xref: /src/contrib/libpcap/pcap-dlpi.c (revision 16cef5f7a65588def71db4fdfa961f959847e3b6)
1 /*
2  * Copyright (c) 1993, 1994, 1995, 1996, 1997
3  *	The Regents of the University of California.  All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that: (1) source code distributions
7  * retain the above copyright notice and this paragraph in its entirety, (2)
8  * distributions including binary code include the above copyright notice and
9  * this paragraph in its entirety in the documentation or other materials
10  * provided with the distribution, and (3) all advertising materials mentioning
11  * features or use of this software display the following acknowledgement:
12  * ``This product includes software developed by the University of California,
13  * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14  * the University nor the names of its contributors may be used to endorse
15  * or promote products derived from this software without specific prior
16  * written permission.
17  * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18  * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19  * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
20  *
21  * This code contributed by Atanu Ghosh (atanu@cs.ucl.ac.uk),
22  * University College London, and subsequently modified by
23  * Guy Harris, Mark Pizzolato
24  * <List-tcpdump-workers@subscriptions.pizzolato.net>,
25  * Mark C. Brown (mbrown@hp.com), and Sagun Shakya <Sagun.Shakya@Sun.COM>.
26  */
27 
28 /*
29  * Packet capture routine for DLPI under SunOS 5, HP-UX 9/10/11, and AIX.
30  *
31  * Notes:
32  *
33  *    - The DLIOCRAW ioctl() is specific to SunOS.
34  *
35  *    - There is a bug in bufmod(7) such that setting the snapshot
36  *      length results in data being left of the front of the packet.
37  *
38  *    - It might be desirable to use pfmod(7) to filter packets in the
39  *      kernel when possible.
40  *
41  *    - An older version of the HP-UX DLPI Programmer's Guide, which
42  *      I think was advertised as the 10.20 version, used to be available
43  *      at
44  *
45  *            http://docs.hp.com/hpux/onlinedocs/B2355-90093/B2355-90093.html
46  *
47  *      but is no longer available; it can still be found at
48  *
49  *            http://h21007.www2.hp.com/dspp/files/unprotected/Drivers/Docs/Refs/B2355-90093.pdf
50  *
51  *      in PDF form.
52  *
53  *    - The HP-UX 10.x, 11.0, and 11i v1.6 version of the HP-UX DLPI
54  *      Programmer's Guide, which I think was once advertised as the
55  *      11.00 version is available at
56  *
57  *            http://docs.hp.com/en/B2355-90139/index.html
58  *
59  *    - The HP-UX 11i v2 version of the HP-UX DLPI Programmer's Guide
60  *      is available at
61  *
62  *            http://docs.hp.com/en/B2355-90871/index.html
63  *
64  *    - All of the HP documents describe raw-mode services, which are
65  *      what we use if DL_HP_RAWDLS is defined.  XXX - we use __hpux
66  *      in some places to test for HP-UX, but use DL_HP_RAWDLS in
67  *      other places; do we support any versions of HP-UX without
68  *      DL_HP_RAWDLS?
69  */
70 
71 #include <config.h>
72 
73 #include <sys/types.h>
74 #include <sys/time.h>
75 #ifdef HAVE_SYS_BUFMOD_H
76 #include <sys/bufmod.h>
77 #endif
78 #include <sys/dlpi.h>
79 #ifdef HAVE_SYS_DLPI_EXT_H
80 #include <sys/dlpi_ext.h>
81 #endif
82 #ifdef HAVE_HPUX9
83 #include <sys/socket.h>
84 #endif
85 #ifdef DL_HP_PPA_REQ
86 #include <sys/stat.h>
87 #endif
88 #include <sys/stream.h>
89 #if defined(HAVE_SOLARIS) && defined(HAVE_SYS_BUFMOD_H)
90 #include <sys/systeminfo.h>
91 #endif
92 
93 #ifdef HAVE_HPUX9
94 #include <net/if.h>
95 #endif
96 
97 #ifdef HAVE_HPUX9
98 #include <nlist.h>
99 #endif
100 #include <errno.h>
101 #include <fcntl.h>
102 #include <memory.h>
103 #include <stdio.h>
104 #include <stdlib.h>
105 #include <string.h>
106 #include <stropts.h>
107 #include <unistd.h>
108 #include <limits.h>
109 
110 #include "pcap-int.h"
111 #include "dlpisubs.h"
112 
113 #ifdef HAVE_OS_PROTO_H
114 #include "os-proto.h"
115 #endif
116 
117 #if defined(__hpux)
118   /*
119    * HP-UX has a /dev/dlpi device; you open it and set the PPA of the actual
120    * network device you want.
121    */
122   #define HAVE_DEV_DLPI
123 #elif defined(_AIX)
124   /*
125    * AIX has a /dev/dlpi directory, with devices named after the interfaces
126    * underneath it.
127    */
128   #define PCAP_DEV_PREFIX "/dev/dlpi"
129 #elif defined(HAVE_SOLARIS)
130   /*
131    * Solaris has devices named after the interfaces underneath /dev.
132    */
133   #define PCAP_DEV_PREFIX "/dev"
134 #endif
135 
136 #define	MAXDLBUF	8192
137 
138 /* Forwards */
139 static char *split_dname(char *, u_int *, char *);
140 static int dl_doattach(int, int, char *);
141 #ifdef DL_HP_RAWDLS
142 static int dl_dohpuxbind(int, char *);
143 #endif
144 static int dlpromiscon(pcap_t *, bpf_u_int32);
145 static int dlbindreq(int, bpf_u_int32, char *);
146 static int dlbindack(int, char *, char *, int *);
147 static int dlokack(int, const char *, char *, char *, int *);
148 static int dlinforeq(int, char *);
149 static int dlinfoack(int, char *, char *);
150 
151 #ifdef HAVE_DL_PASSIVE_REQ_T
152 static void dlpassive(int, char *);
153 #endif
154 
155 #ifdef DL_HP_RAWDLS
156 static int dlrawdatareq(int, const u_char *, int);
157 #endif
158 static int recv_ack(int, int, const char *, char *, char *, int *);
159 static char *dlstrerror(char *, size_t, bpf_u_int32);
160 static char *dlprim(char *, size_t, bpf_u_int32);
161 #if defined(HAVE_SOLARIS) && defined(HAVE_SYS_BUFMOD_H)
162 #define GET_RELEASE_BUFSIZE	32
163 static void get_release(char *, size_t, bpf_u_int32 *, bpf_u_int32 *,
164     bpf_u_int32 *);
165 #endif
166 static int send_request(int, char *, int, char *, char *);
167 #ifdef HAVE_HPUX9
168 static int dlpi_kread(int, off_t, void *, u_int, char *);
169 #endif
170 #ifdef HAVE_DEV_DLPI
171 static int get_dlpi_ppa(int, const char *, u_int, u_int *, char *);
172 #endif
173 
174 /*
175  * Cast a buffer to "union DL_primitives" without provoking warnings
176  * from the compiler.
177  */
178 #define MAKE_DL_PRIMITIVES(ptr)	((union DL_primitives *)(void *)(ptr))
179 
180 static int
pcap_read_dlpi(pcap_t * p,int cnt,pcap_handler callback,u_char * user)181 pcap_read_dlpi(pcap_t *p, int cnt, pcap_handler callback, u_char *user)
182 {
183 	int cc;
184 	u_char *bp;
185 	int flags;
186 	bpf_u_int32 ctlbuf[MAXDLBUF];
187 	struct strbuf ctl = {
188 		MAXDLBUF,
189 		0,
190 		(char *)ctlbuf
191 	};
192 	struct strbuf data;
193 
194 	flags = 0;
195 	cc = p->cc;
196 	if (cc == 0) {
197 		data.buf = (char *)p->buffer + p->offset;
198 		data.maxlen = p->bufsize;
199 		data.len = 0;
200 		do {
201 			/*
202 			 * Has "pcap_breakloop()" been called?
203 			 */
204 			if (p->break_loop) {
205 				/*
206 				 * Yes - clear the flag that indicates
207 				 * that it has, and return -2 to
208 				 * indicate that we were told to
209 				 * break out of the loop.
210 				 */
211 				p->break_loop = 0;
212 				return (-2);
213 			}
214 			/*
215 			 * XXX - check for the DLPI primitive, which
216 			 * would be DL_HP_RAWDATA_IND on HP-UX
217 			 * if we're in raw mode?
218 			 */
219 			ctl.buf = (char *)ctlbuf;
220 			ctl.maxlen = MAXDLBUF;
221 			ctl.len = 0;
222 			if (getmsg(p->fd, &ctl, &data, &flags) < 0) {
223 				/* Don't choke when we get ptraced */
224 				switch (errno) {
225 
226 				case EINTR:
227 					cc = 0;
228 					continue;
229 
230 				case EAGAIN:
231 					return (0);
232 				}
233 				pcapint_fmt_errmsg_for_errno(p->errbuf,
234 				    sizeof(p->errbuf), errno, "getmsg");
235 				return (-1);
236 			}
237 			cc = data.len;
238 		} while (cc == 0);
239 		bp = (u_char *)p->buffer + p->offset;
240 	} else
241 		bp = p->bp;
242 
243 	return (pcap_process_pkts(p, callback, user, cnt, bp, cc));
244 }
245 
246 static int
pcap_inject_dlpi(pcap_t * p,const void * buf,int size)247 pcap_inject_dlpi(pcap_t *p, const void *buf, int size)
248 {
249 #ifdef DL_HP_RAWDLS
250 	struct pcap_dlpi *pd = p->priv;
251 #endif
252 	int ret;
253 
254 #if defined(DLIOCRAW)
255 	ret = write(p->fd, buf, size);
256 	if (ret == -1) {
257 		pcapint_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE,
258 		    errno, "send");
259 		return (-1);
260 	}
261 #elif defined(DL_HP_RAWDLS)
262 	if (pd->send_fd < 0) {
263 		snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
264 		    "send: Output FD couldn't be opened");
265 		return (-1);
266 	}
267 	ret = dlrawdatareq(pd->send_fd, buf, size);
268 	if (ret == -1) {
269 		pcapint_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE,
270 		    errno, "send");
271 		return (-1);
272 	}
273 	/*
274 	 * putmsg() returns either 0 or -1; it doesn't indicate how
275 	 * many bytes were written (presumably they were all written
276 	 * or none of them were written).  OpenBSD's pcap_inject()
277 	 * returns the number of bytes written, so, for API compatibility,
278 	 * we return the number of bytes we were told to write.
