1 /* 2 * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000 3 * The Regents of the University of California. All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that: (1) source code distributions 7 * retain the above copyright notice and this paragraph in its entirety, (2) 8 * distributions including binary code include the above copyright notice and 9 * this paragraph in its entirety in the documentation or other materials 10 * provided with the distribution, and (3) all advertising materials mentioning 11 * features or use of this software display the following acknowledgement: 12 * ``This product includes software developed by the University of California, 13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of 14 * the University nor the names of its contributors may be used to endorse 15 * or promote products derived from this software without specific prior 16 * written permission. 17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED 18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF 19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 20 * 21 * Support for splitting captures into multiple files with a maximum 22 * file size: 23 * 24 * Copyright (c) 2001 25 * Seth Webster <swebster@sst.ll.mit.edu> 26 */ 27 28 #ifndef lint 29 static const char copyright[] _U_ = 30 "@(#) Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000\n\ 31 The Regents of the University of California. All rights reserved.\n"; 32 #endif 33 34 /* $FreeBSD$ */ 35 36 /* 37 * tcpdump - monitor tcp/ip traffic on an ethernet. 38 * 39 * First written in 1987 by Van Jacobson, Lawrence Berkeley Laboratory. 40 * Mercilessly hacked and occasionally improved since then via the 41 * combined efforts of Van, Steve McCanne and Craig Leres of LBL. 42 */ 43 44 #ifdef HAVE_CONFIG_H 45 #include "config.h" 46 #endif 47 48 /* 49 * Mac OS X may ship pcap.h from libpcap 0.6 with a libpcap based on 50 * 0.8. That means it has pcap_findalldevs() but the header doesn't 51 * define pcap_if_t, meaning that we can't actually *use* pcap_findalldevs(). 52 */ 53 #ifdef HAVE_PCAP_FINDALLDEVS 54 #ifndef HAVE_PCAP_IF_T 55 #undef HAVE_PCAP_FINDALLDEVS 56 #endif 57 #endif 58 59 #include <tcpdump-stdinc.h> 60 61 #ifdef WIN32 62 #include "w32_fzs.h" 63 extern int strcasecmp (const char *__s1, const char *__s2); 64 extern int SIZE_BUF; 65 #define off_t long 66 #define uint UINT 67 #endif /* WIN32 */ 68 69 #ifdef USE_LIBSMI 70 #include <smi.h> 71 #endif 72 73 #ifdef HAVE_LIBCRYPTO 74 #include <openssl/crypto.h> 75 #endif 76 77 #ifdef HAVE_GETOPT_LONG 78 #include <getopt.h> 79 #else 80 #include "getopt_long.h" 81 #endif 82 /* Capsicum-specific code requires macros from <net/bpf.h>, which will fail 83 * to compile if <pcap.h> has already been included; including the headers 84 * in the opposite order works fine. 85 */ 86 #ifdef __FreeBSD__ 87 #include <sys/capsicum.h> 88 #include <sys/sysctl.h> 89 #endif /* __FreeBSD__ */ 90 #ifdef HAVE_CAPSICUM 91 #include <libcapsicum.h> 92 #include <libcapsicum_dns.h> 93 #include <libcapsicum_service.h> 94 #include <sys/nv.h> 95 #include <sys/capability.h> 96 #include <sys/ioccom.h> 97 #include <net/bpf.h> 98 #include <fcntl.h> 99 #include <libgen.h> 100 #endif /* HAVE_CAPSICUM */ 101 #include <pcap.h> 102 #include <signal.h> 103 #include <stdio.h> 104 #include <stdlib.h> 105 #include <string.h> 106 #include <limits.h> 107 #ifndef WIN32 108 #include <sys/wait.h> 109 #include <sys/resource.h> 110 #include <pwd.h> 111 #include <grp.h> 112 #endif /* WIN32 */ 113 114 /* capabilities convenience library */ 115 /* If a code depends on HAVE_LIBCAP_NG, it depends also on HAVE_CAP_NG_H. 116 * If HAVE_CAP_NG_H is not defined, undefine HAVE_LIBCAP_NG. 117 * Thus, the later tests are done only on HAVE_LIBCAP_NG. 118 */ 119 #ifdef HAVE_LIBCAP_NG 120 #ifdef HAVE_CAP_NG_H 121 #include <cap-ng.h> 122 #else 123 #undef HAVE_LIBCAP_NG 124 #endif /* HAVE_CAP_NG_H */ 125 #endif /* HAVE_LIBCAP_NG */ 126 127 #include "netdissect.h" 128 #include "interface.h" 129 #include "addrtoname.h" 130 #include "machdep.h" 131 #include "setsignal.h" 132 #include "gmt2local.h" 133 #include "pcap-missing.h" 134 135 #ifndef PATH_MAX 136 #define PATH_MAX 1024 137 #endif 138 139 #ifdef SIGINFO 140 #define SIGNAL_REQ_INFO SIGINFO 141 #elif SIGUSR1 142 #define SIGNAL_REQ_INFO SIGUSR1 143 #endif 144 145 netdissect_options Gndo; 146 netdissect_options *gndo = &Gndo; 147 148 static int Dflag; /* list available devices and exit */ 149 static int dflag; /* print filter code */ 150 static int Lflag; /* list available data link types and exit */ 151 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE 152 static int Jflag; /* list available time stamp types */ 153 #endif 154 #ifdef HAVE_PCAP_SETDIRECTION 155 int Qflag = -1; /* restrict captured packet by send/receive direction */ 156 #endif 157 static char *zflag = NULL; /* compress each savefile using a specified command (like gzip or bzip2) */ 158 159 static int infodelay; 160 static int infoprint; 161 162 char *program_name; 163 164 #ifdef HAVE_CAPSICUM 165 cap_channel_t *capdns; 166 #endif 167 168 int32_t thiszone; /* seconds offset from gmt to local time */ 169 170 /* Forwards */ 171 static RETSIGTYPE cleanup(int); 172 static RETSIGTYPE child_cleanup(int); 173 static void print_version(void); 174 static void print_usage(void); 175 static void show_dlts_and_exit(const char *device, pcap_t *pd) __attribute__((noreturn)); 176 177 static void print_packet(u_char *, const struct pcap_pkthdr *, const u_char *); 178 static void ndo_default_print(netdissect_options *, const u_char *, u_int); 179 static void dump_packet_and_trunc(u_char *, const struct pcap_pkthdr *, const u_char *); 180 static void dump_packet(u_char *, const struct pcap_pkthdr *, const u_char *); 181 static void droproot(const char *, const char *); 182 static void ndo_error(netdissect_options *ndo, const char *fmt, ...) 183 __attribute__((noreturn)) 184 #ifdef __ATTRIBUTE___FORMAT_OK 185 __attribute__((format (printf, 2, 3))) 186 #endif /* __ATTRIBUTE___FORMAT_OK */ 187 ; 188 static void ndo_warning(netdissect_options *ndo, const char *fmt, ...) 