */
236 if (n == 0) {
237 /*
238 * As this refers to all buses, there's no notion of
239 * "connected" vs. "disconnected", as that's a property
240 * that would apply to a particular USB interface.
241 */
242 if (add_dev(devlistp, dev_name,
243 PCAP_IF_CONNECTION_STATUS_NOT_APPLICABLE,
244 "All USB buses", err_str) == NULL)
245 return -1;
246 } else {
247 /*
248 * XXX - is there a way to determine whether anything's
249 * plugged into this bus interface or not, and set
250 * PCAP_IF_CONNECTION_STATUS_CONNECTED or
251 * PCAP_IF_CONNECTION_STATUS_DISCONNECTED?
252 */
253 pcap_snprintf(dev_descr, 30, "USB bus number %d", n);
254 if (add_dev(devlistp, dev_name, 0, dev_descr, err_str) == NULL)
255 return -1;
256 }
257
258 return 0;
259 }
260
261 int
usb_findalldevs(pcap_if_list_t * devlistp,char * err_str)262 usb_findalldevs(pcap_if_list_t *devlistp, char *err_str)
263 {
264 char usb_mon_dir[PATH_MAX];
265 char *usb_mon_prefix;
266 size_t usb_mon_prefix_len;
267 struct dirent* data;
268 int ret = 0;
269 DIR* dir;
270 int n;
271 char* name;
272 size_t len;
273
274 if (have_binary_usbmon()) {
275 /*
276 * We have binary-mode support.
277 * What do the device names look like?
278 * Split LINUX_USB_MON_DEV into a directory that we'll
279 * scan and a file name prefix that we'll check for.
280 */
281 strlcpy(usb_mon_dir, LINUX_USB_MON_DEV, sizeof usb_mon_dir);
282 usb_mon_prefix = strrchr(usb_mon_dir, '/');
283 if (usb_mon_prefix == NULL) {
284 /*
285 * This "shouldn't happen". Just give up if it
286 * does.
287 */
288 return 0;
289 }
290 *usb_mon_prefix++ = '\0';
291 usb_mon_prefix_len = strlen(usb_mon_prefix);
292
293 /*
294 * Open the directory and scan it.
295 */
296 dir = opendir(usb_mon_dir);
297 if (dir != NULL) {
298 while ((ret == 0) && ((data = readdir(dir)) != 0)) {
299 name = data->d_name;
300
301 /*
302 * Is this a usbmon device?
303 */
304 if (strncmp(name, usb_mon_prefix, usb_mon_prefix_len) != 0)
305 continue; /* no */
306
307 /*
308 * What's the device number?
309 */
310 if (sscanf(&name[usb_mon_prefix_len], "%d", &n) == 0)
311 continue; /* failed */
312
313 ret = usb_dev_add(devlistp, n, err_str);
314 }
315
316 closedir(dir);
317 }
318 return 0;
319 } else {
320 /*
321 * We have only text mode support.
322 * We don't look for the text devices because we can't
323 * look for them without root privileges, and we don't
324 * want to require root privileges to enumerate devices
325 * (we want to let the user to try a device and get
326 * an error, rather than seeing no devices and asking
327 * "why am I not seeing devices" and forcing a long
328 * process of poking to figure out whether it's "no
329 * privileges" or "your kernel is too old" or "the
330 * usbmon module isn't loaded" or...).
331 *
332 * Instead, we look to see what buses we have.
333 * If the kernel is so old that it doesn't have
334 * binary-mode support, it's also so old that
335 * it doesn't have a "scan all buses" device.
336 *
337 * First, try scanning sysfs USB bus directory.