279 	 */
280 	ret = size;
281 #else /* no raw mode */
282 	/*
283 	 * XXX - this is a pain, because you might have to extract
284 	 * the address from the packet and use it in a DL_UNITDATA_REQ
285 	 * request.  That would be dependent on the link-layer type.
286 	 *
287 	 * I also don't know what SAP you'd have to bind the descriptor
288 	 * to, or whether you'd need separate "receive" and "send" FDs,
289 	 * nor do I know whether you'd need different bindings for
290 	 * D/I/X Ethernet and 802.3, or for {FDDI,Token Ring} plus
291 	 * 802.2 and {FDDI,Token Ring} plus 802.2 plus SNAP.
292 	 *
293 	 * So, for now, we just return a "you can't send" indication,
294 	 * and leave it up to somebody with a DLPI-based system lacking
295 	 * both DLIOCRAW and DL_HP_RAWDLS to supply code to implement
296 	 * packet transmission on that system.  If they do, they should
297 	 * send it to us - but should not send us code that assumes
298 	 * Ethernet; if the code doesn't work on non-Ethernet interfaces,
299 	 * it should check "p->linktype" and reject the send request if
300 	 * it's anything other than DLT_EN10MB.
301 	 */
302 	pcapint_strlcpy(p->errbuf, "send: Not supported on this version of this OS",
303 	    PCAP_ERRBUF_SIZE);
304 	ret = -1;
305 #endif /* raw mode */
306 	return (ret);
307 }
308 
309 #ifndef DL_IPATM
310 #define DL_IPATM	0x12	/* ATM Classical IP interface */
311 #endif
312 
313 #ifdef HAVE_SOLARIS
314 /*
315  * For SunATM.
316  */
317 #ifndef A_GET_UNITS
318 #define A_GET_UNITS	(('A'<<8)|118)
319 #endif /* A_GET_UNITS */
320 #ifndef A_PROMISCON_REQ
321 #define A_PROMISCON_REQ	(('A'<<8)|121)
322 #endif /* A_PROMISCON_REQ */
323 #endif /* HAVE_SOLARIS */
324 
325 static void
pcap_cleanup_dlpi(pcap_t * p)326 pcap_cleanup_dlpi(pcap_t *p)
327 {
328 #ifdef DL_HP_RAWDLS
329 	struct pcap_dlpi *pd = p->priv;
330 
331 	if (pd->send_fd >= 0) {
332 		close(pd->send_fd);
333 		pd->send_fd = -1;
334 	}
335 #endif
336 	pcapint_cleanup_live_common(p);
337 }
338 
339 #ifdef HAVE_DEV_DLPI
340 static int
handle_dev_dlpi_open_error(const char * ifname,int error,char * errbuf)341 handle_dev_dlpi_open_error(const char *ifname, int error, char *errbuf)
342 {
343 	/*
344 	 * An attempt to open /dev/dlpi failed.
345 	 * Report the appropriate error.
346 	 */
347 	if (error == ENOENT) {
348 		/*
349 		 * Missing; I guess that means we don't support
350 		 * opening DLPI devices, and thus can't capture
351 		 * traffic at all.
352 		 */
353 		snprintf(errbuf, PCAP_ERRBUF_SIZE,
354 		    "Capturing network traffic not supported - /dev/dlpi doesn't exist");
355 		return (PCAP_ERROR_CAPTURE_NOTSUP);
356 	} else if (error == EPERM || error == EACCES) {
357 		/*
358 		 * We lack permission to open it.
359 		 *
360 		 * If the interface exists, report the permission error,
361 		 * otherwise report "no such interface".
362 		 */
363 		int fd;
364 		struct ifreq ifr;
365 
366 		if (strlen(ifname) >= sizeof(ifr.ifr_name)) {
367 			/*
368 			 * The name is too long, so it can't possibly exist.
369 			 * Report that.
370 			 *
371 			 * There's nothing more to say, so clear
372 			 * the error message.
373 			 */
374 			errbuf[0] = '\0';
375 			return (PCAP_ERROR_NO_SUCH_DEVICE);
376 		}
377 
378 		/*
379 		 * Try to get a socket on which to do an ioctl to get the
380 		 * interface's flags.
381 		 */
382 		fd = socket(AF_INET, SOCK_DGRAM, 0);
383 		if (fd < 0) {
384 			/* That failed; report that as the error. */
385 			pcapint_fmt_errmsg_for_errno(errbuf,  PCAP_ERRBUF_SIZE,
386 			    errno, "Can't open socket to get interface flags");
387 			return (PCAP_ERROR);
388 		}
389 
390 		pcapint_strlcpy(ifr.ifr_name, ifname, sizeof(ifr.ifr_name));
391 		if (ioctl(fd, SIOCGIFFLAGS, (char *)&ifr) < 0) {
392 			if (errno == ENXIO || errno == EINVAL) {
393 				/*
394 				 * macOS, *BSD, and Solaris return one of
395 				 * those two errors if the device doesn't
396 				 * exist. Report that.
397 				 * XXX - what about HP-UX?
398 				 *
399 				 * There's nothing more to say, so clear
400 				 * the error message.
401 				 */
402 				errbuf[0] = '\0';
403 				close(fd);
404 				return (PCAP_ERROR_NO_SUCH_DEVICE);
405 			}
406 
407 			/*
408 			 * Some other error.
409 			 */
410 			pcapint_fmt_errmsg_for_errno(errbuf, PCAP_ERRBUF_SIZE,
411 			    errno, "Can't get interface flags");
412 			close(fd);
413 			return (PCAP_ERROR);
414 		}
415 
416 		/*
417 		 * The device exists; report this as a permissions problem.
418 		 */
419 		snprintf(errbuf, PCAP_ERRBUF_SIZE,
420 		    "Attempt to open /dev/dlpi failed with %s - root privilege may be required",
421 		    (error == EPERM) ? "EPERM" : "EACCES");
422 		close(fd);
423 		return (PCAP_ERROR_PERM_DENIED);
424 	} else {
425 		/*
426 		 * Soe other error.
427 		 */
428 		pcapint_fmt_errmsg_for_errno(errbuf, PCAP_ERRBUF_SIZE,
429 		    error, "Attempt to open /dev/dlpi failed");
430 		return (PCAP_ERROR);
431 	}
432 }
433 #else /* HAVE_DEV_DLPI */
434 static int
handle_dlpi_device_open_error(const char * ifname,const char * device,int error,char * errbuf)435 handle_dlpi_device_open_error(const char *ifname, const char *device,
436     int error, char *errbuf)
437 {
438 	/*
439 	 * We couldn't open a DLPI device.
440 	 * Was that due to a permission error?
441 	 */
442 	if (error == EPERM || error == EACCES) {
443 		/*
444 		 * We lack permission to open it.
445 		 *
446 		 * If the interface doesn't exist, there wouldn't be
447 		 * a DLPI device corresponding to it, so we wouldn't
448 		 * have gotten a permissions error.
449 		 */
450 		snprintf(errbuf, PCAP_ERRBUF_SIZE,
451 		    "Attempt to open %s failed with %s - root privilege may be required",
452 		    device, (error == EPERM) ? "EPERM" : "EACCES");
453 		return (PCAP_ERROR_PERM_DENIED);
454 	}
455 
456 	/*
457 	 * Was that due to the DLPI device not existing?
458 	 */
459 	if (error != ENOENT) {
460 		/*
461 		 * No; report it as a generic error, giving the error
462 		 * message for the error code and the name of the
463 		 * device we tried to open.
464 		 */
465 		pcapint_fmt_errmsg_for_errno(errbuf, PCAP_ERRBUF_SIZE,
466 		    error, "Attempt to open %s failed", device);
467 		return (PCAP_ERROR);
468 	}
469 
470 	/*
471 	 * Yes.  That means we can't do DLPI capturing, at least not
472 	 * on that interface.
473 	 *
474 	 * Test whether it exists and, if it does, whether it's
475 	 * a loopback interface.
476 	 */
477 	return (handle_nonexistent_dlpi_device(ifname, errbuf));
478 }
479 #endif /* not HAVE_DEV_DLPI */
480 
481 static int
open_dlpi_device(const char * name,u_int * ppa,char * errbuf)482 open_dlpi_device(const char *name, u_int *ppa, char *errbuf)
483 {
484 	char dname[100];
485 	char *cp, *cq;
486 	int fd;
487 #ifdef HAVE_DEV_DLPI
488 	int status;
489 	u_int unit;
490 #else
491 	char dname2[100];
492 #endif
493 
494 #ifdef HAVE_DEV_DLPI
495 	/*
496 	** Remove any "/dev/" on the front of the device.
497 	*/
498 	cp = strrchr(name, '/');
499 	if (cp == NULL)
500 		pcapint_strlcpy(dname, name, sizeof(dname));
501 	else
502 		pcapint_strlcpy(dname, cp + 1, sizeof(dname));
503 
504 	/*
505 	 * If this name has a colon followed by a number at
506 	 * the end, it's a logical interface.  Those are just
507 	 * the way you assign multiple IP addresses to a real
508 	 * interface, so an entry for a logical interface should
509 	 * be treated like the entry for the real interface;
510 	 * we do that by stripping off the ":" and the number.
511 	 */
512 	cp = strchr(dname, ':');
513 	if (cp != NULL) {
514 		/*
515 		 * We have a ":"; is it followed by a number?
516 		 */
517 		cq = cp + 1;
518 		while (PCAP_ISDIGIT(*cq))
519 			cq++;
520 		if (*cq == '\0') {
521 			/*
522 			 * All digits after the ":" until the end.