189 #ifdef __ATTRIBUTE___FORMAT_OK 190 __attribute__((format (printf, 2, 3))) 191 #endif /* __ATTRIBUTE___FORMAT_OK */ 192 ; 193 194 #ifdef SIGNAL_REQ_INFO 195 RETSIGTYPE requestinfo(int); 196 #endif 197 198 #if defined(USE_WIN32_MM_TIMER) 199 #include <MMsystem.h> 200 static UINT timer_id; 201 static void CALLBACK verbose_stats_dump(UINT, UINT, DWORD_PTR, DWORD_PTR, DWORD_PTR); 202 #elif defined(HAVE_ALARM) 203 static void verbose_stats_dump(int sig); 204 #endif 205 206 static void info(int); 207 static u_int packets_captured; 208 209 struct printer { 210 if_printer f; 211 int type; 212 }; 213 214 215 struct ndo_printer { 216 if_ndo_printer f; 217 int type; 218 }; 219 220 221 static const struct printer printers[] = { 222 { NULL, 0 }, 223 }; 224 225 static const struct ndo_printer ndo_printers[] = { 226 { ether_if_print, DLT_EN10MB }, 227 #ifdef DLT_IPNET 228 { ipnet_if_print, DLT_IPNET }, 229 #endif 230 #ifdef DLT_IEEE802_15_4 231 { ieee802_15_4_if_print, DLT_IEEE802_15_4 }, 232 #endif 233 #ifdef DLT_IEEE802_15_4_NOFCS 234 { ieee802_15_4_if_print, DLT_IEEE802_15_4_NOFCS }, 235 #endif 236 #ifdef DLT_PPI 237 { ppi_if_print, DLT_PPI }, 238 #endif 239 #ifdef DLT_NETANALYZER 240 { netanalyzer_if_print, DLT_NETANALYZER }, 241 #endif 242 #ifdef DLT_NETANALYZER_TRANSPARENT 243 { netanalyzer_transparent_if_print, DLT_NETANALYZER_TRANSPARENT }, 244 #endif 245 #if defined(DLT_NFLOG) && defined(HAVE_PCAP_NFLOG_H) 246 { nflog_if_print, DLT_NFLOG}, 247 #endif 248 #ifdef DLT_CIP 249 { cip_if_print, DLT_CIP }, 250 #endif 251 #ifdef DLT_ATM_CLIP 252 { cip_if_print, DLT_ATM_CLIP }, 253 #endif 254 #ifdef DLT_IP_OVER_FC 255 { ipfc_if_print, DLT_IP_OVER_FC }, 256 #endif 257 { null_if_print, DLT_NULL }, 258 #ifdef DLT_LOOP 259 { null_if_print, DLT_LOOP }, 260 #endif 261 #ifdef DLT_APPLE_IP_OVER_IEEE1394 262 { ap1394_if_print, DLT_APPLE_IP_OVER_IEEE1394 }, 263 #endif 264 #if defined(DLT_BLUETOOTH_HCI_H4_WITH_PHDR) && defined(HAVE_PCAP_BLUETOOTH_H) 265 { bt_if_print, DLT_BLUETOOTH_HCI_H4_WITH_PHDR}, 266 #endif 267 #ifdef DLT_LANE8023 268 { lane_if_print, DLT_LANE8023 }, 269 #endif 270 { arcnet_if_print, DLT_ARCNET }, 271 #ifdef DLT_ARCNET_LINUX 272 { arcnet_linux_if_print, DLT_ARCNET_LINUX }, 273 #endif 274 { raw_if_print, DLT_RAW }, 275 #ifdef DLT_IPV4 276 { raw_if_print, DLT_IPV4 }, 277 #endif 278 #ifdef DLT_IPV6 279 { raw_if_print, DLT_IPV6 }, 280 #endif 281 #ifdef HAVE_PCAP_USB_H 282 #ifdef DLT_USB_LINUX 283 { usb_linux_48_byte_print, DLT_USB_LINUX}, 284 #endif /* DLT_USB_LINUX */ 285 #ifdef DLT_USB_LINUX_MMAPPED 286 { usb_linux_64_byte_print, DLT_USB_LINUX_MMAPPED}, 287 #endif /* DLT_USB_LINUX_MMAPPED */ 288 #endif /* HAVE_PCAP_USB_H */ 289 #ifdef DLT_SYMANTEC_FIREWALL 290 { symantec_if_print, DLT_SYMANTEC_FIREWALL }, 291 #endif 292 #ifdef DLT_C_HDLC 293 { chdlc_if_print, DLT_C_HDLC }, 294 #endif 295 #ifdef DLT_HDLC 296 { chdlc_if_print, DLT_HDLC }, 297 #endif 298 #ifdef DLT_PPP_ETHER 299 { pppoe_if_print, DLT_PPP_ETHER }, 300 #endif 301 #if defined(DLT_PFLOG) && defined(HAVE_NET_PFVAR_H) 302 { pflog_if_print, DLT_PFLOG }, 303 #endif 304 { token_if_print, DLT_IEEE802 }, 305 { fddi_if_print, DLT_FDDI }, 306 #ifdef DLT_LINUX_SLL 307 { sll_if_print, DLT_LINUX_SLL }, 308 #endif 309 #ifdef DLT_FR 310 { fr_if_print, DLT_FR }, 311 #endif 312 #ifdef DLT_FRELAY 313 { fr_if_print, DLT_FRELAY }, 314 #endif 315 #ifdef DLT_MFR 316 { mfr_if_print, DLT_MFR }, 317 #endif 318 { atm_if_print, DLT_ATM_RFC1483 }, 319 #ifdef DLT_SUNATM 320 { sunatm_if_print, DLT_SUNATM }, 321 #endif 322 #ifdef DLT_ENC 323 { enc_if_print, DLT_ENC }, 324 #endif 325 { sl_if_print, DLT_SLIP }, 326 #ifdef DLT_SLIP_BSDOS 327 { sl_bsdos_if_print, DLT_SLIP_BSDOS }, 328 #endif 329 #ifdef DLT_LTALK 330 { ltalk_if_print, DLT_LTALK }, 331 #endif 332 #ifdef DLT_JUNIPER_ATM1 333 { juniper_atm1_print, DLT_JUNIPER_ATM1 }, 334 #endif 335 #ifdef DLT_JUNIPER_ATM2 336 { juniper_atm2_print, DLT_JUNIPER_ATM2 }, 337 #endif 338 #ifdef DLT_JUNIPER_MFR 339 { juniper_mfr_print, DLT_JUNIPER_MFR }, 340 #endif 341 #ifdef DLT_JUNIPER_MLFR 342 { juniper_mlfr_print, DLT_JUNIPER_MLFR }, 343 #endif 344 #ifdef DLT_JUNIPER_MLPPP 345 { juniper_mlppp_print, DLT_JUNIPER_MLPPP }, 346 #endif 347 #ifdef DLT_JUNIPER_PPPOE 348 { juniper_pppoe_print, DLT_JUNIPER_PPPOE }, 349 #endif 350 #ifdef DLT_JUNIPER_PPPOE_ATM 351 { juniper_pppoe_atm_print, DLT_JUNIPER_PPPOE_ATM }, 352 #endif 353 #ifdef DLT_JUNIPER_GGSN 354 { juniper_ggsn_print, DLT_JUNIPER_GGSN }, 355 #endif 356 #ifdef DLT_JUNIPER_ES 357 { juniper_es_print, DLT_JUNIPER_ES }, 358 #endif 359 #ifdef DLT_JUNIPER_MONITOR 360 { juniper_monitor_print, DLT_JUNIPER_MONITOR }, 361 #endif 362 #ifdef DLT_JUNIPER_SERVICES 363 { juniper_services_print, DLT_JUNIPER_SERVICES }, 364 #endif 365 #ifdef DLT_JUNIPER_ETHER 366 { juniper_ether_print, DLT_JUNIPER_ETHER }, 367 #endif 368 #ifdef DLT_JUNIPER_PPP 369 { juniper_ppp_print, DLT_JUNIPER_PPP }, 370 #endif 371 #ifdef DLT_JUNIPER_FRELAY 372 { juniper_frelay_print, DLT_JUNIPER_FRELAY }, 373 #endif 374 #ifdef DLT_JUNIPER_CHDLC 375 { juniper_chdlc_print, DLT_JUNIPER_CHDLC }, 376 #endif 377 #ifdef DLT_PKTAP 378 { pktap_if_print, DLT_PKTAP }, 379 #endif 380 #ifdef DLT_IEEE802_11_RADIO 381 { ieee802_11_radio_if_print, DLT_IEEE802_11_RADIO }, 382 #endif 383 #ifdef DLT_IEEE802_11 384 { ieee802_11_if_print, DLT_IEEE802_11}, 385 #endif 386 #ifdef DLT_IEEE802_11_RADIO_AVS 387 { ieee802_11_radio_avs_if_print, DLT_IEEE802_11_RADIO_AVS }, 388 #endif 389 #ifdef DLT_PRISM_HEADER 390 { prism_if_print, DLT_PRISM_HEADER }, 391 #endif 392 { ppp_if_print, DLT_PPP }, 393 #ifdef DLT_PPP_WITHDIRECTION 394 { ppp_if_print, DLT_PPP_WITHDIRECTION }, 395 #endif 396 #ifdef DLT_PPP_BSDOS 397 { ppp_bsdos_if_print, DLT_PPP_BSDOS }, 398 #endif 399 #ifdef DLT_PPP_SERIAL 400 { ppp_hdlc_if_print, DLT_PPP_SERIAL }, 401 #endif 402 { NULL, 0 }, 403 }; 404 405 static const struct tok status_flags[] = { 406 #ifdef PCAP_IF_UP 407 { PCAP_IF_UP, "Up" }, 408 #endif 409 #ifdef PCAP_IF_RUNNING 410 { PCAP_IF_RUNNING, "Running" }, 411 #endif 412 { PCAP_IF_LOOPBACK, "Loopback" }, 413 { 0, NULL } 414 }; 415 416 if_printer 417 lookup_printer(int type) 418 { 419 const struct printer *p; 420 421 for (p = printers; p->f; ++p) 422 if (type == p->type) 423 return p->f; 424 425 return NULL; 426 /* NOTREACHED */ 427 } 428 429 if_ndo_printer 430 lookup_ndo_printer(int type) 431 { 432 const struct ndo_printer *p; 433 434 for (p = ndo_printers; p->f; ++p) 435 if (type == p->type) 436 return p->f; 437 438 #if defined(DLT_USER2) && defined(DLT_PKTAP) 439 /* 440 * Apple incorrectly chose to use DLT_USER2 for their PKTAP 441 * header. 