338 */
339 dir = opendir(SYS_USB_BUS_DIR);
340 if (dir != NULL) {
341 while ((ret == 0) && ((data = readdir(dir)) != 0)) {
342 name = data->d_name;
343
344 if (strncmp(name, "usb", 3) != 0)
345 continue;
346
347 if (sscanf(&name[3], "%d", &n) == 0)
348 continue;
349
350 ret = usb_dev_add(devlistp, n, err_str);
351 }
352
353 closedir(dir);
354 return 0;
355 }
356
357 /* That didn't work; try scanning procfs USB bus directory. */
358 dir = opendir(PROC_USB_BUS_DIR);
359 if (dir != NULL) {
360 while ((ret == 0) && ((data = readdir(dir)) != 0)) {
361 name = data->d_name;
362 len = strlen(name);
363
364 /* if this file name does not end with a number it's not of our interest */
365 if ((len < 1) || !isdigit(name[--len]))
366 continue;
367 while (isdigit(name[--len]));
368 if (sscanf(&name[len+1], "%d", &n) != 1)
369 continue;
370
371 ret = usb_dev_add(devlistp, n, err_str);
372 }
373
374 closedir(dir);
375 return ret;
376 }
377
378 /* neither of them worked */
379 return 0;
380 }
381 }
382
383 static
usb_mmap(pcap_t * handle)384 int usb_mmap(pcap_t* handle)
385 {
386 struct pcap_usb_linux *handlep = handle->priv;
387 int len = ioctl(handle->fd, MON_IOCQ_RING_SIZE);
388 if (len < 0)
389 return 0;
390
391 handlep->mmapbuflen = len;
392 handlep->mmapbuf = mmap(0, handlep->mmapbuflen, PROT_READ,
393 MAP_SHARED, handle->fd, 0);
394 return handlep->mmapbuf != MAP_FAILED;
395 }
396
397 #ifdef HAVE_LINUX_USBDEVICE_FS_H
398
399 #define CTRL_TIMEOUT (5*1000) /* milliseconds */
400
401 #define USB_DIR_IN 0x80
402 #define USB_TYPE_STANDARD 0x00
403 #define USB_RECIP_DEVICE 0x00
404
405 #define USB_REQ_GET_DESCRIPTOR 6
406
407 #define USB_DT_DEVICE 1
408
409 /* probe the descriptors of the devices attached to the bus */
410 /* the descriptors will end up in the captured packet stream */
411 /* and be decoded by external apps like wireshark */
412 /* without these identifying probes packet data can't be fully decoded */
413 static void
probe_devices(int bus)414 probe_devices(int bus)
415 {
416 struct usbdevfs_ctrltransfer ctrl;
417 struct dirent* data;
418 int ret = 0;
419 char buf[sizeof("/dev/bus/usb/000/") + NAME_MAX];
420 DIR* dir;
421
422 /* scan usb bus directories for device nodes */
423 pcap_snprintf(buf, sizeof(buf), "/dev/bus/usb/%03d", bus);
424 dir = opendir(buf);
425 if (!dir)
426 return;
427
428 while ((ret >= 0) && ((data = readdir(dir)) != 0)) {
429 int fd;
430 char* name = data->d_name;
431
432 if (name[0] == '.')
433 continue;
434
435 pcap_snprintf(buf, sizeof(buf), "/dev/bus/usb/%03d/%s", bus, data->d_name);
436
437 fd = open(buf, O_RDWR);
438 if (fd == -1)
439 continue;
440
441 /*
442 * Sigh. Different kernels have different member names
443 * for this structure.
444 */
445 #ifdef HAVE_STRUCT_USBDEVFS_CTRLTRANSFER_BREQUESTTYPE
446 ctrl.bRequestType = USB_DIR_IN | USB_TYPE_STANDARD | USB_RECIP_DEVICE;
447 ctrl.bRequest = USB_REQ_GET_DESCRIPTOR;
448 ctrl.wValue = USB_DT_DEVICE << 8;
449 ctrl.wIndex = 0;
450 ctrl.wLength = sizeof(buf);
451 #else
452 ctrl.requesttype = USB_DIR_IN | USB_TYPE_STANDARD | USB_RECIP_DEVICE;
453 ctrl.request = USB_REQ_GET_DESCRIPTOR;
454 ctrl.value = USB_DT_DEVICE << 8;
455 ctrl.index = 0;
456 ctrl.length = sizeof(buf);
457 #endif
458 ctrl.data = buf;
459 ctrl.timeout = CTRL_TIMEOUT;
460
461 ret = ioctl(fd, USBDEVFS_CONTROL, &ctrl);
462
463 close(fd);
464 }
465 closedir(dir);
466 }
467 #endif /* HAVE_LINUX_USBDEVICE_FS_H */
468
469 pcap_t *
usb_create(const char * device,char * ebuf,int * is_ours)470 usb_create(const char *device, char *ebuf, int *is_ours)
471 {
472 const char *cp;
473 char *cpend;
474 long devnum;
475 pcap_t *p;
476
477 /* Does this look like a USB monitoring device? */
478 cp = strrchr(device, '/');
479 if (cp == NULL)
480 cp = device;
481 /* Does it begin with USB_IFACE? */
482 if (strncmp(cp, USB_IFACE, sizeof USB_IFACE - 1) != 0) {
483 /* Nope, doesn't begin with USB_IFACE */
484 *is_ours = 0;
485 return NULL;
486 }
487 /* Yes - is USB_IFACE followed by a number? */
488 cp += sizeof USB_IFACE - 1;
489 devnum = strtol(cp, &cpend, 10);
490 if (cpend == cp || *cpend != '\0') {
491 /* Not followed by a number. */
492 *is_ours = 0;
493 return NULL;
494 }
495 if (devnum < 0) {
496 /* Followed by a non-valid number. */
497 *is_ours = 0;
498 return NULL;
499 }
500
501 /* OK, it's probably ours. */
502 *is_ours = 1;
503
504 p = pcap_create_common(ebuf, sizeof (struct pcap_usb_linux));
505 if (p == NULL)
506 return (NULL);
507
508 p->activate_op = usb_activate;
509 return (p);
510 }
511
512 static int
usb_activate(pcap_t * handle)513 usb_activate(pcap_t* handle)
514 {
515 struct pcap_usb_linux *handlep = handle->priv;
516 char full_path[USB_LINE_LEN];
517
518 /*
519 * Turn a negative snapshot value (invalid), a snapshot value of
520 * 0 (unspecified), or a value bigger than the normal maximum
521 * value, into the maximum allowed value.
