Commit | Line | Data |
---|---|---|
c8cf0f94 PA |
1 | /* |
2 | * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000 | |
3 | * The Regents of the University of California. All rights reserved. | |
4 | * | |
5 | * Redistribution and use in source and binary forms, with or without | |
6 | * modification, are permitted provided that: (1) source code distributions | |
7 | * retain the above copyright notice and this paragraph in its entirety, (2) | |
8 | * distributions including binary code include the above copyright notice and | |
9 | * this paragraph in its entirety in the documentation or other materials | |
10 | * provided with the distribution, and (3) all advertising materials mentioning | |
11 | * features or use of this software display the following acknowledgement: | |
12 | * ``This product includes software developed by the University of California, | |
13 | * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of | |
14 | * the University nor the names of its contributors may be used to endorse | |
15 | * or promote products derived from this software without specific prior | |
16 | * written permission. | |
17 | * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED | |
18 | * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF | |
19 | * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. | |
20 | * | |
21 | * Support for splitting captures into multiple files with a maximum | |
22 | * file size: | |
23 | * | |
24 | * Copyright (c) 2001 | |
25 | * Seth Webster <swebster@sst.ll.mit.edu> | |
26 | */ | |
27 | ||
c8cf0f94 | 28 | /* |
411677ae | 29 | * tcpdump - dump traffic on a network |
c8cf0f94 PA |
30 | * |
31 | * First written in 1987 by Van Jacobson, Lawrence Berkeley Laboratory. | |
32 | * Mercilessly hacked and occasionally improved since then via the | |
33 | * combined efforts of Van, Steve McCanne and Craig Leres of LBL. | |
34 | */ | |
35 | ||
36 | #ifdef HAVE_CONFIG_H | |
ed775ee7 | 37 | #include <config.h> |
c8cf0f94 PA |
38 | #endif |
39 | ||
411677ae | 40 | /* |
ed775ee7 AHJ |
41 | * Some older versions of Mac OS X may ship pcap.h from libpcap 0.6 with a |
42 | * libpcap based on 0.8. That means it has pcap_findalldevs() but the | |
43 | * header doesn't define pcap_if_t, meaning that we can't actually *use* | |
44 | * pcap_findalldevs(). | |
411677ae AL |
45 | */ |
46 | #ifdef HAVE_PCAP_FINDALLDEVS | |
47 | #ifndef HAVE_PCAP_IF_T | |
48 | #undef HAVE_PCAP_FINDALLDEVS | |
49 | #endif | |
50 | #endif | |
c8cf0f94 | 51 | |
ed775ee7 AHJ |
52 | #include "netdissect-stdinc.h" |
53 | ||
54 | /* | |
55 | * This must appear after including netdissect-stdinc.h, so that _U_ is | |
56 | * defined. | |
57 | */ | |
58 | #ifndef lint | |
59 | static const char copyright[] _U_ = | |
60 | "@(#) Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000\n\ | |
61 | The Regents of the University of California. All rights reserved.\n"; | |
62 | #endif | |
c8cf0f94 | 63 | |
411677ae AL |
64 | #include <sys/stat.h> |
65 | ||
66 | #ifdef HAVE_FCNTL_H | |
67 | #include <fcntl.h> | |
68 | #endif | |
69 | ||
70 | #ifdef HAVE_LIBCRYPTO | |
71 | #include <openssl/crypto.h> | |
c8cf0f94 PA |
72 | #endif |
73 | ||
411677ae AL |
74 | #ifdef HAVE_GETOPT_LONG |
75 | #include <getopt.h> | |
76 | #else | |
ed775ee7 | 77 | #include "missing/getopt_long.h" |
411677ae AL |
78 | #endif |
79 | /* Capsicum-specific code requires macros from <net/bpf.h>, which will fail | |
80 | * to compile if <pcap.h> has already been included; including the headers | |
81 | * in the opposite order works fine. | |
82 | */ | |
83 | #ifdef HAVE_CAPSICUM | |
ed775ee7 | 84 | #include <sys/capsicum.h> |
411677ae AL |
85 | #include <sys/ioccom.h> |
86 | #include <net/bpf.h> | |
87 | #include <libgen.h> | |
ed775ee7 AHJ |
88 | #ifdef HAVE_CASPER |
89 | #include <libcasper.h> | |
90 | #include <casper/cap_dns.h> | |
91 | #include <sys/nv.h> | |
92 | #endif /* HAVE_CASPER */ | |
411677ae | 93 | #endif /* HAVE_CAPSICUM */ |
ed775ee7 AHJ |
94 | #ifdef HAVE_PCAP_OPEN |
95 | /* | |
96 | * We found pcap_open() in the capture library, so we'll be using | |
97 | * the remote capture APIs; define PCAP_REMOTE before we include pcap.h, | |
98 | * so we get those APIs declared, and the types and #defines that they | |
99 | * use defined. | |
100 | * | |
101 | * WinPcap's headers require that PCAP_REMOTE be defined in order to get | |
102 | * remote-capture APIs declared and types and #defines that they use | |
103 | * defined. | |
104 | * | |
105 | * (Versions of libpcap with those APIs, and thus Npcap, which is based on | |
106 | * those versions of libpcap, don't require it.) | |
107 | */ | |
108 | #define HAVE_REMOTE | |
109 | #endif | |
c8cf0f94 PA |
110 | #include <pcap.h> |
111 | #include <signal.h> | |
112 | #include <stdio.h> | |
411677ae | 113 | #include <stdarg.h> |
c8cf0f94 PA |
114 | #include <stdlib.h> |
115 | #include <string.h> | |
ea7b4bf5 | 116 | #include <limits.h> |
ed775ee7 AHJ |
117 | #ifdef _WIN32 |
118 | #include <windows.h> | |
119 | #else | |
120 | #include <sys/time.h> | |
ea7b4bf5 PA |
121 | #include <sys/wait.h> |
122 | #include <sys/resource.h> | |
c8cf0f94 PA |
123 | #include <pwd.h> |
124 | #include <grp.h> | |
411677ae | 125 | #endif /* _WIN32 */ |
c8cf0f94 | 126 | |
ed775ee7 AHJ |
127 | /* |
128 | * Pathname separator. | |
129 | * Use this in pathnames, but do *not* use it in URLs. | |
130 | */ | |
131 | #ifdef _WIN32 | |
132 | #define PATH_SEPARATOR '\\' | |
133 | #else | |
134 | #define PATH_SEPARATOR '/' | |
135 | #endif | |
136 | ||
411677ae AL |
137 | /* capabilities convenience library */ |
138 | /* If a code depends on HAVE_LIBCAP_NG, it depends also on HAVE_CAP_NG_H. | |
139 | * If HAVE_CAP_NG_H is not defined, undefine HAVE_LIBCAP_NG. | |
140 | * Thus, the later tests are done only on HAVE_LIBCAP_NG. | |
141 | */ | |
142 | #ifdef HAVE_LIBCAP_NG | |
143 | #ifdef HAVE_CAP_NG_H | |
144 | #include <cap-ng.h> | |
145 | #else | |
146 | #undef HAVE_LIBCAP_NG | |
147 | #endif /* HAVE_CAP_NG_H */ | |
148 | #endif /* HAVE_LIBCAP_NG */ | |
ea7b4bf5 | 149 | |
ed775ee7 AHJ |
150 | #ifdef __FreeBSD__ |
151 | #include <sys/sysctl.h> | |
152 | #endif /* __FreeBSD__ */ | |
153 | ||
154 | #include "netdissect-stdinc.h" | |
c8cf0f94 PA |
155 | #include "netdissect.h" |
156 | #include "interface.h" | |
157 | #include "addrtoname.h" | |
158 | #include "machdep.h" | |
c8cf0f94 | 159 | #include "pcap-missing.h" |
411677ae AL |
160 | #include "ascii_strcasecmp.h" |
161 | ||
162 | #include "print.h" | |
c8cf0f94 | 163 | |
ed775ee7 AHJ |
164 | #include "fptype.h" |
165 | ||
411677ae AL |
166 | #ifndef PATH_MAX |
167 | #define PATH_MAX 1024 | |
ea7b4bf5 PA |
168 | #endif |
169 | ||
ed775ee7 | 170 | #if defined(SIGINFO) |
6263709f | 171 | #define SIGNAL_REQ_INFO SIGINFO |
ed775ee7 | 172 | #elif defined(SIGUSR1) |
6263709f PA |
173 | #define SIGNAL_REQ_INFO SIGUSR1 |
174 | #endif | |
175 | ||
ed775ee7 AHJ |
176 | #if defined(HAVE_PCAP_DUMP_FLUSH) && defined(SIGUSR2) |
177 | #define SIGNAL_FLUSH_PCAP SIGUSR2 | |
178 | #endif | |
179 | ||
180 | #if defined(HAVE_PCAP_CREATE) || defined(_WIN32) | |
411677ae | 181 | static int Bflag; /* buffer size */ |
ed775ee7 AHJ |
182 | #endif |
183 | #ifdef HAVE_PCAP_DUMP_FTELL64 | |
184 | static int64_t Cflag; /* rotate dump files after this many bytes */ | |
185 | #else | |
411677ae | 186 | static long Cflag; /* rotate dump files after this many bytes */ |
ed775ee7 | 187 | #endif |
411677ae | 188 | static int Cflag_count; /* Keep track of which file number we're writing */ |
ed775ee7 | 189 | #ifdef HAVE_PCAP_FINDALLDEVS |
411677ae | 190 | static int Dflag; /* list available devices and exit */ |
ed775ee7 AHJ |
191 | #endif |
192 | #ifdef HAVE_PCAP_FINDALLDEVS_EX | |
193 | static char *remote_interfaces_source; /* list available devices from this source and exit */ | |
194 | #endif | |
195 | ||
411677ae AL |
196 | /* |
197 | * This is exported because, in some versions of libpcap, if libpcap | |
198 | * is built with optimizer debugging code (which is *NOT* the default | |
199 | * configuration!), the library *imports*(!) a variable named dflag, | |
200 | * under the expectation that tcpdump is exporting it, to govern | |
201 | * how much debugging information to print when optimizing | |
202 | * the generated BPF code. | |
203 | * | |
204 | * This is a horrible hack; newer versions of libpcap don't import | |
205 | * dflag but, instead, *if* built with optimizer debugging code, | |
206 | * *export* a routine to set that flag. | |
207 | */ | |
ed775ee7 | 208 | extern int dflag; |
411677ae AL |
209 | int dflag; /* print filter code */ |
210 | static int Gflag; /* rotate dump files after this many seconds */ | |
211 | static int Gflag_count; /* number of files created with Gflag rotation */ | |
212 | static time_t Gflag_time; /* The last time_t the dump file was rotated. */ | |
27bfbee1 | 213 | static int Lflag; /* list available data link types and exit */ |
411677ae | 214 | static int Iflag; /* rfmon (monitor) mode */ |
27bfbee1 PA |
215 | #ifdef HAVE_PCAP_SET_TSTAMP_TYPE |
216 | static int Jflag; /* list available time stamp types */ | |
411677ae | 217 | static int jflag = -1; /* packet time stamp source */ |
ed775ee7 AHJ |
218 | #endif |
219 | static int lflag; /* line-buffered output */ | |
411677ae AL |
220 | static int pflag; /* don't go promiscuous */ |
221 | #ifdef HAVE_PCAP_SETDIRECTION | |
222 | static int Qflag = -1; /* restrict captured packet by send/receive direction */ | |
223 | #endif | |
ed775ee7 | 224 | #ifdef HAVE_PCAP_DUMP_FLUSH |
411677ae | 225 | static int Uflag; /* "unbuffered" output of dump files */ |
ed775ee7 | 226 | #endif |
411677ae AL |
227 | static int Wflag; /* recycle output files after this number of files */ |
228 | static int WflagChars; | |
27bfbee1 | 229 | static char *zflag = NULL; /* compress each savefile using a specified command (like gzip or bzip2) */ |
ed775ee7 AHJ |
230 | static int timeout = 1000; /* default timeout = 1000 ms = 1 s */ |
231 | #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE | |
411677ae | 232 | static int immediate_mode; |
ed775ee7 AHJ |
233 | #endif |
234 | static int count_mode; | |
c8cf0f94 PA |
235 | |
236 | static int infodelay; | |
237 | static int infoprint; | |
238 | ||
239 | char *program_name; | |
240 | ||
ed775ee7 AHJ |
241 | #ifdef HAVE_CASPER |
242 | cap_channel_t *capdns; | |
243 | #endif | |
244 | ||
c8cf0f94 | 245 | /* Forwards */ |
ed775ee7 | 246 | static NORETURN void error(FORMAT_STRING(const char *), ...) PRINTFLIKE(1, 2); |
411677ae | 247 | static void warning(FORMAT_STRING(const char *), ...) PRINTFLIKE(1, 2); |
ed775ee7 AHJ |
248 | static NORETURN void exit_tcpdump(int); |
249 | static void (*setsignal (int sig, void (*func)(int)))(int); | |
250 | static void cleanup(int); | |
251 | static void child_cleanup(int); | |
252 | static void print_version(FILE *); | |
253 | static void print_usage(FILE *); | |
254 | #ifdef HAVE_PCAP_SET_TSTAMP_TYPE | |
255 | static NORETURN void show_tstamp_types_and_exit(pcap_t *, const char *device); | |
256 | #endif | |
257 | static NORETURN void show_dlts_and_exit(pcap_t *, const char *device); | |
411677ae | 258 | #ifdef HAVE_PCAP_FINDALLDEVS |
ed775ee7 AHJ |
259 | static NORETURN void show_devices_and_exit(void); |
260 | #endif | |
261 | #ifdef HAVE_PCAP_FINDALLDEVS_EX | |
262 | static NORETURN void show_remote_devices_and_exit(void); | |
411677ae | 263 | #endif |
c8cf0f94 PA |
264 | |
265 | static void print_packet(u_char *, const struct pcap_pkthdr *, const u_char *); | |
c8cf0f94 PA |
266 | static void dump_packet_and_trunc(u_char *, const struct pcap_pkthdr *, const u_char *); |
267 | static void dump_packet(u_char *, const struct pcap_pkthdr *, const u_char *); | |
268 | static void droproot(const char *, const char *); | |
c8cf0f94 | 269 | |
6263709f | 270 | #ifdef SIGNAL_REQ_INFO |
ed775ee7 | 271 | static void requestinfo(int); |
c8cf0f94 PA |
272 | #endif |
273 | ||
ed775ee7 AHJ |
274 | #ifdef SIGNAL_FLUSH_PCAP |
275 | static void flushpcap(int); | |
c8cf0f94 PA |
276 | #endif |
277 | ||
ed775ee7 AHJ |
278 | #ifdef _WIN32 |
279 | static HANDLE timer_handle = INVALID_HANDLE_VALUE; | |
280 | static void CALLBACK verbose_stats_dump(PVOID param, BOOLEAN timer_fired); | |
281 | #else /* _WIN32 */ | |
282 | static void verbose_stats_dump(int sig); | |
283 | #endif /* _WIN32 */ | |
284 | ||
c8cf0f94 PA |
285 | static void info(int); |
286 | static u_int packets_captured; | |
287 | ||
411677ae AL |
288 | #ifdef HAVE_PCAP_FINDALLDEVS |
289 | static const struct tok status_flags[] = { | |
290 | #ifdef PCAP_IF_UP | |
291 | { PCAP_IF_UP, "Up" }, | |
292 | #endif | |
293 | #ifdef PCAP_IF_RUNNING | |
294 | { PCAP_IF_RUNNING, "Running" }, | |
295 | #endif | |
296 | { PCAP_IF_LOOPBACK, "Loopback" }, | |
ed775ee7 AHJ |
297 | #ifdef PCAP_IF_WIRELESS |
298 | { PCAP_IF_WIRELESS, "Wireless" }, | |
299 | #endif | |
411677ae | 300 | { 0, NULL } |
c8cf0f94 | 301 | }; |
411677ae | 302 | #endif |
c8cf0f94 | 303 | |
411677ae | 304 | static pcap_t *pd; |
ed775ee7 | 305 | static pcap_dumper_t *pdd = NULL; |
27bfbee1 | 306 | |
411677ae | 307 | static int supports_monitor_mode; |
27bfbee1 | 308 | |
411677ae AL |
309 | extern int optind; |
310 | extern int opterr; | |
311 | extern char *optarg; | |
27bfbee1 | 312 | |
411677ae AL |
313 | struct dump_info { |
314 | char *WFileName; | |
315 | char *CurrentFileName; | |
316 | pcap_t *pd; | |
ed775ee7 AHJ |
317 | pcap_dumper_t *pdd; |
318 | netdissect_options *ndo; | |
411677ae AL |
319 | #ifdef HAVE_CAPSICUM |
320 | int dirfd; | |
c8cf0f94 | 321 | #endif |
c8cf0f94 PA |
322 | }; |
323 | ||
411677ae AL |
324 | #if defined(HAVE_PCAP_SET_PARSER_DEBUG) |
325 | /* | |
326 | * We have pcap_set_parser_debug() in libpcap; declare it (it's not declared | |
327 | * by any libpcap header, because it's a special hack, only available if | |
328 | * libpcap was configured to include it, and only intended for use by | |
329 | * libpcap developers trying to debug the parser for filter expressions). | |
330 | */ | |
331 | #ifdef _WIN32 | |
332 | __declspec(dllimport) | |
333 | #else /* _WIN32 */ | |
334 | extern | |
335 | #endif /* _WIN32 */ | |
336 | void pcap_set_parser_debug(int); | |
337 | #elif defined(HAVE_PCAP_DEBUG) || defined(HAVE_YYDEBUG) | |
338 | /* | |
339 | * We don't have pcap_set_parser_debug() in libpcap, but we do have | |
340 | * pcap_debug or yydebug. Make a local version of pcap_set_parser_debug() | |
341 | * to set the flag, and define HAVE_PCAP_SET_PARSER_DEBUG. | |
342 | */ | |
343 | static void | |
344 | pcap_set_parser_debug(int value) | |
c8cf0f94 | 345 | { |
411677ae AL |
346 | #ifdef HAVE_PCAP_DEBUG |
347 | extern int pcap_debug; | |
c8cf0f94 | 348 | |
411677ae AL |
349 | pcap_debug = value; |
350 | #else /* HAVE_PCAP_DEBUG */ | |
351 | extern int yydebug; | |
c8cf0f94 | 352 | |
411677ae AL |
353 | yydebug = value; |
354 | #endif /* HAVE_PCAP_DEBUG */ | |
c8cf0f94 PA |
355 | } |
356 | ||
411677ae AL |
357 | #define HAVE_PCAP_SET_PARSER_DEBUG |
358 | #endif | |
27bfbee1 | 359 | |
411677ae AL |
360 | #if defined(HAVE_PCAP_SET_OPTIMIZER_DEBUG) |
361 | /* | |
362 | * We have pcap_set_optimizer_debug() in libpcap; declare it (it's not declared | |