442 * 443 * We map DLT_PKTAP, whether it's DLT_USER2 as it is on Darwin- 444 * based OSes or the same value as LINKTYPE_PKTAP as it is on 445 * other OSes, to LINKTYPE_PKTAP, so files written with 446 * this version of libpcap for a DLT_PKTAP capture have a link- 447 * layer header type of LINKTYPE_PKTAP. 448 * 449 * However, files written on OS X Mavericks for a DLT_PKTAP 450 * capture have a link-layer header type of LINKTYPE_USER2. 451 * If we don't have a printer for DLT_USER2, and type is 452 * DLT_USER2, we look up the printer for DLT_PKTAP and use 453 * that. 454 */ 455 if (type == DLT_USER2) { 456 for (p = ndo_printers; p->f; ++p) 457 if (DLT_PKTAP == p->type) 458 return p->f; 459 } 460 #endif 461 462 return NULL; 463 /* NOTREACHED */ 464 } 465 466 static pcap_t *pd; 467 468 static int supports_monitor_mode; 469 470 extern int optind; 471 extern int opterr; 472 extern char *optarg; 473 474 struct print_info { 475 netdissect_options *ndo; 476 union { 477 if_printer printer; 478 if_ndo_printer ndo_printer; 479 } p; 480 int ndo_type; 481 }; 482 483 struct dump_info { 484 char *WFileName; 485 char *CurrentFileName; 486 pcap_t *pd; 487 pcap_dumper_t *p; 488 #ifdef HAVE_CAPSICUM 489 int dirfd; 490 #endif 491 }; 492 493 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE 494 static void 495 show_tstamp_types_and_exit(const char *device, pcap_t *pd) 496 { 497 int n_tstamp_types; 498 int *tstamp_types = 0; 499 const char *tstamp_type_name; 500 int i; 501 502 n_tstamp_types = pcap_list_tstamp_types(pd, &tstamp_types); 503 if (n_tstamp_types < 0) 504 error("%s", pcap_geterr(pd)); 505 506 if (n_tstamp_types == 0) { 507 fprintf(stderr, "Time stamp type cannot be set for %s\n", 508 device); 509 exit(0); 510 } 511 fprintf(stderr, "Time stamp types for %s (use option -j to set):\n", 512 device); 513 for (i = 0; i < n_tstamp_types; i++) { 514 tstamp_type_name = pcap_tstamp_type_val_to_name(tstamp_types[i]); 515 if (tstamp_type_name != NULL) { 516 (void) fprintf(stderr, " %s (%s)\n", tstamp_type_name, 517 pcap_tstamp_type_val_to_description(tstamp_types[i])); 518 } else { 519 (void) fprintf(stderr, " %d\n", tstamp_types[i]); 520 } 521 } 522 pcap_free_tstamp_types(tstamp_types); 523 exit(0); 524 } 525 #endif 526 527 static void 528 show_dlts_and_exit(const char *device, pcap_t *pd) 529 { 530 int n_dlts; 531 int *dlts = 0; 532 const char *dlt_name; 533 534 n_dlts = pcap_list_datalinks(pd, &dlts); 535 if (n_dlts < 0) 536 error("%s", pcap_geterr(pd)); 537 else if (n_dlts == 0 || !dlts) 538 error("No data link types."); 539 540 /* 541 * If the interface is known to support monitor mode, indicate 542 * whether these are the data link types available when not in 543 * monitor mode, if -I wasn't specified, or when in monitor mode, 544 * when -I was specified (the link-layer types available in 545 * monitor mode might be different from the ones available when 546 * not in monitor mode). 547 */ 548 if (supports_monitor_mode) 549 (void) fprintf(stderr, "Data link types for %s %s (use option -y to set):\n", 550 device, 551 Iflag ? "when in monitor mode" : "when not in monitor mode"); 552 else 553 (void) fprintf(stderr, "Data link types for %s (use option -y to set):\n", 554 device); 555 556 while (--n_dlts >= 0) { 557 dlt_name = pcap_datalink_val_to_name(dlts[n_dlts]); 558 if (dlt_name != NULL) { 559 (void) fprintf(stderr, " %s (%s)", dlt_name, 560 pcap_datalink_val_to_description(dlts[n_dlts])); 561 562 /* 563 * OK, does tcpdump handle that type? 564 */ 565 if (lookup_printer(dlts[n_dlts]) == NULL 566 && lookup_ndo_printer(dlts[n_dlts]) == NULL) 567 (void) fprintf(stderr, " (printing not supported)"); 568 fprintf(stderr, "\n"); 569 } else { 570 (void) fprintf(stderr, " DLT %d (printing not supported)\n", 571 dlts[n_dlts]); 572 } 573 } 574 #ifdef HAVE_PCAP_FREE_DATALINKS 575 pcap_free_datalinks(dlts); 576 #endif 577 exit(0); 578 } 579 580 #ifdef HAVE_PCAP_FINDALLDEVS 581 static void 582 show_devices_and_exit (void) 583 { 584 pcap_if_t *devpointer; 585 char ebuf[PCAP_ERRBUF_SIZE]; 586 int i; 587 588 if (pcap_findalldevs(&devpointer, ebuf) < 0) 589 error("%s", ebuf); 590 else { 591 for (i = 0; devpointer != NULL; i++) { 592 printf("%d.%s", i+1, devpointer->name); 593 if (devpointer->description != NULL) 594 printf(" (%s)", devpointer->description); 595 if (devpointer->flags != 0) 596 printf(" [%s]", bittok2str(status_flags, "none", devpointer->flags)); 597 printf("\n"); 598 devpointer = devpointer->next; 599 } 600 } 601 exit(0); 602 } 603 #endif /* HAVE_PCAP_FINDALLDEVS */ 604 605 /* 606 * Short options. 607 * 608 * Note that there we use all letters for short options except for g, k, 609 * o, and P, and those are used by other versions of tcpdump, and we should 610 * only use them for the same purposes that the other versions of tcpdump 611 * use them: 612 * 613 * OS X tcpdump uses -g to force non--v output for IP to be on one 614 * line, making it more "g"repable; 615 * 616 * OS X tcpdump uses -k tospecify that packet comments in pcap-ng files 617 * should be printed; 618 * 619 * OpenBSD tcpdump uses -o to indicate that OS fingerprinting should be done 620 * for hosts sending TCP SYN packets; 621 * 622 * OS X tcpdump uses -P to indicate that -w should write pcap-ng rather 623 * than pcap files. 624 * 625 * OS X tcpdump also uses -Q to specify expressions that match packet 626 * metadata, including but not limited to the packet direction. 