523 			 * Strip off the ":" and everything after
524 			 * it.
525 			 */
526 			*cp = '\0';
527 		}
528 	}
529 
530 	/*
531 	 * Split the device name into a device type name and a unit number;
532 	 * chop off the unit number, so "dname" is just a device type name.
533 	 */
534 	cp = split_dname(dname, &unit, errbuf);
535 	if (cp == NULL) {
536 		/*
537 		 * split_dname() has filled in the error message.
538 		 */
539 		return (PCAP_ERROR_NO_SUCH_DEVICE);
540 	}
541 	*cp = '\0';
542 
543 	/*
544 	 * Use "/dev/dlpi" as the device.
545 	 *
546 	 * XXX - HP's DLPI Programmer's Guide for HP-UX 11.00 says that
547 	 * the "dl_mjr_num" field is for the "major number of interface
548 	 * driver"; that's the major of "/dev/dlpi" on the system on
549 	 * which I tried this, but there may be DLPI devices that
550 	 * use a different driver, in which case we may need to
551 	 * search "/dev" for the appropriate device with that major
552 	 * device number, rather than hardwiring "/dev/dlpi".
553 	 */
554 	if ((fd = open("/dev/dlpi", O_RDWR)) < 0)
555 		return (handle_dev_dlpi_open_error(name, errno, errbuf));
556 
557 	/*
558 	 * Get a table of all PPAs for that device, and search that
559 	 * table for the specified device type name and unit number.
560 	 */
561 	status = get_dlpi_ppa(fd, dname, unit, ppa, errbuf);
562 	if (status < 0) {
563 		close(fd);
564 		return (status);
565 	}
566 #else
567 	/*
568 	 * If the device name begins with "/", assume it begins with
569 	 * the pathname of the directory containing the device to open;
570 	 * otherwise, concatenate the device directory name and the
571 	 * device name.
572 	 */
573 	if (*name == '/')
574 		pcapint_strlcpy(dname, name, sizeof(dname));
575 	else
576 		snprintf(dname, sizeof(dname), "%s/%s", PCAP_DEV_PREFIX,
577 		    name);
578 
579 	/*
580 	 * If this name has a colon followed by a number at
581 	 * the end, it's a logical interface.  Those are just
582 	 * the way you assign multiple IP addresses to a real
583 	 * interface, so an entry for a logical interface should
584 	 * be treated like the entry for the real interface;
585 	 * we do that by stripping off the ":" and the number.
586 	 */
587 	cp = strchr(dname, ':');
588 	if (cp != NULL) {
589 		/*
590 		 * We have a ":"; is it followed by a number?
591 		 */
592 		cq = cp + 1;
593 		while (PCAP_ISDIGIT(*cq))
594 			cq++;
595 		if (*cq == '\0') {
596 			/*
597 			 * All digits after the ":" until the end.
598 			 * Strip off the ":" and everything after
599 			 * it.
600 			 */
601 			*cp = '\0';
602 		}
603 	}
604 
605 	/*
606 	 * Get the unit number, and a pointer to the end of the device
607 	 * type name.
608 	 */
609 	cp = split_dname(dname, ppa, errbuf);
610 	if (cp == NULL) {
611 		/*
612 		 * split_dname() has filled in the error message.
613 		 */
614 		return (PCAP_ERROR_NO_SUCH_DEVICE);
615 	}
616 
617 	/*
618 	 * Make a copy of the device pathname, and then remove the unit
619 	 * number from the device pathname.
620 	 */
621 	pcapint_strlcpy(dname2, dname, sizeof(dname));
622 	*cp = '\0';
623 
624 	/* Try device without unit number */
625 	if ((fd = open(dname, O_RDWR)) < 0) {
626 		if (errno != ENOENT)
627 			return (handle_dlpi_device_open_error(name, dname,
628 			    errno, errbuf));
629 
630 		/*
631 		 * There's no DLPI device whose name is the interface
632 		 * name with the unit number removed.
633 		 *
634 		 * Try again with a device name that includes the
635 		 * unit number.
636 		 */
637 		if ((fd = open(dname2, O_RDWR)) < 0)
638 			return (handle_dlpi_device_open_error(name, dname2,
639 			    errno, errbuf));
640 		/* XXX Assume unit zero */
641 		*ppa = 0;
642 	}
643 #endif
644 	return (fd);
645 }
646 
647 static int
pcap_activate_dlpi(pcap_t * p)648 pcap_activate_dlpi(pcap_t *p)
649 {
650 #ifdef DL_HP_RAWDLS
651 	struct pcap_dlpi *pd = p->priv;
652 #endif
653 	int status = 0;
654 	int retv;
655 	u_int ppa;
656 #ifdef HAVE_SOLARIS
657 	int isatm = 0;
658 #endif
659 	register dl_info_ack_t *infop;
660 #ifdef HAVE_SYS_BUFMOD_H
661 	bpf_u_int32 ss;
662 #ifdef HAVE_SOLARIS
663 	char release[GET_RELEASE_BUFSIZE];
664 	bpf_u_int32 osmajor, osminor, osmicro;
665 #endif
666 #endif
667 	bpf_u_int32 buf[MAXDLBUF];
668 
669 	p->fd = open_dlpi_device(p->opt.device, &ppa, p->errbuf);
670 	if (p->fd < 0) {
671 		status = p->fd;
672 		goto bad;
673 	}
674 
675 #ifdef DL_HP_RAWDLS
676 	/*
677 	 * XXX - HP-UX 10.20 and 11.xx don't appear to support sending and
678 	 * receiving packets on the same descriptor - you need separate
679 	 * descriptors for sending and receiving, bound to different SAPs.
680 	 *
681 	 * If the open fails, we just leave -1 in "pd->send_fd" and reject
682 	 * attempts to send packets, just as if, in pcap-bpf.c, we fail
683 	 * to open the BPF device for reading and writing, we just try
684 	 * to open it for reading only and, if that succeeds, just let
685 	 * the send attempts fail.
686 	 */
687 	pd->send_fd = open("/dev/dlpi", O_RDWR);
688 #endif
689 
690 	/*
691 	** Attach if "style 2" provider
692 	*/
693 	if (dlinforeq(p->fd, p->errbuf) < 0 ||
694 	    dlinfoack(p->fd, (char *)buf, p->errbuf) < 0) {
695 		status = PCAP_ERROR;
696 		goto bad;
697 	}
698 	infop = &(MAKE_DL_PRIMITIVES(buf))->info_ack;
699 #ifdef HAVE_SOLARIS
700 	if (infop->dl_mac_type == DL_IPATM)
701 		isatm = 1;
702 #endif
703 	if (infop->dl_provider_style == DL_STYLE2) {
704 		retv = dl_doattach(p->fd, ppa, p->errbuf);
705 		if (retv < 0) {
706 			status = retv;
707 			goto bad;
708 		}
709 #ifdef DL_HP_RAWDLS
710 		if (pd->send_fd >= 0) {
711 			retv = dl_doattach(pd->send_fd, ppa, p->errbuf);
712 			if (retv < 0) {
713 				status = retv;
714 				goto bad;
715 			}
716 		}
717 #endif
718 	}
719 
720 	if (p->opt.rfmon) {
721 		/*
722 		 * This device exists, but we don't support monitor mode
723 		 * any platforms that support DLPI.
724 		 */
725 		status = PCAP_ERROR_RFMON_NOTSUP;
726 		goto bad;
727 	}
728 
729 #ifdef HAVE_DL_PASSIVE_REQ_T
730 	/*
731 	 * Enable Passive mode to be able to capture on aggregated link.
732 	 * Not supported in all Solaris versions.
733 	 */
734 	dlpassive(p->fd, p->errbuf);
735 #endif
736 	/*
737 	** Bind (defer if using HP-UX 9 or HP-UX 10.20 or later, totally
738 	** skip if using SINIX)
739 	*/
740 #if !defined(HAVE_HPUX9) && !defined(HAVE_HPUX10_20_OR_LATER) && !defined(sinix)
741 #ifdef _AIX
742 	/*
743 	** AIX.
744 	** According to IBM's AIX Support Line, the dl_sap value
745 	** should not be less than 0x600 (1536) for standard Ethernet.
746 	** However, we seem to get DL_BADADDR - "DLSAP addr in improper
747 	** format or invalid" - errors if we use 1537 on the "tr0"
748 	** device, which, given that its name starts with "tr" and that
749 	** it's IBM, probably means a Token Ring device.  (Perhaps we
750 	** need to use 1537 on "/dev/dlpi/en" because that device is for
751 	** D/I/X Ethernet, the "SAP" is actually an Ethernet type, and
752 	** it rejects invalid Ethernet types.)
753 	**
754 	** So if 1537 fails, we try 2, as Hyung Sik Yoon of IBM Korea
755 	** says that works on Token Ring (he says that 0 does *not*
756 	** work; perhaps that's considered an invalid LLC SAP value - I
757 	** assume the SAP value in a DLPI bind is an LLC SAP for network
758 	** types that use 802.2 LLC).
759 	*/
760 	if ((dlbindreq(p->fd, 1537, p->errbuf) < 0 &&
761 	     dlbindreq(p->fd, 2, p->errbuf) < 0) ||
762 	     dlbindack(p->fd, (char *)buf, p->errbuf, NULL) < 0) {
763 		status = PCAP_ERROR;
764 		goto bad;
765 	}
766 #elif defined(DL_HP_RAWDLS)
767 	/*
768 	** HP-UX 10.0x and 10.1x.
769 	*/
770 	if (dl_dohpuxbind(p->fd, p->errbuf) < 0) {
771 		status = PCAP_ERROR;
772 		goto bad;
773 	}
774 	if (pd->send_fd >= 0) {
775 		/*
776 		** XXX - if this fails, just close send_fd and
777 		** set it to -1, so that you can't send but can
778 		** still receive?