522 *
523 * If some application really *needs* a bigger snapshot
524 * length, we should just increase MAXIMUM_SNAPLEN.
525 */
526 if (handle->snapshot <= 0 || handle->snapshot > MAXIMUM_SNAPLEN)
527 handle->snapshot = MAXIMUM_SNAPLEN;
528
529 /* Initialize some components of the pcap structure. */
530 handle->bufsize = handle->snapshot;
531 handle->offset = 0;
532 handle->linktype = DLT_USB_LINUX;
533
534 handle->inject_op = usb_inject_linux;
535 handle->setfilter_op = install_bpf_program; /* no kernel filtering */
536 handle->setdirection_op = usb_setdirection_linux;
537 handle->set_datalink_op = NULL; /* can't change data link type */
538 handle->getnonblock_op = pcap_getnonblock_fd;
539 handle->setnonblock_op = pcap_setnonblock_fd;
540
541 /*get usb bus index from device name */
542 if (sscanf(handle->opt.device, USB_IFACE"%d", &handlep->bus_index) != 1)
543 {
544 pcap_snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
545 "Can't get USB bus index from %s", handle->opt.device);
546 return PCAP_ERROR;
547 }
548
549 if (have_binary_usbmon())
550 {
551 /*
552 * We have binary-mode support.
553 * Try to open the binary interface.
554 */
555 pcap_snprintf(full_path, USB_LINE_LEN, LINUX_USB_MON_DEV"%d", handlep->bus_index);
556 handle->fd = open(full_path, O_RDONLY, 0);
557 if (handle->fd < 0)
558 {
559 /*
560 * The attempt failed; why?
561 */
562 switch (errno) {
563
564 case ENOENT:
565 /*
566 * The device doesn't exist.
567 * That could either mean that there's
568 * no support for monitoring USB buses
569 * (which probably means "the usbmon
570 * module isn't loaded") or that there
571 * is but that *particular* device
572 * doesn't exist (no "scan all buses"
573 * device if the bus index is 0, no
574 * such bus if the bus index isn't 0).
575 */
576 return PCAP_ERROR_NO_SUCH_DEVICE;
577
578 case EACCES:
579 /*
580 * We didn't have permission to open it.
581 */
582 return PCAP_ERROR_PERM_DENIED;
583
584 default:
585 /*
586 * Something went wrong.
587 */
588 pcap_fmt_errmsg_for_errno(handle->errbuf,
589 PCAP_ERRBUF_SIZE, errno,
590 "Can't open USB bus file %s", full_path);
591 return PCAP_ERROR;
592 }
593 }
594
595 if (handle->opt.rfmon)
596 {
597 /*
598 * Monitor mode doesn't apply to USB devices.
599 */
600 close(handle->fd);
601 return PCAP_ERROR_RFMON_NOTSUP;
602 }
603
604 /* try to use fast mmap access */
605 if (usb_mmap(handle))
606 {
607 handle->linktype = DLT_USB_LINUX_MMAPPED;
608 handle->stats_op = usb_stats_linux_bin;
609 handle->read_op = usb_read_linux_mmap;
610 handle->cleanup_op = usb_cleanup_linux_mmap;
611 #ifdef HAVE_LINUX_USBDEVICE_FS_H
612 probe_devices(handlep->bus_index);
613 #endif
614
615 /*
616 * "handle->fd" is a real file, so
617 * "select()" and "poll()" work on it.