627 * The expression syntax is different from a simple "in|out|inout", 628 * and those expressions aren't accepted by OS X tcpdump, but the 629 * equivalents would be "in" = "dir=in", "out" = "dir=out", and 630 * "inout" = "dir=in or dir=out", and the parser could conceivably 631 * special-case "in", "out", and "inout" as expressions for backwards 632 * compatibility, so all is not (yet) lost. 633 */ 634 635 /* 636 * Set up flags that might or might not be supported depending on the 637 * version of libpcap we're using. 638 */ 639 #if defined(HAVE_PCAP_CREATE) || defined(WIN32) 640 #define B_FLAG "B:" 641 #define B_FLAG_USAGE " [ -B size ]" 642 #else /* defined(HAVE_PCAP_CREATE) || defined(WIN32) */ 643 #define B_FLAG 644 #define B_FLAG_USAGE 645 #endif /* defined(HAVE_PCAP_CREATE) || defined(WIN32) */ 646 647 #ifdef HAVE_PCAP_CREATE 648 #define I_FLAG "I" 649 #else /* HAVE_PCAP_CREATE */ 650 #define I_FLAG 651 #endif /* HAVE_PCAP_CREATE */ 652 653 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE 654 #define j_FLAG "j:" 655 #define j_FLAG_USAGE " [ -j tstamptype ]" 656 #define J_FLAG "J" 657 #else /* PCAP_ERROR_TSTAMP_TYPE_NOTSUP */ 658 #define j_FLAG 659 #define j_FLAG_USAGE 660 #define J_FLAG 661 #endif /* PCAP_ERROR_TSTAMP_TYPE_NOTSUP */ 662 663 #ifdef HAVE_PCAP_FINDALLDEVS 664 #define D_FLAG "D" 665 #else 666 #define D_FLAG 667 #endif 668 669 #ifdef HAVE_PCAP_DUMP_FLUSH 670 #define U_FLAG "U" 671 #else 672 #define U_FLAG 673 #endif 674 675 #ifdef HAVE_PCAP_SETDIRECTION 676 #define Q_FLAG "Q:" 677 #else 678 #define Q_FLAG 679 #endif 680 681 #define SHORTOPTS "aAb" B_FLAG "c:C:d" D_FLAG "eE:fF:G:hHi:" I_FLAG j_FLAG J_FLAG "KlLm:M:nNOpq" Q_FLAG "r:Rs:StT:u" U_FLAG "vV:w:W:xXy:Yz:Z:#" 682 683 /* 684 * Long options. 685 * 686 * We do not currently have long options corresponding to all short 687 * options; we should probably pick appropriate option names for them. 688 * 689 * However, the short options where the number of times the option is 690 * specified matters, such as -v and -d and -t, should probably not 691 * just map to a long option, as saying 692 * 693 * tcpdump --verbose --verbose 694 * 695 * doesn't make sense; it should be --verbosity={N} or something such 696 * as that. 697 * 698 * For long options with no corresponding short options, we define values 699 * outside the range of ASCII graphic characters, make that the last 700 * component of the entry for the long option, and have a case for that 701 * option in the switch statement. 702 */ 703 #define OPTION_VERSION 128 704 #define OPTION_TSTAMP_PRECISION 129 705 #define OPTION_IMMEDIATE_MODE 130 706 707 static const struct option longopts[] = { 708 #if defined(HAVE_PCAP_CREATE) || defined(WIN32) 709 { "buffer-size", required_argument, NULL, 'B' }, 710 #endif 711 { "list-interfaces", no_argument, NULL, 'D' }, 712 { "help", no_argument, NULL, 'h' }, 713 { "interface", required_argument, NULL, 'i' }, 714 #ifdef HAVE_PCAP_CREATE 715 { "monitor-mode", no_argument, NULL, 'I' }, 716 #endif 717 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE 718 { "time-stamp-type", required_argument, NULL, 'j' }, 719 { "list-time-stamp-types", no_argument, NULL, 'J' }, 720 #endif 721 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION 722 { "time-stamp-precision", required_argument, NULL, OPTION_TSTAMP_PRECISION}, 723 #endif 724 { "dont-verify-checksums", no_argument, NULL, 'K' }, 725 { "list-data-link-types", no_argument, NULL, 'L' }, 726 { "no-optimize", no_argument, NULL, 'O' }, 727 { "no-promiscuous-mode", no_argument, NULL, 'p' }, 728 #ifdef HAVE_PCAP_SETDIRECTION 729 { "direction", required_argument, NULL, 'Q' }, 730 #endif 731 { "snapshot-length", required_argument, NULL, 's' }, 732 { "absolute-tcp-sequence-numbers", no_argument, NULL, 'S' }, 733 #ifdef HAVE_PCAP_DUMP_FLUSH 734 { "packet-buffered", no_argument, NULL, 'U' }, 735 #endif 736 { "linktype", required_argument, NULL, 'y' }, 737 #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE 738 { "immediate-mode", no_argument, NULL, OPTION_IMMEDIATE_MODE }, 739 #endif 740 #if defined(HAVE_PCAP_DEBUG) || defined(HAVE_YYDEBUG) 741 { "debug-filter-parser", no_argument, NULL, 'Y' }, 742 #endif 743 { "relinquish-privileges", required_argument, NULL, 'Z' }, 744 { "number", no_argument, NULL, '#' }, 745 { "version", no_argument, NULL, OPTION_VERSION }, 746 { NULL, 0, NULL, 0 } 747 }; 748 749 #ifndef WIN32 750 /* Drop root privileges and chroot if necessary */ 751 static void 752 droproot(const char *username, const char *chroot_dir) 753 { 754 struct passwd *pw = NULL; 755 756 if (chroot_dir && !username) { 757 fprintf(stderr, "tcpdump: Chroot without dropping root is insecure\n"); 758 exit(1); 759 } 760 761 pw = getpwnam(username); 762 if (pw) { 763 if (chroot_dir) { 764 if (chroot(chroot_dir) != 0 || chdir ("/") != 0) { 765 fprintf(stderr, "tcpdump: Couldn't chroot/chdir to '%.64s': %s\n", 766 chroot_dir, pcap_strerror(errno)); 767 exit(1); 768 } 769 } 770 #ifdef HAVE_LIBCAP_NG 771 int ret = capng_change_id(pw->pw_uid, pw->pw_gid, CAPNG_NO_FLAG); 772 if (ret < 0) { 773 fprintf(stderr, "error : ret %d\n", ret); 774 } 775 else { 776 fprintf(stderr, "dropped privs to %s\n", username); 777 } 778 #else 779 if (initgroups(pw->pw_name, pw->pw_gid) != 0 || 780 setgid(pw->pw_gid) != 0 || setuid(pw->pw_uid) != 0) { 781 fprintf(stderr, "tcpdump: Couldn't change to '%.32s' uid=%lu gid=%lu: %s\n", 782 username, 783 (unsigned long)pw->pw_uid, 784 (unsigned long)pw->pw_gid, 785 pcap_strerror(errno)); 786 exit(1); 787 } 788 else { 789 fprintf(stderr, "dropped privs to %s\n", username); 790 } 791 #endif /* HAVE_LIBCAP_NG */ 792 } 793 else { 794 fprintf(stderr, "tcpdump: Couldn't find user '%.32s'\n", 795 username); 796 exit(1); 797 } 798 #ifdef HAVE_LIBCAP_NG 799 /* We don't need CAP_SETUID and CAP_SETGID any more. */ 800 capng_updatev( 801 CAPNG_DROP, 802 CAPNG_EFFECTIVE | CAPNG_PERMITTED, 803 CAP_SETUID, 804 CAP_SETGID, 805 -1); 806 capng_apply(CAPNG_SELECT_BOTH); 807 #endif /* HAVE_LIBCAP_NG */ 808 809 } 810 #endif /* WIN32 */ 811 812 static int 813 getWflagChars(int x) 814 { 815 int c = 0; 816 817 x -= 1; 818 while (x > 0) { 819 c += 1; 820 x /= 10; 821 } 822 823 return c; 824 } 825 826 827 static void 828 MakeFilename(char *buffer, char *orig_name, int cnt, int max_chars) 829 { 830 char *filename = malloc(PATH_MAX + 1); 831 if (filename == NULL) 832 error("Makefilename: malloc"); 833 834 /* Process with strftime if Gflag is set. */ 835 if (Gflag != 0) { 836 struct tm *local_tm; 837 838 /* Convert Gflag_time to a usable format */ 839 if ((local_tm = localtime(&Gflag_time)) == NULL) { 840 error("MakeTimedFilename: localtime"); 841 } 842 843 /* There's no good way to detect an error in strftime since a return 844 * value of 0 isn't necessarily failure. 