363 | * by any libpcap header, because it's a special hack, only available if | |
364 | * libpcap was configured to include it, and only intended for use by | |
365 | * libpcap developers trying to debug the optimizer for filter expressions). | |
366 | */ | |
367 | #ifdef _WIN32 | |
368 | __declspec(dllimport) | |
369 | #else /* _WIN32 */ | |
370 | extern | |
371 | #endif /* _WIN32 */ | |
372 | void pcap_set_optimizer_debug(int); | |
373 | #endif | |
27bfbee1 | 374 | |
411677ae AL |
375 | /* VARARGS */ |
376 | static void | |
377 | error(const char *fmt, ...) | |
378 | { | |
379 | va_list ap; | |
380 | ||
381 | (void)fprintf(stderr, "%s: ", program_name); | |
382 | va_start(ap, fmt); | |
383 | (void)vfprintf(stderr, fmt, ap); | |
384 | va_end(ap); | |
385 | if (*fmt) { | |
386 | fmt += strlen(fmt); | |
387 | if (fmt[-1] != '\n') | |
388 | (void)fputc('\n', stderr); | |
389 | } | |
ed775ee7 | 390 | exit_tcpdump(S_ERR_HOST_PROGRAM); |
27bfbee1 PA |
391 | /* NOTREACHED */ |
392 | } | |
393 | ||
411677ae AL |
394 | /* VARARGS */ |
395 | static void | |
396 | warning(const char *fmt, ...) | |
397 | { | |
398 | va_list ap; | |
c8cf0f94 | 399 | |
411677ae AL |
400 | (void)fprintf(stderr, "%s: WARNING: ", program_name); |
401 | va_start(ap, fmt); | |
402 | (void)vfprintf(stderr, fmt, ap); | |
403 | va_end(ap); | |
404 | if (*fmt) { | |
405 | fmt += strlen(fmt); | |
406 | if (fmt[-1] != '\n') | |
407 | (void)fputc('\n', stderr); | |
408 | } | |
409 | } | |
c8cf0f94 | 410 | |
411677ae AL |
411 | static void |
412 | exit_tcpdump(int status) | |
413 | { | |
414 | nd_cleanup(); | |
415 | exit(status); | |
416 | } | |
c8cf0f94 | 417 | |
27bfbee1 PA |
418 | #ifdef HAVE_PCAP_SET_TSTAMP_TYPE |
419 | static void | |
411677ae | 420 | show_tstamp_types_and_exit(pcap_t *pc, const char *device) |
27bfbee1 PA |
421 | { |
422 | int n_tstamp_types; | |
423 | int *tstamp_types = 0; | |
424 | const char *tstamp_type_name; | |
425 | int i; | |
426 | ||
411677ae | 427 | n_tstamp_types = pcap_list_tstamp_types(pc, &tstamp_types); |
27bfbee1 | 428 | if (n_tstamp_types < 0) |
411677ae | 429 | error("%s", pcap_geterr(pc)); |
27bfbee1 PA |
430 | |
431 | if (n_tstamp_types == 0) { | |
432 | fprintf(stderr, "Time stamp type cannot be set for %s\n", | |
433 | device); | |
ed775ee7 | 434 | exit_tcpdump(S_SUCCESS); |
27bfbee1 PA |
435 | } |
436 | fprintf(stderr, "Time stamp types for %s (use option -j to set):\n", | |
437 | device); | |
438 | for (i = 0; i < n_tstamp_types; i++) { | |
439 | tstamp_type_name = pcap_tstamp_type_val_to_name(tstamp_types[i]); | |
440 | if (tstamp_type_name != NULL) { | |
441 | (void) fprintf(stderr, " %s (%s)\n", tstamp_type_name, | |
442 | pcap_tstamp_type_val_to_description(tstamp_types[i])); | |
443 | } else { | |
444 | (void) fprintf(stderr, " %d\n", tstamp_types[i]); | |
445 | } | |
446 | } | |
447 | pcap_free_tstamp_types(tstamp_types); | |
ed775ee7 | 448 | exit_tcpdump(S_SUCCESS); |
27bfbee1 PA |
449 | } |
450 | #endif | |
451 | ||
c8cf0f94 | 452 | static void |
411677ae | 453 | show_dlts_and_exit(pcap_t *pc, const char *device) |
c8cf0f94 | 454 | { |
411677ae | 455 | int n_dlts, i; |
c8cf0f94 PA |
456 | int *dlts = 0; |
457 | const char *dlt_name; | |
458 | ||
411677ae | 459 | n_dlts = pcap_list_datalinks(pc, &dlts); |
c8cf0f94 | 460 | if (n_dlts < 0) |
411677ae | 461 | error("%s", pcap_geterr(pc)); |
c8cf0f94 PA |
462 | else if (n_dlts == 0 || !dlts) |
463 | error("No data link types."); | |
464 | ||
27bfbee1 PA |
465 | /* |
466 | * If the interface is known to support monitor mode, indicate | |
467 | * whether these are the data link types available when not in | |
468 | * monitor mode, if -I wasn't specified, or when in monitor mode, | |
469 | * when -I was specified (the link-layer types available in | |
470 | * monitor mode might be different from the ones available when | |
471 | * not in monitor mode). | |
472 | */ | |
473 | if (supports_monitor_mode) | |
474 | (void) fprintf(stderr, "Data link types for %s %s (use option -y to set):\n", | |
475 | device, | |
476 | Iflag ? "when in monitor mode" : "when not in monitor mode"); | |
477 | else | |
478 | (void) fprintf(stderr, "Data link types for %s (use option -y to set):\n", | |
479 | device); | |
c8cf0f94 | 480 | |
411677ae AL |
481 | for (i = 0; i < n_dlts; i++) { |
482 | dlt_name = pcap_datalink_val_to_name(dlts[i]); | |
c8cf0f94 PA |
483 | if (dlt_name != NULL) { |
484 | (void) fprintf(stderr, " %s (%s)", dlt_name, | |
411677ae | 485 | pcap_datalink_val_to_description(dlts[i])); |
c8cf0f94 PA |
486 | |
487 | /* | |
488 | * OK, does tcpdump handle that type? | |
489 | */ | |
411677ae | 490 | if (!has_printer(dlts[i])) |
ea7b4bf5 | 491 | (void) fprintf(stderr, " (printing not supported)"); |
27bfbee1 | 492 | fprintf(stderr, "\n"); |
c8cf0f94 | 493 | } else { |
ea7b4bf5 | 494 | (void) fprintf(stderr, " DLT %d (printing not supported)\n", |
411677ae | 495 | dlts[i]); |
c8cf0f94 PA |
496 | } |
497 | } | |
411677ae | 498 | #ifdef HAVE_PCAP_FREE_DATALINKS |
27bfbee1 | 499 | pcap_free_datalinks(dlts); |
411677ae | 500 | #endif |
ed775ee7 | 501 | exit_tcpdump(S_SUCCESS); |
411677ae AL |
502 | } |
503 | ||
504 | #ifdef HAVE_PCAP_FINDALLDEVS | |
505 | static void | |
ed775ee7 | 506 | show_devices_and_exit(void) |
411677ae AL |
507 | { |
508 | pcap_if_t *dev, *devlist; | |
509 | char ebuf[PCAP_ERRBUF_SIZE]; | |
510 | int i; | |
511 | ||
512 | if (pcap_findalldevs(&devlist, ebuf) < 0) | |
513 | error("%s", ebuf); | |
ed775ee7 AHJ |
514 | for (i = 0, dev = devlist; dev != NULL; i++, dev = dev->next) { |
515 | printf("%d.%s", i+1, dev->name); | |
516 | if (dev->description != NULL) | |
517 | printf(" (%s)", dev->description); | |
518 | if (dev->flags != 0) { | |
519 | printf(" ["); | |
520 | printf("%s", bittok2str(status_flags, "none", dev->flags)); | |
521 | #ifdef PCAP_IF_WIRELESS | |
522 | if (dev->flags & PCAP_IF_WIRELESS) { | |
523 | switch (dev->flags & PCAP_IF_CONNECTION_STATUS) { | |
524 | ||
525 | case PCAP_IF_CONNECTION_STATUS_UNKNOWN: | |
526 | printf(", Association status unknown"); | |
527 | break; | |
528 | ||
529 | case PCAP_IF_CONNECTION_STATUS_CONNECTED: | |
530 | printf(", Associated"); | |
531 | break; | |
532 | ||
533 | case PCAP_IF_CONNECTION_STATUS_DISCONNECTED: | |
534 | printf(", Not associated"); | |
535 | break; | |
536 | ||
537 | case PCAP_IF_CONNECTION_STATUS_NOT_APPLICABLE: | |
538 | break; | |
539 | } | |
540 | } else { | |
541 | switch (dev->flags & PCAP_IF_CONNECTION_STATUS) { | |
542 | ||
543 | case PCAP_IF_CONNECTION_STATUS_UNKNOWN: | |
544 | printf(", Connection status unknown"); | |
545 | break; | |
546 | ||
547 | case PCAP_IF_CONNECTION_STATUS_CONNECTED: | |
548 | printf(", Connected"); | |
549 | break; | |
550 | ||
551 | case PCAP_IF_CONNECTION_STATUS_DISCONNECTED: | |
552 | printf(", Disconnected"); | |
553 | break; | |
554 | ||
555 | case PCAP_IF_CONNECTION_STATUS_NOT_APPLICABLE: | |
556 | break; | |
557 | } | |
558 | } | |
559 | #endif | |
560 | printf("]"); | |
561 | } | |
562 | printf("\n"); | |
563 | } | |
564 | pcap_freealldevs(devlist); | |
565 | exit_tcpdump(S_SUCCESS); | |
566 | } | |
567 | #endif /* HAVE_PCAP_FINDALLDEVS */ | |
568 | ||
569 | #ifdef HAVE_PCAP_FINDALLDEVS_EX | |
570 | static void | |
571 | show_remote_devices_and_exit(void) | |
572 | { | |
573 | pcap_if_t *dev, *devlist; | |
574 | char ebuf[PCAP_ERRBUF_SIZE]; | |
575 | int i; | |
576 | ||
577 | if (pcap_findalldevs_ex(remote_interfaces_source, NULL, &devlist, | |
578 | ebuf) < 0) | |
579 | error("%s", ebuf); | |
411677ae AL |
580 | for (i = 0, dev = devlist; dev != NULL; i++, dev = dev->next) { |
581 | printf("%d.%s", i+1, dev->name); | |
582 | if (dev->description != NULL) | |
583 | printf(" (%s)", dev->description); | |
584 | if (dev->flags != 0) | |
585 | printf(" [%s]", bittok2str(status_flags, "none", dev->flags)); | |
586 | printf("\n"); | |
587 | } | |
588 | pcap_freealldevs(devlist); | |
ed775ee7 | 589 | exit_tcpdump(S_SUCCESS); |
c8cf0f94 | 590 | } |
411677ae AL |
591 | #endif /* HAVE_PCAP_FINDALLDEVS */ |
592 | ||
593 | /* | |
594 | * Short options. | |
595 | * | |
596 | * Note that there we use all letters for short options except for g, k, | |
597 | * o, and P, and those are used by other versions of tcpdump, and we should | |
598 | * only use them for the same purposes that the other versions of tcpdump | |
599 | * use them: | |
600 | * | |
ed775ee7 | 601 | * macOS tcpdump uses -g to force non--v output for IP to be on one |
411677ae AL |
602 | * line, making it more "g"repable; |
603 | * | |
ed775ee7 | 604 | * macOS tcpdump uses -k to specify that packet comments in pcapng files |
411677ae AL |
605 | * should be printed; |
606 | * | |
607 | * OpenBSD tcpdump uses -o to indicate that OS fingerprinting should be done | |
608 | * for hosts sending TCP SYN packets; | |
609 | * | |
ed775ee7 | 610 | * macOS tcpdump uses -P to indicate that -w should write pcapng rather |
411677ae AL |
611 | * than pcap files. |
612 | * | |
ed775ee7 | 613 | * macOS tcpdump also uses -Q to specify expressions that match packet |
411677ae AL |
614 | * metadata, including but not limited to the packet direction. |
615 | * The expression syntax is different from a simple "in|out|inout", | |
ed775ee7 | 616 | * and those expressions aren't accepted by macOS tcpdump, but the |
411677ae AL |
617 | * equivalents would be "in" = "dir=in", "out" = "dir=out", and |
618 | * "inout" = "dir=in or dir=out", and the parser could conceivably | |
619 | * special-case "in", "out", and "inout" as expressions for backwards | |
620 | * compatibility, so all is not (yet) lost. | |
621 | */ | |
c8cf0f94 PA |
622 | |
623 | /* | |
624 | * Set up flags that might or might not be supported depending on the | |
625 | * version of libpcap we're using. | |
626 | */ | |
411677ae | 627 | #if defined(HAVE_PCAP_CREATE) || defined(_WIN32) |
c8cf0f94 PA |
628 | #define B_FLAG "B:" |
629 | #define B_FLAG_USAGE " [ -B size ]" | |
411677ae | 630 | #else /* defined(HAVE_PCAP_CREATE) || defined(_WIN32) */ |
c8cf0f94 PA |
631 | #define B_FLAG |
632 | #define B_FLAG_USAGE | |
411677ae | 633 | #endif /* defined(HAVE_PCAP_CREATE) || defined(_WIN32) */ |
ea7b4bf5 | 634 | |
ed775ee7 AHJ |
635 | #ifdef HAVE_PCAP_FINDALLDEVS |
636 | #define D_FLAG "D" | |
637 | #else | |
638 | #define D_FLAG | |
639 | #endif | |
640 | ||
ea7b4bf5 PA |
641 | #ifdef HAVE_PCAP_CREATE |
642 | #define I_FLAG "I" | |
643 | #else /* HAVE_PCAP_CREATE */ | |
644 | #define I_FLAG | |
645 | #endif /* HAVE_PCAP_CREATE */ | |
c8cf0f94 | 646 | |
27bfbee1 PA |
647 | #ifdef HAVE_PCAP_SET_TSTAMP_TYPE |
648 | #define j_FLAG "j:" | |
649 | #define j_FLAG_USAGE " [ -j tstamptype ]" | |
650 | #define J_FLAG "J" | |
651 | #else /* PCAP_ERROR_TSTAMP_TYPE_NOTSUP */ | |
652 | #define j_FLAG | |
653 | #define j_FLAG_USAGE | |
654 | #define J_FLAG | |
655 | #endif /* PCAP_ERROR_TSTAMP_TYPE_NOTSUP */ | |
656 | ||
ed775ee7 AHJ |
657 | #ifdef USE_LIBSMI |
658 | #define m_FLAG_USAGE "[ -m module ] ..." | |
659 | #endif | |
660 | ||
661 | #ifdef HAVE_PCAP_SETDIRECTION | |
662 | #define Q_FLAG "Q:" | |
663 | #define Q_FLAG_USAGE " [ -Q in|out|inout ]" | |
c8cf0f94 | 664 | #else |
ed775ee7 AHJ |
665 | #define Q_FLAG |
666 | #define Q_FLAG_USAGE | |
c8cf0f94 PA |
667 | #endif |
668 | ||
669 | #ifdef HAVE_PCAP_DUMP_FLUSH | |
670 | #define U_FLAG "U" | |
671 | #else | |
672 | #define U_FLAG | |
673 | #endif | |
674 | ||
411677ae AL |
675 | #define SHORTOPTS "aAb" B_FLAG "c:C:d" D_FLAG "eE:fF:G:hHi:" I_FLAG j_FLAG J_FLAG "KlLm:M:nNOpq" Q_FLAG "r:s:StT:u" U_FLAG "vV:w:W:xXy:Yz:Z:#" |
676 | ||
677 | /* | |
678 | * Long options. | |
679 | * | |
680 | * We do not currently have long options corresponding to all short | |
681 | * options; we should probably pick appropriate option names for them. | |
682 | * | |
683 | * However, the short options where the number of times the option is | |
684 | * specified matters, such as -v and -d and -t, should probably not | |
685 | * just map to a long option, as saying | |
686 | * | |
687 | * tcpdump --verbose --verbose | |
688 | * | |
689 | * doesn't make sense; it should be --verbosity={N} or something such | |
690 | * as that. | |
691 | * | |
692 | * For long options with no corresponding short options, we define values | |
693 | * outside the range of ASCII graphic characters, make that the last | |
694 | * component of the entry for the long option, and have a case for that | |
695 | * option in the switch statement. | |
696 | */ | |
ed775ee7 AHJ |
697 | #define OPTION_VERSION 128 |
698 | #define OPTION_TSTAMP_PRECISION 129 | |
699 | #define OPTION_IMMEDIATE_MODE 130 | |
700 | #define OPTION_PRINT 131 | |
701 | #define OPTION_LIST_REMOTE_INTERFACES 132 | |
702 | #define OPTION_TSTAMP_MICRO 133 | |
703 | #define OPTION_TSTAMP_NANO 134 | |
704 | #define OPTION_FP_TYPE 135 | |
705 | #define OPTION_COUNT 136 | |
411677ae AL |
706 | |
707 | static const struct option longopts[] = { | |
708 | #if defined(HAVE_PCAP_CREATE) || defined(_WIN32) | |
709 | { "buffer-size", required_argument, NULL, 'B' }, | |
710 | #endif | |
711 | { "list-interfaces", no_argument, NULL, 'D' }, | |
ed775ee7 AHJ |
712 | #ifdef HAVE_PCAP_FINDALLDEVS_EX |
713 | { "list-remote-interfaces", required_argument, NULL, OPTION_LIST_REMOTE_INTERFACES }, | |
714 | #endif | |
411677ae AL |
715 | { "help", no_argument, NULL, 'h' }, |
716 | { "interface", required_argument, NULL, 'i' }, | |
717 | #ifdef HAVE_PCAP_CREATE | |
718 | { "monitor-mode", no_argument, NULL, 'I' }, | |
719 | #endif | |
720 | #ifdef HAVE_PCAP_SET_TSTAMP_TYPE | |
721 | { "time-stamp-type", required_argument, NULL, 'j' }, | |
722 | { "list-time-stamp-types", no_argument, NULL, 'J' }, | |
723 | #endif | |
724 | #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION | |
ed775ee7 AHJ |
725 | { "micro", no_argument, NULL, OPTION_TSTAMP_MICRO}, |
726 | { "nano", no_argument, NULL, OPTION_TSTAMP_NANO}, | |
411677ae AL |
727 | { "time-stamp-precision", required_argument, NULL, OPTION_TSTAMP_PRECISION}, |
728 | #endif | |
729 | { "dont-verify-checksums", no_argument, NULL, 'K' }, | |
730 | { "list-data-link-types", no_argument, NULL, 'L' }, | |
731 | { "no-optimize", no_argument, NULL, 'O' }, | |
732 | { "no-promiscuous-mode", no_argument, NULL, 'p' }, | |
733 | #ifdef HAVE_PCAP_SETDIRECTION | |
734 | { "direction", required_argument, NULL, 'Q' }, | |
735 | #endif | |
736 | { "snapshot-length", required_argument, NULL, 's' }, | |
737 | { "absolute-tcp-sequence-numbers", no_argument, NULL, 'S' }, | |
738 | #ifdef HAVE_PCAP_DUMP_FLUSH | |
739 | { "packet-buffered", no_argument, NULL, 'U' }, | |
740 | #endif | |
741 | { "linktype", required_argument, NULL, 'y' }, | |
742 | #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE | |
743 | { "immediate-mode", no_argument, NULL, OPTION_IMMEDIATE_MODE }, | |
744 | #endif | |
745 | #ifdef HAVE_PCAP_SET_PARSER_DEBUG | |
746 | { "debug-filter-parser", no_argument, NULL, 'Y' }, | |
747 | #endif | |
748 | { "relinquish-privileges", required_argument, NULL, 'Z' }, | |
ed775ee7 AHJ |
749 | { "count", no_argument, NULL, OPTION_COUNT }, |
750 | { "fp-type", no_argument, NULL, OPTION_FP_TYPE }, | |
411677ae | 751 | { "number", no_argument, NULL, '#' }, |