618 */
619 handle->selectable_fd = handle->fd;
620 return 0;
621 }
622
623 /* can't mmap, use plain binary interface access */
624 handle->stats_op = usb_stats_linux_bin;
625 handle->read_op = usb_read_linux_bin;
626 #ifdef HAVE_LINUX_USBDEVICE_FS_H
627 probe_devices(handlep->bus_index);
628 #endif
629 }
630 else {
631 /*
632 * We don't have binary mode support.
633 * Try opening the text-mode device.
634 */
635 pcap_snprintf(full_path, USB_LINE_LEN, USB_TEXT_DIR"/%dt", handlep->bus_index);
636 handle->fd = open(full_path, O_RDONLY, 0);
637 if (handle->fd < 0)
638 {
639 if (errno == ENOENT)
640 {
641 /*
642 * Not found at the new location; try
643 * the old location.
644 */
645 pcap_snprintf(full_path, USB_LINE_LEN, USB_TEXT_DIR_OLD"/%dt", handlep->bus_index);
646 handle->fd = open(full_path, O_RDONLY, 0);
647 }
648 if (handle->fd < 0) {
649 /*
650 * Is the problem that we didn't have
651 * sufficient permission to open it?
652 */
653 if (errno == EACCES) {
654 /*
655 * Yes - return that error.
656 */
657 return PCAP_ERROR_PERM_DENIED;
658 }
659
660 /*
661 * No - was the problem something other
662 * than "it doesn't exist"?
663 */
664 if (errno != ENOENT) {
665 /*
666 * Yes - return *that* error.
667 */
668 pcap_fmt_errmsg_for_errno(handle->errbuf,
669 PCAP_ERRBUF_SIZE, errno,
670 "Can't open USB bus file %s",
671 full_path);
672 return PCAP_ERROR;
673 }
674
675 /*
676 * No. Report that as "no such device".
677 * (That could mean "no such USB bus"
678 * or "monitoring not supported".)
679 */
680 return PCAP_ERROR_NO_SUCH_DEVICE;
681 }
682 }
683
684 if (handle->opt.rfmon)
685 {
686 /*
687 * Monitor mode doesn't apply to USB devices.
688 */
689 close(handle->fd);
690 return PCAP_ERROR_RFMON_NOTSUP;
691 }
692
693 handle->stats_op = usb_stats_linux;
694 handle->read_op = usb_read_linux;
695 }
696
697 /*
698 * "handle->fd" is a real file, so "select()" and "poll()"
699 * work on it.
700 */
701 handle->selectable_fd = handle->fd;
702
703 /* for plain binary access and text access we need to allocate the read
704 * buffer */
705 handle->buffer = malloc(handle->bufsize);
706 if (!handle->buffer) {
707 pcap_fmt_errmsg_for_errno(handle->errbuf, PCAP_ERRBUF_SIZE,
708 errno, "malloc");
709 close(handle->fd);
710 return PCAP_ERROR;
711 }
712 return 0;
713 }
714
715 static inline int
ascii_to_int(char c)716 ascii_to_int(char c)
717 {
718 return c < 'A' ? c- '0': ((c<'a') ? c - 'A' + 10: c-'a'+10);
719 }
720
721 /*
722 * see <linux-kernel-source>/Documentation/usb/usbmon.txt and
723 * <linux-kernel-source>/drivers/usb/mon/mon_text.c for urb string
724 * format description
725 */
726 static int
usb_read_linux(pcap_t * handle,int max_packets _U_,pcap_handler callback,u_char * user)727 usb_read_linux(pcap_t *handle, int max_packets _U_, pcap_handler callback, u_char *user)
728 {
729 /* see:
730 * /usr/src/linux/Documentation/usb/usbmon.txt
731 * for message format
732 */
733 struct pcap_usb_linux *handlep = handle->priv;
734 unsigned timestamp;
735 int tag, cnt, ep_num, dev_addr, dummy, ret, urb_len, data_len;
736 char etype, pipeid1, pipeid2, status[16], urb_tag, line[USB_LINE_LEN];
737 char *string = line;
738 u_char * rawdata = handle->buffer;
739 struct pcap_pkthdr pkth;
740 pcap_usb_header* uhdr = (pcap_usb_header*)handle->buffer;
741 u_char urb_transfer=0;
742 int incoming=0;
743
744 /* ignore interrupt system call errors */
745 do {
746 ret = read(handle->fd, line, USB_LINE_LEN - 1);
747 if (handle->break_loop)
748 {
749 handle->break_loop = 0;
750 return -2;
751 }
752 } while ((ret == -1) && (errno == EINTR));
753 if (ret < 0)
754 {
755 if (errno == EAGAIN)
756 return 0; /* no data there */
757
758 pcap_fmt_errmsg_for_errno(handle->errbuf, PCAP_ERRBUF_SIZE,
759 errno, "Can't read from fd %d", handle->fd);
760 return -1;
761 }
762
763 /* read urb header; %n argument may increment return value, but it's