845 */ 846 strftime(filename, PATH_MAX, orig_name, local_tm); 847 } else { 848 strncpy(filename, orig_name, PATH_MAX); 849 } 850 851 if (cnt == 0 && max_chars == 0) 852 strncpy(buffer, filename, PATH_MAX + 1); 853 else 854 if (snprintf(buffer, PATH_MAX + 1, "%s%0*d", filename, max_chars, cnt) > PATH_MAX) 855 /* Report an error if the filename is too large */ 856 error("too many output files or filename is too long (> %d)", PATH_MAX); 857 free(filename); 858 } 859 860 static int tcpdump_printf(netdissect_options *ndo _U_, 861 const char *fmt, ...) 862 { 863 864 va_list args; 865 int ret; 866 867 va_start(args, fmt); 868 ret=vfprintf(stdout, fmt, args); 869 va_end(args); 870 871 return ret; 872 } 873 874 static struct print_info 875 get_print_info(int type) 876 { 877 struct print_info printinfo; 878 879 printinfo.ndo_type = 1; 880 printinfo.ndo = gndo; 881 printinfo.p.ndo_printer = lookup_ndo_printer(type); 882 if (printinfo.p.ndo_printer == NULL) { 883 printinfo.p.printer = lookup_printer(type); 884 printinfo.ndo_type = 0; 885 if (printinfo.p.printer == NULL) { 886 gndo->ndo_dltname = pcap_datalink_val_to_name(type); 887 if (gndo->ndo_dltname != NULL) 888 error("packet printing is not supported for link type %s: use -w", 889 gndo->ndo_dltname); 890 else 891 error("packet printing is not supported for link type %d: use -w", type); 892 } 893 } 894 return (printinfo); 895 } 896 897 static char * 898 get_next_file(FILE *VFile, char *ptr) 899 { 900 char *ret; 901 902 ret = fgets(ptr, PATH_MAX, VFile); 903 if (!ret) 904 return NULL; 905 906 if (ptr[strlen(ptr) - 1] == '\n') 907 ptr[strlen(ptr) - 1] = '\0'; 908 909 return ret; 910 } 911 912 #ifdef HAVE_CAPSICUM 913 static cap_channel_t * 914 capdns_setup(void) 915 { 916 cap_channel_t *capcas, *capdnsloc; 917 const char *types[1]; 918 int families[2]; 919 920 capcas = cap_init(); 921 if (capcas == NULL) { 922 warning("unable to contact casperd"); 923 return (NULL); 924 } 925 capdnsloc = cap_service_open(capcas, "system.dns"); 926 /* Casper capability no longer needed. */ 927 cap_close(capcas); 928 if (capdnsloc == NULL) 929 error("unable to open system.dns service"); 930 /* Limit system.dns to reverse DNS lookups. */ 931 types[0] = "ADDR"; 932 if (cap_dns_type_limit(capdnsloc, types, 1) < 0) 933 error("unable to limit access to system.dns service"); 934 families[0] = AF_INET; 935 families[1] = AF_INET6; 936 if (cap_dns_family_limit(capdnsloc, families, 2) < 0) 937 error("unable to limit access to system.dns service"); 938 939 return (capdnsloc); 940 } 941 #endif /* HAVE_CAPSICUM */ 942 943 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION 944 static int 945 tstamp_precision_from_string(const char *precision) 946 { 947 if (strncmp(precision, "nano", strlen("nano")) == 0) 948 return PCAP_TSTAMP_PRECISION_NANO; 949 950 if (strncmp(precision, "micro", strlen("micro")) == 0) 951 return PCAP_TSTAMP_PRECISION_MICRO; 952 953 return -EINVAL; 954 } 955 956 static const char * 957 tstamp_precision_to_string(int precision) 958 { 959 switch (precision) { 960 961 case PCAP_TSTAMP_PRECISION_MICRO: 962 return "micro"; 963 964 case PCAP_TSTAMP_PRECISION_NANO: 965 return "nano"; 966 967 default: 968 return "unknown"; 969 } 970 } 971 #endif 972 973 #ifdef HAVE_CAPSICUM 974 /* 975 * Ensure that, on a dump file's descriptor, we have all the rights 976 * necessary to make the standard I/O library work with an fdopen()ed 977 * FILE * from that descriptor. 978 * 979 * A long time ago, in a galaxy far far away, AT&T decided that, instead 980 * of providing separate APIs for getting and setting the FD_ flags on a 981 * descriptor, getting and setting the O_ flags on a descriptor, and 982 * locking files, they'd throw them all into a kitchen-sink fcntl() call 983 * along the lines of ioctl(), the fact that ioctl() operations are 984 * largely specific to particular character devices but fcntl() operations 985 * are either generic to all descriptors or generic to all descriptors for 986 * regular files nonwithstanding. 987 * 988 * The Capsicum people decided that fine-grained control of descriptor 989 * operations was required, so that you need to grant permission for 990 * reading, writing, seeking, and fcntl-ing. The latter, courtesy of 991 * AT&T's decision, means that "fcntl-ing" isn't a thing, but a motley 992 * collection of things, so there are *individual* fcntls for which 993 * permission needs to be granted. 994 * 995 * The FreeBSD standard I/O people implemented some optimizations that 996 * requires that the standard I/O routines be able to determine whether 997 * the descriptor for the FILE * is open append-only or not; as that 998 * descriptor could have come from an open() rather than an fopen(), 999 * that requires that it be able to do an F_GETFL fcntl() to read 1000 * the O_ flags. 1001 * 1002 * Tcpdump uses ftell() to determine how much data has been written 1003 * to a file in order to, when used with -C, determine when it's time 1004 * to rotate capture files. ftell() therefore needs to do an lseek() 1005 * to find out the file offset and must, thanks to the aforementioned 1006 * optimization, also know whether the descriptor is open append-only 1007 * or not. 1008 * 1009 * The net result of all the above is that we need to grant CAP_SEEK, 1010 * CAP_WRITE, and CAP_FCNTL with the CAP_FCNTL_GETFL subcapability. 