ed775ee7 | 752 | { "print", no_argument, NULL, OPTION_PRINT }, |
411677ae AL |
753 | { "version", no_argument, NULL, OPTION_VERSION }, |
754 | { NULL, 0, NULL, 0 } | |
755 | }; | |
756 | ||
ed775ee7 AHJ |
757 | #ifdef HAVE_PCAP_FINDALLDEVS_EX |
758 | #define LIST_REMOTE_INTERFACES_USAGE "[ --list-remote-interfaces remote-source ]" | |
759 | #else | |
760 | #define LIST_REMOTE_INTERFACES_USAGE | |
761 | #endif | |
762 | ||
763 | #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE | |
764 | #define IMMEDIATE_MODE_USAGE " [ --immediate-mode ]" | |
765 | #else | |
766 | #define IMMEDIATE_MODE_USAGE "" | |
767 | #endif | |
768 | ||
411677ae | 769 | #ifndef _WIN32 |
c8cf0f94 PA |
770 | /* Drop root privileges and chroot if necessary */ |
771 | static void | |
772 | droproot(const char *username, const char *chroot_dir) | |
773 | { | |
774 | struct passwd *pw = NULL; | |
775 | ||
ed775ee7 AHJ |
776 | if (chroot_dir && !username) |
777 | error("Chroot without dropping root is insecure"); | |
411677ae | 778 | |
c8cf0f94 PA |
779 | pw = getpwnam(username); |
780 | if (pw) { | |
781 | if (chroot_dir) { | |
ed775ee7 AHJ |
782 | if (chroot(chroot_dir) != 0 || chdir ("/") != 0) |
783 | error("Couldn't chroot/chdir to '%.64s': %s", | |
784 | chroot_dir, pcap_strerror(errno)); | |
c8cf0f94 | 785 | } |
411677ae AL |
786 | #ifdef HAVE_LIBCAP_NG |
787 | { | |
788 | int ret = capng_change_id(pw->pw_uid, pw->pw_gid, CAPNG_NO_FLAG); | |
789 | if (ret < 0) | |
790 | error("capng_change_id(): return %d\n", ret); | |
791 | else | |
792 | fprintf(stderr, "dropped privs to %s\n", username); | |
793 | } | |
794 | #else | |
c8cf0f94 | 795 | if (initgroups(pw->pw_name, pw->pw_gid) != 0 || |
ed775ee7 AHJ |
796 | setgid(pw->pw_gid) != 0 || setuid(pw->pw_uid) != 0) |
797 | error("Couldn't change to '%.32s' uid=%lu gid=%lu: %s", | |
798 | username, | |
411677ae AL |
799 | (unsigned long)pw->pw_uid, |
800 | (unsigned long)pw->pw_gid, | |
801 | pcap_strerror(errno)); | |
411677ae AL |
802 | else { |
803 | fprintf(stderr, "dropped privs to %s\n", username); | |
c8cf0f94 | 804 | } |
411677ae | 805 | #endif /* HAVE_LIBCAP_NG */ |
ed775ee7 AHJ |
806 | } else |
807 | error("Couldn't find user '%.32s'", username); | |
411677ae AL |
808 | #ifdef HAVE_LIBCAP_NG |
809 | /* We don't need CAP_SETUID, CAP_SETGID and CAP_SYS_CHROOT any more. */ | |
ed775ee7 | 810 | DIAG_OFF_CLANG(assign-enum) |
411677ae AL |
811 | capng_updatev( |
812 | CAPNG_DROP, | |
813 | CAPNG_EFFECTIVE | CAPNG_PERMITTED, | |
814 | CAP_SETUID, | |
815 | CAP_SETGID, | |
816 | CAP_SYS_CHROOT, | |
817 | -1); | |
ed775ee7 | 818 | DIAG_ON_CLANG(assign-enum) |
411677ae AL |
819 | capng_apply(CAPNG_SELECT_BOTH); |
820 | #endif /* HAVE_LIBCAP_NG */ | |
821 | ||
c8cf0f94 | 822 | } |
411677ae | 823 | #endif /* _WIN32 */ |
c8cf0f94 PA |
824 | |
825 | static int | |
826 | getWflagChars(int x) | |
827 | { | |
828 | int c = 0; | |
829 | ||
830 | x -= 1; | |
831 | while (x > 0) { | |
832 | c += 1; | |
833 | x /= 10; | |
834 | } | |
835 | ||
836 | return c; | |
837 | } | |
838 | ||
839 | ||
840 | static void | |
841 | MakeFilename(char *buffer, char *orig_name, int cnt, int max_chars) | |
842 | { | |
411677ae AL |
843 | char *filename = malloc(PATH_MAX + 1); |
844 | if (filename == NULL) | |
ed775ee7 | 845 | error("%s: malloc", __func__); |
ea7b4bf5 PA |
846 | |
847 | /* Process with strftime if Gflag is set. */ | |
848 | if (Gflag != 0) { | |
849 | struct tm *local_tm; | |
850 | ||
851 | /* Convert Gflag_time to a usable format */ | |
852 | if ((local_tm = localtime(&Gflag_time)) == NULL) { | |
ed775ee7 | 853 | error("%s: localtime", __func__); |
ea7b4bf5 PA |
854 | } |
855 | ||
856 | /* There's no good way to detect an error in strftime since a return | |
857 | * value of 0 isn't necessarily failure. | |
858 | */ | |
411677ae | 859 | strftime(filename, PATH_MAX, orig_name, local_tm); |
ea7b4bf5 | 860 | } else { |
411677ae | 861 | strncpy(filename, orig_name, PATH_MAX); |
ea7b4bf5 PA |
862 | } |
863 | ||
c8cf0f94 | 864 | if (cnt == 0 && max_chars == 0) |
411677ae | 865 | strncpy(buffer, filename, PATH_MAX + 1); |
c8cf0f94 | 866 | else |
411677ae | 867 | if (snprintf(buffer, PATH_MAX + 1, "%s%0*d", filename, max_chars, cnt) > PATH_MAX) |
ea7b4bf5 | 868 | /* Report an error if the filename is too large */ |
411677ae | 869 | error("too many output files or filename is too long (> %d)", PATH_MAX); |
ea7b4bf5 | 870 | free(filename); |
c8cf0f94 PA |
871 | } |
872 | ||
411677ae AL |
873 | static char * |
874 | get_next_file(FILE *VFile, char *ptr) | |
c8cf0f94 | 875 | { |
411677ae AL |
876 | char *ret; |
877 | size_t len; | |
c8cf0f94 | 878 | |
411677ae AL |
879 | ret = fgets(ptr, PATH_MAX, VFile); |
880 | if (!ret) | |
881 | return NULL; | |
c8cf0f94 | 882 | |
411677ae AL |
883 | len = strlen (ptr); |
884 | if (len > 0 && ptr[len - 1] == '\n') | |
885 | ptr[len - 1] = '\0'; | |
886 | ||
887 | return ret; | |
888 | } | |
889 | ||
ed775ee7 AHJ |
890 | #ifdef HAVE_CASPER |
891 | static cap_channel_t * | |
892 | capdns_setup(void) | |
893 | { | |
894 | cap_channel_t *capcas, *capdnsloc; | |
895 | const char *types[1]; | |
896 | int families[2]; | |
897 | ||
898 | capcas = cap_init(); | |
899 | if (capcas == NULL) | |
900 | error("unable to create casper process"); | |
901 | capdnsloc = cap_service_open(capcas, "system.dns"); | |
902 | /* Casper capability no longer needed. */ | |
903 | cap_close(capcas); | |
904 | if (capdnsloc == NULL) | |
905 | error("unable to open system.dns service"); | |
906 | /* Limit system.dns to reverse DNS lookups. */ | |
907 | types[0] = "ADDR"; | |
908 | if (cap_dns_type_limit(capdnsloc, types, 1) < 0) | |
909 | error("unable to limit access to system.dns service"); | |
910 | families[0] = AF_INET; | |
911 | families[1] = AF_INET6; | |
912 | if (cap_dns_family_limit(capdnsloc, families, 2) < 0) | |
913 | error("unable to limit access to system.dns service"); | |
914 | ||
915 | return (capdnsloc); | |
916 | } | |
917 | #endif /* HAVE_CASPER */ | |
918 | ||
411677ae AL |
919 | #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION |
920 | static int | |
921 | tstamp_precision_from_string(const char *precision) | |
922 | { | |
923 | if (strncmp(precision, "nano", strlen("nano")) == 0) | |
924 | return PCAP_TSTAMP_PRECISION_NANO; | |
925 | ||
926 | if (strncmp(precision, "micro", strlen("micro")) == 0) | |
927 | return PCAP_TSTAMP_PRECISION_MICRO; | |
928 | ||
929 | return -EINVAL; | |
930 | } | |
931 | ||
932 | static const char * | |
933 | tstamp_precision_to_string(int precision) | |
934 | { | |
935 | switch (precision) { | |
936 | ||
937 | case PCAP_TSTAMP_PRECISION_MICRO: | |
938 | return "micro"; | |
939 | ||
940 | case PCAP_TSTAMP_PRECISION_NANO: | |
941 | return "nano"; | |
942 | ||
943 | default: | |
944 | return "unknown"; | |
945 | } | |
946 | } | |
947 | #endif | |
948 | ||
949 | #ifdef HAVE_CAPSICUM | |
950 | /* | |
951 | * Ensure that, on a dump file's descriptor, we have all the rights | |
952 | * necessary to make the standard I/O library work with an fdopen()ed | |
953 | * FILE * from that descriptor. | |
954 | * | |
ed775ee7 | 955 | * A long time ago in a galaxy far, far away, AT&T decided that, instead |
411677ae AL |
956 | * of providing separate APIs for getting and setting the FD_ flags on a |
957 | * descriptor, getting and setting the O_ flags on a descriptor, and | |
958 | * locking files, they'd throw them all into a kitchen-sink fcntl() call | |
959 | * along the lines of ioctl(), the fact that ioctl() operations are | |
960 | * largely specific to particular character devices but fcntl() operations | |
961 | * are either generic to all descriptors or generic to all descriptors for | |
962 | * regular files nonwithstanding. | |
963 | * | |
964 | * The Capsicum people decided that fine-grained control of descriptor | |
965 | * operations was required, so that you need to grant permission for | |
966 | * reading, writing, seeking, and fcntl-ing. The latter, courtesy of | |
967 | * AT&T's decision, means that "fcntl-ing" isn't a thing, but a motley | |
968 | * collection of things, so there are *individual* fcntls for which | |
969 | * permission needs to be granted. | |
970 | * | |
971 | * The FreeBSD standard I/O people implemented some optimizations that | |
972 | * requires that the standard I/O routines be able to determine whether | |
973 | * the descriptor for the FILE * is open append-only or not; as that | |
974 | * descriptor could have come from an open() rather than an fopen(), | |
975 | * that requires that it be able to do an F_GETFL fcntl() to read | |
976 | * the O_ flags. | |
977 | * | |
978 | * Tcpdump uses ftell() to determine how much data has been written | |
979 | * to a file in order to, when used with -C, determine when it's time | |
980 | * to rotate capture files. ftell() therefore needs to do an lseek() | |
981 | * to find out the file offset and must, thanks to the aforementioned | |
982 | * optimization, also know whether the descriptor is open append-only | |
983 | * or not. | |
984 | * | |
985 | * The net result of all the above is that we need to grant CAP_SEEK, | |
986 | * CAP_WRITE, and CAP_FCNTL with the CAP_FCNTL_GETFL subcapability. | |
987 | * | |
988 | * Perhaps this is the universe's way of saying that either | |
989 | * | |
990 | * 1) there needs to be an fopenat() call and a pcap_dump_openat() call | |
991 | * using it, so that Capsicum-capable tcpdump wouldn't need to do | |
992 | * an fdopen() | |
993 | * | |
994 | * or | |
995 | * | |
996 | * 2) there needs to be a cap_fdopen() call in the FreeBSD standard | |
997 | * I/O library that knows what rights are needed by the standard | |
998 | * I/O library, based on the open mode, and assigns them, perhaps | |
999 | * with an additional argument indicating, for example, whether | |
1000 | * seeking should be allowed, so that tcpdump doesn't need to know | |
1001 | * what the standard I/O library happens to require this week. | |
1002 | */ | |
1003 | static void | |
1004 | set_dumper_capsicum_rights(pcap_dumper_t *p) | |
1005 | { | |
1006 | int fd = fileno(pcap_dump_file(p)); | |
1007 | cap_rights_t rights; | |
1008 | ||
1009 | cap_rights_init(&rights, CAP_SEEK, CAP_WRITE, CAP_FCNTL); | |
1010 | if (cap_rights_limit(fd, &rights) < 0 && errno != ENOSYS) { | |
1011 | error("unable to limit dump descriptor"); | |
1012 | } | |
1013 | if (cap_fcntls_limit(fd, CAP_FCNTL_GETFL) < 0 && errno != ENOSYS) { | |
1014 | error("unable to limit dump descriptor fcntls"); | |
1015 | } | |
1016 | } | |
1017 | #endif | |
1018 | ||
1019 | /* | |
1020 | * Copy arg vector into a new buffer, concatenating arguments with spaces. | |
1021 | */ | |
1022 | static char * | |
ed775ee7 | 1023 | copy_argv(char **argv) |
411677ae | 1024 | { |
ed775ee7 AHJ |
1025 | char **p; |
1026 | size_t len = 0; | |
411677ae AL |
1027 | char *buf; |
1028 | char *src, *dst; | |
1029 | ||
1030 | p = argv; | |
1031 | if (*p == NULL) | |
1032 | return 0; | |
1033 | ||
1034 | while (*p) | |
1035 | len += strlen(*p++) + 1; | |
1036 | ||
1037 | buf = (char *)malloc(len); | |
1038 | if (buf == NULL) | |
ed775ee7 | 1039 | error("%s: malloc", __func__); |
411677ae AL |
1040 | |
1041 | p = argv; | |
1042 | dst = buf; | |
1043 | while ((src = *p++) != NULL) { | |
1044 | while ((*dst++ = *src++) != '\0') | |
1045 | ; | |
1046 | dst[-1] = ' '; | |
1047 | } | |
1048 | dst[-1] = '\0'; | |
1049 | ||
1050 | return buf; | |
1051 | } | |
1052 | ||
1053 | /* | |
1054 | * On Windows, we need to open the file in binary mode, so that | |
1055 | * we get all the bytes specified by the size we get from "fstat()". | |
1056 | * On UNIX, that's not necessary. O_BINARY is defined on Windows; | |
1057 | * we define it as 0 if it's not defined, so it does nothing. | |
1058 | */ | |
1059 | #ifndef O_BINARY | |
1060 | #define O_BINARY 0 | |
1061 | #endif | |
1062 | ||
1063 | static char * | |
1064 | read_infile(char *fname) | |
1065 | { | |
ed775ee7 AHJ |
1066 | int i, fd; |
1067 | ssize_t cc; | |
1068 | char *cp; | |
1069 | our_statb buf; | |
411677ae AL |
1070 | |
1071 | fd = open(fname, O_RDONLY|O_BINARY); | |
1072 | if (fd < 0) | |
1073 | error("can't open %s: %s", fname, pcap_strerror(errno)); | |
1074 | ||
ed775ee7 | 1075 | if (our_fstat(fd, &buf) < 0) |
411677ae AL |
1076 | error("can't stat %s: %s", fname, pcap_strerror(errno)); |
1077 | ||
ed775ee7 AHJ |
1078 | /* |
1079 | * Reject files whose size doesn't fit into an int; a filter | |
1080 | * *that* large will probably be too big. | |
1081 | */ | |
1082 | if (buf.st_size > INT_MAX) | |
1083 | error("%s is too large", fname); | |
1084 | ||
411677ae AL |
1085 | cp = malloc((u_int)buf.st_size + 1); |
1086 | if (cp == NULL) | |
1087 | error("malloc(%d) for %s: %s", (u_int)buf.st_size + 1, | |
1088 | fname, pcap_strerror(errno)); | |
1089 | cc = read(fd, cp, (u_int)buf.st_size); | |
1090 | if (cc < 0) | |
1091 | error("read %s: %s", fname, pcap_strerror(errno)); | |
1092 | if (cc != buf.st_size) | |
ed775ee7 AHJ |
1093 | error("short read %s (%d != %d)", fname, (int) cc, |
1094 | (int)buf.st_size); | |
411677ae AL |
1095 | |
1096 | close(fd); | |
1097 | /* replace "# comment" with spaces */ | |
1098 | for (i = 0; i < cc; i++) { | |
1099 | if (cp[i] == '#') | |
1100 | while (i < cc && cp[i] != '\n') | |
1101 | cp[i++] = ' '; | |
1102 | } | |
1103 | cp[cc] = '\0'; | |
1104 | return (cp); | |
1105 | } | |
1106 | ||
1107 | #ifdef HAVE_PCAP_FINDALLDEVS | |
1108 | static long | |
1109 | parse_interface_number(const char *device) | |
1110 | { | |
ed775ee7 | 1111 | const char *p; |
411677ae AL |
1112 | long devnum; |
1113 | char *end; | |
1114 | ||
ed775ee7 AHJ |
1115 | /* |
1116 | * Search for a colon, terminating any scheme at the beginning | |
1117 | * of the device. | |
1118 | */ | |
1119 | p = strchr(device, ':'); | |
1120 | if (p != NULL) { | |
1121 | /* | |
1122 | * We found it. Is it followed by "//"? | |
1123 | */ | |
1124 | p++; /* skip the : */ | |
1125 | if (strncmp(p, "//", 2) == 0) { | |
1126 | /* | |
1127 | * Yes. Search for the next /, at the end of the | |
1128 | * authority part of the URL. | |
1129 | */ | |
1130 | p += 2; /* skip the // */ | |
1131 | p = strchr(p, '/'); | |
1132 | if (p != NULL) { | |
1133 | /* | |
1134 | * OK, past the / is the path. | |
1135 | */ | |
1136 | device = p + 1; | |
1137 | } | |
1138 | } | |
1139 | } | |
411677ae AL |
1140 | devnum = strtol(device, &end, 10); |
1141 | if (device != end && *end == '\0') { | |
1142 | /* | |
1143 | * It's all-numeric, but is it a valid number? | |
1144 | */ | |
1145 | if (devnum <= 0) { | |
1146 | /* | |
1147 | * No, it's not an ordinal. | |
1148 | */ | |
1149 | error("Invalid adapter index"); | |
1150 | } | |
1151 | return (devnum); | |
1152 | } else { | |
1153 | /* | |
1154 | * It's not all-numeric; return -1, so our caller | |
1155 | * knows that. | |
1156 | */ | |
1157 | return (-1); | |
1158 | } | |
1159 | } | |
1160 | ||
1161 | static char * | |
ed775ee7 AHJ |
1162 | find_interface_by_number(const char *url |
1163 | #ifndef HAVE_PCAP_FINDALLDEVS_EX | |
1164 | _U_ | |
1165 | #endif | |
1166 | , long devnum) | |
411677ae AL |
1167 | { |
1168 | pcap_if_t *dev, *devlist; | |
1169 | long i; | |
1170 | char ebuf[PCAP_ERRBUF_SIZE]; | |