779 		*/
780 		if (dl_dohpuxbind(pd->send_fd, p->errbuf) < 0) {
781 			status = PCAP_ERROR;
782 			goto bad;
783 		}
784 	}
785 #else /* neither AIX nor HP-UX */
786 	/*
787 	** Not Sinix, and neither AIX nor HP-UX - Solaris, and any other
788 	** OS using DLPI.
789 	**/
790 	if (dlbindreq(p->fd, 0, p->errbuf) < 0 ||
791 	    dlbindack(p->fd, (char *)buf, p->errbuf, NULL) < 0) {
792 		status = PCAP_ERROR;
793 		goto bad;
794 	}
795 #endif /* AIX vs. HP-UX vs. other */
796 #endif /* !HP-UX 9 and !HP-UX 10.20 or later and !SINIX */
797 
798 	/*
799 	 * Turn a negative snapshot value (invalid), a snapshot value of
800 	 * 0 (unspecified), or a value bigger than the normal maximum
801 	 * value, into the maximum allowed value.
802 	 *
803 	 * If some application really *needs* a bigger snapshot
804 	 * length, we should just increase MAXIMUM_SNAPLEN.
805 	 */
806 	if (p->snapshot <= 0 || p->snapshot > MAXIMUM_SNAPLEN)
807 		p->snapshot = MAXIMUM_SNAPLEN;
808 
809 #ifdef HAVE_SOLARIS
810 	if (isatm) {
811 		/*
812 		** Have to turn on some special ATM promiscuous mode
813 		** for SunATM.
814 		** Do *NOT* turn regular promiscuous mode on; it doesn't
815 		** help, and may break things.
816 		*/
817 		if (strioctl(p->fd, A_PROMISCON_REQ, 0, NULL) < 0) {
818 			status = PCAP_ERROR;
819 			pcapint_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE,
820 			    errno, "A_PROMISCON_REQ");
821 			goto bad;
822 		}
823 	} else
824 #endif
825 	if (p->opt.promisc) {
826 		/*
827 		** Enable promiscuous (not necessary on send FD)
828 		*/
829 		retv = dlpromiscon(p, DL_PROMISC_PHYS);
830 		if (retv < 0) {
831 			if (retv == PCAP_ERROR_PERM_DENIED)
832 				status = PCAP_ERROR_PROMISC_PERM_DENIED;
833 			else
834 				status = retv;
835 			goto bad;
836 		}
837 
838 		/*
839 		** Try to enable multicast (you would have thought
840 		** promiscuous would be sufficient). (Skip if using
841 		** HP-UX or SINIX) (Not necessary on send FD)
842 		*/
843 #if !defined(__hpux) && !defined(sinix)
844 		retv = dlpromiscon(p, DL_PROMISC_MULTI);
845 		if (retv < 0)
846 			status = PCAP_WARNING;
847 #endif
848 	}
849 	/*
850 	** Try to enable SAP promiscuity (when not in promiscuous mode
851 	** when using HP-UX, when not doing SunATM on Solaris, and never
852 	** under SINIX) (Not necessary on send FD)
853 	*/
854 #ifndef sinix
855 #if defined(__hpux)
856 	/* HP-UX - only do this when not in promiscuous mode */
857 	if (!p->opt.promisc) {
858 #elif defined(HAVE_SOLARIS)
859 	/* Solaris - don't do this on SunATM devices */
860 	if (!isatm) {
861 #else
862 	/* Everything else (except for SINIX) - always do this */
863 	{
864 #endif
865 		retv = dlpromiscon(p, DL_PROMISC_SAP);
866 		if (retv < 0) {
867 			if (p->opt.promisc) {
868 				/*
869 				 * Not fatal, since the DL_PROMISC_PHYS mode
870 				 * worked.
871 				 *
872 				 * Report it as a warning, however.
873 				 */
874 				status = PCAP_WARNING;
875 			} else {
876 				/*
877 				 * Fatal.
878 				 */
879 				status = retv;
880 				goto bad;
881 			}
882 		}
883 	}
884 #endif /* sinix */
885 
886 	/*
887 	** HP-UX 9, and HP-UX 10.20 or later, must bind after setting
888 	** promiscuous options.
889 	*/
890 #if defined(HAVE_HPUX9) || defined(HAVE_HPUX10_20_OR_LATER)
891 	if (dl_dohpuxbind(p->fd, p->errbuf) < 0) {
892 		status = PCAP_ERROR;
893 		goto bad;
894 	}
895 	/*
896 	** We don't set promiscuous mode on the send FD, but we'll defer
897 	** binding it anyway, just to keep the HP-UX 9/10.20 or later
898 	** code together.
899 	*/
900 	if (pd->send_fd >= 0) {
901 		/*
902 		** XXX - if this fails, just close send_fd and
903 		** set it to -1, so that you can't send but can
904 		** still receive?
905 		*/
906 		if (dl_dohpuxbind(pd->send_fd, p->errbuf) < 0) {
907 			status = PCAP_ERROR;
908 			goto bad;
909 		}
910 	}
911 #endif
912 
913 	/*
914 	** Determine link type
915 	** XXX - get SAP length and address length as well, for use
916 	** when sending packets.
917 	*/
918 	if (dlinforeq(p->fd, p->errbuf) < 0 ||
919 	    dlinfoack(p->fd, (char *)buf, p->errbuf) < 0) {
920 		status = PCAP_ERROR;
921 		goto bad;
922 	}
923 
924 	infop = &(MAKE_DL_PRIMITIVES(buf))->info_ack;
925 	if (pcap_process_mactype(p, infop->dl_mac_type) != 0) {
926 		status = PCAP_ERROR;
927 		goto bad;
928 	}
929 
930 #ifdef	DLIOCRAW
931 	/*
932 	** This is a non standard SunOS hack to get the full raw link-layer
933 	** header.
934 	*/
935 	if (strioctl(p->fd, DLIOCRAW, 0, NULL) < 0) {
936 		status = PCAP_ERROR;
937 		pcapint_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE,
938 		    errno, "DLIOCRAW");
939 		goto bad;
940 	}
941 #endif
942 
943 #ifdef HAVE_SYS_BUFMOD_H
944 	ss = p->snapshot;
945 
946 	/*
947 	** There is a bug in bufmod(7). When dealing with messages of
948 	** less than snaplen size it strips data from the beginning not
949 	** the end.
950 	**
951 	** This bug is fixed in 5.3.2. Also, there is a patch available.
952 	** Ask for bugid 1149065.
953 	*/
954 #ifdef HAVE_SOLARIS
955 	get_release(release, sizeof (release), &osmajor, &osminor, &osmicro);
956 	if (osmajor == 5 && (osminor <= 2 || (osminor == 3 && osmicro < 2)) &&
957 	    getenv("BUFMOD_FIXED") == NULL) {
958 		snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
959 		"WARNING: bufmod is broken in SunOS %s; ignoring snaplen.",
960 		    release);
961 		ss = 0;
962 		status = PCAP_WARNING;
963 	}
964 #endif
965 
966 	/* Push and configure bufmod. */
967 	if (pcap_conf_bufmod(p, ss) != 0) {
968 		status = PCAP_ERROR;
969 		goto bad;
970 	}
971 #endif
972 
973 	/*
974 	** As the last operation flush the read side.
975 	*/
976 	if (ioctl(p->fd, I_FLUSH, FLUSHR) != 0) {
977 		status = PCAP_ERROR;
978 		pcapint_fmt_errmsg_for_errno(p->errbuf, PCAP_ERRBUF_SIZE,
979 		    errno, "FLUSHR");
980 		goto bad;
981 	}
982 
983 	/* Allocate data buffer. */
984 	if (pcap_alloc_databuf(p) != 0) {
985 		status = PCAP_ERROR;
986 		goto bad;
987 	}
988 
989 	/*
990 	 * Success.
991 	 *
992 	 * "p->fd" is an FD for a STREAMS device, so "select()" and
993 	 * "poll()" should work on it.
994 	 */
995 	p->selectable_fd = p->fd;
996 
997 	p->read_op = pcap_read_dlpi;
998 	p->inject_op = pcap_inject_dlpi;
999 	p->setfilter_op = pcapint_install_bpf_program;	/* no kernel filtering */
1000 	p->setdirection_op = NULL;	/* Not implemented.*/
1001 	p->set_datalink_op = NULL;	/* can't change data link type */
1002 	p->getnonblock_op = pcapint_getnonblock_fd;
1003 	p->setnonblock_op = pcapint_setnonblock_fd;
1004 	p->stats_op = pcap_stats_dlpi;
1005 	p->cleanup_op = pcap_cleanup_dlpi;
1006 
1007 	return (status);
1008 bad:
1009 	pcap_cleanup_dlpi(p);
1010 	return (status);
1011 }
1012 
1013 /*
1014  * Split a device name into a device type name and a unit number;
1015  * return the a pointer to the beginning of the unit number, which
1016  * is the end of the device type name, and set "*unitp" to the unit
1017  * number.
1018  *
1019  * Returns NULL on error, and fills "ebuf" with an error message.
1020  */
1021 static char *
1022 split_dname(char *device, u_int *unitp, char *ebuf)
1023 {
1024 	char *cp;
1025 	char *eos;
1026 	long unit;
1027 
1028 	/*
1029 	 * Look for a number at the end of the device name string.