1011 * 1012 * Perhaps this is the universe's way of saying that either 1013 * 1014 * 1) there needs to be an fopenat() call and a pcap_dump_openat() call 1015 * using it, so that Capsicum-capable tcpdump wouldn't need to do 1016 * an fdopen() 1017 * 1018 * or 1019 * 1020 * 2) there needs to be a cap_fdopen() call in the FreeBSD standard 1021 * I/O library that knows what rights are needed by the standard 1022 * I/O library, based on the open mode, and assigns them, perhaps 1023 * with an additional argument indicating, for example, whether 1024 * seeking should be allowed, so that tcpdump doesn't need to know 1025 * what the standard I/O library happens to require this week. 1026 */ 1027 static void 1028 set_dumper_capsicum_rights(pcap_dumper_t *p) 1029 { 1030 int fd = fileno(pcap_dump_file(p)); 1031 cap_rights_t rights; 1032 1033 cap_rights_init(&rights, CAP_SEEK, CAP_WRITE, CAP_FCNTL); 1034 if (cap_rights_limit(fd, &rights) < 0 && errno != ENOSYS) { 1035 error("unable to limit dump descriptor"); 1036 } 1037 if (cap_fcntls_limit(fd, CAP_FCNTL_GETFL) < 0 && errno != ENOSYS) { 1038 error("unable to limit dump descriptor fcntls"); 1039 } 1040 } 1041 #endif 1042 1043 int 1044 main(int argc, char **argv) 1045 { 1046 register int cnt, op, i; 1047 bpf_u_int32 localnet =0 , netmask = 0; 1048 register char *cp, *infile, *cmdbuf, *device, *RFileName, *VFileName, *WFileName; 1049 pcap_handler callback; 1050 int type; 1051 int dlt; 1052 int new_dlt; 1053 const char *dlt_name; 1054 struct bpf_program fcode; 1055 #ifndef WIN32 1056 RETSIGTYPE (*oldhandler)(int); 1057 #endif 1058 struct print_info printinfo; 1059 struct dump_info dumpinfo; 1060 u_char *pcap_userdata; 1061 char ebuf[PCAP_ERRBUF_SIZE]; 1062 char VFileLine[PATH_MAX + 1]; 1063 char *username = NULL; 1064 char *chroot_dir = NULL; 1065 char *ret = NULL; 1066 char *end; 1067 #ifdef HAVE_PCAP_FINDALLDEVS 1068 pcap_if_t *devpointer; 1069 int devnum; 1070 #endif 1071 int status; 1072 FILE *VFile; 1073 #ifdef HAVE_CAPSICUM 1074 cap_rights_t rights; 1075 #endif /* HAVE_CAPSICUM */ 1076 int cansandbox; 1077 1078 #ifdef WIN32 1079 if(wsockinit() != 0) return 1; 1080 #endif /* WIN32 */ 1081 1082 jflag=-1; /* not set */ 1083 gndo->ndo_Oflag=1; 1084 gndo->ndo_Rflag=1; 1085 gndo->ndo_dlt=-1; 1086 gndo->ndo_default_print=ndo_default_print; 1087 gndo->ndo_printf=tcpdump_printf; 1088 gndo->ndo_error=ndo_error; 1089 gndo->ndo_warning=ndo_warning; 1090 gndo->ndo_snaplen = DEFAULT_SNAPLEN; 1091 gndo->ndo_immediate = 0; 1092 1093 cnt = -1; 1094 device = NULL; 1095 infile = NULL; 1096 RFileName = NULL; 1097 VFileName = NULL; 1098 VFile = NULL; 1099 WFileName = NULL; 1100 dlt = -1; 1101 if ((cp = strrchr(argv[0], '/')) != NULL) 1102 program_name = cp + 1; 1103 else 1104 program_name = argv[0]; 1105 1106 /* 1107 * On platforms where the CPU doesn't support unaligned loads, 1108 * force unaligned accesses to abort with SIGBUS, rather than 1109 * being fixed up (slowly) by the OS kernel; on those platforms, 1110 * misaligned accesses are bugs, and we want tcpdump to crash so 1111 * that the bugs are reported. 1112 */ 1113 if (abort_on_misalignment(ebuf, sizeof(ebuf)) < 0) 1114 error("%s", ebuf); 1115 1116 #ifdef USE_LIBSMI 1117 smiInit("tcpdump"); 1118 #endif 1119 1120 while ( 1121 (op = getopt_long(argc, argv, SHORTOPTS, longopts, NULL)) != -1) 1122 switch (op) { 1123 1124 case 'a': 1125 /* compatibility for old -a */ 1126 break; 1127 1128 case 'A': 1129 ++Aflag; 1130 break; 1131 1132 case 'b': 1133 ++bflag; 1134 break; 1135 1136 #if defined(HAVE_PCAP_CREATE) || defined(WIN32) 1137 case 'B': 1138 Bflag = atoi(optarg)*1024; 1139 if (Bflag <= 0) 1140 error("invalid packet buffer size %s", optarg); 1141 break; 1142 #endif /* defined(HAVE_PCAP_CREATE) || defined(WIN32) */ 1143 1144 case 'c': 1145 cnt = atoi(optarg); 1146 if (cnt <= 0) 1147 error("invalid packet count %s", optarg); 1148 break; 1149 1150 case 'C': 1151 Cflag = atoi(optarg) * 1000000; 1152 if (Cflag < 0) 1153 error("invalid file size %s", optarg); 1154 break; 1155 1156 case 'd': 1157 ++dflag; 1158 break; 1159 1160 case 'D': 1161 Dflag++; 1162 break; 1163 1164 case 'L': 1165 Lflag++; 1166 break; 1167 1168 case 'e': 1169 ++eflag; 1170 break; 1171 1172 case 'E': 1173 #ifndef HAVE_LIBCRYPTO 1174 warning("crypto code not compiled in"); 1175 #endif 1176 gndo->ndo_espsecret = optarg; 1177 break; 1178 1179 case 'f': 1180 ++fflag; 1181 break; 1182 1183 case 'F': 1184 infile = optarg; 1185 break; 1186 1187 case 'G': 1188 Gflag = atoi(optarg); 1189 if (Gflag < 0) 1190 error("invalid number of seconds %s", optarg); 1191 1192 /* We will create one file initially. */ 1193 Gflag_count = 0; 1194 1195 /* Grab the current time for rotation use. */ 1196 if ((Gflag_time = time(NULL)) == (time_t)-1) { 1197 error("main: can't get current time: %s", 1198 pcap_strerror(errno)); 1199 } 1200 break; 1201 1202 case 'h': 1203 print_usage(); 1204 exit(0); 1205 break; 1206 1207 case 'H': 1208 ++Hflag; 1209 break; 1210 1211 case 'i': 1212 if (optarg[0] == '0' && optarg[1] == 0) 1213 error("Invalid adapter index"); 1214 1215 #ifdef HAVE_PCAP_FINDALLDEVS 1216 /* 1217 * If the argument is a number, treat it as 1218 * an index into the list of adapters, as 1219 * printed by "tcpdump -D". 1220 * 1221 * This should be OK on UNIX systems, as interfaces 1222 * shouldn't have names that begin with digits. 1223 * It can be useful on Windows, where more than 1224 * one interface can have the same name. 1225 */ 1226 devnum = strtol(optarg, &end, 10); 1227 if (optarg != end && *end == '\0') { 1228 if (devnum < 0) 1229 error("Invalid adapter index"); 1230 1231 if (pcap_findalldevs(&devpointer, ebuf) < 0) 1232 error("%s", ebuf); 1233 else { 1234 /* 1235 * Look for the devnum-th entry 1236 * in the list of devices 1237 * (1-based). 