1171 | char *device; | |
ed775ee7 AHJ |
1172 | #ifdef HAVE_PCAP_FINDALLDEVS_EX |
1173 | const char *endp; | |
1174 | char *host_url; | |
1175 | #endif | |
1176 | int status; | |
411677ae | 1177 | |
ed775ee7 AHJ |
1178 | #ifdef HAVE_PCAP_FINDALLDEVS_EX |
1179 | /* | |
1180 | * Search for a colon, terminating any scheme at the beginning | |
1181 | * of the URL. | |
1182 | */ | |
1183 | endp = strchr(url, ':'); | |
1184 | if (endp != NULL) { | |
1185 | /* | |
1186 | * We found it. Is it followed by "//"? | |
1187 | */ | |
1188 | endp++; /* skip the : */ | |
1189 | if (strncmp(endp, "//", 2) == 0) { | |
1190 | /* | |
1191 | * Yes. Search for the next /, at the end of the | |
1192 | * authority part of the URL. | |
1193 | */ | |
1194 | endp += 2; /* skip the // */ | |
1195 | endp = strchr(endp, '/'); | |
1196 | } else | |
1197 | endp = NULL; | |
1198 | } | |
1199 | if (endp != NULL) { | |
1200 | /* | |
1201 | * OK, everything from device to endp is a URL to hand | |
1202 | * to pcap_findalldevs_ex(). | |
1203 | */ | |
1204 | endp++; /* Include the trailing / in the URL; pcap_findalldevs_ex() requires it */ | |
1205 | host_url = malloc(endp - url + 1); | |
1206 | if (host_url == NULL && (endp - url + 1) > 0) | |
1207 | error("Invalid allocation for host"); | |
1208 | ||
1209 | memcpy(host_url, url, endp - url); | |
1210 | host_url[endp - url] = '\0'; | |
1211 | status = pcap_findalldevs_ex(host_url, NULL, &devlist, ebuf); | |
1212 | free(host_url); | |
1213 | } else | |
1214 | #endif | |
1215 | status = pcap_findalldevs(&devlist, ebuf); | |
1216 | if (status < 0) | |
411677ae AL |
1217 | error("%s", ebuf); |
1218 | /* | |
1219 | * Look for the devnum-th entry in the list of devices (1-based). | |
1220 | */ | |
1221 | for (i = 0, dev = devlist; i < devnum-1 && dev != NULL; | |
1222 | i++, dev = dev->next) | |
1223 | ; | |
1224 | if (dev == NULL) | |
1225 | error("Invalid adapter index"); | |
1226 | device = strdup(dev->name); | |
1227 | pcap_freealldevs(devlist); | |
1228 | return (device); | |
1229 | } | |
1230 | #endif | |
1231 | ||
ed775ee7 AHJ |
1232 | #ifdef HAVE_PCAP_OPEN |
1233 | /* | |
1234 | * Prefixes for rpcap URLs. | |
1235 | */ | |
1236 | static char rpcap_prefix[] = "rpcap://"; | |
1237 | static char rpcap_ssl_prefix[] = "rpcaps://"; | |
1238 | #endif | |
1239 | ||
411677ae AL |
1240 | static pcap_t * |
1241 | open_interface(const char *device, netdissect_options *ndo, char *ebuf) | |
1242 | { | |
1243 | pcap_t *pc; | |
1244 | #ifdef HAVE_PCAP_CREATE | |
1245 | int status; | |
1246 | char *cp; | |
1247 | #endif | |
1248 | ||
ed775ee7 AHJ |
1249 | #ifdef HAVE_PCAP_OPEN |
1250 | /* | |
1251 | * Is this an rpcap URL? | |
1252 | */ | |
1253 | if (strncmp(device, rpcap_prefix, sizeof(rpcap_prefix) - 1) == 0 || | |
1254 | strncmp(device, rpcap_ssl_prefix, sizeof(rpcap_ssl_prefix) - 1) == 0) { | |
1255 | /* | |
1256 | * Yes. Open it with pcap_open(). | |
1257 | */ | |
1258 | *ebuf = '\0'; | |
1259 | pc = pcap_open(device, ndo->ndo_snaplen, | |
1260 | pflag ? 0 : PCAP_OPENFLAG_PROMISCUOUS, timeout, NULL, | |
1261 | ebuf); | |
1262 | if (pc == NULL) { | |
1263 | /* | |
1264 | * If this failed with "No such device" or "The system | |
1265 | * cannot find the device specified", that means | |
1266 | * the interface doesn't exist; return NULL, so that | |
1267 | * the caller can see whether the device name is | |
1268 | * actually an interface index. | |
1269 | */ | |
1270 | if (strstr(ebuf, "No such device") != NULL || | |
1271 | strstr(ebuf, "The system cannot find the device specified") != NULL) | |
1272 | return (NULL); | |
1273 | error("%s", ebuf); | |
1274 | } | |
1275 | if (*ebuf) | |
1276 | warning("%s", ebuf); | |
1277 | return (pc); | |
1278 | } | |
1279 | #endif /* HAVE_PCAP_OPEN */ | |
1280 | ||
411677ae AL |
1281 | #ifdef HAVE_PCAP_CREATE |
1282 | pc = pcap_create(device, ebuf); | |
1283 | if (pc == NULL) { | |
1284 | /* | |
1285 | * If this failed with "No such device", that means | |
1286 | * the interface doesn't exist; return NULL, so that | |
1287 | * the caller can see whether the device name is | |
1288 | * actually an interface index. | |
1289 | */ | |
1290 | if (strstr(ebuf, "No such device") != NULL) | |
1291 | return (NULL); | |
1292 | error("%s", ebuf); | |
1293 | } | |
1294 | #ifdef HAVE_PCAP_SET_TSTAMP_TYPE | |
1295 | if (Jflag) | |
1296 | show_tstamp_types_and_exit(pc, device); | |
1297 | #endif | |
1298 | #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION | |
1299 | status = pcap_set_tstamp_precision(pc, ndo->ndo_tstamp_precision); | |
1300 | if (status != 0) | |
1301 | error("%s: Can't set %ssecond time stamp precision: %s", | |
ed775ee7 AHJ |
1302 | device, |
1303 | tstamp_precision_to_string(ndo->ndo_tstamp_precision), | |
1304 | pcap_statustostr(status)); | |
411677ae AL |
1305 | #endif |
1306 | ||
1307 | #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE | |
1308 | if (immediate_mode) { | |
1309 | status = pcap_set_immediate_mode(pc, 1); | |
1310 | if (status != 0) | |
1311 | error("%s: Can't set immediate mode: %s", | |
ed775ee7 | 1312 | device, pcap_statustostr(status)); |
411677ae AL |
1313 | } |
1314 | #endif | |
1315 | /* | |
1316 | * Is this an interface that supports monitor mode? | |
1317 | */ | |
1318 | if (pcap_can_set_rfmon(pc) == 1) | |
1319 | supports_monitor_mode = 1; | |
1320 | else | |
1321 | supports_monitor_mode = 0; | |
ed775ee7 AHJ |
1322 | if (ndo->ndo_snaplen != 0) { |
1323 | /* | |
1324 | * A snapshot length was explicitly specified; | |
1325 | * use it. | |
1326 | */ | |
1327 | status = pcap_set_snaplen(pc, ndo->ndo_snaplen); | |
1328 | if (status != 0) | |
1329 | error("%s: Can't set snapshot length: %s", | |
1330 | device, pcap_statustostr(status)); | |
1331 | } | |
411677ae AL |
1332 | status = pcap_set_promisc(pc, !pflag); |
1333 | if (status != 0) | |
1334 | error("%s: Can't set promiscuous mode: %s", | |
1335 | device, pcap_statustostr(status)); | |
1336 | if (Iflag) { | |
1337 | status = pcap_set_rfmon(pc, 1); | |
1338 | if (status != 0) | |
1339 | error("%s: Can't set monitor mode: %s", | |
1340 | device, pcap_statustostr(status)); | |
1341 | } | |
ed775ee7 | 1342 | status = pcap_set_timeout(pc, timeout); |
411677ae AL |
1343 | if (status != 0) |
1344 | error("%s: pcap_set_timeout failed: %s", | |
1345 | device, pcap_statustostr(status)); | |
1346 | if (Bflag != 0) { | |
1347 | status = pcap_set_buffer_size(pc, Bflag); | |
1348 | if (status != 0) | |
1349 | error("%s: Can't set buffer size: %s", | |
1350 | device, pcap_statustostr(status)); | |
1351 | } | |
1352 | #ifdef HAVE_PCAP_SET_TSTAMP_TYPE | |
1353 | if (jflag != -1) { | |
1354 | status = pcap_set_tstamp_type(pc, jflag); | |
1355 | if (status < 0) | |
1356 | error("%s: Can't set time stamp type: %s", | |
ed775ee7 | 1357 | device, pcap_statustostr(status)); |
411677ae AL |
1358 | else if (status > 0) |
1359 | warning("When trying to set timestamp type '%s' on %s: %s", | |
ed775ee7 AHJ |
1360 | pcap_tstamp_type_val_to_name(jflag), device, |
1361 | pcap_statustostr(status)); | |
411677ae AL |
1362 | } |
1363 | #endif | |
1364 | status = pcap_activate(pc); | |
1365 | if (status < 0) { | |
1366 | /* | |
1367 | * pcap_activate() failed. | |
1368 | */ | |
1369 | cp = pcap_geterr(pc); | |
1370 | if (status == PCAP_ERROR) | |
1371 | error("%s", cp); | |
1372 | else if (status == PCAP_ERROR_NO_SUCH_DEVICE) { | |
1373 | /* | |
1374 | * Return an error for our caller to handle. | |
1375 | */ | |
1376 | snprintf(ebuf, PCAP_ERRBUF_SIZE, "%s: %s\n(%s)", | |
1377 | device, pcap_statustostr(status), cp); | |
411677ae AL |
1378 | } else if (status == PCAP_ERROR_PERM_DENIED && *cp != '\0') |
1379 | error("%s: %s\n(%s)", device, | |
1380 | pcap_statustostr(status), cp); | |
ed775ee7 AHJ |
1381 | #ifdef __FreeBSD__ |
1382 | else if (status == PCAP_ERROR_RFMON_NOTSUP && | |
1383 | strncmp(device, "wlan", 4) == 0) { | |
1384 | char parent[8], newdev[8]; | |
1385 | char sysctl[32]; | |
1386 | size_t s = sizeof(parent); | |
1387 | ||
1388 | snprintf(sysctl, sizeof(sysctl), | |
1389 | "net.wlan.%d.%%parent", atoi(device + 4)); | |
1390 | sysctlbyname(sysctl, parent, &s, NULL, 0); | |
1391 | strlcpy(newdev, device, sizeof(newdev)); | |
1392 | /* Suggest a new wlan device. */ | |
1393 | /* FIXME: incrementing the index this way is not going to work well | |
1394 | * when the index is 9 or greater but the only consequence in this | |
1395 | * specific case would be an error message that looks a bit odd. | |
1396 | */ | |
1397 | newdev[strlen(newdev)-1]++; | |
1398 | error("%s is not a monitor mode VAP\n" | |
1399 | "To create a new monitor mode VAP use:\n" | |
1400 | " ifconfig %s create wlandev %s wlanmode monitor\n" | |
1401 | "and use %s as the tcpdump interface", | |
1402 | device, newdev, parent, newdev); | |
1403 | } | |
1404 | #endif | |
411677ae AL |
1405 | else |
1406 | error("%s: %s", device, | |
1407 | pcap_statustostr(status)); | |
ed775ee7 AHJ |
1408 | pcap_close(pc); |
1409 | return (NULL); | |
411677ae AL |
1410 | } else if (status > 0) { |
1411 | /* | |
1412 | * pcap_activate() succeeded, but it's warning us | |
1413 | * of a problem it had. | |
1414 | */ | |
1415 | cp = pcap_geterr(pc); | |
1416 | if (status == PCAP_WARNING) | |
1417 | warning("%s", cp); | |
1418 | else if (status == PCAP_WARNING_PROMISC_NOTSUP && | |
1419 | *cp != '\0') | |
1420 | warning("%s: %s\n(%s)", device, | |
1421 | pcap_statustostr(status), cp); | |
1422 | else | |
1423 | warning("%s: %s", device, | |
1424 | pcap_statustostr(status)); | |
1425 | } | |
1426 | #ifdef HAVE_PCAP_SETDIRECTION | |
1427 | if (Qflag != -1) { | |
1428 | status = pcap_setdirection(pc, Qflag); | |
1429 | if (status != 0) | |
1430 | error("%s: pcap_setdirection() failed: %s", | |
1431 | device, pcap_geterr(pc)); | |
1432 | } | |
1433 | #endif /* HAVE_PCAP_SETDIRECTION */ | |
1434 | #else /* HAVE_PCAP_CREATE */ | |
1435 | *ebuf = '\0'; | |
ed775ee7 AHJ |
1436 | /* |
1437 | * If no snapshot length was specified, or a length of 0 was | |
1438 | * specified, default to 256KB. | |
1439 | */ | |
1440 | if (ndo->ndo_snaplen == 0) | |
1441 | ndo->ndo_snaplen = MAXIMUM_SNAPLEN; | |
1442 | pc = pcap_open_live(device, ndo->ndo_snaplen, !pflag, timeout, ebuf); | |
411677ae AL |
1443 | if (pc == NULL) { |
1444 | /* | |
1445 | * If this failed with "No such device", that means | |
1446 | * the interface doesn't exist; return NULL, so that | |
1447 | * the caller can see whether the device name is | |
1448 | * actually an interface index. | |
1449 | */ | |
1450 | if (strstr(ebuf, "No such device") != NULL) | |
1451 | return (NULL); | |
1452 | error("%s", ebuf); | |
1453 | } | |
1454 | if (*ebuf) | |
1455 | warning("%s", ebuf); | |
1456 | #endif /* HAVE_PCAP_CREATE */ | |
1457 | ||
1458 | return (pc); | |
c8cf0f94 PA |
1459 | } |
1460 | ||
1461 | int | |
1462 | main(int argc, char **argv) | |
1463 | { | |
ed775ee7 AHJ |
1464 | int cnt, op, i; |
1465 | bpf_u_int32 localnet = 0, netmask = 0; | |
1466 | char *cp, *infile, *cmdbuf, *device, *RFileName, *VFileName, *WFileName; | |
1467 | char *endp; | |
c8cf0f94 | 1468 | pcap_handler callback; |
411677ae AL |
1469 | int dlt; |
1470 | const char *dlt_name; | |
c8cf0f94 | 1471 | struct bpf_program fcode; |
411677ae | 1472 | #ifndef _WIN32 |
ed775ee7 | 1473 | void (*oldhandler)(int); |
c8cf0f94 | 1474 | #endif |
c8cf0f94 PA |
1475 | struct dump_info dumpinfo; |
1476 | u_char *pcap_userdata; | |
1477 | char ebuf[PCAP_ERRBUF_SIZE]; | |
411677ae | 1478 | char VFileLine[PATH_MAX + 1]; |
ed775ee7 AHJ |
1479 | const char *username = NULL; |
1480 | #ifndef _WIN32 | |
1481 | const char *chroot_dir = NULL; | |
1482 | #endif | |
411677ae AL |
1483 | char *ret = NULL; |
1484 | char *end; | |
c8cf0f94 | 1485 | #ifdef HAVE_PCAP_FINDALLDEVS |
411677ae AL |
1486 | pcap_if_t *devlist; |
1487 | long devnum; | |
c8cf0f94 PA |
1488 | #endif |
1489 | int status; | |
411677ae AL |
1490 | FILE *VFile; |
1491 | #ifdef HAVE_CAPSICUM | |
1492 | cap_rights_t rights; | |
1493 | int cansandbox; | |
1494 | #endif /* HAVE_CAPSICUM */ | |
1495 | int Oflag = 1; /* run filter code optimizer */ | |
1496 | int yflag_dlt = -1; | |
1497 | const char *yflag_dlt_name = NULL; | |
ed775ee7 | 1498 | int print = 0; |
411677ae AL |
1499 | |
1500 | netdissect_options Ndo; | |
1501 | netdissect_options *ndo = &Ndo; | |
1502 | ||
1503 | /* | |
1504 | * Initialize the netdissect code. | |
1505 | */ | |
ed775ee7 | 1506 | if (nd_init(ebuf, sizeof(ebuf)) == -1) |
411677ae AL |
1507 | error("%s", ebuf); |
1508 | ||
1509 | memset(ndo, 0, sizeof(*ndo)); | |
1510 | ndo_set_function_pointers(ndo); | |
411677ae | 1511 | |
c8cf0f94 PA |
1512 | cnt = -1; |
1513 | device = NULL; | |
1514 | infile = NULL; | |
1515 | RFileName = NULL; | |
411677ae AL |
1516 | VFileName = NULL; |
1517 | VFile = NULL; | |
c8cf0f94 | 1518 | WFileName = NULL; |
411677ae | 1519 | dlt = -1; |
ed775ee7 | 1520 | if ((cp = strrchr(argv[0], PATH_SEPARATOR)) != NULL) |
411677ae | 1521 | ndo->program_name = program_name = cp + 1; |
c8cf0f94 | 1522 | else |
411677ae AL |
1523 | ndo->program_name = program_name = argv[0]; |
1524 | ||
ed775ee7 | 1525 | #if defined(HAVE_PCAP_WSOCKINIT) |
411677ae AL |
1526 | if (pcap_wsockinit() != 0) |
1527 | error("Attempting to initialize Winsock failed"); | |
ed775ee7 AHJ |
1528 | #elif defined(HAVE_WSOCKINIT) |
1529 | if (wsockinit() != 0) | |
1530 | error("Attempting to initialize Winsock failed"); | |
1531 | #endif | |
c8cf0f94 | 1532 | |
411677ae AL |
1533 | /* |
1534 | * On platforms where the CPU doesn't support unaligned loads, | |
1535 | * force unaligned accesses to abort with SIGBUS, rather than | |
1536 | * being fixed up (slowly) by the OS kernel; on those platforms, | |
1537 | * misaligned accesses are bugs, and we want tcpdump to crash so | |
1538 | * that the bugs are reported. | |
1539 | */ | |
c8cf0f94 PA |
1540 | if (abort_on_misalignment(ebuf, sizeof(ebuf)) < 0) |
1541 | error("%s", ebuf); | |
1542 | ||
c8cf0f94 | 1543 | while ( |
411677ae | 1544 | (op = getopt_long(argc, argv, SHORTOPTS, longopts, NULL)) != -1) |
c8cf0f94 PA |
1545 | switch (op) { |
1546 | ||
1547 | case 'a': | |
1548 | /* compatibility for old -a */ | |
1549 | break; | |
1550 | ||
1551 | case 'A': | |
411677ae | 1552 | ++ndo->ndo_Aflag; |
c8cf0f94 PA |
1553 | break; |
1554 | ||
27bfbee1 | 1555 | case 'b': |
411677ae | 1556 | ++ndo->ndo_bflag; |
27bfbee1 PA |
1557 | break; |
1558 | ||
411677ae | 1559 | #if defined(HAVE_PCAP_CREATE) || defined(_WIN32) |
c8cf0f94 | 1560 | case 'B': |
ea7b4bf5 PA |
1561 | Bflag = atoi(optarg)*1024; |
1562 | if (Bflag <= 0) | |
c8cf0f94 PA |
1563 | error("invalid packet buffer size %s", optarg); |
1564 | break; | |
411677ae | 1565 | #endif /* defined(HAVE_PCAP_CREATE) || defined(_WIN32) */ |
c8cf0f94 PA |
1566 | |
1567 | case 'c': | |
1568 | cnt = atoi(optarg); | |
1569 | if (cnt <= 0) | |
1570 | error("invalid packet count %s", optarg); | |
1571 | break; | |
1572 | ||
1573 | case 'C': | |
ed775ee7 AHJ |
1574 | errno = 0; |
1575 | #ifdef HAVE_PCAP_DUMP_FTELL64 | |
1576 | Cflag = strtoint64_t(optarg, &endp, 10); | |
1577 | #else | |
1578 | Cflag = strtol(optarg, &endp, 10); | |
1579 | #endif | |
1580 | if (endp == optarg || *endp != '\0' || errno != 0 | |
1581 | || Cflag <= 0) | |