1030 	 */
1031 	cp = device + strlen(device) - 1;
1032 	if (*cp < '0' || *cp > '9') {
1033 		snprintf(ebuf, PCAP_ERRBUF_SIZE, "%s missing unit number",
1034 		    device);
1035 		return (NULL);
1036 	}
1037 
1038 	/* Digits at end of string are unit number */
1039 	while (cp-1 >= device && *(cp-1) >= '0' && *(cp-1) <= '9')
1040 		cp--;
1041 	if (cp == device || *(cp-1) == '/') {
1042 		snprintf(ebuf, PCAP_ERRBUF_SIZE, "%s has only a unit number",
1043 		    device);
1044 		return (NULL);
1045 	}
1046 
1047 	errno = 0;
1048 	unit = strtol(cp, &eos, 10);
1049 	if (*eos != '\0') {
1050 		snprintf(ebuf, PCAP_ERRBUF_SIZE, "%s bad unit number", device);
1051 		return (NULL);
1052 	}
1053 	if (errno == ERANGE || unit > INT_MAX) {
1054 		snprintf(ebuf, PCAP_ERRBUF_SIZE, "%s unit number too large",
1055 		    device);
1056 		return (NULL);
1057 	}
1058 	if (unit < 0) {
1059 		snprintf(ebuf, PCAP_ERRBUF_SIZE, "%s unit number is negative",
1060 		    device);
1061 		return (NULL);
1062 	}
1063 	*unitp = (u_int)unit;
1064 	return (cp);
1065 }
1066 
1067 static int
1068 dl_doattach(int fd, int ppa, char *ebuf)
1069 {
1070 	dl_attach_req_t	req;
1071 	bpf_u_int32 buf[MAXDLBUF];
1072 	int err;
1073 
1074 	req.dl_primitive = DL_ATTACH_REQ;
1075 	req.dl_ppa = ppa;
1076 	if (send_request(fd, (char *)&req, sizeof(req), "attach", ebuf) < 0)
1077 		return (PCAP_ERROR);
1078 
1079 	err = dlokack(fd, "attach", (char *)buf, ebuf, NULL);
1080 	if (err < 0)
1081 		return (err);
1082 	return (0);
1083 }
1084 
1085 #ifdef DL_HP_RAWDLS
1086 static int
1087 dl_dohpuxbind(int fd, char *ebuf)
1088 {
1089 	int hpsap;
1090 	int uerror;
1091 	bpf_u_int32 buf[MAXDLBUF];
1092 
1093 	/*
1094 	 * XXX - we start at 22 because we used to use only 22, but
1095 	 * that was just because that was the value used in some
1096 	 * sample code from HP.  With what value *should* we start?
1097 	 * Does it matter, given that we're enabling SAP promiscuity
1098 	 * on the input FD?
1099 	 */
1100 	hpsap = 22;
1101 	for (;;) {
1102 		if (dlbindreq(fd, hpsap, ebuf) < 0)
1103 			return (-1);
1104 		if (dlbindack(fd, (char *)buf, ebuf, &uerror) >= 0)
1105 			break;
1106 		/*
1107 		 * For any error other than a UNIX EBUSY, give up.
1108 		 */
1109 		if (uerror != EBUSY) {
1110 			/*
1111 			 * dlbindack() has already filled in ebuf for
1112 			 * this error.
1113 			 */
1114 			return (-1);
1115 		}
1116 
1117 		/*
1118 		 * For EBUSY, try the next SAP value; that means that
1119 		 * somebody else is using that SAP.  Clear ebuf so
1120 		 * that application doesn't report the "Device busy"
1121 		 * error as a warning.
1122 		 */
1123 		*ebuf = '\0';
1124 		hpsap++;
1125 		if (hpsap > 100) {
1126 			pcapint_strlcpy(ebuf,
1127 			    "All SAPs from 22 through 100 are in use",
1128 			    PCAP_ERRBUF_SIZE);
1129 			return (-1);
1130 		}
1131 	}
1132 	return (0);
1133 }
1134 #endif
1135 
1136 #define STRINGIFY(n)	#n
1137 
1138 static int
1139 dlpromiscon(pcap_t *p, bpf_u_int32 level)
1140 {
1141 	dl_promiscon_req_t req;
1142 	bpf_u_int32 buf[MAXDLBUF];
1143 	int err;
1144 	int uerror;
1145 
1146 	req.dl_primitive = DL_PROMISCON_REQ;
1147 	req.dl_level = level;
1148 	if (send_request(p->fd, (char *)&req, sizeof(req), "promiscon",
1149 	    p->errbuf) < 0)
1150 		return (PCAP_ERROR);
1151 	err = dlokack(p->fd, "promiscon" STRINGIFY(level), (char *)buf,
1152 	    p->errbuf, &uerror);
1153 	if (err < 0) {
1154 		if (err == PCAP_ERROR_PERM_DENIED) {
1155 			snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
1156 			    "Attempt to set promiscuous mode failed with %s - root privilege may be required",
1157 			    (uerror == EPERM) ? "EPERM" : "EACCES");
1158 			err = PCAP_ERROR_PROMISC_PERM_DENIED;
1159 		}
1160 		return (err);
1161 	}
1162 	return (0);
1163 }
1164 
1165 /*
1166  * Show all interfaces, so users don't ask "why is this interface not
1167  * showing up?" or "why are no interfaces showing up?"  We report
1168  * PCAP_ERROR_CAPTURE_NOTSUP if there's no DLPI device, with an
1169  * error message that tries to explain the source of the problem,
1170  * which is some flavor of "sorry, that's simply not supported by
1171  * your OS".
1172  */
1173 static int
1174 show_them_all(const char *name _U_)
1175 {
1176 	return (1);
1177 }
1178 
1179 static int
1180 get_if_flags(const char *name _U_, bpf_u_int32 *flags _U_, char *errbuf _U_)
1181 {
1182 	/*
1183 	 * Nothing we can do other than mark loopback devices as "the
1184 	 * connected/disconnected status doesn't apply".
1185 	 *
1186 	 * XXX - on Solaris, can we do what the dladm command does,
1187 	 * i.e. get a connected/disconnected indication from a kstat?
1188 	 * (Note that you can also get the link speed, and possibly
1189 	 * other information, from a kstat as well.)
1190 	 */
1191 	if (*flags & PCAP_IF_LOOPBACK) {
1192 		/*
1193 		 * Loopback devices aren't wireless, and "connected"/
1194 		 * "disconnected" doesn't apply to them.
1195 		 */
1196 		*flags |= PCAP_IF_CONNECTION_STATUS_NOT_APPLICABLE;
1197 		return (0);
1198 	}
1199 	return (0);
1200 }
1201 
1202 int
1203 pcapint_platform_finddevs(pcap_if_list_t *devlistp, char *errbuf)
1204 {
1205 #ifdef HAVE_SOLARIS
1206 	int fd;
1207 	union {
1208 		u_int nunits;
1209 		char pad[516];	/* XXX - must be at least 513; is 516
1210 				   in "atmgetunits" */
1211 	} buf;
1212 	char baname[2+1+1];
1213 	u_int i;
1214 #endif
1215 
1216 	/*
1217 	 * Get the list of regular interfaces first.
1218 	 */
1219 	if (pcapint_findalldevs_interfaces(devlistp, errbuf, show_them_all,
1220 	    get_if_flags) == -1)
1221 		return (-1);	/* failure */
1222 
1223 #ifdef HAVE_SOLARIS
1224 	/*
1225 	 * We may have to do special magic to get ATM devices.
1226 	 */
1227 	if ((fd = open("/dev/ba", O_RDWR)) < 0) {
1228 		/*
1229 		 * We couldn't open the "ba" device.
1230 		 * For now, just give up; perhaps we should
1231 		 * return an error if the problem is neither
1232 		 * a "that device doesn't exist" error (ENOENT,
1233 		 * ENXIO, etc.) or a "you're not allowed to do
1234 		 * that" error (EPERM, EACCES).
1235 		 */
1236 		return (0);
1237 	}
1238 
1239 	if (strioctl(fd, A_GET_UNITS, sizeof(buf), (char *)&buf) < 0) {
1240 		pcapint_fmt_errmsg_for_errno(errbuf, PCAP_ERRBUF_SIZE,
1241 		    errno, "A_GET_UNITS");
1242 		return (-1);
1243 	}
1244 	for (i = 0; i < buf.nunits; i++) {
1245 		snprintf(baname, sizeof baname, "ba%u", i);
1246 		/*
1247 		 * XXX - is there a notion of "up" and "running"?
1248 		 * And is there a way to determine whether the
1249 		 * interface is plugged into a network?
1250 		 */
1251 		if (pcapint_add_dev(devlistp, baname, 0, NULL, errbuf) == NULL)
1252 			return (-1);
1253 	}
1254 #endif
1255 
1256 	return (0);
1257 }
1258 
1259 static int
1260 send_request(int fd, char *ptr, int len, char *what, char *ebuf)
1261 {
1262 	struct	strbuf	ctl;
1263 	int	flags;
1264 
1265 	ctl.maxlen = 0;
1266 	ctl.len = len;
1267 	ctl.buf = ptr;
1268 
1269 	flags = 0;
1270 	if (putmsg(fd, &ctl, (struct strbuf *) NULL, flags) < 0) {
1271 		pcapint_fmt_errmsg_for_errno(ebuf, PCAP_ERRBUF_SIZE,
1272 		    errno, "send_request: putmsg \"%s\"", what);
1273 		return (-1);
1274 	}
1275 	return (0);
1276 }
1277 
1278 static int
1279 recv_ack(int fd, int size, const char *what, char *bufp, char *ebuf, int *uerror)
1280 {
1281 	union	DL_primitives	*dlp;
1282 	struct	strbuf	ctl;
1283 	int	flags;
1284 	char	errmsgbuf[PCAP_ERRBUF_SIZE];
1285 	char	dlprimbuf[64];
1286 
1287 	/*
1288 	 * Clear out "*uerror", so it's only set for DL_ERROR_ACK/DL_SYSERR,
1289 	 * making that the only place where EBUSY is treated specially.