1238 */ 1239 for (i = 0; 1240 i < devnum-1 && devpointer != NULL; 1241 i++, devpointer = devpointer->next) 1242 ; 1243 if (devpointer == NULL) 1244 error("Invalid adapter index"); 1245 } 1246 device = devpointer->name; 1247 break; 1248 } 1249 #endif /* HAVE_PCAP_FINDALLDEVS */ 1250 device = optarg; 1251 break; 1252 1253 #ifdef HAVE_PCAP_CREATE 1254 case 'I': 1255 ++Iflag; 1256 break; 1257 #endif /* HAVE_PCAP_CREATE */ 1258 1259 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE 1260 case 'j': 1261 jflag = pcap_tstamp_type_name_to_val(optarg); 1262 if (jflag < 0) 1263 error("invalid time stamp type %s", optarg); 1264 break; 1265 1266 case 'J': 1267 Jflag++; 1268 break; 1269 #endif 1270 1271 case 'l': 1272 #ifdef WIN32 1273 /* 1274 * _IOLBF is the same as _IOFBF in Microsoft's C 1275 * libraries; the only alternative they offer 1276 * is _IONBF. 1277 * 1278 * XXX - this should really be checking for MSVC++, 1279 * not WIN32, if, for example, MinGW has its own 1280 * C library that is more UNIX-compatible. 1281 */ 1282 setvbuf(stdout, NULL, _IONBF, 0); 1283 #else /* WIN32 */ 1284 #ifdef HAVE_SETLINEBUF 1285 setlinebuf(stdout); 1286 #else 1287 setvbuf(stdout, NULL, _IOLBF, 0); 1288 #endif 1289 #endif /* WIN32 */ 1290 break; 1291 1292 case 'K': 1293 ++Kflag; 1294 break; 1295 1296 case 'm': 1297 #ifdef USE_LIBSMI 1298 if (smiLoadModule(optarg) == 0) { 1299 error("could not load MIB module %s", optarg); 1300 } 1301 sflag = 1; 1302 #else 1303 (void)fprintf(stderr, "%s: ignoring option `-m %s' ", 1304 program_name, optarg); 1305 (void)fprintf(stderr, "(no libsmi support)\n"); 1306 #endif 1307 break; 1308 1309 case 'M': 1310 /* TCP-MD5 shared secret */ 1311 #ifndef HAVE_LIBCRYPTO 1312 warning("crypto code not compiled in"); 1313 #endif 1314 sigsecret = optarg; 1315 break; 1316 1317 case 'n': 1318 ++nflag; 1319 break; 1320 1321 case 'N': 1322 ++Nflag; 1323 break; 1324 1325 case 'O': 1326 Oflag = 0; 1327 break; 1328 1329 case 'p': 1330 ++pflag; 1331 break; 1332 1333 case 'q': 1334 ++qflag; 1335 ++suppress_default_print; 1336 break; 1337 1338 #ifdef HAVE_PCAP_SETDIRECTION 1339 case 'Q': 1340 if (strcasecmp(optarg, "in") == 0) 1341 Qflag = PCAP_D_IN; 1342 else if (strcasecmp(optarg, "out") == 0) 1343 Qflag = PCAP_D_OUT; 1344 else if (strcasecmp(optarg, "inout") == 0) 1345 Qflag = PCAP_D_INOUT; 1346 else 1347 error("unknown capture direction `%s'", optarg); 1348 break; 1349 #endif /* HAVE_PCAP_SETDIRECTION */ 1350 1351 case 'r': 1352 RFileName = optarg; 1353 break; 1354 1355 case 'R': 1356 Rflag = 0; 1357 break; 1358 1359 case 's': 1360 snaplen = strtol(optarg, &end, 0); 1361 if (optarg == end || *end != '\0' 1362 || snaplen < 0 || snaplen > MAXIMUM_SNAPLEN) 1363 error("invalid snaplen %s", optarg); 1364 else if (snaplen == 0) 1365 snaplen = MAXIMUM_SNAPLEN; 1366 break; 1367 1368 case 'S': 1369 ++Sflag; 1370 break; 1371 1372 case 't': 1373 ++tflag; 1374 break; 1375 1376 case 'T': 1377 if (strcasecmp(optarg, "vat") == 0) 1378 packettype = PT_VAT; 1379 else if (strcasecmp(optarg, "wb") == 0) 1380 packettype = PT_WB; 1381 else if (strcasecmp(optarg, "rpc") == 0) 1382 packettype = PT_RPC; 1383 else if (strcasecmp(optarg, "rtp") == 0) 1384 packettype = PT_RTP; 1385 else if (strcasecmp(optarg, "rtcp") == 0) 1386 packettype = PT_RTCP; 1387 else if (strcasecmp(optarg, "snmp") == 0) 1388 packettype = PT_SNMP; 1389 else if (strcasecmp(optarg, "cnfp") == 0) 1390 packettype = PT_CNFP; 1391 else if (strcasecmp(optarg, "tftp") == 0) 1392 packettype = PT_TFTP; 1393 else if (strcasecmp(optarg, "aodv") == 0) 1394 packettype = PT_AODV; 1395 else if (strcasecmp(optarg, "carp") == 0) 1396 packettype = PT_CARP; 1397 else if (strcasecmp(optarg, "radius") == 0) 1398 packettype = PT_RADIUS; 1399 else if (strcasecmp(optarg, "zmtp1") == 0) 1400 packettype = PT_ZMTP1; 1401 else if (strcasecmp(optarg, "vxlan") == 0) 1402 packettype = PT_VXLAN; 1403 else if (strcasecmp(optarg, "pgm") == 0) 1404 packettype = PT_PGM; 1405 else if (strcasecmp(optarg, "pgm_zmtp1") == 0) 1406 packettype = PT_PGM_ZMTP1; 1407 else if (strcasecmp(optarg, "lmp") == 0) 1408 packettype = PT_LMP; 1409 else 1410 error("unknown packet type `%s'", optarg); 1411 break; 1412 1413 case 'u': 1414 ++uflag; 1415 break; 1416 1417 #ifdef HAVE_PCAP_DUMP_FLUSH 1418 case 'U': 1419 ++Uflag; 1420 break; 1421 #endif 1422 1423 case 'v': 1424 ++vflag; 1425 break; 1426 1427 case 'V': 1428 VFileName = optarg; 1429 break; 1430 1431 case 'w': 1432 WFileName = optarg; 1433 break; 1434 1435 case 'W': 1436 Wflag = atoi(optarg); 1437 if (Wflag < 0) 1438 error("invalid number of output files %s", optarg); 1439 WflagChars = getWflagChars(Wflag); 1440 break; 1441 1442 case 'x': 1443 ++xflag; 1444 ++suppress_default_print; 1445 break; 1446 1447 case 'X': 1448 ++Xflag; 1449 ++suppress_default_print; 1450 break; 1451 1452 case 'y': 1453 gndo->ndo_dltname = optarg; 1454 gndo->ndo_dlt = 1455 pcap_datalink_name_to_val(gndo->ndo_dltname); 1456 if (gndo->ndo_dlt < 0) 1457 error("invalid data link type %s", gndo->ndo_dltname); 1458 break; 1459 1460 #if defined(HAVE_PCAP_DEBUG) || defined(HAVE_YYDEBUG) 1461 case 'Y': 1462 { 1463 /* Undocumented flag */ 1464 #ifdef HAVE_PCAP_DEBUG 1465 extern int pcap_debug; 1466 pcap_debug = 1; 1467 #else 1468 extern int yydebug; 1469 yydebug = 1; 1470 #endif 1471 } 1472 break; 1473 #endif 1474 case 'z': 1475 zflag = strdup(optarg); 1476 break; 1477 1478 case 'Z': 1479 username = strdup(optarg); 1480 break; 1481 1482 case '#': 1483 gndo->ndo_packet_number = 1; 1484 break; 1485 1486 case OPTION_VERSION: 1487 print_version(); 1488 exit(0); 1489 break; 1490 1491 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION 1492 case OPTION_TSTAMP_PRECISION: 1493 gndo->ndo_tstamp_precision = tstamp_precision_from_string(optarg); 1494 if (gndo->ndo_tstamp_precision < 0) 1495 error("unsupported time stamp precision"); 1496 break; 1497 #endif 1498 1499 #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE 1500 case OPTION_IMMEDIATE_MODE: 1501 gndo->ndo_immediate = 1; 1502 break; 1503 #endif 1504 1505 default: 1506 print_usage(); 1507 exit(1); 1508 /* NOTREACHED */ 1509 } 1510 1511 #ifdef HAVE_PCAP_FINDALLDEVS 1512 if (Dflag) 1513 