764 * not mandatory, so does not count on it*/
765 string[ret] = 0;
766 ret = sscanf(string, "%x %d %c %c%c:%d:%d %s%n", &tag, ×tamp, &etype,
767 &pipeid1, &pipeid2, &dev_addr, &ep_num, status,
768 &cnt);
769 if (ret < 8)
770 {
771 pcap_snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
772 "Can't parse USB bus message '%s', too few tokens (expected 8 got %d)",
773 string, ret);
774 return -1;
775 }
776 uhdr->id = tag;
777 uhdr->device_address = dev_addr;
778 uhdr->bus_id = handlep->bus_index;
779 uhdr->status = 0;
780 string += cnt;
781
782 /* don't use usbmon provided timestamp, since it have low precision*/
783 if (gettimeofday(&pkth.ts, NULL) < 0)
784 {
785 pcap_fmt_errmsg_for_errno(handle->errbuf, PCAP_ERRBUF_SIZE,
786 errno, "Can't get timestamp for message '%s'", string);
787 return -1;
788 }
789 uhdr->ts_sec = pkth.ts.tv_sec;
790 uhdr->ts_usec = pkth.ts.tv_usec;
791
792 /* parse endpoint information */
793 if (pipeid1 == 'C')
794 urb_transfer = URB_CONTROL;
795 else if (pipeid1 == 'Z')
796 urb_transfer = URB_ISOCHRONOUS;
797 else if (pipeid1 == 'I')
798 urb_transfer = URB_INTERRUPT;
799 else if (pipeid1 == 'B')
800 urb_transfer = URB_BULK;
801 if (pipeid2 == 'i') {
802 ep_num |= URB_TRANSFER_IN;
803 incoming = 1;
804 }
805 if (etype == 'C')
806 incoming = !incoming;
807
808 /* direction check*/
809 if (incoming)
810 {
811 if (handle->direction == PCAP_D_OUT)
812 return 0;
813 }
814 else
815 if (handle->direction == PCAP_D_IN)
816 return 0;
817 uhdr->event_type = etype;
818 uhdr->transfer_type = urb_transfer;
819 uhdr->endpoint_number = ep_num;
820 pkth.caplen = sizeof(pcap_usb_header);
821 rawdata += sizeof(pcap_usb_header);
822
823 /* check if this is a setup packet */
824 ret = sscanf(status, "%d", &dummy);
825 if (ret != 1)
826 {
827 /* this a setup packet, setup data can be filled with underscore if
828 * usbmon has not been able to read them, so we must parse this fields as
829 * strings */
830 pcap_usb_setup* shdr;
831 char str1[3], str2[3], str3[5], str4[5], str5[5];
832 ret = sscanf(string, "%s %s %s %s %s%n", str1, str2, str3, str4,
833 str5, &cnt);
834 if (ret < 5)
835 {
836 pcap_snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
837 "Can't parse USB bus message '%s', too few tokens (expected 5 got %d)",
838 string, ret);
839 return -1;
840 }
841 string += cnt;
842
843 /* try to convert to corresponding integer */
844 shdr = &uhdr->setup;
845 shdr->bmRequestType = strtoul(str1, 0, 16);
846 shdr->bRequest = strtoul(str2, 0, 16);
847 shdr->wValue = htols(strtoul(str3, 0, 16));
848 shdr->wIndex = htols(strtoul(str4, 0, 16));
849 shdr->wLength = htols(strtoul(str5, 0, 16));
850
851 uhdr->setup_flag = 0;
852 }
853 else
854 uhdr->setup_flag = 1;
855
856 /* read urb data */
857 ret = sscanf(string, " %d%n", &urb_len, &cnt);
858 if (ret < 1)
859 {
860 pcap_snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
861 "Can't parse urb length from '%s'", string);
862 return -1;
863 }
864 string += cnt;
865
866 /* urb tag is not present if urb length is 0, so we can stop here
867 * text parsing */
868 pkth.len = urb_len+pkth.caplen;
869 uhdr->urb_len = urb_len;
870 uhdr->data_flag = 1;
871 data_len = 0;
872 if (uhdr->urb_len == 0)
873 goto got;
874
875 /* check for data presence; data is present if and only if urb tag is '=' */
876 if (sscanf(string, " %c", &urb_tag) != 1)
877 {
878 pcap_snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
879 "Can't parse urb tag from '%s'", string);
880 return -1;
881 }
882
883 if (urb_tag != '=')
884 goto got;
885
886 /* skip urb tag and following space */
887 string += 3;
888
889 /* if we reach this point we got some urb data*/
890 uhdr->data_flag = 0;
891
892 /* read all urb data; if urb length is greater then the usbmon internal
893 * buffer length used by the kernel to spool the URB, we get only
894 * a partial information.