1290 	 */
1291 	if (uerror != NULL)
1292 		*uerror = 0;
1293 
1294 	ctl.maxlen = MAXDLBUF;
1295 	ctl.len = 0;
1296 	ctl.buf = bufp;
1297 
1298 	flags = 0;
1299 	if (getmsg(fd, &ctl, (struct strbuf*)NULL, &flags) < 0) {
1300 		pcapint_fmt_errmsg_for_errno(ebuf, PCAP_ERRBUF_SIZE,
1301 		    errno, "recv_ack: %s getmsg", what);
1302 		return (PCAP_ERROR);
1303 	}
1304 
1305 	dlp = MAKE_DL_PRIMITIVES(ctl.buf);
1306 	switch (dlp->dl_primitive) {
1307 
1308 	case DL_INFO_ACK:
1309 	case DL_BIND_ACK:
1310 	case DL_OK_ACK:
1311 #ifdef DL_HP_PPA_ACK
1312 	case DL_HP_PPA_ACK:
1313 #endif
1314 		/* These are OK */
1315 		break;
1316 
1317 	case DL_ERROR_ACK:
1318 		switch (dlp->error_ack.dl_errno) {
1319 
1320 		case DL_SYSERR:
1321 			if (uerror != NULL)
1322 				*uerror = dlp->error_ack.dl_unix_errno;
1323 			pcapint_fmt_errmsg_for_errno(ebuf, PCAP_ERRBUF_SIZE,
1324 			    dlp->error_ack.dl_unix_errno,
1325 			    "recv_ack: %s: UNIX error", what);
1326 			if (dlp->error_ack.dl_unix_errno == EPERM ||
1327 			    dlp->error_ack.dl_unix_errno == EACCES)
1328 				return (PCAP_ERROR_PERM_DENIED);
1329 			break;
1330 
1331 		default:
1332 			/*
1333 			 * Neither EPERM nor EACCES.
1334 			 */
1335 			snprintf(ebuf, PCAP_ERRBUF_SIZE,
1336 			    "recv_ack: %s: %s", what,
1337 			    dlstrerror(errmsgbuf, sizeof (errmsgbuf), dlp->error_ack.dl_errno));
1338 			if (dlp->error_ack.dl_errno == DL_BADPPA)
1339 				return (PCAP_ERROR_NO_SUCH_DEVICE);
1340 			else if (dlp->error_ack.dl_errno == DL_ACCESS)
1341 				return (PCAP_ERROR_PERM_DENIED);
1342 			break;
1343 		}
1344 		return (PCAP_ERROR);
1345 
1346 	default:
1347 		snprintf(ebuf, PCAP_ERRBUF_SIZE,
1348 		    "recv_ack: %s: Unexpected primitive ack %s",
1349 		    what, dlprim(dlprimbuf, sizeof (dlprimbuf), dlp->dl_primitive));
1350 		return (PCAP_ERROR);
1351 	}
1352 
1353 	if (ctl.len < size) {
1354 		snprintf(ebuf, PCAP_ERRBUF_SIZE,
1355 		    "recv_ack: %s: Ack too small (%d < %d)",
1356 		    what, ctl.len, size);
1357 		return (PCAP_ERROR);
1358 	}
1359 	return (ctl.len);
1360 }
1361 
1362 static char *
1363 dlstrerror(char *errbuf, size_t errbufsize, bpf_u_int32 dl_errno)
1364 {
1365 	switch (dl_errno) {
1366 
1367 	case DL_ACCESS:
1368 		return ("Improper permissions for request");
1369 
1370 	case DL_BADADDR:
1371 		return ("DLSAP addr in improper format or invalid");
1372 
1373 	case DL_BADCORR:
1374 		return ("Seq number not from outstand DL_CONN_IND");
1375 
1376 	case DL_BADDATA:
1377 		return ("User data exceeded provider limit");
1378 
1379 	case DL_BADPPA:
1380 #ifdef HAVE_DEV_DLPI
1381 		/*
1382 		 * With a single "/dev/dlpi" device used for all
1383 		 * DLPI providers, PPAs have nothing to do with
1384 		 * unit numbers.
1385 		 */
1386 		return ("Specified PPA was invalid");
1387 #else
1388 		/*
1389 		 * We have separate devices for separate devices;
1390 		 * the PPA is just the unit number.
1391 		 */
1392 		return ("Specified PPA (device unit) was invalid");
1393 #endif
1394 
1395 	case DL_BADPRIM:
1396 		return ("Primitive received not known by provider");
1397 
1398 	case DL_BADQOSPARAM:
1399 		return ("QOS parameters contained invalid values");
1400 
1401 	case DL_BADQOSTYPE:
1402 		return ("QOS structure type is unknown/unsupported");
1403 
1404 	case DL_BADSAP:
1405 		return ("Bad LSAP selector");
1406 
1407 	case DL_BADTOKEN:
1408 		return ("Token used not an active stream");
1409 
1410 	case DL_BOUND:
1411 		return ("Attempted second bind with dl_max_conind");
1412 
1413 	case DL_INITFAILED:
1414 		return ("Physical link initialization failed");
1415 
1416 	case DL_NOADDR:
1417 		return ("Provider couldn't allocate alternate address");
1418 
1419 	case DL_NOTINIT:
1420 		return ("Physical link not initialized");
1421 
1422 	case DL_OUTSTATE:
1423 		return ("Primitive issued in improper state");
1424 
1425 	case DL_SYSERR:
1426 		return ("UNIX system error occurred");
1427 
1428 	case DL_UNSUPPORTED:
1429 		return ("Requested service not supplied by provider");
1430 
1431 	case DL_UNDELIVERABLE:
1432 		return ("Previous data unit could not be delivered");
1433 
1434 	case DL_NOTSUPPORTED:
1435 		return ("Primitive is known but not supported");
1436 
1437 	case DL_TOOMANY:
1438 		return ("Limit exceeded");
1439 
1440 	case DL_NOTENAB:
1441 		return ("Promiscuous mode not enabled");
1442 
1443 	case DL_BUSY:
1444 		return ("Other streams for PPA in post-attached");
1445 
1446 	case DL_NOAUTO:
1447 		return ("Automatic handling XID&TEST not supported");
1448 
1449 	case DL_NOXIDAUTO:
1450 		return ("Automatic handling of XID not supported");
1451 
1452 	case DL_NOTESTAUTO:
1453 		return ("Automatic handling of TEST not supported");
1454 
1455 	case DL_XIDAUTO:
1456 		return ("Automatic handling of XID response");
1457 
1458 	case DL_TESTAUTO:
1459 		return ("Automatic handling of TEST response");
1460 
1461 	case DL_PENDING:
1462 		return ("Pending outstanding connect indications");
1463 
1464 	default:
1465 		snprintf(errbuf, errbufsize, "Error %02x", dl_errno);
1466 		return (errbuf);
1467 	}
1468 }
1469 
1470 static char *
1471 dlprim(char *primbuf, size_t primbufsize, bpf_u_int32 prim)
1472 {
1473 	switch (prim) {
1474 
1475 	case DL_INFO_REQ:
1476 		return ("DL_INFO_REQ");
1477 
1478 	case DL_INFO_ACK:
1479 		return ("DL_INFO_ACK");
1480 
1481 	case DL_ATTACH_REQ:
1482 		return ("DL_ATTACH_REQ");
1483 
1484 	case DL_DETACH_REQ:
1485 		return ("DL_DETACH_REQ");
1486 
1487 	case DL_BIND_REQ:
1488 		return ("DL_BIND_REQ");
1489 
1490 	case DL_BIND_ACK:
1491 		return ("DL_BIND_ACK");
1492 
1493 	case DL_UNBIND_REQ:
1494 		return ("DL_UNBIND_REQ");
1495 
1496 	case DL_OK_ACK:
1497 		return ("DL_OK_ACK");
1498 
1499 	case DL_ERROR_ACK:
1500 		return ("DL_ERROR_ACK");
1501 
1502 	case DL_SUBS_BIND_REQ:
1503 		return ("DL_SUBS_BIND_REQ");
1504 
1505 	case DL_SUBS_BIND_ACK:
1506 		return ("DL_SUBS_BIND_ACK");
1507 
1508 	case DL_UNITDATA_REQ:
1509 		return ("DL_UNITDATA_REQ");
1510 
1511 	case DL_UNITDATA_IND:
1512 		return ("DL_UNITDATA_IND");
1513 
1514 	case DL_UDERROR_IND:
1515 		return ("DL_UDERROR_IND");
1516 
1517 	case DL_UDQOS_REQ:
1518 		return ("DL_UDQOS_REQ");
1519 
1520 	case DL_CONNECT_REQ:
1521 		return ("DL_CONNECT_REQ");
1522 
1523 	case DL_CONNECT_IND:
1524 		return ("DL_CONNECT_IND");
1525 
1526 	case DL_CONNECT_RES:
1527 		return ("DL_CONNECT_RES");
1528 
1529 	case DL_CONNECT_CON:
1530 		return ("DL_CONNECT_CON");
1531 
1532 	case DL_TOKEN_REQ:
1533 		return ("DL_TOKEN_REQ");
1534 
1535 	case DL_TOKEN_ACK:
1536 		return ("DL_TOKEN_ACK");
1537 
1538 	case DL_DISCONNECT_REQ:
1539 		return ("DL_DISCONNECT_REQ");
1540 
1541 	case DL_DISCONNECT_IND:
1542 		return ("DL_DISCONNECT_IND");
1543 
1544 	case DL_RESET_REQ:
1545 		return ("DL_RESET_REQ");
1546 
1547 	case DL_RESET_IND:
1548 		return ("DL_RESET_IND");
1549 
1550 	case DL_RESET_RES:
1551 		return ("DL_RESET_RES");
1552 
1553 	case DL_RESET_CON:
1554 		return ("DL_RESET_CON");
1555 
1556 	default:
1557 		snprintf(primbuf, primbufsize, "unknown primitive 0x%x",
1558 		    prim);
1559 		return (primbuf);
1560 	}
1561 }
1562 
1563 static int
1564 dlbindreq(int fd, bpf_u_int32 sap, char *ebuf)
1565 {
1566 
1567 	dl_bind_req_t	req;
1568 
1569 	memset((char *)&req, 0, sizeof(req));
1570 	req.dl_primitive = DL_BIND_REQ;
1571 	/* XXX - what if neither of these are defined? */
1572 #if defined(DL_HP_RAWDLS)
1573 	req.dl_max_conind = 1;			/* XXX magic number */
1574 	req.dl_service_mode = DL_HP_RAWDLS;
1575 #elif defined(DL_CLDLS)
1576 	req.dl_service_mode = DL_CLDLS;
1577 #endif
1578 	req.dl_sap = sap;
1579 
1580 	return (send_request(fd, (char *)&req, sizeof(req), "bind", ebuf));
1581 }
1582 
1583 static int
1584 dlbindack(int fd, char *bufp, char *ebuf, int *uerror)
1585 {
1586 
1587 	return (recv_ack(fd, DL_BIND_ACK_SIZE, "bind", bufp, ebuf, uerror));
1588 }
1589 
1590 static int
1591 dlokack(int fd, const char *what, char *bufp, char *ebuf, int *uerror)
1592 {
1593 
1594 	return (recv_ack(fd, DL_OK_ACK_SIZE, what, bufp, ebuf, uerror));
1595 }
1596 
1597 
1598 static int
1599 dlinforeq(int fd, char *ebuf)
1600 {
1601 	dl_info_req_t req;
1602 
1603 	req.dl_primitive = DL_INFO_REQ;
1604 
1605 	return (send_request(fd, (char *)&req, sizeof(req), "info", ebuf));
1606 }
1607 
1608 static int
1609 dlinfoack(int fd, char *bufp, char *ebuf)
1610 {
1611 
1612 	return (recv_ack(fd, DL_INFO_ACK_SIZE, "info", bufp, ebuf, NULL));
1613 }
1614 
1615 #ifdef HAVE_DL_PASSIVE_REQ_T
1616 /*
1617  * Enable DLPI passive mode. We do not care if this request fails, as this
1618  * indicates the underlying DLPI device does not support link aggregation.