c8cf0f94 | 1582 | error("invalid file size %s", optarg); |
ed775ee7 AHJ |
1583 | /* |
1584 | * Will multiplying it by 1000000 overflow? | |
1585 | */ | |
1586 | #ifdef HAVE_PCAP_DUMP_FTELL64 | |
1587 | if (Cflag > INT64_T_CONSTANT(0x7fffffffffffffff) / 1000000) | |
1588 | #else | |
1589 | if (Cflag > LONG_MAX / 1000000) | |
1590 | #endif | |
1591 | error("file size %s is too large", optarg); | |
1592 | Cflag *= 1000000; | |
c8cf0f94 PA |
1593 | break; |
1594 | ||
1595 | case 'd': | |
1596 | ++dflag; | |
1597 | break; | |
1598 | ||
ed775ee7 | 1599 | #ifdef HAVE_PCAP_FINDALLDEVS |
c8cf0f94 | 1600 | case 'D': |
411677ae AL |
1601 | Dflag++; |
1602 | break; | |
ed775ee7 AHJ |
1603 | #endif |
1604 | ||
1605 | #ifdef HAVE_PCAP_FINDALLDEVS_EX | |
1606 | case OPTION_LIST_REMOTE_INTERFACES: | |
1607 | remote_interfaces_source = optarg; | |
1608 | break; | |
1609 | #endif | |
c8cf0f94 PA |
1610 | |
1611 | case 'L': | |
1612 | Lflag++; | |
1613 | break; | |
1614 | ||
1615 | case 'e': | |
411677ae | 1616 | ++ndo->ndo_eflag; |
c8cf0f94 PA |
1617 | break; |
1618 | ||
1619 | case 'E': | |
1620 | #ifndef HAVE_LIBCRYPTO | |
1621 | warning("crypto code not compiled in"); | |
1622 | #endif | |
411677ae | 1623 | ndo->ndo_espsecret = optarg; |
c8cf0f94 PA |
1624 | break; |
1625 | ||
1626 | case 'f': | |
411677ae | 1627 | ++ndo->ndo_fflag; |
c8cf0f94 PA |
1628 | break; |
1629 | ||
1630 | case 'F': | |
1631 | infile = optarg; | |
1632 | break; | |
1633 | ||
ea7b4bf5 PA |
1634 | case 'G': |
1635 | Gflag = atoi(optarg); | |
1636 | if (Gflag < 0) | |
1637 | error("invalid number of seconds %s", optarg); | |
1638 | ||
1639 | /* We will create one file initially. */ | |
1640 | Gflag_count = 0; | |
1641 | ||
1642 | /* Grab the current time for rotation use. */ | |
1643 | if ((Gflag_time = time(NULL)) == (time_t)-1) { | |
ed775ee7 AHJ |
1644 | error("%s: can't get current time: %s", |
1645 | __func__, pcap_strerror(errno)); | |
ea7b4bf5 PA |
1646 | } |
1647 | break; | |
1648 | ||
27bfbee1 | 1649 | case 'h': |
ed775ee7 AHJ |
1650 | print_usage(stdout); |
1651 | exit_tcpdump(S_SUCCESS); | |
27bfbee1 PA |
1652 | break; |
1653 | ||
1654 | case 'H': | |
411677ae | 1655 | ++ndo->ndo_Hflag; |
27bfbee1 PA |
1656 | break; |
1657 | ||
c8cf0f94 | 1658 | case 'i': |
c8cf0f94 PA |
1659 | device = optarg; |
1660 | break; | |
1661 | ||
ea7b4bf5 PA |
1662 | #ifdef HAVE_PCAP_CREATE |
1663 | case 'I': | |
1664 | ++Iflag; | |
1665 | break; | |
1666 | #endif /* HAVE_PCAP_CREATE */ | |
1667 | ||
27bfbee1 PA |
1668 | #ifdef HAVE_PCAP_SET_TSTAMP_TYPE |
1669 | case 'j': | |
1670 | jflag = pcap_tstamp_type_name_to_val(optarg); | |
1671 | if (jflag < 0) | |
1672 | error("invalid time stamp type %s", optarg); | |
1673 | break; | |
1674 | ||
1675 | case 'J': | |
1676 | Jflag++; | |
1677 | break; | |
1678 | #endif | |
1679 | ||
c8cf0f94 | 1680 | case 'l': |
411677ae | 1681 | #ifdef _WIN32 |
c8cf0f94 PA |
1682 | /* |
1683 | * _IOLBF is the same as _IOFBF in Microsoft's C | |
1684 | * libraries; the only alternative they offer | |
1685 | * is _IONBF. | |
1686 | * | |
1687 | * XXX - this should really be checking for MSVC++, | |
411677ae | 1688 | * not _WIN32, if, for example, MinGW has its own |
c8cf0f94 PA |
1689 | * C library that is more UNIX-compatible. |
1690 | */ | |
1691 | setvbuf(stdout, NULL, _IONBF, 0); | |
411677ae | 1692 | #else /* _WIN32 */ |
c8cf0f94 PA |
1693 | #ifdef HAVE_SETLINEBUF |
1694 | setlinebuf(stdout); | |
1695 | #else | |
1696 | setvbuf(stdout, NULL, _IOLBF, 0); | |
1697 | #endif | |
411677ae | 1698 | #endif /* _WIN32 */ |
ed775ee7 | 1699 | lflag = 1; |
c8cf0f94 PA |
1700 | break; |
1701 | ||
ea7b4bf5 | 1702 | case 'K': |
411677ae | 1703 | ++ndo->ndo_Kflag; |
c8cf0f94 PA |
1704 | break; |
1705 | ||
1706 | case 'm': | |
411677ae | 1707 | if (nd_have_smi_support()) { |
ed775ee7 | 1708 | if (nd_load_smi_module(optarg, ebuf, sizeof(ebuf)) == -1) |
411677ae AL |
1709 | error("%s", ebuf); |
1710 | } else { | |
1711 | (void)fprintf(stderr, "%s: ignoring option `-m %s' ", | |
1712 | program_name, optarg); | |
1713 | (void)fprintf(stderr, "(no libsmi support)\n"); | |
ea7b4bf5 | 1714 | } |
c8cf0f94 PA |
1715 | break; |
1716 | ||
1717 | case 'M': | |
1718 | /* TCP-MD5 shared secret */ | |
1719 | #ifndef HAVE_LIBCRYPTO | |
1720 | warning("crypto code not compiled in"); | |
1721 | #endif | |
411677ae | 1722 | ndo->ndo_sigsecret = optarg; |
c8cf0f94 PA |
1723 | break; |
1724 | ||
ea7b4bf5 | 1725 | case 'n': |
411677ae | 1726 | ++ndo->ndo_nflag; |
ea7b4bf5 PA |
1727 | break; |
1728 | ||
1729 | case 'N': | |
411677ae | 1730 | ++ndo->ndo_Nflag; |
ea7b4bf5 PA |
1731 | break; |
1732 | ||
c8cf0f94 PA |
1733 | case 'O': |
1734 | Oflag = 0; | |
1735 | break; | |
1736 | ||
1737 | case 'p': | |
1738 | ++pflag; | |
1739 | break; | |
1740 | ||
1741 | case 'q': | |
411677ae AL |
1742 | ++ndo->ndo_qflag; |
1743 | ++ndo->ndo_suppress_default_print; | |
c8cf0f94 PA |
1744 | break; |
1745 | ||
411677ae AL |
1746 | #ifdef HAVE_PCAP_SETDIRECTION |
1747 | case 'Q': | |
1748 | if (ascii_strcasecmp(optarg, "in") == 0) | |
1749 | Qflag = PCAP_D_IN; | |
1750 | else if (ascii_strcasecmp(optarg, "out") == 0) | |
1751 | Qflag = PCAP_D_OUT; | |
1752 | else if (ascii_strcasecmp(optarg, "inout") == 0) | |
1753 | Qflag = PCAP_D_INOUT; | |
1754 | else | |
1755 | error("unknown capture direction `%s'", optarg); | |
c8cf0f94 | 1756 | break; |
411677ae | 1757 | #endif /* HAVE_PCAP_SETDIRECTION */ |
c8cf0f94 | 1758 | |
411677ae AL |
1759 | case 'r': |
1760 | RFileName = optarg; | |
c8cf0f94 PA |
1761 | break; |
1762 | ||
411677ae | 1763 | case 's': |
ed775ee7 | 1764 | ndo->ndo_snaplen = (int)strtol(optarg, &end, 0); |
c8cf0f94 | 1765 | if (optarg == end || *end != '\0' |
411677ae | 1766 | || ndo->ndo_snaplen < 0 || ndo->ndo_snaplen > MAXIMUM_SNAPLEN) |
ed775ee7 AHJ |
1767 | error("invalid snaplen %s (must be >= 0 and <= %d)", |
1768 | optarg, MAXIMUM_SNAPLEN); | |
c8cf0f94 | 1769 | break; |
c8cf0f94 PA |
1770 | |
1771 | case 'S': | |
411677ae | 1772 | ++ndo->ndo_Sflag; |
c8cf0f94 PA |
1773 | break; |
1774 | ||
1775 | case 't': | |
411677ae | 1776 | ++ndo->ndo_tflag; |
c8cf0f94 PA |
1777 | break; |
1778 | ||
1779 | case 'T': | |
411677ae AL |
1780 | if (ascii_strcasecmp(optarg, "vat") == 0) |
1781 | ndo->ndo_packettype = PT_VAT; | |
1782 | else if (ascii_strcasecmp(optarg, "wb") == 0) | |
1783 | ndo->ndo_packettype = PT_WB; | |
1784 | else if (ascii_strcasecmp(optarg, "rpc") == 0) | |
1785 | ndo->ndo_packettype = PT_RPC; | |
1786 | else if (ascii_strcasecmp(optarg, "rtp") == 0) | |
1787 | ndo->ndo_packettype = PT_RTP; | |
1788 | else if (ascii_strcasecmp(optarg, "rtcp") == 0) | |
1789 | ndo->ndo_packettype = PT_RTCP; | |
1790 | else if (ascii_strcasecmp(optarg, "snmp") == 0) | |
1791 | ndo->ndo_packettype = PT_SNMP; | |
1792 | else if (ascii_strcasecmp(optarg, "cnfp") == 0) | |
1793 | ndo->ndo_packettype = PT_CNFP; | |
1794 | else if (ascii_strcasecmp(optarg, "tftp") == 0) | |
1795 | ndo->ndo_packettype = PT_TFTP; | |
1796 | else if (ascii_strcasecmp(optarg, "aodv") == 0) | |
1797 | ndo->ndo_packettype = PT_AODV; | |
1798 | else if (ascii_strcasecmp(optarg, "carp") == 0) | |
1799 | ndo->ndo_packettype = PT_CARP; | |
1800 | else if (ascii_strcasecmp(optarg, "radius") == 0) | |
1801 | ndo->ndo_packettype = PT_RADIUS; | |
1802 | else if (ascii_strcasecmp(optarg, "zmtp1") == 0) | |
1803 | ndo->ndo_packettype = PT_ZMTP1; | |
1804 | else if (ascii_strcasecmp(optarg, "vxlan") == 0) | |
1805 | ndo->ndo_packettype = PT_VXLAN; | |
1806 | else if (ascii_strcasecmp(optarg, "pgm") == 0) | |
1807 | ndo->ndo_packettype = PT_PGM; | |
1808 | else if (ascii_strcasecmp(optarg, "pgm_zmtp1") == 0) | |
1809 | ndo->ndo_packettype = PT_PGM_ZMTP1; | |
1810 | else if (ascii_strcasecmp(optarg, "lmp") == 0) | |
1811 | ndo->ndo_packettype = PT_LMP; | |
1812 | else if (ascii_strcasecmp(optarg, "resp") == 0) | |
1813 | ndo->ndo_packettype = PT_RESP; | |
ed775ee7 AHJ |
1814 | else if (ascii_strcasecmp(optarg, "ptp") == 0) |
1815 | ndo->ndo_packettype = PT_PTP; | |
1816 | else if (ascii_strcasecmp(optarg, "someip") == 0) | |
1817 | ndo->ndo_packettype = PT_SOMEIP; | |
1818 | else if (ascii_strcasecmp(optarg, "domain") == 0) | |
1819 | ndo->ndo_packettype = PT_DOMAIN; | |
c8cf0f94 PA |
1820 | else |
1821 | error("unknown packet type `%s'", optarg); | |
1822 | break; | |
1823 | ||
1824 | case 'u': | |
411677ae | 1825 | ++ndo->ndo_uflag; |
c8cf0f94 PA |
1826 | break; |
1827 | ||
1828 | #ifdef HAVE_PCAP_DUMP_FLUSH | |
1829 | case 'U': | |
1830 | ++Uflag; | |
1831 | break; | |
1832 | #endif | |
1833 | ||
1834 | case 'v': | |
411677ae AL |
1835 | ++ndo->ndo_vflag; |
1836 | break; | |
1837 | ||
1838 | case 'V': | |
1839 | VFileName = optarg; | |
c8cf0f94 PA |
1840 | break; |
1841 | ||
1842 | case 'w': | |
1843 | WFileName = optarg; | |
1844 | break; | |
1845 | ||
1846 | case 'W': | |
1847 | Wflag = atoi(optarg); | |
411677ae | 1848 | if (Wflag <= 0) |
c8cf0f94 PA |
1849 | error("invalid number of output files %s", optarg); |
1850 | WflagChars = getWflagChars(Wflag); | |
1851 | break; | |
1852 | ||
1853 | case 'x': | |
411677ae AL |
1854 | ++ndo->ndo_xflag; |
1855 | ++ndo->ndo_suppress_default_print; | |
c8cf0f94 PA |
1856 | break; |
1857 | ||
1858 | case 'X': | |
411677ae AL |
1859 | ++ndo->ndo_Xflag; |
1860 | ++ndo->ndo_suppress_default_print; | |
c8cf0f94 PA |
1861 | break; |
1862 | ||
1863 | case 'y': | |
411677ae AL |
1864 | yflag_dlt_name = optarg; |
1865 | yflag_dlt = | |
1866 | pcap_datalink_name_to_val(yflag_dlt_name); | |
1867 | if (yflag_dlt < 0) | |
1868 | error("invalid data link type %s", yflag_dlt_name); | |
c8cf0f94 PA |
1869 | break; |
1870 | ||
411677ae | 1871 | #ifdef HAVE_PCAP_SET_PARSER_DEBUG |
c8cf0f94 PA |
1872 | case 'Y': |
1873 | { | |
1874 | /* Undocumented flag */ | |
411677ae | 1875 | pcap_set_parser_debug(1); |
c8cf0f94 PA |
1876 | } |
1877 | break; | |
1878 | #endif | |
ea7b4bf5 | 1879 | case 'z': |
411677ae | 1880 | zflag = optarg; |
ea7b4bf5 PA |
1881 | break; |
1882 | ||
c8cf0f94 | 1883 | case 'Z': |
411677ae AL |
1884 | username = optarg; |
1885 | break; | |
1886 | ||
1887 | case '#': | |
1888 | ndo->ndo_packet_number = 1; | |
1889 | break; | |
1890 | ||
1891 | case OPTION_VERSION: | |
ed775ee7 AHJ |
1892 | print_version(stdout); |
1893 | exit_tcpdump(S_SUCCESS); | |
c8cf0f94 PA |
1894 | break; |
1895 | ||
411677ae AL |
1896 | #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION |
1897 | case OPTION_TSTAMP_PRECISION: | |
1898 | ndo->ndo_tstamp_precision = tstamp_precision_from_string(optarg); | |
1899 | if (ndo->ndo_tstamp_precision < 0) | |
1900 | error("unsupported time stamp precision"); | |
1901 | break; | |
1902 | #endif | |
1903 | ||
1904 | #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE | |
1905 | case OPTION_IMMEDIATE_MODE: | |
1906 | immediate_mode = 1; | |
1907 | break; | |
1908 | #endif | |
1909 | ||
ed775ee7 AHJ |
1910 | case OPTION_PRINT: |
1911 | print = 1; | |
1912 | break; | |
1913 | ||
1914 | #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION | |
1915 | case OPTION_TSTAMP_MICRO: | |
1916 | ndo->ndo_tstamp_precision = PCAP_TSTAMP_PRECISION_MICRO; | |
1917 | break; | |
1918 | ||
1919 | case OPTION_TSTAMP_NANO: | |
1920 | ndo->ndo_tstamp_precision = PCAP_TSTAMP_PRECISION_NANO; | |
1921 | break; | |
1922 | #endif | |
1923 | ||
1924 | case OPTION_FP_TYPE: | |
1925 | /* | |
1926 | * Print out the type of floating-point arithmetic | |
1927 | * we're doing; it's probably IEEE, unless somebody | |
1928 | * tries to run this on a VAX, but the precision | |
1929 | * may differ (e.g., it might be 32-bit, 64-bit, | |
1930 | * or 80-bit). | |
1931 | */ | |
1932 | float_type_check(0x4e93312d); | |
1933 | return 0; | |
1934 | ||
1935 | case OPTION_COUNT: | |
1936 | count_mode = 1; | |
1937 | break; | |
1938 | ||
c8cf0f94 | 1939 | default: |
ed775ee7 AHJ |
1940 | print_usage(stderr); |
1941 | exit_tcpdump(S_ERR_HOST_PROGRAM); | |
c8cf0f94 PA |
1942 | /* NOTREACHED */ |
1943 | } | |
1944 | ||
411677ae AL |
1945 | #ifdef HAVE_PCAP_FINDALLDEVS |
1946 | if (Dflag) | |
1947 | show_devices_and_exit(); | |
1948 | #endif | |
ed775ee7 AHJ |
1949 | #ifdef HAVE_PCAP_FINDALLDEVS_EX |
1950 | if (remote_interfaces_source != NULL) | |
1951 | show_remote_devices_and_exit(); | |
1952 | #endif | |
1953 | ||
1954 | #if defined(DLT_LINUX_SLL2) && defined(HAVE_PCAP_SET_DATALINK) | |
1955 | /* Set default linktype DLT_LINUX_SLL2 when capturing on the "any" device */ | |
1956 | if (device != NULL && | |
1957 | strncmp (device, "any", strlen("any")) == 0 | |
1958 | && yflag_dlt == -1) | |
1959 | yflag_dlt = DLT_LINUX_SLL2; | |
1960 | #endif | |
411677ae AL |
1961 | |
1962 | switch (ndo->ndo_tflag) { | |
c8cf0f94 PA |
1963 | |
1964 | case 0: /* Default */ | |
c8cf0f94 PA |
1965 | case 1: /* No time stamp */ |
1966 | case 2: /* Unix timeval style */ | |
ed775ee7 AHJ |
1967 | case 3: /* Microseconds/nanoseconds since previous packet */ |
1968 | case 4: /* Date + Default */ | |
1969 | case 5: /* Microseconds/nanoseconds since first packet */ | |
c8cf0f94 PA |
1970 | break; |
1971 | ||
1972 | default: /* Not supported */ | |
ea7b4bf5 | 1973 | error("only -t, -tt, -ttt, -tttt and -ttttt are supported"); |
c8cf0f94 PA |
1974 | break; |
1975 | } | |
1976 | ||
411677ae AL |
1977 | if (ndo->ndo_fflag != 0 && (VFileName != NULL || RFileName != NULL)) |
1978 | error("-f can not be used with -V or -r"); | |
1979 | ||
1980 | if (VFileName != NULL && RFileName != NULL) | |
1981 | error("-V and -r are mutually exclusive."); | |
1982 | ||
411677ae | 1983 | /* |
ed775ee7 AHJ |
1984 | * If we're printing dissected packets to the standard output, |
1985 | * and either the standard output is a terminal or we're doing | |
1986 | * "line" buffering, set the capture timeout to .1 second rather | |
1987 | * than 1 second, as the user's probably expecting to see packets | |
1988 | * pop up immediately shortly after they arrive. | |
1989 | * | |
1990 | * XXX - would there be some value appropriate for all cases, | |
1991 | * based on, say, the buffer size and packet input rate? | |
411677ae | 1992 | */ |
ed775ee7 AHJ |
1993 | if ((WFileName == NULL || print) && (isatty(1) || lflag)) |
1994 | timeout = 100; | |
411677ae | 1995 | |
c8cf0f94 PA |
1996 | #ifdef WITH_CHROOT |
1997 | /* if run as root, prepare for chrooting */ | |
1998 | if (getuid() == 0 || geteuid() == 0) { | |
1999 | /* future extensibility for cmd-line arguments */ | |
2000 | if (!chroot_dir) | |
2001 | chroot_dir = WITH_CHROOT; | |
2002 | } | |
2003 | #endif | |
2004 | ||
2005 | #ifdef WITH_USER | |
2006 | /* if run as root, prepare for dropping root privileges */ | |
2007 | if (getuid() == 0 || geteuid() == 0) { | |
411677ae | 2008 | /* Run with '-Z root' to restore old behaviour */ |
c8cf0f94 PA |
2009 | if (!username) |
2010 | username = WITH_USER; | |
2011 | } | |
2012 | #endif | |
2013 | ||
411677ae AL |
2014 | if (RFileName != NULL || VFileName != NULL) { |
2015 | /* | |
2016 | * If RFileName is non-null, it's the pathname of a | |
2017 | * savefile to read. If VFileName is non-null, it's | |
2018 | * the pathname of a file containing a list of pathnames | |
2019 | * (one per line) of savefiles to read. | |
2020 | * | |