895 * At least until linux 2.6.17 there is no way to set usbmon intenal buffer
896 * length and default value is 130. */
897 while ((string[0] != 0) && (string[1] != 0) && (pkth.caplen < (bpf_u_int32)handle->snapshot))
898 {
899 rawdata[0] = ascii_to_int(string[0]) * 16 + ascii_to_int(string[1]);
900 rawdata++;
901 string+=2;
902 if (string[0] == ' ')
903 string++;
904 pkth.caplen++;
905 data_len++;
906 }
907
908 got:
909 uhdr->data_len = data_len;
910 if (pkth.caplen > (bpf_u_int32)handle->snapshot)
911 pkth.caplen = (bpf_u_int32)handle->snapshot;
912
913 if (handle->fcode.bf_insns == NULL ||
914 bpf_filter(handle->fcode.bf_insns, handle->buffer,
915 pkth.len, pkth.caplen)) {
916 handlep->packets_read++;
917 callback(user, &pkth, handle->buffer);
918 return 1;
919 }
920 return 0; /* didn't pass filter */
921 }
922
923 static int
usb_inject_linux(pcap_t * handle,const void * buf _U_,size_t size _U_)924 usb_inject_linux(pcap_t *handle, const void *buf _U_, size_t size _U_)
925 {
926 pcap_snprintf(handle->errbuf, PCAP_ERRBUF_SIZE, "inject not supported on "
927 "USB devices");
928 return (-1);
929 }
930
931 static int
usb_stats_linux(pcap_t * handle,struct pcap_stat * stats)932 usb_stats_linux(pcap_t *handle, struct pcap_stat *stats)
933 {
934 struct pcap_usb_linux *handlep = handle->priv;
935 int dummy, ret, consumed, cnt;
936 char string[USB_LINE_LEN];
937 char token[USB_LINE_LEN];
938 char * ptr = string;
939 int fd;
940
941 pcap_snprintf(string, USB_LINE_LEN, USB_TEXT_DIR"/%ds", handlep->bus_index);
942 fd = open(string, O_RDONLY, 0);
943 if (fd < 0)
944 {
945 if (errno == ENOENT)
946 {
947 /*
948 * Not found at the new location; try the old
949 * location.
950 */
951 pcap_snprintf(string, USB_LINE_LEN, USB_TEXT_DIR_OLD"/%ds", handlep->bus_index);
952 fd = open(string, O_RDONLY, 0);
953 }
954 if (fd < 0) {
955 pcap_fmt_errmsg_for_errno(handle->errbuf,
956 PCAP_ERRBUF_SIZE, errno,
957 "Can't open USB stats file %s", string);
958 return -1;
959 }
960 }
961
962 /* read stats line */
963 do {
964 ret = read(fd, string, USB_LINE_LEN-1);
965 } while ((ret == -1) && (errno == EINTR));
966 close(fd);
967
968 if (ret < 0)
969 {
970 pcap_snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
971 "Can't read stats from fd %d ", fd);
972 return -1;
973 }
974 string[ret] = 0;
975
976 /* extract info on dropped urbs */
977 for (consumed=0; consumed < ret; ) {
978 /* from the sscanf man page:
979 * The C standard says: "Execution of a %n directive does
980 * not increment the assignment count returned at the completion
981 * of execution" but the Corrigendum seems to contradict this.