1619  */
1620 static void
1621 dlpassive(int fd, char *ebuf)
1622 {
1623 	dl_passive_req_t req;
1624 	bpf_u_int32 buf[MAXDLBUF];
1625 
1626 	req.dl_primitive = DL_PASSIVE_REQ;
1627 
1628 	if (send_request(fd, (char *)&req, sizeof(req), "dlpassive", ebuf) == 0)
1629 	    (void) dlokack(fd, "dlpassive", (char *)buf, ebuf, NULL);
1630 }
1631 #endif
1632 
1633 #ifdef DL_HP_RAWDLS
1634 /*
1635  * There's an ack *if* there's an error.
1636  */
1637 static int
1638 dlrawdatareq(int fd, const u_char *datap, int datalen)
1639 {
1640 	struct strbuf ctl, data;
1641 	long buf[MAXDLBUF];	/* XXX - char? */
1642 	union DL_primitives *dlp;
1643 	int dlen;
1644 
1645 	dlp = MAKE_DL_PRIMITIVES(buf);
1646 
1647 	dlp->dl_primitive = DL_HP_RAWDATA_REQ;
1648 	dlen = DL_HP_RAWDATA_REQ_SIZE;
1649 
1650 	/*
1651 	 * HP's documentation doesn't appear to show us supplying any
1652 	 * address pointed to by the control part of the message.
1653 	 * I think that's what raw mode means - you just send the raw
1654 	 * packet, you don't specify where to send it to, as that's
1655 	 * implied by the destination address.
1656 	 */
1657 	ctl.maxlen = 0;
1658 	ctl.len = dlen;
1659 	ctl.buf = (void *)buf;
1660 
1661 	data.maxlen = 0;
1662 	data.len = datalen;
1663 	data.buf = (void *)datap;
1664 
1665 	return (putmsg(fd, &ctl, &data, 0));
1666 }
1667 #endif /* DL_HP_RAWDLS */
1668 
1669 #if defined(HAVE_SOLARIS) && defined(HAVE_SYS_BUFMOD_H)
1670 static void
1671 get_release(char *buf, size_t bufsize, bpf_u_int32 *majorp,
1672     bpf_u_int32 *minorp, bpf_u_int32 *microp)
1673 {
1674 	char *cp;
1675 
1676 	*majorp = 0;
1677 	*minorp = 0;
1678 	*microp = 0;
1679 	if (sysinfo(SI_RELEASE, buf, bufsize) < 0) {
1680 		pcapint_strlcpy(buf, "?", bufsize);
1681 		return;
1682 	}
1683 	cp = buf;
1684 	if (!PCAP_ISDIGIT((unsigned char)*cp))
1685 		return;
1686 	*majorp = strtol(cp, &cp, 10);
1687 	if (*cp++ != '.')
1688 		return;
1689 	*minorp =  strtol(cp, &cp, 10);
1690 	if (*cp++ != '.')
1691 		return;
1692 	*microp =  strtol(cp, &cp, 10);
1693 }
1694 #endif
1695 
1696 #ifdef DL_HP_PPA_REQ
1697 /*
1698  * Under HP-UX 10 and HP-UX 11, we can ask for the ppa
1699  */
1700 
1701 
1702 /*
1703  * Determine ppa number that specifies ifname.
1704  *
1705  * If the "dl_hp_ppa_info_t" doesn't have a "dl_module_id_1" member,
1706  * the code that's used here is the old code for HP-UX 10.x.
1707  *
1708  * However, HP-UX 10.20, at least, appears to have such a member
1709  * in its "dl_hp_ppa_info_t" structure, so the new code is used.
1710  * The new code didn't work on an old 10.20 system on which Rick
1711  * Jones of HP tried it, but with later patches installed, it
1712  * worked - it appears that the older system had those members but
1713  * didn't put anything in them, so, if the search by name fails, we
1714  * do the old search.
1715  *
1716  * Rick suggests that making sure your system is "up on the latest
1717  * lancommon/DLPI/driver patches" is probably a good idea; it'd fix
1718  * that problem, as well as allowing libpcap to see packets sent
1719  * from the system on which the libpcap application is being run.
1720  * (On 10.20, in addition to getting the latest patches, you need
1721  * to turn the kernel "lanc_outbound_promisc_flag" flag on with ADB;
1722  * a posting to "comp.sys.hp.hpux" at
1723  *
1724  *	http://www.deja.com/[ST_rn=ps]/getdoc.xp?AN=558092266
1725  *
1726  * says that, to see the machine's outgoing traffic, you'd need to
1727  * apply the right patches to your system, and also set that variable
1728  * with:
1729 
1730 echo 'lanc_outbound_promisc_flag/W1' | /usr/bin/adb -w /stand/vmunix /dev/kmem
1731 
1732  * which could be put in, for example, "/sbin/init.d/lan".
1733  *
1734  * Setting the variable is not necessary on HP-UX 11.x.
1735  */
1736 static int
1737 get_dlpi_ppa(register int fd, register const char *device, register u_int unit,
1738     u_int *ppa, register char *ebuf)
1739 {
1740 	register dl_hp_ppa_ack_t *ap;
1741 	register dl_hp_ppa_info_t *ipstart, *ip;
1742 	register u_int i;
1743 	char dname[100];
1744 	register u_long majdev;
1745 	struct stat statbuf;
1746 	dl_hp_ppa_req_t	req;
1747 	char buf[MAXDLBUF];
1748 	char *ppa_data_buf;
1749 	dl_hp_ppa_ack_t	*dlp;
1750 	struct strbuf ctl;
1751 	int flags;
1752 
1753 	memset((char *)&req, 0, sizeof(req));
1754 	req.dl_primitive = DL_HP_PPA_REQ;
1755 
1756 	memset((char *)buf, 0, sizeof(buf));
1757 	if (send_request(fd, (char *)&req, sizeof(req), "hpppa", ebuf) < 0)
1758 		return (PCAP_ERROR);
1759 
1760 	ctl.maxlen = DL_HP_PPA_ACK_SIZE;
1761 	ctl.len = 0;
1762 	ctl.buf = (char *)buf;
1763 
1764 	flags = 0;
1765 	/*
1766 	 * DLPI may return a big chunk of data for a DL_HP_PPA_REQ. The normal
1767 	 * recv_ack will fail because it set the maxlen to MAXDLBUF (8192)
1768 	 * which is NOT big enough for a DL_HP_PPA_REQ.
1769 	 *
1770 	 * This causes libpcap applications to fail on a system with HP-APA
1771 	 * installed.
1772 	 *
1773 	 * To figure out how big the returned data is, we first call getmsg
1774 	 * to get the small head and peek at the head to get the actual data
1775 	 * length, and  then issue another getmsg to get the actual PPA data.