2021 | * In either case, we're reading a savefile, not doing | |
2022 | * a live capture. | |
2023 | */ | |
2024 | #ifndef _WIN32 | |
c8cf0f94 PA |
2025 | /* |
2026 | * We don't need network access, so relinquish any set-UID | |
2027 | * or set-GID privileges we have (if any). | |
2028 | * | |
2029 | * We do *not* want set-UID privileges when opening a | |
2030 | * trace file, as that might let the user read other | |
2031 | * people's trace files (especially if we're set-UID | |
2032 | * root). | |
2033 | */ | |
2034 | if (setgid(getgid()) != 0 || setuid(getuid()) != 0 ) | |
2035 | fprintf(stderr, "Warning: setgid/setuid failed !\n"); | |
411677ae AL |
2036 | #endif /* _WIN32 */ |
2037 | if (VFileName != NULL) { | |
2038 | if (VFileName[0] == '-' && VFileName[1] == '\0') | |
2039 | VFile = stdin; | |
2040 | else | |
2041 | VFile = fopen(VFileName, "r"); | |
2042 | ||
2043 | if (VFile == NULL) | |
2044 | error("Unable to open file: %s\n", pcap_strerror(errno)); | |
2045 | ||
2046 | ret = get_next_file(VFile, VFileLine); | |
2047 | if (!ret) | |
2048 | error("Nothing in %s\n", VFileName); | |
2049 | RFileName = VFileLine; | |
2050 | } | |
2051 | ||
2052 | #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION | |
2053 | pd = pcap_open_offline_with_tstamp_precision(RFileName, | |
2054 | ndo->ndo_tstamp_precision, ebuf); | |
2055 | #else | |
c8cf0f94 | 2056 | pd = pcap_open_offline(RFileName, ebuf); |
411677ae AL |
2057 | #endif |
2058 | ||
c8cf0f94 PA |
2059 | if (pd == NULL) |
2060 | error("%s", ebuf); | |
411677ae AL |
2061 | #ifdef HAVE_CAPSICUM |
2062 | cap_rights_init(&rights, CAP_READ); | |
2063 | if (cap_rights_limit(fileno(pcap_file(pd)), &rights) < 0 && | |
2064 | errno != ENOSYS) { | |
2065 | error("unable to limit pcap descriptor"); | |
2066 | } | |
2067 | #endif | |
c8cf0f94 PA |
2068 | dlt = pcap_datalink(pd); |
2069 | dlt_name = pcap_datalink_val_to_name(dlt); | |
ed775ee7 | 2070 | fprintf(stderr, "reading from file %s", RFileName); |
c8cf0f94 | 2071 | if (dlt_name == NULL) { |
ed775ee7 | 2072 | fprintf(stderr, ", link-type %u", dlt); |
c8cf0f94 | 2073 | } else { |
ed775ee7 AHJ |
2074 | fprintf(stderr, ", link-type %s (%s)", dlt_name, |
2075 | pcap_datalink_val_to_description(dlt)); | |
c8cf0f94 | 2076 | } |
ed775ee7 AHJ |
2077 | fprintf(stderr, ", snapshot length %d\n", pcap_snapshot(pd)); |
2078 | #ifdef DLT_LINUX_SLL2 | |
2079 | if (dlt == DLT_LINUX_SLL2) | |
2080 | fprintf(stderr, "Warning: interface names might be incorrect\n"); | |
2081 | #endif | |
2082 | } else if (dflag && !device) { | |
2083 | int dump_dlt = DLT_EN10MB; | |
2084 | /* | |
2085 | * We're dumping the compiled code without an explicit | |
2086 | * device specification. (If a device is specified, we | |
2087 | * definitely want to open it to use the DLT of that device.) | |
2088 | * Either default to DLT_EN10MB with a warning, or use | |
2089 | * the user-specified value if supplied. | |
2090 | */ | |
2091 | /* | |
2092 | * If no snapshot length was specified, or a length of 0 was | |
2093 | * specified, default to 256KB. | |
2094 | */ | |
2095 | if (ndo->ndo_snaplen == 0) | |
2096 | ndo->ndo_snaplen = MAXIMUM_SNAPLEN; | |
2097 | /* | |
2098 | * If a DLT was specified with the -y flag, use that instead. | |
2099 | */ | |
2100 | if (yflag_dlt != -1) | |
2101 | dump_dlt = yflag_dlt; | |
2102 | else | |
2103 | fprintf(stderr, "Warning: assuming Ethernet\n"); | |
2104 | pd = pcap_open_dead(dump_dlt, ndo->ndo_snaplen); | |
c8cf0f94 | 2105 | } else { |
411677ae AL |
2106 | /* |
2107 | * We're doing a live capture. | |
2108 | */ | |
c8cf0f94 | 2109 | if (device == NULL) { |
411677ae AL |
2110 | /* |
2111 | * No interface was specified. Pick one. | |
2112 | */ | |
2113 | #ifdef HAVE_PCAP_FINDALLDEVS | |
2114 | /* | |
2115 | * Find the list of interfaces, and pick | |
2116 | * the first interface. | |
2117 | */ | |
ed775ee7 AHJ |
2118 | if (pcap_findalldevs(&devlist, ebuf) == -1) |
2119 | error("%s", ebuf); | |
2120 | if (devlist == NULL) | |
2121 | error("no interfaces available for capture"); | |
2122 | device = strdup(devlist->name); | |
2123 | pcap_freealldevs(devlist); | |
411677ae AL |
2124 | #else /* HAVE_PCAP_FINDALLDEVS */ |
2125 | /* | |
2126 | * Use whatever interface pcap_lookupdev() | |
2127 | * chooses. | |
2128 | */ | |
c8cf0f94 PA |
2129 | device = pcap_lookupdev(ebuf); |
2130 | if (device == NULL) | |
2131 | error("%s", ebuf); | |
ed775ee7 | 2132 | #endif |
c8cf0f94 | 2133 | } |
c8cf0f94 | 2134 | |
27bfbee1 | 2135 | /* |
411677ae | 2136 | * Try to open the interface with the specified name. |
27bfbee1 | 2137 | */ |
411677ae AL |
2138 | pd = open_interface(device, ndo, ebuf); |
2139 | if (pd == NULL) { | |
ea7b4bf5 | 2140 | /* |
411677ae AL |
2141 | * That failed. If we can get a list of |
2142 | * interfaces, and the interface name | |
2143 | * is purely numeric, try to use it as | |
2144 | * a 1-based index in the list of | |
2145 | * interfaces. | |
ea7b4bf5 | 2146 | */ |
411677ae AL |
2147 | #ifdef HAVE_PCAP_FINDALLDEVS |
2148 | devnum = parse_interface_number(device); | |
2149 | if (devnum == -1) { | |
2150 | /* | |
2151 | * It's not a number; just report | |
2152 | * the open error and fail. | |
2153 | */ | |
2154 | error("%s", ebuf); | |
2155 | } | |
2156 | ||
ea7b4bf5 | 2157 | /* |
411677ae AL |
2158 | * OK, it's a number; try to find the |
2159 | * interface with that index, and try | |
2160 | * to open it. | |
2161 | * | |
2162 | * find_interface_by_number() exits if it | |
2163 | * couldn't be found. | |
2164 | */ | |
ed775ee7 | 2165 | device = find_interface_by_number(device, devnum); |
411677ae AL |
2166 | pd = open_interface(device, ndo, ebuf); |
2167 | if (pd == NULL) | |
2168 | error("%s", ebuf); | |
2169 | #else /* HAVE_PCAP_FINDALLDEVS */ | |
2170 | /* | |
2171 | * We can't get a list of interfaces; just | |
2172 | * fail. | |
ea7b4bf5 | 2173 | */ |
c8cf0f94 | 2174 | error("%s", ebuf); |
411677ae AL |
2175 | #endif /* HAVE_PCAP_FINDALLDEVS */ |
2176 | } | |
2177 | ||
c8cf0f94 | 2178 | /* |
ed775ee7 AHJ |
2179 | * Let user own process after capture device has |
2180 | * been opened. | |
c8cf0f94 | 2181 | */ |
411677ae | 2182 | #ifndef _WIN32 |
c8cf0f94 PA |
2183 | if (setgid(getgid()) != 0 || setuid(getuid()) != 0) |
2184 | fprintf(stderr, "Warning: setgid/setuid failed !\n"); | |
411677ae AL |
2185 | #endif /* _WIN32 */ |
2186 | #if !defined(HAVE_PCAP_CREATE) && defined(_WIN32) | |
ea7b4bf5 PA |
2187 | if(Bflag != 0) |
2188 | if(pcap_setbuff(pd, Bflag)==-1){ | |
c8cf0f94 PA |
2189 | error("%s", pcap_geterr(pd)); |
2190 | } | |
411677ae | 2191 | #endif /* !defined(HAVE_PCAP_CREATE) && defined(_WIN32) */ |
c8cf0f94 | 2192 | if (Lflag) |
411677ae AL |
2193 | show_dlts_and_exit(pd, device); |
2194 | if (yflag_dlt >= 0) { | |
c8cf0f94 | 2195 | #ifdef HAVE_PCAP_SET_DATALINK |
411677ae | 2196 | if (pcap_set_datalink(pd, yflag_dlt) < 0) |
c8cf0f94 PA |
2197 | error("%s", pcap_geterr(pd)); |
2198 | #else | |
2199 | /* | |
2200 | * We don't actually support changing the | |
2201 | * data link type, so we only let them | |
2202 | * set it to what it already is. | |
2203 | */ | |
411677ae | 2204 | if (yflag_dlt != pcap_datalink(pd)) { |
c8cf0f94 | 2205 | error("%s is not one of the DLTs supported by this device\n", |
411677ae | 2206 | yflag_dlt_name); |
c8cf0f94 PA |
2207 | } |
2208 | #endif | |
2209 | (void)fprintf(stderr, "%s: data link type %s\n", | |
ed775ee7 AHJ |
2210 | program_name, |
2211 | pcap_datalink_val_to_name(yflag_dlt)); | |
c8cf0f94 PA |
2212 | (void)fflush(stderr); |
2213 | } | |
2214 | i = pcap_snapshot(pd); | |
411677ae | 2215 | if (ndo->ndo_snaplen < i) { |
ed775ee7 AHJ |
2216 | if (ndo->ndo_snaplen != 0) |
2217 | warning("snaplen raised from %d to %d", ndo->ndo_snaplen, i); | |
2218 | ndo->ndo_snaplen = i; | |
2219 | } else if (ndo->ndo_snaplen > i) { | |
2220 | warning("snaplen lowered from %d to %d", ndo->ndo_snaplen, i); | |
411677ae | 2221 | ndo->ndo_snaplen = i; |
c8cf0f94 | 2222 | } |
411677ae AL |
2223 | if(ndo->ndo_fflag != 0) { |
2224 | if (pcap_lookupnet(device, &localnet, &netmask, ebuf) < 0) { | |
2225 | warning("foreign (-f) flag used but: %s", ebuf); | |
2226 | } | |
2227 | } | |
2228 | ||
c8cf0f94 PA |
2229 | } |
2230 | if (infile) | |
2231 | cmdbuf = read_infile(infile); | |
2232 | else | |
2233 | cmdbuf = copy_argv(&argv[optind]); | |
2234 | ||
411677ae AL |
2235 | #ifdef HAVE_PCAP_SET_OPTIMIZER_DEBUG |
2236 | pcap_set_optimizer_debug(dflag); | |
2237 | #endif | |
c8cf0f94 PA |
2238 | if (pcap_compile(pd, &fcode, cmdbuf, Oflag, netmask) < 0) |
2239 | error("%s", pcap_geterr(pd)); | |
2240 | if (dflag) { | |
2241 | bpf_dump(&fcode, dflag); | |
2242 | pcap_close(pd); | |
411677ae AL |
2243 | free(cmdbuf); |
2244 | pcap_freecode(&fcode); | |
ed775ee7 | 2245 | exit_tcpdump(S_SUCCESS); |
c8cf0f94 | 2246 | } |
ed775ee7 AHJ |
2247 | |
2248 | #ifdef HAVE_CASPER | |
2249 | if (!ndo->ndo_nflag) | |
2250 | capdns = capdns_setup(); | |
2251 | #endif /* HAVE_CASPER */ | |
2252 | ||
2253 | init_print(ndo, localnet, netmask); | |
c8cf0f94 | 2254 | |
411677ae | 2255 | #ifndef _WIN32 |
c8cf0f94 | 2256 | (void)setsignal(SIGPIPE, cleanup); |
c8cf0f94 | 2257 | (void)setsignal(SIGTERM, cleanup); |
411677ae | 2258 | #endif /* _WIN32 */ |
ed775ee7 | 2259 | (void)setsignal(SIGINT, cleanup); |
27bfbee1 PA |
2260 | #if defined(HAVE_FORK) || defined(HAVE_VFORK) |
2261 | (void)setsignal(SIGCHLD, child_cleanup); | |
2262 | #endif | |
c8cf0f94 | 2263 | /* Cooperate with nohup(1) */ |
411677ae | 2264 | #ifndef _WIN32 |
c8cf0f94 PA |
2265 | if ((oldhandler = setsignal(SIGHUP, cleanup)) != SIG_DFL) |
2266 | (void)setsignal(SIGHUP, oldhandler); | |
411677ae | 2267 | #endif /* _WIN32 */ |
c8cf0f94 | 2268 | |
411677ae | 2269 | #ifndef _WIN32 |
27bfbee1 PA |
2270 | /* |
2271 | * If a user name was specified with "-Z", attempt to switch to | |
2272 | * that user's UID. This would probably be used with sudo, | |
2273 | * to allow tcpdump to be run in a special restricted | |
2274 | * account (if you just want to allow users to open capture | |
2275 | * devices, and can't just give users that permission, | |
2276 | * you'd make tcpdump set-UID or set-GID). | |
2277 | * | |
2278 | * Tcpdump doesn't necessarily write only to one savefile; | |
2279 | * the general only way to allow a -Z instance to write to | |
2280 | * savefiles as the user under whose UID it's run, rather | |
2281 | * than as the user specified with -Z, would thus be to switch | |
2282 | * to the original user ID before opening a capture file and | |
2283 | * then switch back to the -Z user ID after opening the savefile. | |
2284 | * Switching to the -Z user ID only after opening the first | |
2285 | * savefile doesn't handle the general case. | |
2286 | */ | |
411677ae | 2287 | |
27bfbee1 | 2288 | if (getuid() == 0 || geteuid() == 0) { |
411677ae AL |
2289 | #ifdef HAVE_LIBCAP_NG |
2290 | /* Initialize capng */ | |
2291 | capng_clear(CAPNG_SELECT_BOTH); | |
2292 | if (username) { | |
ed775ee7 | 2293 | DIAG_OFF_CLANG(assign-enum) |
411677ae AL |
2294 | capng_updatev( |
2295 | CAPNG_ADD, | |
2296 | CAPNG_PERMITTED | CAPNG_EFFECTIVE, | |
2297 | CAP_SETUID, | |
2298 | CAP_SETGID, | |
2299 | -1); | |
ed775ee7 | 2300 | DIAG_ON_CLANG(assign-enum) |
411677ae AL |
2301 | } |
2302 | if (chroot_dir) { | |
ed775ee7 | 2303 | DIAG_OFF_CLANG(assign-enum) |
411677ae AL |
2304 | capng_update( |
2305 | CAPNG_ADD, | |
2306 | CAPNG_PERMITTED | CAPNG_EFFECTIVE, | |
2307 | CAP_SYS_CHROOT | |
2308 | ); | |
ed775ee7 | 2309 | DIAG_ON_CLANG(assign-enum) |
411677ae AL |
2310 | } |
2311 | ||
2312 | if (WFileName) { | |
ed775ee7 | 2313 | DIAG_OFF_CLANG(assign-enum) |
411677ae AL |
2314 | capng_update( |
2315 | CAPNG_ADD, | |
2316 | CAPNG_PERMITTED | CAPNG_EFFECTIVE, | |
2317 | CAP_DAC_OVERRIDE | |
2318 | ); | |
ed775ee7 | 2319 | DIAG_ON_CLANG(assign-enum) |
411677ae AL |
2320 | } |
2321 | capng_apply(CAPNG_SELECT_BOTH); | |
2322 | #endif /* HAVE_LIBCAP_NG */ | |
27bfbee1 PA |
2323 | if (username || chroot_dir) |
2324 | droproot(username, chroot_dir); | |
411677ae | 2325 | |
27bfbee1 | 2326 | } |
411677ae | 2327 | #endif /* _WIN32 */ |
27bfbee1 | 2328 | |
c8cf0f94 PA |
2329 | if (pcap_setfilter(pd, &fcode) < 0) |
2330 | error("%s", pcap_geterr(pd)); | |
411677ae | 2331 | #ifdef HAVE_CAPSICUM |
ed775ee7 | 2332 | if (RFileName == NULL && VFileName == NULL && pcap_fileno(pd) != -1) { |
411677ae AL |
2333 | static const unsigned long cmds[] = { BIOCGSTATS, BIOCROTZBUF }; |
2334 | ||
2335 | /* | |
2336 | * The various libpcap devices use a combination of | |
2337 | * read (bpf), ioctl (bpf, netmap), poll (netmap) | |
2338 | * so we add the relevant access rights. | |
2339 | */ | |
2340 | cap_rights_init(&rights, CAP_IOCTL, CAP_READ, CAP_EVENT); | |
2341 | if (cap_rights_limit(pcap_fileno(pd), &rights) < 0 && | |
2342 | errno != ENOSYS) { | |
2343 | error("unable to limit pcap descriptor"); | |
2344 | } | |
2345 | if (cap_ioctls_limit(pcap_fileno(pd), cmds, | |
2346 | sizeof(cmds) / sizeof(cmds[0])) < 0 && errno != ENOSYS) { | |
2347 | error("unable to limit ioctls on pcap descriptor"); | |
2348 | } | |
2349 | } | |
2350 | #endif | |
c8cf0f94 | 2351 | if (WFileName) { |
411677ae AL |
2352 | /* Do not exceed the default PATH_MAX for files. */ |
2353 | dumpinfo.CurrentFileName = (char *)malloc(PATH_MAX + 1); | |
ea7b4bf5 PA |
2354 | |
2355 | if (dumpinfo.CurrentFileName == NULL) | |
2356 | error("malloc of dumpinfo.CurrentFileName"); | |
2357 | ||
2358 | /* We do not need numbering for dumpfiles if Cflag isn't set. */ | |
2359 | if (Cflag != 0) | |
2360 | MakeFilename(dumpinfo.CurrentFileName, WFileName, 0, WflagChars); | |
2361 | else | |
2362 | MakeFilename(dumpinfo.CurrentFileName, WFileName, 0, 0); | |
c8cf0f94 | 2363 | |
ed775ee7 | 2364 | pdd = pcap_dump_open(pd, dumpinfo.CurrentFileName); |
411677ae AL |
2365 | #ifdef HAVE_LIBCAP_NG |
2366 | /* Give up CAP_DAC_OVERRIDE capability. | |
2367 | * Only allow it to be restored if the -C or -G flag have been | |
2368 | * set since we may need to create more files later on. | |
2369 | */ | |
2370 | capng_update( | |
2371 | CAPNG_DROP, | |
2372 | (Cflag || Gflag ? 0 : CAPNG_PERMITTED) | |
2373 | | CAPNG_EFFECTIVE, | |
2374 | CAP_DAC_OVERRIDE | |
2375 | ); | |
2376 | capng_apply(CAPNG_SELECT_BOTH); | |
2377 | #endif /* HAVE_LIBCAP_NG */ | |
ed775ee7 | 2378 | if (pdd == NULL) |
c8cf0f94 | 2379 | error("%s", pcap_geterr(pd)); |
411677ae | 2380 | #ifdef HAVE_CAPSICUM |
ed775ee7 | 2381 | set_dumper_capsicum_rights(pdd); |
411677ae | 2382 | #endif |
ea7b4bf5 | 2383 | if (Cflag != 0 || Gflag != 0) { |
411677ae AL |
2384 | #ifdef HAVE_CAPSICUM |
2385 | dumpinfo.WFileName = strdup(basename(WFileName)); | |
2386 | if (dumpinfo.WFileName == NULL) { | |
2387 | error("Unable to allocate memory for file %s", | |
2388 | WFileName); | |
2389 | } | |
2390 | dumpinfo.dirfd = open(dirname(WFileName), | |
2391 | O_DIRECTORY | O_RDONLY); | |
2392 | if (dumpinfo.dirfd < 0) { | |
2393 | error("unable to open directory %s", | |
2394 | dirname(WFileName)); | |
2395 | } | |
2396 | cap_rights_init(&rights, CAP_CREATE, CAP_FCNTL, | |
2397 | CAP_FTRUNCATE, CAP_LOOKUP, CAP_SEEK, CAP_WRITE); | |
2398 | if (cap_rights_limit(dumpinfo.dirfd, &rights) < 0 && | |
2399 | errno != ENOSYS) { | |