982 * Do not make any assumptions on the effect of %n conversions
983 * on the return value and explicitly check for cnt assignmet*/
984 int ntok;
985
986 cnt = -1;
987 ntok = sscanf(ptr, "%s%n", token, &cnt);
988 if ((ntok < 1) || (cnt < 0))
989 break;
990 consumed += cnt;
991 ptr += cnt;
992 if (strcmp(token, "nreaders") == 0)
993 ret = sscanf(ptr, "%d", &stats->ps_drop);
994 else
995 ret = sscanf(ptr, "%d", &dummy);
996 if (ntok != 1)
997 break;
998 consumed += cnt;
999 ptr += cnt;
1000 }
1001
1002 stats->ps_recv = handlep->packets_read;
1003 stats->ps_ifdrop = 0;
1004 return 0;
1005 }
1006
1007 static int
usb_setdirection_linux(pcap_t * p,pcap_direction_t d)1008 usb_setdirection_linux(pcap_t *p, pcap_direction_t d)
1009 {
1010 p->direction = d;
1011 return 0;
1012 }
1013
1014
1015 static int
usb_stats_linux_bin(pcap_t * handle,struct pcap_stat * stats)1016 usb_stats_linux_bin(pcap_t *handle, struct pcap_stat *stats)
1017 {
1018 struct pcap_usb_linux *handlep = handle->priv;
1019 int ret;
1020 struct mon_bin_stats st;
1021 ret = ioctl(handle->fd, MON_IOCG_STATS, &st);
1022 if (ret < 0)
1023 {
1024 pcap_fmt_errmsg_for_errno(handle->errbuf, PCAP_ERRBUF_SIZE,
1025 errno, "Can't read stats from fd %d", handle->fd);
1026 return -1;
1027 }
1028
1029 stats->ps_recv = handlep->packets_read + st.queued;
1030 stats->ps_drop = st.dropped;
1031 stats->ps_ifdrop = 0;
1032 return 0;
1033 }
1034
1035 /*
1036 * see <linux-kernel-source>/Documentation/usb/usbmon.txt and
1037 * <linux-kernel-source>/drivers/usb/mon/mon_bin.c binary ABI
1038 */
1039 static int
usb_read_linux_bin(pcap_t * handle,int max_packets _U_,pcap_handler callback,u_char * user)1040 usb_read_linux_bin(pcap_t *handle, int max_packets _U_, pcap_handler callback, u_char *user)
1041 {
1042 struct pcap_usb_linux *handlep = handle->priv;
1043 struct mon_bin_get info;
1044 int ret;
1045 struct pcap_pkthdr pkth;
1046 u_int clen = handle->snapshot - sizeof(pcap_usb_header);
1047
1048 /* the usb header is going to be part of 'packet' data*/
1049 info.hdr = (pcap_usb_header*) handle->buffer;
1050 info.data = (u_char *)handle->buffer + sizeof(pcap_usb_header);
1051 info.data_len = clen;
1052
1053 /* ignore interrupt system call errors */
1054 do {
1055 ret = ioctl(handle->fd, MON_IOCX_GET, &info);
1056 if (handle->break_loop)
1057 {
1058 handle->break_loop = 0;
1059 return -2;
1060 }
1061 } while ((ret == -1) && (errno == EINTR));
1062 if (ret < 0)
1063 {
1064 if (errno == EAGAIN)
1065 return 0; /* no data there */
1066
1067 pcap_fmt_errmsg_for_errno(handle->errbuf, PCAP_ERRBUF_SIZE,
1068 errno, "Can't read from fd %d", handle->fd);
1069 return -1;
1070 }
1071
1072 /* we can get less that than really captured from kernel, depending on
1073 * snaplen, so adjust header accordingly */
1074 if (info.hdr->data_len < clen)
1075 clen = info.hdr->data_len;
1076 info.hdr->data_len = clen;
1077 pkth.caplen = clen + sizeof(pcap_usb_header);
1078 pkth.len = info.hdr->data_len + sizeof(pcap_usb_header);
1079 pkth.ts.tv_sec = info.hdr->ts_sec;
1080 pkth.ts.tv_usec = info.hdr->ts_usec;
1081
1082 if (handle->fcode.bf_insns == NULL ||
1083 bpf_filter(handle->fcode.bf_insns, handle->buffer,
1084 pkth.len, pkth.caplen)) {
1085 handlep->packets_read++;
1086 callback(user, &pkth, handle->buffer);
1087 return 1;
1088 }
1089