1776 	 */
1777 	/* get the head first */
1778 	if (getmsg(fd, &ctl, (struct strbuf *)NULL, &flags) < 0) {
1779 		pcapint_fmt_errmsg_for_errno(ebuf, PCAP_ERRBUF_SIZE,
1780 		    errno, "get_dlpi_ppa: hpppa getmsg");
1781 		return (PCAP_ERROR);
1782 	}
1783 	if (ctl.len == -1) {
1784 		snprintf(ebuf, PCAP_ERRBUF_SIZE,
1785 		    "get_dlpi_ppa: hpppa getmsg: control buffer has no data");
1786 		return (PCAP_ERROR);
1787 	}
1788 
1789 	dlp = (dl_hp_ppa_ack_t *)ctl.buf;
1790 	if (dlp->dl_primitive != DL_HP_PPA_ACK) {
1791 		snprintf(ebuf, PCAP_ERRBUF_SIZE,
1792 		    "get_dlpi_ppa: hpppa unexpected primitive ack 0x%x",
1793 		    (bpf_u_int32)dlp->dl_primitive);
1794 		return (PCAP_ERROR);
1795 	}
1796 
1797 	if ((size_t)ctl.len < DL_HP_PPA_ACK_SIZE) {
1798 		snprintf(ebuf, PCAP_ERRBUF_SIZE,
1799 		    "get_dlpi_ppa: hpppa ack too small (%d < %lu)",
1800 		     ctl.len, (unsigned long)DL_HP_PPA_ACK_SIZE);
1801 		return (PCAP_ERROR);
1802 	}
1803 
1804 	/* allocate buffer */
1805 	if ((ppa_data_buf = (char *)malloc(dlp->dl_length)) == NULL) {
1806 		pcapint_fmt_errmsg_for_errno(ebuf, PCAP_ERRBUF_SIZE,
1807 		    errno, "get_dlpi_ppa: hpppa malloc");
1808 		return (PCAP_ERROR);
1809 	}
1810 	ctl.maxlen = dlp->dl_length;
1811 	ctl.len = 0;
1812 	ctl.buf = (char *)ppa_data_buf;
1813 	/* get the data */
1814 	if (getmsg(fd, &ctl, (struct strbuf *)NULL, &flags) < 0) {
1815 		pcapint_fmt_errmsg_for_errno(ebuf, PCAP_ERRBUF_SIZE,
1816 		    errno, "get_dlpi_ppa: hpppa getmsg");
1817 		free(ppa_data_buf);
1818 		return (PCAP_ERROR);
1819 	}
1820 	if (ctl.len == -1) {
1821 		snprintf(ebuf, PCAP_ERRBUF_SIZE,
1822 		    "get_dlpi_ppa: hpppa getmsg: control buffer has no data");
1823 		return (PCAP_ERROR);
1824 	}
1825 	if ((u_int)ctl.len < dlp->dl_length) {
1826 		snprintf(ebuf, PCAP_ERRBUF_SIZE,
1827 		    "get_dlpi_ppa: hpppa ack too small (%d < %lu)",
1828 		    ctl.len, (unsigned long)dlp->dl_length);
1829 		free(ppa_data_buf);
1830 		return (PCAP_ERROR);
1831 	}
1832 
1833 	ap = (dl_hp_ppa_ack_t *)buf;
1834 	ipstart = (dl_hp_ppa_info_t *)ppa_data_buf;
1835 	ip = ipstart;
1836 
1837 #ifdef HAVE_DL_HP_PPA_INFO_T_DL_MODULE_ID_1
1838 	/*
1839 	 * The "dl_hp_ppa_info_t" structure has a "dl_module_id_1"
1840 	 * member that should, in theory, contain the part of the
1841 	 * name for the device that comes before the unit number,
1842 	 * and should also have a "dl_module_id_2" member that may
1843 	 * contain an alternate name (e.g., I think Ethernet devices
1844 	 * have both "lan", for "lanN", and "snap", for "snapN", with
1845 	 * the former being for Ethernet packets and the latter being
1846 	 * for 802.3/802.2 packets).
1847 	 *
1848 	 * Search for the device that has the specified name and
1849 	 * instance number.
1850 	 */
1851 	for (i = 0; i < ap->dl_count; i++) {
1852 		if ((strcmp((const char *)ip->dl_module_id_1, device) == 0 ||
1853 		     strcmp((const char *)ip->dl_module_id_2, device) == 0) &&
1854 		    ip->dl_instance_num == unit)
1855 			break;
1856 
1857 		ip = (dl_hp_ppa_info_t *)((u_char *)ipstart + ip->dl_next_offset);
1858 	}
1859 #else
1860 	/*
1861 	 * We don't have that member, so the search is impossible; make it
1862 	 * look as if the search failed.
1863 	 */
1864 	i = ap->dl_count;
1865 #endif
1866 
1867 	if (i == ap->dl_count) {
1868 		/*
1869 		 * Well, we didn't, or can't, find the device by name.
1870 		 *
1871 		 * HP-UX 10.20, whilst it has "dl_module_id_1" and
1872 		 * "dl_module_id_2" fields in the "dl_hp_ppa_info_t",
1873 		 * doesn't seem to fill them in unless the system is
1874 		 * at a reasonably up-to-date patch level.
1875 		 *
1876 		 * Older HP-UX 10.x systems might not have those fields
1877 		 * at all.
1878 		 *
1879 		 * Therefore, we'll search for the entry with the major
1880 		 * device number of a device with the name "/dev/<dev><unit>",
1881 		 * if such a device exists, as the old code did.
1882 		 */
1883 		snprintf(dname, sizeof(dname), "/dev/%s%u", device, unit);
1884 		if (stat(dname, &statbuf) < 0) {
1885 			pcapint_fmt_errmsg_for_errno(ebuf, PCAP_ERRBUF_SIZE,
1886 			    errno, "stat: %s", dname);
1887 			return (PCAP_ERROR);
1888 		}
1889 		majdev = major(statbuf.st_rdev);
1890 
1891 		ip = ipstart;
1892 
1893 		for (i = 0; i < ap->dl_count; i++) {
1894 			if (ip->dl_mjr_num == majdev &&
1895 			    ip->dl_instance_num == unit)
1896 				break;
1897 
1898 			ip = (dl_hp_ppa_info_t *)((u_char *)ipstart + ip->dl_next_offset);
1899 		}
1900 	}
1901 	if (i == ap->dl_count) {
1902 		snprintf(ebuf, PCAP_ERRBUF_SIZE,
1903 		    "can't find /dev/dlpi PPA for %s%u", device, unit);
1904 		return (PCAP_ERROR_NO_SUCH_DEVICE);
1905 	}
1906 	if (ip->dl_hdw_state == HDW_DEAD) {
1907 		snprintf(ebuf, PCAP_ERRBUF_SIZE,
1908 		    "%s%d: hardware state: DOWN\n", device, unit);
1909 		free(ppa_data_buf);
1910 		return (PCAP_ERROR);
1911 	}
1912 	*ppa = ip->dl_ppa;
1913 	free(ppa_data_buf);
1914 	return (0);
1915 }
1916 #endif
1917 
1918 #ifdef HAVE_HPUX9
1919 /*
1920  * Under HP-UX 9, there is no good way to determine the ppa.
1921  * So punt and read it from /dev/kmem.
1922  */
1923 static struct nlist nl[] = {
1924 #define NL_IFNET 0
1925 	{ "ifnet" },
1926 	{ "" }
1927 };
1928 
1929 static char path_vmunix[] = "/hp-ux";
1930 
1931 /* Determine ppa number that specifies ifname */
1932 static int
1933 get_dlpi_ppa(register int fd, register const char *ifname, register u_int unit,
1934     u_int *ppa, register char *ebuf)
1935 {
1936 	register const char *cp;
1937 	register int kd;
1938 	void *addr;
1939 	struct ifnet ifnet;
1940 	char if_name[sizeof(ifnet.if_name) + 1];
1941 
1942 	cp = strrchr(ifname, '/');
1943 	if (cp != NULL)
1944 		ifname = cp + 1;
1945 	if (nlist(path_vmunix, &nl) < 0) {
1946 		snprintf(ebuf, PCAP_ERRBUF_SIZE, "nlist %s failed",
1947 		    path_vmunix);
1948 		return (PCAP_ERROR);
1949 	}
1950 	if (nl[NL_IFNET].n_value == 0) {
1951 		snprintf(ebuf, PCAP_ERRBUF_SIZE,
1952 		    "couldn't find %s kernel symbol",
1953 		    nl[NL_IFNET].n_name);
1954 		return (PCAP_ERROR);
1955 	}
1956 	kd = open("/dev/kmem", O_RDONLY);
1957 	if (kd < 0) {
1958 		pcapint_fmt_errmsg_for_errno(ebuf, PCAP_ERRBUF_SIZE,
1959 		    errno, "kmem open");
1960 		return (PCAP_ERROR);
1961 	}
1962 	if (dlpi_kread(kd, nl[NL_IFNET].n_value,
1963 	    &addr, sizeof(addr), ebuf) < 0) {
1964 		close(kd);
1965 		return (PCAP_ERROR);
1966 	}
1967 	for (; addr != NULL; addr = ifnet.if_next) {
1968 		if (dlpi_kread(kd, (off_t)addr,
1969 		    &ifnet, sizeof(ifnet), ebuf) < 0 ||
1970 		    dlpi_kread(kd, (off_t)ifnet.if_name,
1971 		    if_name, sizeof(ifnet.if_name), ebuf) < 0) {
1972 			(void)close(kd);
1973 			return (PCAP_ERROR);
1974 		}
1975 		if_name[sizeof(ifnet.if_name)] = '\0';
1976 		if (strcmp(if_name, ifname) == 0 && ifnet.if_unit == unit) {
1977 			*ppa = ifnet.if_index;
1978 			return (0);
1979 		}
1980 	}
1981 
1982 	snprintf(ebuf, PCAP_ERRBUF_SIZE, "Can't find %s", ifname);
1983 	return (PCAP_ERROR_NO_SUCH_DEVICE);
1984 }
1985 
1986 static int
1987 dlpi_kread(register int fd, register off_t addr,
1988     register void *buf, register u_int len, register char *ebuf)
1989 {
1990 	register int cc;
1991 
1992 	if (lseek(fd, addr, SEEK_SET) < 0) {
1993 		pcapint_fmt_errmsg_for_errno(ebuf, PCAP_ERRBUF_SIZE,
1994 		    errno, "lseek");
1995 		return (-1);
1996 	}
1997 	cc = read(fd, buf, len);
1998 	if (cc < 0) {
1999 		pcapint_fmt_errmsg_for_errno(ebuf, PCAP_ERRBUF_SIZE,
2000 		    errno, "read");
2001 		return (-1);
2002 	} else if (cc != len) {
2003 		snprintf(ebuf, PCAP_ERRBUF_SIZE, "short read (%d != %d)", cc,
2004 		    len);
2005 		return (-1);
2006 	}
2007 	return (cc);
2008 }
2009 #endif
2010 
2011 pcap_t *
2012 pcapint_create_interface(const char *device _U_, char *ebuf)
2013 {
2014 	pcap_t *p;
2015 #ifdef DL_HP_RAWDLS
2016 	struct pcap_dlpi *pd;
2017 #endif
2018 
2019 	p = PCAP_CREATE_COMMON(ebuf, struct pcap_dlpi);
2020 	if (p == NULL)
2021 		return (NULL);
2022 
2023 #ifdef DL_HP_RAWDLS
2024 	pd = p->priv;
2025 	pd->send_fd = -1;	/* it hasn't been opened yet */
2026 #endif
2027 
2028 	p->activate_op = pcap_activate_dlpi;
2029 	return (p);
2030 }
2031 
2032 /*
2033  * Libpcap version string.
2034  */
2035 const char *
2036 pcap_lib_version(void)
2037 {
2038 	return (PCAP_VERSION_STRING);
2039 }
2040