2400 | error("unable to limit directory rights"); | |
2401 | } | |
2402 | if (cap_fcntls_limit(dumpinfo.dirfd, CAP_FCNTL_GETFL) < 0 && | |
2403 | errno != ENOSYS) { | |
2404 | error("unable to limit dump descriptor fcntls"); | |
2405 | } | |
2406 | #else /* !HAVE_CAPSICUM */ | |
c8cf0f94 | 2407 | dumpinfo.WFileName = WFileName; |
411677ae AL |
2408 | #endif |
2409 | callback = dump_packet_and_trunc; | |
c8cf0f94 | 2410 | dumpinfo.pd = pd; |
ed775ee7 | 2411 | dumpinfo.pdd = pdd; |
c8cf0f94 PA |
2412 | pcap_userdata = (u_char *)&dumpinfo; |
2413 | } else { | |
2414 | callback = dump_packet; | |
ed775ee7 AHJ |
2415 | dumpinfo.WFileName = WFileName; |
2416 | dumpinfo.pd = pd; | |
2417 | dumpinfo.pdd = pdd; | |
2418 | pcap_userdata = (u_char *)&dumpinfo; | |
c8cf0f94 | 2419 | } |
ed775ee7 AHJ |
2420 | if (print) { |
2421 | dlt = pcap_datalink(pd); | |
2422 | ndo->ndo_if_printer = get_if_printer(dlt); | |
2423 | dumpinfo.ndo = ndo; | |
2424 | } else | |
2425 | dumpinfo.ndo = NULL; | |
2426 | ||
27bfbee1 PA |
2427 | #ifdef HAVE_PCAP_DUMP_FLUSH |
2428 | if (Uflag) | |
ed775ee7 | 2429 | pcap_dump_flush(pdd); |
27bfbee1 | 2430 | #endif |
c8cf0f94 | 2431 | } else { |
411677ae | 2432 | dlt = pcap_datalink(pd); |
ed775ee7 | 2433 | ndo->ndo_if_printer = get_if_printer(dlt); |
c8cf0f94 | 2434 | callback = print_packet; |
411677ae | 2435 | pcap_userdata = (u_char *)ndo; |
c8cf0f94 | 2436 | } |
27bfbee1 | 2437 | |
6263709f | 2438 | #ifdef SIGNAL_REQ_INFO |
ea7b4bf5 PA |
2439 | /* |
2440 | * We can't get statistics when reading from a file rather | |
2441 | * than capturing from a device. | |
2442 | */ | |
2443 | if (RFileName == NULL) | |
6263709f | 2444 | (void)setsignal(SIGNAL_REQ_INFO, requestinfo); |
c8cf0f94 | 2445 | #endif |
ed775ee7 AHJ |
2446 | #ifdef SIGNAL_FLUSH_PCAP |
2447 | (void)setsignal(SIGNAL_FLUSH_PCAP, flushpcap); | |
2448 | #endif | |
c8cf0f94 | 2449 | |
ed775ee7 AHJ |
2450 | if (ndo->ndo_vflag > 0 && WFileName && RFileName == NULL && !print) { |
2451 | /* | |
2452 | * When capturing to a file, if "--print" wasn't specified, | |
2453 | *"-v" means tcpdump should, once per second, | |
2454 | * "v"erbosely report the number of packets captured. | |
2455 | * Except when reading from a file, because -r, -w and -v | |
2456 | * together used to make a corner case, in which pcap_loop() | |
2457 | * errored due to EINTR (see GH #155 for details). | |
2458 | */ | |
2459 | #ifdef _WIN32 | |
c8cf0f94 | 2460 | /* |
ed775ee7 AHJ |
2461 | * https://blogs.msdn.microsoft.com/oldnewthing/20151230-00/?p=92741 |
2462 | * | |
2463 | * suggests that this dates back to W2K. | |
2464 | * | |
2465 | * I don't know what a "long wait" is, but we'll assume | |
2466 | * that printing the stats could be a "long wait". | |
c8cf0f94 | 2467 | */ |
ed775ee7 AHJ |
2468 | CreateTimerQueueTimer(&timer_handle, NULL, |
2469 | verbose_stats_dump, NULL, 1000, 1000, | |
2470 | WT_EXECUTEDEFAULT|WT_EXECUTELONGFUNCTION); | |
c8cf0f94 | 2471 | setvbuf(stderr, NULL, _IONBF, 0); |
ed775ee7 AHJ |
2472 | #else /* _WIN32 */ |
2473 | /* | |
2474 | * Assume this is UN*X, and that it has setitimer(); that | |
2475 | * dates back to UNIX 95. | |
2476 | */ | |
2477 | struct itimerval timer; | |
c8cf0f94 | 2478 | (void)setsignal(SIGALRM, verbose_stats_dump); |
ed775ee7 AHJ |
2479 | timer.it_interval.tv_sec = 1; |
2480 | timer.it_interval.tv_usec = 0; | |
2481 | timer.it_value.tv_sec = 1; | |
2482 | timer.it_value.tv_usec = 1; | |
2483 | setitimer(ITIMER_REAL, &timer, NULL); | |
2484 | #endif /* _WIN32 */ | |
c8cf0f94 PA |
2485 | } |
2486 | ||
c8cf0f94 | 2487 | if (RFileName == NULL) { |
411677ae AL |
2488 | /* |
2489 | * Live capture (if -V was specified, we set RFileName | |
2490 | * to a file from the -V file). Print a message to | |
2491 | * the standard error on UN*X. | |
2492 | */ | |
2493 | if (!ndo->ndo_vflag && !WFileName) { | |
c8cf0f94 | 2494 | (void)fprintf(stderr, |
ed775ee7 | 2495 | "%s: verbose output suppressed, use -v[v]... for full protocol decode\n", |
c8cf0f94 PA |
2496 | program_name); |
2497 | } else | |
2498 | (void)fprintf(stderr, "%s: ", program_name); | |
2499 | dlt = pcap_datalink(pd); | |
2500 | dlt_name = pcap_datalink_val_to_name(dlt); | |
ed775ee7 | 2501 | (void)fprintf(stderr, "listening on %s", device); |
c8cf0f94 | 2502 | if (dlt_name == NULL) { |
ed775ee7 | 2503 | (void)fprintf(stderr, ", link-type %u", dlt); |
c8cf0f94 | 2504 | } else { |
ed775ee7 AHJ |
2505 | (void)fprintf(stderr, ", link-type %s (%s)", dlt_name, |
2506 | pcap_datalink_val_to_description(dlt)); | |
c8cf0f94 | 2507 | } |
ed775ee7 | 2508 | (void)fprintf(stderr, ", snapshot length %d bytes\n", ndo->ndo_snaplen); |
c8cf0f94 PA |
2509 | (void)fflush(stderr); |
2510 | } | |
411677ae AL |
2511 | |
2512 | #ifdef HAVE_CAPSICUM | |
ed775ee7 AHJ |
2513 | cansandbox = (VFileName == NULL && zflag == NULL); |
2514 | #ifdef HAVE_CASPER | |
2515 | cansandbox = (cansandbox && (ndo->ndo_nflag || capdns != NULL)); | |
2516 | #else | |
2517 | cansandbox = (cansandbox && ndo->ndo_nflag); | |
2518 | #endif /* HAVE_CASPER */ | |
411677ae AL |
2519 | if (cansandbox && cap_enter() < 0 && errno != ENOSYS) |
2520 | error("unable to enter the capability mode"); | |
2521 | #endif /* HAVE_CAPSICUM */ | |
2522 | ||
2523 | do { | |
2524 | status = pcap_loop(pd, cnt, callback, pcap_userdata); | |
2525 | if (WFileName == NULL) { | |
c8cf0f94 | 2526 | /* |
411677ae AL |
2527 | * We're printing packets. Flush the printed output, |
2528 | * so it doesn't get intermingled with error output. | |
c8cf0f94 | 2529 | */ |
411677ae AL |
2530 | if (status == -2) { |
2531 | /* | |
2532 | * We got interrupted, so perhaps we didn't | |
2533 | * manage to finish a line we were printing. | |
2534 | * Print an extra newline, just in case. | |
2535 | */ | |
2536 | putchar('\n'); | |
2537 | } | |
2538 | (void)fflush(stdout); | |
2539 | } | |
2540 | if (status == -2) { | |
2541 | /* | |
2542 | * We got interrupted. If we are reading multiple | |
2543 | * files (via -V) set these so that we stop. | |
2544 | */ | |
2545 | VFileName = NULL; | |
2546 | ret = NULL; | |
2547 | } | |
2548 | if (status == -1) { | |
2549 | /* | |
2550 | * Error. Report it. | |
2551 | */ | |
2552 | (void)fprintf(stderr, "%s: pcap_loop: %s\n", | |
2553 | program_name, pcap_geterr(pd)); | |
2554 | } | |
2555 | if (RFileName == NULL) { | |
2556 | /* | |
2557 | * We're doing a live capture. Report the capture | |
2558 | * statistics. | |
2559 | */ | |
2560 | info(1); | |
2561 | } | |
2562 | pcap_close(pd); | |
2563 | if (VFileName != NULL) { | |
2564 | ret = get_next_file(VFile, VFileLine); | |
2565 | if (ret) { | |
2566 | int new_dlt; | |
2567 | ||
2568 | RFileName = VFileLine; | |
2569 | pd = pcap_open_offline(RFileName, ebuf); | |
2570 | if (pd == NULL) | |
2571 | error("%s", ebuf); | |
2572 | #ifdef HAVE_CAPSICUM | |
2573 | cap_rights_init(&rights, CAP_READ); | |
2574 | if (cap_rights_limit(fileno(pcap_file(pd)), | |
2575 | &rights) < 0 && errno != ENOSYS) { | |
2576 | error("unable to limit pcap descriptor"); | |
2577 | } | |
2578 | #endif | |
2579 | new_dlt = pcap_datalink(pd); | |
2580 | if (new_dlt != dlt) { | |
2581 | /* | |
2582 | * The new file has a different | |
2583 | * link-layer header type from the | |
2584 | * previous one. | |
2585 | */ | |
2586 | if (WFileName != NULL) { | |
2587 | /* | |
2588 | * We're writing raw packets | |
2589 | * that match the filter to | |
2590 | * a pcap file. pcap files | |
2591 | * don't support multiple | |
2592 | * different link-layer | |
2593 | * header types, so we fail | |
2594 | * here. | |
2595 | */ | |
2596 | error("%s: new dlt does not match original", RFileName); | |
2597 | } | |
2598 | ||
2599 | /* | |
2600 | * We're printing the decoded packets; | |
2601 | * switch to the new DLT. | |
2602 | * | |
2603 | * To do that, we need to change | |
2604 | * the printer, change the DLT name, | |
2605 | * and recompile the filter with | |
2606 | * the new DLT. | |
2607 | */ | |
2608 | dlt = new_dlt; | |
ed775ee7 | 2609 | ndo->ndo_if_printer = get_if_printer(dlt); |
411677ae AL |
2610 | if (pcap_compile(pd, &fcode, cmdbuf, Oflag, netmask) < 0) |
2611 | error("%s", pcap_geterr(pd)); | |
2612 | } | |
2613 | ||
2614 | /* | |
2615 | * Set the filter on the new file. | |
2616 | */ | |
2617 | if (pcap_setfilter(pd, &fcode) < 0) | |
2618 | error("%s", pcap_geterr(pd)); | |
2619 | ||
2620 | /* | |
2621 | * Report the new file. | |
2622 | */ | |
2623 | dlt_name = pcap_datalink_val_to_name(dlt); | |
ed775ee7 | 2624 | fprintf(stderr, "reading from file %s", RFileName); |
411677ae | 2625 | if (dlt_name == NULL) { |
ed775ee7 | 2626 | fprintf(stderr, ", link-type %u", dlt); |
411677ae | 2627 | } else { |
ed775ee7 AHJ |
2628 | fprintf(stderr, ", link-type %s (%s)", |
2629 | dlt_name, | |
2630 | pcap_datalink_val_to_description(dlt)); | |
411677ae | 2631 | } |
ed775ee7 | 2632 | fprintf(stderr, ", snapshot length %d\n", pcap_snapshot(pd)); |
411677ae | 2633 | } |
c8cf0f94 | 2634 | } |
c8cf0f94 | 2635 | } |
411677ae AL |
2636 | while (ret != NULL); |
2637 | ||
ed775ee7 AHJ |
2638 | if (count_mode && RFileName != NULL) |
2639 | fprintf(stdout, "%u packet%s\n", packets_captured, | |
2640 | PLURAL_SUFFIX(packets_captured)); | |
2641 | ||
411677ae AL |
2642 | free(cmdbuf); |
2643 | pcap_freecode(&fcode); | |
2644 | exit_tcpdump(status == -1 ? 1 : 0); | |
c8cf0f94 PA |
2645 | } |
2646 | ||
ed775ee7 AHJ |
2647 | /* |
2648 | * Catch a signal. | |
2649 | */ | |
2650 | static void | |
2651 | (*setsignal (int sig, void (*func)(int)))(int) | |
2652 | { | |
2653 | #ifdef _WIN32 | |
2654 | return (signal(sig, func)); | |
2655 | #else | |
2656 | struct sigaction old, new; | |
2657 | ||
2658 | memset(&new, 0, sizeof(new)); | |
2659 | new.sa_handler = func; | |
2660 | if (sig == SIGCHLD) | |
2661 | new.sa_flags = SA_RESTART; | |
2662 | if (sigaction(sig, &new, &old) < 0) | |
2663 | return (SIG_ERR); | |
2664 | return (old.sa_handler); | |
2665 | #endif | |
2666 | } | |
2667 | ||
c8cf0f94 | 2668 | /* make a clean exit on interrupts */ |
ed775ee7 | 2669 | static void |
c8cf0f94 PA |
2670 | cleanup(int signo _U_) |
2671 | { | |
ed775ee7 AHJ |
2672 | #ifdef _WIN32 |
2673 | if (timer_handle != INVALID_HANDLE_VALUE) { | |
2674 | DeleteTimerQueueTimer(NULL, timer_handle, NULL); | |
2675 | CloseHandle(timer_handle); | |
2676 | timer_handle = INVALID_HANDLE_VALUE; | |
2677 | } | |
2678 | #else /* _WIN32 */ | |
2679 | struct itimerval timer; | |
2680 | ||
2681 | timer.it_interval.tv_sec = 0; | |
2682 | timer.it_interval.tv_usec = 0; | |
2683 | timer.it_value.tv_sec = 0; | |
2684 | timer.it_value.tv_usec = 0; | |
2685 | setitimer(ITIMER_REAL, &timer, NULL); | |
2686 | #endif /* _WIN32 */ | |
c8cf0f94 PA |
2687 | |
2688 | #ifdef HAVE_PCAP_BREAKLOOP | |
2689 | /* | |
2690 | * We have "pcap_breakloop()"; use it, so that we do as little | |
2691 | * as possible in the signal handler (it's probably not safe | |
2692 | * to do anything with standard I/O streams in a signal handler - | |
2693 | * the ANSI C standard doesn't say it is). | |
2694 | */ | |
2695 | pcap_breakloop(pd); | |
2696 | #else | |
2697 | /* | |
2698 | * We don't have "pcap_breakloop()"; this isn't safe, but | |
2699 | * it's the best we can do. Print the summary if we're | |
2700 | * not reading from a savefile - i.e., if we're doing a | |
2701 | * live capture - and exit. | |
2702 | */ | |
2703 | if (pd != NULL && pcap_file(pd) == NULL) { | |
2704 | /* | |
2705 | * We got interrupted, so perhaps we didn't | |
2706 | * manage to finish a line we were printing. | |
2707 | * Print an extra newline, just in case. | |
2708 | */ | |
2709 | putchar('\n'); | |
2710 | (void)fflush(stdout); | |
2711 | info(1); | |
2712 | } | |
ed775ee7 | 2713 | exit_tcpdump(S_SUCCESS); |
c8cf0f94 PA |
2714 | #endif |
2715 | } | |
2716 | ||
ea7b4bf5 PA |
2717 | /* |
2718 | On windows, we do not use a fork, so we do not care less about | |
2719 | waiting a child processes to die | |
2720 | */ | |
27bfbee1 | 2721 | #if defined(HAVE_FORK) || defined(HAVE_VFORK) |
ed775ee7 | 2722 | static void |
ea7b4bf5 PA |
2723 | child_cleanup(int signo _U_) |
2724 | { | |
2725 | wait(NULL); | |
2726 | } | |
27bfbee1 | 2727 | #endif /* HAVE_FORK && HAVE_VFORK */ |
ea7b4bf5 | 2728 | |
c8cf0f94 | 2729 | static void |
ed775ee7 | 2730 | info(int verbose) |
c8cf0f94 | 2731 | { |
411677ae | 2732 | struct pcap_stat stats; |
c8cf0f94 | 2733 | |
27bfbee1 PA |
2734 | /* |
2735 | * Older versions of libpcap didn't set ps_ifdrop on some | |
2736 | * platforms; initialize it to 0 to handle that. | |
2737 | */ | |
411677ae AL |
2738 | stats.ps_ifdrop = 0; |
2739 | if (pcap_stats(pd, &stats) < 0) { | |
c8cf0f94 | 2740 | (void)fprintf(stderr, "pcap_stats: %s\n", pcap_geterr(pd)); |
ea7b4bf5 | 2741 | infoprint = 0; |
c8cf0f94 PA |
2742 | return; |
2743 | } | |
2744 | ||
2745 | if (!verbose) | |
2746 | fprintf(stderr, "%s: ", program_name); | |
2747 | ||
27bfbee1 PA |
2748 | (void)fprintf(stderr, "%u packet%s captured", packets_captured, |
2749 | PLURAL_SUFFIX(packets_captured)); | |
c8cf0f94 PA |
2750 | if (!verbose) |
2751 | fputs(", ", stderr); | |
2752 | else | |
2753 | putc('\n', stderr); | |
411677ae AL |
2754 | (void)fprintf(stderr, "%u packet%s received by filter", stats.ps_recv, |
2755 | PLURAL_SUFFIX(stats.ps_recv)); | |
c8cf0f94 PA |
2756 | if (!verbose) |
2757 | fputs(", ", stderr); | |
2758 | else | |
2759 | putc('\n', stderr); | |
411677ae AL |
2760 | (void)fprintf(stderr, "%u packet%s dropped by kernel", stats.ps_drop, |
2761 | PLURAL_SUFFIX(stats.ps_drop)); | |
2762 | if (stats.ps_ifdrop != 0) { | |
27bfbee1 PA |
2763 | if (!verbose) |
2764 | fputs(", ", stderr); | |
2765 | else | |
2766 | putc('\n', stderr); | |
2767 | (void)fprintf(stderr, "%u packet%s dropped by interface\n", | |
411677ae | 2768 | stats.ps_ifdrop, PLURAL_SUFFIX(stats.ps_ifdrop)); |
27bfbee1 PA |
2769 | } else |
2770 | putc('\n', stderr); | |
c8cf0f94 PA |
2771 | infoprint = 0; |
2772 | } | |
2773 | ||
27bfbee1 | 2774 | #if defined(HAVE_FORK) || defined(HAVE_VFORK) |
411677ae AL |
2775 | #ifdef HAVE_FORK |
2776 | #define fork_subprocess() fork() | |
2777 | #else | |
2778 | #define fork_subprocess() vfork() | |
2779 | #endif | |
ea7b4bf5 PA |
2780 | static void |
2781 | compress_savefile(const char *filename) | |
2782 | { | |
411677ae AL |
2783 | pid_t child; |
2784 | ||
2785 | child = fork_subprocess(); | |
2786 | if (child == -1) { | |
2787 | fprintf(stderr, | |
2788 | "compress_savefile: fork failed: %s\n", | |
2789 | pcap_strerror(errno)); | |
2790 | return; | |
2791 | } | |
2792 | if (child != 0) { | |
2793 | /* Parent process. */ | |
ea7b4bf5 | 2794 | return; |
411677ae AL |
2795 | } |
2796 | ||
ea7b4bf5 | 2797 | /* |
411677ae AL |
2798 | * Child process. |
2799 | * Set to lowest priority so that this doesn't disturb the capture. | |
ea7b4bf5 PA |
2800 | */ |
2801 | #ifdef NZERO | |
2802 | setpriority(PRIO_PROCESS, 0, NZERO - 1); | |
2803 | #else | |
2804 | setpriority(PRIO_PROCESS, 0, 19); | |
2805 | #endif | |
27bfbee1 | 2806 | if (execlp(zflag, zflag, filename, (char *)NULL) == -1) |
ea7b4bf5 | 2807 | fprintf(stderr, |
411677ae | 2808 | "compress_savefile: execlp(%s, %s) failed: %s\n", |
ea7b4bf5 PA |
2809 | zflag, |
2810 | filename, | |
411677ae AL |