1090 return 0; /* didn't pass filter */
1091 }
1092
1093 /*
1094 * see <linux-kernel-source>/Documentation/usb/usbmon.txt and
1095 * <linux-kernel-source>/drivers/usb/mon/mon_bin.c binary ABI
1096 */
1097 #define VEC_SIZE 32
1098 static int
usb_read_linux_mmap(pcap_t * handle,int max_packets,pcap_handler callback,u_char * user)1099 usb_read_linux_mmap(pcap_t *handle, int max_packets, pcap_handler callback, u_char *user)
1100 {
1101 struct pcap_usb_linux *handlep = handle->priv;
1102 struct mon_bin_mfetch fetch;
1103 int32_t vec[VEC_SIZE];
1104 struct pcap_pkthdr pkth;
1105 pcap_usb_header* hdr;
1106 int nflush = 0;
1107 int packets = 0;
1108 u_int clen, max_clen;
1109
1110 max_clen = handle->snapshot - sizeof(pcap_usb_header);
1111
1112 for (;;) {
1113 int i, ret;
1114 int limit = max_packets - packets;
1115 if (limit <= 0)
1116 limit = VEC_SIZE;
1117 if (limit > VEC_SIZE)
1118 limit = VEC_SIZE;
1119
1120 /* try to fetch as many events as possible*/
1121 fetch.offvec = vec;
1122 fetch.nfetch = limit;
1123 fetch.nflush = nflush;
1124 /* ignore interrupt system call errors */
1125 do {
1126 ret = ioctl(handle->fd, MON_IOCX_MFETCH, &fetch);
1127 if (handle->break_loop)
1128 {
1129 handle->break_loop = 0;
1130 return -2;
1131 }
1132 } while ((ret == -1) && (errno == EINTR));
1133 if (ret < 0)
1134 {
1135 if (errno == EAGAIN)
1136 return 0; /* no data there */
1137
1138 pcap_fmt_errmsg_for_errno(handle->errbuf,
1139 PCAP_ERRBUF_SIZE, errno, "Can't mfetch fd %d",
1140 handle->fd);
1141 return -1;
1142 }
1143
1144 /* keep track of processed events, we will flush them later */
1145 nflush = fetch.nfetch;
1146 for (i=0; i<fetch.nfetch; ++i) {
1147 /* discard filler */
1148 hdr = (pcap_usb_header*) &handlep->mmapbuf[vec[i]];
1149 if (hdr->event_type == '@')
1150 continue;
1151
1152 /* we can get less that than really captured from kernel, depending on
1153 * snaplen, so adjust header accordingly */
1154 clen = max_clen;
1155 if (hdr->data_len < clen)
1156 clen = hdr->data_len;
1157
1158 /* get packet info from header*/
1159 pkth.caplen = clen + sizeof(pcap_usb_header_mmapped);
1160 pkth.len = hdr->data_len + sizeof(pcap_usb_header_mmapped);
1161 pkth.ts.tv_sec = hdr->ts_sec;
1162 pkth.ts.tv_usec = hdr->ts_usec;
1163
1164 if (handle->fcode.bf_insns == NULL ||
1165 bpf_filter(handle->fcode.bf_insns, (u_char*) hdr,
1166 pkth.len, pkth.caplen)) {
1167 handlep->packets_read++;
1168 callback(user, &pkth, (u_char*) hdr);
1169 packets++;
1170 }
1171 }
1172
1173 /* with max_packets specifying "unlimited" we stop afer the first chunk*/
1174 if (PACKET_COUNT_IS_UNLIMITED(max_packets) || (packets == max_packets))
1175 break;
1176 }
1177
1178 /* flush pending events*/
1179 if (ioctl(handle->fd, MON_IOCH_MFLUSH, nflush) == -1) {
1180 pcap_fmt_errmsg_for_errno(handle->errbuf, PCAP_ERRBUF_SIZE,
1181 errno, "Can't mflush fd %d", handle->fd);
1182 return -1;
1183 }
1184 return packets;
1185 }
1186
1187 static void
usb_cleanup_linux_mmap(pcap_t * handle)1188 usb_cleanup_linux_mmap(pcap_t* handle)
1189 {
1190 struct pcap_usb_linux *handlep = handle->priv;
1191
1192 /* if we have a memory-mapped buffer, unmap it */
1193 if (handlep->mmapbuf != NULL) {
1194 munmap(handlep->mmapbuf, handlep->mmapbuflen);
1195 handlep->mmapbuf = NULL;
1196 }
1197 pcap_cleanup_live_common(handle);
1198 }
1199