2811 | pcap_strerror(errno)); |
2812 | #ifdef HAVE_FORK | |
ed775ee7 | 2813 | exit(S_ERR_HOST_PROGRAM); |
411677ae | 2814 | #else |
ed775ee7 | 2815 | _exit(S_ERR_HOST_PROGRAM); |
411677ae | 2816 | #endif |
ea7b4bf5 | 2817 | } |
27bfbee1 | 2818 | #else /* HAVE_FORK && HAVE_VFORK */ |
ea7b4bf5 PA |
2819 | static void |
2820 | compress_savefile(const char *filename) | |
2821 | { | |
2822 | fprintf(stderr, | |
27bfbee1 | 2823 | "compress_savefile failed. Functionality not implemented under your system\n"); |
ea7b4bf5 | 2824 | } |
27bfbee1 | 2825 | #endif /* HAVE_FORK && HAVE_VFORK */ |
ea7b4bf5 | 2826 | |
c8cf0f94 PA |
2827 | static void |
2828 | dump_packet_and_trunc(u_char *user, const struct pcap_pkthdr *h, const u_char *sp) | |
2829 | { | |
2830 | struct dump_info *dump_info; | |
c8cf0f94 PA |
2831 | |
2832 | ++packets_captured; | |
2833 | ||
2834 | ++infodelay; | |
2835 | ||
2836 | dump_info = (struct dump_info *)user; | |
2837 | ||
ea7b4bf5 PA |
2838 | /* |
2839 | * XXX - this won't force the file to rotate on the specified time | |
2840 | * boundary, but it will rotate on the first packet received after the | |
2841 | * specified Gflag number of seconds. Note: if a Gflag time boundary | |
2842 | * and a Cflag size boundary coincide, the time rotation will occur | |
2843 | * first thereby cancelling the Cflag boundary (since the file should | |
2844 | * be 0). | |
2845 | */ | |
2846 | if (Gflag != 0) { | |
2847 | /* Check if it is time to rotate */ | |
2848 | time_t t; | |
2849 | ||
2850 | /* Get the current time */ | |
2851 | if ((t = time(NULL)) == (time_t)-1) { | |
ed775ee7 AHJ |
2852 | error("%s: can't get current_time: %s", |
2853 | __func__, pcap_strerror(errno)); | |
ea7b4bf5 PA |
2854 | } |
2855 | ||
2856 | ||
2857 | /* If the time is greater than the specified window, rotate */ | |
2858 | if (t - Gflag_time >= Gflag) { | |
411677ae AL |
2859 | #ifdef HAVE_CAPSICUM |
2860 | FILE *fp; | |
2861 | int fd; | |
2862 | #endif | |
2863 | ||
ea7b4bf5 PA |
2864 | /* Update the Gflag_time */ |
2865 | Gflag_time = t; | |
2866 | /* Update Gflag_count */ | |
2867 | Gflag_count++; | |
2868 | /* | |
2869 | * Close the current file and open a new one. | |
2870 | */ | |
ed775ee7 | 2871 | pcap_dump_close(dump_info->pdd); |
ea7b4bf5 PA |
2872 | |
2873 | /* | |
2874 | * Compress the file we just closed, if the user asked for it | |
2875 | */ | |
2876 | if (zflag != NULL) | |
2877 | compress_savefile(dump_info->CurrentFileName); | |
2878 | ||
2879 | /* | |
2880 | * Check to see if we've exceeded the Wflag (when | |
2881 | * not using Cflag). | |
2882 | */ | |
2883 | if (Cflag == 0 && Wflag > 0 && Gflag_count >= Wflag) { | |
2884 | (void)fprintf(stderr, "Maximum file limit reached: %d\n", | |
2885 | Wflag); | |
411677ae | 2886 | info(1); |
ed775ee7 | 2887 | exit_tcpdump(S_SUCCESS); |
ea7b4bf5 PA |
2888 | /* NOTREACHED */ |
2889 | } | |
2890 | if (dump_info->CurrentFileName != NULL) | |
2891 | free(dump_info->CurrentFileName); | |
2892 | /* Allocate space for max filename + \0. */ | |
411677ae | 2893 | dump_info->CurrentFileName = (char *)malloc(PATH_MAX + 1); |
ea7b4bf5 PA |
2894 | if (dump_info->CurrentFileName == NULL) |
2895 | error("dump_packet_and_trunc: malloc"); | |
411677ae AL |
2896 | /* |
2897 | * Gflag was set otherwise we wouldn't be here. Reset the count | |
2898 | * so multiple files would end with 1,2,3 in the filename. | |
2899 | * The counting is handled with the -C flow after this. | |
2900 | */ | |
2901 | Cflag_count = 0; | |
2902 | ||
ea7b4bf5 PA |
2903 | /* |
2904 | * This is always the first file in the Cflag | |
2905 | * rotation: e.g. 0 | |
2906 | * We also don't need numbering if Cflag is not set. | |
2907 | */ | |
2908 | if (Cflag != 0) | |
2909 | MakeFilename(dump_info->CurrentFileName, dump_info->WFileName, 0, | |
2910 | WflagChars); | |
2911 | else | |
2912 | MakeFilename(dump_info->CurrentFileName, dump_info->WFileName, 0, 0); | |
2913 | ||
411677ae AL |
2914 | #ifdef HAVE_LIBCAP_NG |
2915 | capng_update(CAPNG_ADD, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE); | |
2916 | capng_apply(CAPNG_SELECT_BOTH); | |
2917 | #endif /* HAVE_LIBCAP_NG */ | |
2918 | #ifdef HAVE_CAPSICUM | |
2919 | fd = openat(dump_info->dirfd, | |
2920 | dump_info->CurrentFileName, | |
2921 | O_CREAT | O_WRONLY | O_TRUNC, 0644); | |
2922 | if (fd < 0) { | |
2923 | error("unable to open file %s", | |
2924 | dump_info->CurrentFileName); | |
2925 | } | |
2926 | fp = fdopen(fd, "w"); | |
2927 | if (fp == NULL) { | |
2928 | error("unable to fdopen file %s", | |
2929 | dump_info->CurrentFileName); | |
2930 | } | |
ed775ee7 | 2931 | dump_info->pdd = pcap_dump_fopen(dump_info->pd, fp); |
411677ae | 2932 | #else /* !HAVE_CAPSICUM */ |
ed775ee7 | 2933 | dump_info->pdd = pcap_dump_open(dump_info->pd, dump_info->CurrentFileName); |
411677ae AL |
2934 | #endif |
2935 | #ifdef HAVE_LIBCAP_NG | |
2936 | capng_update(CAPNG_DROP, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE); | |
2937 | capng_apply(CAPNG_SELECT_BOTH); | |
2938 | #endif /* HAVE_LIBCAP_NG */ | |
ed775ee7 | 2939 | if (dump_info->pdd == NULL) |
ea7b4bf5 | 2940 | error("%s", pcap_geterr(pd)); |
411677ae | 2941 | #ifdef HAVE_CAPSICUM |
ed775ee7 | 2942 | set_dumper_capsicum_rights(dump_info->pdd); |
411677ae | 2943 | #endif |
ea7b4bf5 PA |
2944 | } |
2945 | } | |
2946 | ||
c8cf0f94 PA |
2947 | /* |
2948 | * XXX - this won't prevent capture files from getting | |
2949 | * larger than Cflag - the last packet written to the | |
2950 | * file could put it over Cflag. | |
2951 | */ | |
411677ae | 2952 | if (Cflag != 0) { |
ed775ee7 AHJ |
2953 | #ifdef HAVE_PCAP_DUMP_FTELL64 |
2954 | int64_t size = pcap_dump_ftell64(dump_info->pdd); | |
2955 | #else | |
2956 | /* | |
2957 | * XXX - this only handles a Cflag value > 2^31-1 on | |
2958 | * LP64 platforms; to handle ILP32 (32-bit UN*X and | |
2959 | * Windows) or LLP64 (64-bit Windows) would require | |
2960 | * a version of libpcap with pcap_dump_ftell64(). | |
2961 | */ | |
2962 | long size = pcap_dump_ftell(dump_info->pdd); | |
2963 | #endif | |
ea7b4bf5 | 2964 | |
411677ae AL |
2965 | if (size == -1) |
2966 | error("ftell fails on output file"); | |
2967 | if (size > Cflag) { | |
2968 | #ifdef HAVE_CAPSICUM | |
2969 | FILE *fp; | |
2970 | int fd; | |
2971 | #endif | |
2972 | ||
2973 | /* | |
2974 | * Close the current file and open a new one. | |
2975 | */ | |
ed775ee7 | 2976 | pcap_dump_close(dump_info->pdd); |
411677ae AL |
2977 | |
2978 | /* | |
2979 | * Compress the file we just closed, if the user | |
2980 | * asked for it. | |
2981 | */ | |
2982 | if (zflag != NULL) | |
2983 | compress_savefile(dump_info->CurrentFileName); | |
ea7b4bf5 | 2984 | |
411677ae AL |
2985 | Cflag_count++; |
2986 | if (Wflag > 0) { | |
2987 | if (Cflag_count >= Wflag) | |
2988 | Cflag_count = 0; | |
2989 | } | |
2990 | if (dump_info->CurrentFileName != NULL) | |
2991 | free(dump_info->CurrentFileName); | |
2992 | dump_info->CurrentFileName = (char *)malloc(PATH_MAX + 1); | |
2993 | if (dump_info->CurrentFileName == NULL) | |
ed775ee7 | 2994 | error("%s: malloc", __func__); |
411677ae AL |
2995 | MakeFilename(dump_info->CurrentFileName, dump_info->WFileName, Cflag_count, WflagChars); |
2996 | #ifdef HAVE_LIBCAP_NG | |
2997 | capng_update(CAPNG_ADD, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE); | |
2998 | capng_apply(CAPNG_SELECT_BOTH); | |
2999 | #endif /* HAVE_LIBCAP_NG */ | |
3000 | #ifdef HAVE_CAPSICUM | |
3001 | fd = openat(dump_info->dirfd, dump_info->CurrentFileName, | |
3002 | O_CREAT | O_WRONLY | O_TRUNC, 0644); | |
3003 | if (fd < 0) { | |
3004 | error("unable to open file %s", | |
3005 | dump_info->CurrentFileName); | |
3006 | } | |
3007 | fp = fdopen(fd, "w"); | |
3008 | if (fp == NULL) { | |
3009 | error("unable to fdopen file %s", | |
3010 | dump_info->CurrentFileName); | |
3011 | } | |
ed775ee7 | 3012 | dump_info->pdd = pcap_dump_fopen(dump_info->pd, fp); |
411677ae | 3013 | #else /* !HAVE_CAPSICUM */ |
ed775ee7 | 3014 | dump_info->pdd = pcap_dump_open(dump_info->pd, dump_info->CurrentFileName); |
411677ae AL |
3015 | #endif |
3016 | #ifdef HAVE_LIBCAP_NG | |
3017 | capng_update(CAPNG_DROP, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE); | |
3018 | capng_apply(CAPNG_SELECT_BOTH); | |
3019 | #endif /* HAVE_LIBCAP_NG */ | |
ed775ee7 | 3020 | if (dump_info->pdd == NULL) |
411677ae AL |
3021 | error("%s", pcap_geterr(pd)); |
3022 | #ifdef HAVE_CAPSICUM | |
ed775ee7 | 3023 | set_dumper_capsicum_rights(dump_info->pdd); |
411677ae | 3024 | #endif |
c8cf0f94 | 3025 | } |
c8cf0f94 PA |
3026 | } |
3027 | ||
ed775ee7 | 3028 | pcap_dump((u_char *)dump_info->pdd, h, sp); |
c8cf0f94 PA |
3029 | #ifdef HAVE_PCAP_DUMP_FLUSH |
3030 | if (Uflag) | |
ed775ee7 | 3031 | pcap_dump_flush(dump_info->pdd); |
c8cf0f94 PA |
3032 | #endif |
3033 | ||
ed775ee7 AHJ |
3034 | if (dump_info->ndo != NULL) |
3035 | pretty_print_packet(dump_info->ndo, h, sp, packets_captured); | |
3036 | ||
c8cf0f94 PA |
3037 | --infodelay; |
3038 | if (infoprint) | |
3039 | info(0); | |
3040 | } | |
3041 | ||
3042 | static void | |
3043 | dump_packet(u_char *user, const struct pcap_pkthdr *h, const u_char *sp) | |
3044 | { | |
ed775ee7 AHJ |
3045 | struct dump_info *dump_info; |
3046 | ||
c8cf0f94 PA |
3047 | ++packets_captured; |
3048 | ||
3049 | ++infodelay; | |
3050 | ||
ed775ee7 AHJ |
3051 | dump_info = (struct dump_info *)user; |
3052 | ||
3053 | pcap_dump((u_char *)dump_info->pdd, h, sp); | |
c8cf0f94 PA |
3054 | #ifdef HAVE_PCAP_DUMP_FLUSH |
3055 | if (Uflag) | |
ed775ee7 | 3056 | pcap_dump_flush(dump_info->pdd); |
c8cf0f94 PA |
3057 | #endif |
3058 | ||
ed775ee7 AHJ |
3059 | if (dump_info->ndo != NULL) |
3060 | pretty_print_packet(dump_info->ndo, h, sp, packets_captured); | |
3061 | ||
c8cf0f94 PA |
3062 | --infodelay; |
3063 | if (infoprint) | |
3064 | info(0); | |
3065 | } | |
3066 | ||
3067 | static void | |
3068 | print_packet(u_char *user, const struct pcap_pkthdr *h, const u_char *sp) | |
3069 | { | |
c8cf0f94 PA |
3070 | ++packets_captured; |
3071 | ||
3072 | ++infodelay; | |
c8cf0f94 | 3073 | |
ed775ee7 AHJ |
3074 | if (!count_mode) |
3075 | pretty_print_packet((netdissect_options *)user, h, sp, packets_captured); | |
c8cf0f94 PA |
3076 | |
3077 | --infodelay; | |
3078 | if (infoprint) | |
3079 | info(0); | |
3080 | } | |
3081 | ||
6263709f | 3082 | #ifdef SIGNAL_REQ_INFO |
ed775ee7 AHJ |
3083 | static void |
3084 | requestinfo(int signo _U_) | |
c8cf0f94 PA |
3085 | { |
3086 | if (infodelay) | |
3087 | ++infoprint; | |
3088 | else | |
3089 | info(0); | |
3090 | } | |
3091 | #endif | |
3092 | ||
ed775ee7 AHJ |
3093 | #ifdef SIGNAL_FLUSH_PCAP |
3094 | static void | |
3095 | flushpcap(int signo _U_) | |
3096 | { | |
3097 | if (pdd != NULL) | |
3098 | pcap_dump_flush(pdd); | |
3099 | } | |
3100 | #endif | |
3101 | ||
3102 | static void | |
3103 | print_packets_captured (void) | |
3104 | { | |
3105 | static u_int prev_packets_captured, first = 1; | |
3106 | ||
3107 | if (infodelay == 0 && (first || packets_captured != prev_packets_captured)) { | |
3108 | fprintf(stderr, "Got %u\r", packets_captured); | |
3109 | first = 0; | |
3110 | prev_packets_captured = packets_captured; | |
3111 | } | |
3112 | } | |
3113 | ||
c8cf0f94 PA |
3114 | /* |
3115 | * Called once each second in verbose mode while dumping to file | |
3116 | */ | |
ed775ee7 AHJ |
3117 | #ifdef _WIN32 |
3118 | static void CALLBACK verbose_stats_dump(PVOID param _U_, | |
3119 | BOOLEAN timer_fired _U_) | |
c8cf0f94 | 3120 | { |
ed775ee7 | 3121 | print_packets_captured(); |
c8cf0f94 | 3122 | } |
ed775ee7 | 3123 | #else /* _WIN32 */ |
c8cf0f94 PA |
3124 | static void verbose_stats_dump(int sig _U_) |
3125 | { | |
ed775ee7 | 3126 | print_packets_captured(); |
c8cf0f94 | 3127 | } |
ed775ee7 | 3128 | #endif /* _WIN32 */ |
c8cf0f94 | 3129 | |
411677ae | 3130 | USES_APPLE_DEPRECATED_API |
c8cf0f94 | 3131 | static void |
ed775ee7 | 3132 | print_version(FILE *f) |
c8cf0f94 | 3133 | { |
c8cf0f94 | 3134 | #ifndef HAVE_PCAP_LIB_VERSION |
ed775ee7 | 3135 | #ifdef HAVE_PCAP_VERSION |
c8cf0f94 | 3136 | extern char pcap_version[]; |
ed775ee7 | 3137 | #else /* HAVE_PCAP_VERSION */ |
c8cf0f94 | 3138 | static char pcap_version[] = "unknown"; |
ed775ee7 | 3139 | #endif /* HAVE_PCAP_VERSION */ |
c8cf0f94 | 3140 | #endif /* HAVE_PCAP_LIB_VERSION */ |
411677ae | 3141 | const char *smi_version_string; |
c8cf0f94 | 3142 | |
ed775ee7 | 3143 | (void)fprintf(f, "%s version " PACKAGE_VERSION "\n", program_name); |
c8cf0f94 | 3144 | #ifdef HAVE_PCAP_LIB_VERSION |
ed775ee7 | 3145 | (void)fprintf(f, "%s\n", pcap_lib_version()); |
c8cf0f94 | 3146 | #else /* HAVE_PCAP_LIB_VERSION */ |
ed775ee7 | 3147 | (void)fprintf(f, "libpcap version %s\n", pcap_version); |
c8cf0f94 | 3148 | #endif /* HAVE_PCAP_LIB_VERSION */ |
411677ae AL |
3149 | |
3150 | #if defined(HAVE_LIBCRYPTO) && defined(SSLEAY_VERSION) | |
ed775ee7 | 3151 | (void)fprintf (f, "%s\n", SSLeay_version(SSLEAY_VERSION)); |
411677ae AL |
3152 | #endif |
3153 | ||
3154 | smi_version_string = nd_smi_version_string(); | |
3155 | if (smi_version_string != NULL) | |
ed775ee7 | 3156 | (void)fprintf (f, "SMI-library: %s\n", smi_version_string); |
411677ae AL |
3157 | |
3158 | #if defined(__SANITIZE_ADDRESS__) | |
ed775ee7 | 3159 | (void)fprintf (f, "Compiled with AddressSanitizer/GCC.\n"); |
411677ae AL |
3160 | #elif defined(__has_feature) |
3161 | # if __has_feature(address_sanitizer) | |
ed775ee7 AHJ |
3162 | (void)fprintf (f, "Compiled with AddressSanitizer/Clang.\n"); |
3163 | # elif __has_feature(memory_sanitizer) | |
3164 | (void)fprintf (f, "Compiled with MemorySanitizer/Clang.\n"); | |
411677ae AL |
3165 | # endif |
3166 | #endif /* __SANITIZE_ADDRESS__ or __has_feature */ | |
3167 | } | |
3168 | USES_APPLE_RST | |
3169 | ||
3170 | static void | |
ed775ee7 | 3171 | print_usage(FILE *f) |
411677ae | 3172 | { |
ed775ee7 AHJ |
3173 | print_version(f); |
3174 | (void)fprintf(f, | |
3175 | "Usage: %s [-Abd" D_FLAG "efhH" I_FLAG J_FLAG "KlLnNOpqStu" U_FLAG "vxX#]" B_FLAG_USAGE " [ -c count ] [--count]\n", program_name); | |
3176 | (void)fprintf(f, | |
ea7b4bf5 | 3177 | "\t\t[ -C file_size ] [ -E algo:secret ] [ -F file ] [ -G seconds ]\n"); |
ed775ee7 AHJ |
3178 | (void)fprintf(f, |
3179 | "\t\t[ -i interface ]" IMMEDIATE_MODE_USAGE j_FLAG_USAGE "\n"); | |
3180 | #ifdef HAVE_PCAP_FINDALLDEVS_EX | |
3181 | (void)fprintf(f, | |
3182 | "\t\t" LIST_REMOTE_INTERFACES_USAGE "\n"); | |
3183 | #endif | |
3184 | #ifdef USE_LIBSMI | |
3185 | (void)fprintf(f, | |
3186 | "\t\t" m_FLAG_USAGE "\n"); | |
3187 | #endif | |
3188 | (void)fprintf(f, | |
3189 | "\t\t[ -M secret ] [ --number ] [ --print ]" Q_FLAG_USAGE "\n"); | |
3190 | (void)fprintf(f, | |
3191 | "\t\t[ -r file ] [ -s snaplen ] [ -T type ] [ --version ]\n"); | |
3192 | (void)fprintf(f, | |
3193 | "\t\t[ -V file ] [ -w file ] [ -W filecount ] [ -y datalinktype ]\n"); | |
411677ae | 3194 | #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION |
ed775ee7 AHJ |
3195 | (void)fprintf(f, |
3196 | "\t\t[ --time-stamp-precision precision ] [ --micro ] [ --nano ]\n"); | |
411677ae | 3197 | #endif |
ed775ee7 AHJ |
3198 | (void)fprintf(f, |
3199 | "\t\t[ -z postrotate-command ] [ -Z user ] [ expression ]\n"); | |
c8cf0f94 | 3200 | } |