show_devices_and_exit(); 1514 #endif 1515 1516 switch (tflag) { 1517 1518 case 0: /* Default */ 1519 case 4: /* Default + Date*/ 1520 thiszone = gmt2local(0); 1521 break; 1522 1523 case 1: /* No time stamp */ 1524 case 2: /* Unix timeval style */ 1525 case 3: /* Microseconds since previous packet */ 1526 case 5: /* Microseconds since first packet */ 1527 break; 1528 1529 default: /* Not supported */ 1530 error("only -t, -tt, -ttt, -tttt and -ttttt are supported"); 1531 break; 1532 } 1533 1534 if (fflag != 0 && (VFileName != NULL || RFileName != NULL)) 1535 error("-f can not be used with -V or -r"); 1536 1537 if (VFileName != NULL && RFileName != NULL) 1538 error("-V and -r are mutually exclusive."); 1539 1540 #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE 1541 /* 1542 * If we're printing dissected packets to the standard output 1543 * rather than saving raw packets to a file, and the standard 1544 * output is a terminal, use immediate mode, as the user's 1545 * probably expecting to see packets pop up immediately. 1546 */ 1547 if (WFileName == NULL && isatty(1)) 1548 gndo->ndo_immediate = 1; 1549 #endif 1550 1551 #ifdef WITH_CHROOT 1552 /* if run as root, prepare for chrooting */ 1553 if (getuid() == 0 || geteuid() == 0) { 1554 /* future extensibility for cmd-line arguments */ 1555 if (!chroot_dir) 1556 chroot_dir = WITH_CHROOT; 1557 } 1558 #endif 1559 1560 #ifdef WITH_USER 1561 /* if run as root, prepare for dropping root privileges */ 1562 if (getuid() == 0 || geteuid() == 0) { 1563 /* Run with '-Z root' to restore old behaviour */ 1564 if (!username) 1565 username = WITH_USER; 1566 } 1567 #endif 1568 1569 if (RFileName != NULL || VFileName != NULL) { 1570 /* 1571 * If RFileName is non-null, it's the pathname of a 1572 * savefile to read. If VFileName is non-null, it's 1573 * the pathname of a file containing a list of pathnames 1574 * (one per line) of savefiles to read. 1575 * 1576 * In either case, we're reading a savefile, not doing 1577 * a live capture. 1578 */ 1579 #ifndef WIN32 1580 /* 1581 * We don't need network access, so relinquish any set-UID 1582 * or set-GID privileges we have (if any). 1583 * 1584 * We do *not* want set-UID privileges when opening a 1585 * trace file, as that might let the user read other 1586 * people's trace files (especially if we're set-UID 1587 * root). 1588 */ 1589 if (setgid(getgid()) != 0 || setuid(getuid()) != 0 ) 1590 fprintf(stderr, "Warning: setgid/setuid failed !\n"); 1591 #endif /* WIN32 */ 1592 if (VFileName != NULL) { 1593 if (VFileName[0] == '-' && VFileName[1] == '\0') 1594 VFile = stdin; 1595 else 1596 VFile = fopen(VFileName, "r"); 1597 1598 if (VFile == NULL) 1599 error("Unable to open file: %s\n", strerror(errno)); 1600 1601 ret = get_next_file(VFile, VFileLine); 1602 if (!ret) 1603 error("Nothing in %s\n", VFileName); 1604 RFileName = VFileLine; 1605 } 1606 1607 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION 1608 pd = pcap_open_offline_with_tstamp_precision(RFileName, 1609 gndo->ndo_tstamp_precision, ebuf); 1610 #else 1611 pd = pcap_open_offline(RFileName, ebuf); 1612 #endif 1613 1614 if (pd == NULL) 1615 error("%s", ebuf); 1616 #ifdef HAVE_CAPSICUM 1617 cap_rights_init(&rights, CAP_READ); 1618 if (cap_rights_limit(fileno(pcap_file(pd)), &rights) < 0 && 1619 errno != ENOSYS) { 1620 error("unable to limit pcap descriptor"); 1621 } 1622 #endif 1623 dlt = pcap_datalink(pd); 1624 dlt_name = pcap_datalink_val_to_name(dlt); 1625 if (dlt_name == NULL) { 1626 fprintf(stderr, "reading from file %s, link-type %u\n", 1627 RFileName, dlt); 1628 } else { 1629 fprintf(stderr, 1630 "reading from file %s, link-type %s (%s)\n", 1631 RFileName, dlt_name, 1632 pcap_datalink_val_to_description(dlt)); 1633 } 1634 } else { 1635 /* 1636 * We're doing a live capture. 1637 */ 1638 if (device == NULL) { 1639 device = pcap_lookupdev(ebuf); 1640 if (device == NULL) 1641 error("%s", ebuf); 1642 } 1643 #ifdef WIN32 1644 /* 1645 * Print a message to the standard error on Windows. 1646 * XXX - why do it here, with a different message? 1647 */ 1648 if(strlen(device) == 1) /* we assume that an ASCII string is always longer than 1 char */ 1649 { /* a Unicode string has a \0 as second byte (so strlen() is 1) */ 1650 fprintf(stderr, "%s: listening on %ws\n", program_name, device); 1651 } 1652 else 1653 { 1654 fprintf(stderr, "%s: listening on %s\n", program_name, device); 1655 } 1656 1657 fflush(stderr); 1658 #endif /* WIN32 */ 1659 #ifdef HAVE_PCAP_CREATE 1660 pd = pcap_create(device, ebuf); 1661 if (pd == NULL) 1662 error("%s", ebuf); 1663 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE 1664 if (Jflag) 1665 show_tstamp_types_and_exit(device, pd); 1666 #endif 1667 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION 1668 status = pcap_set_tstamp_precision(pd, gndo->ndo_tstamp_precision); 1669 if (status != 0) 1670 error("%s: Can't set %ssecond time stamp precision: %s", 1671 device, 1672 tstamp_precision_to_string(gndo->ndo_tstamp_precision), 1673 pcap_statustostr(status)); 1674 #endif 1675 1676 #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE 1677 if (gndo->ndo_immediate) { 1678 status = pcap_set_immediate_mode(pd, 1); 1679 if (status != 0) 1680 error("%s: Can't set immediate mode: %s", 1681 device, 1682 pcap_statustostr(status)); 1683 } 1684 #endif 1685 /* 1686 * Is this an interface that supports monitor mode? 1687 */ 1688 if (pcap_can_set_rfmon(pd) == 1) 1689 supports_monitor_mode = 1; 1690 else 1691 supports_monitor_mode = 0; 1692 status = pcap_set_snaplen(pd, snaplen); 1693 if (status != 0) 1694 error("%s: Can't set snapshot length: %s", 1695 device, pcap_statustostr(status)); 1696 status = pcap_set_promisc(pd, !pflag); 1697 if (status != 0) 1698 error("%s: Can't set promiscuous mode: %s", 1699 device, pcap_statustostr(status)); 1700 if (Iflag) { 1701 status = pcap_set_rfmon(pd, 1); 1702 if (status != 0) 1703 error("%s: Can't set monitor mode: %s", 1704 device, pcap_statustostr(status)); 1705 } 1706 status = pcap_set_timeout(pd, 1000); 1707 if (status != 0) 1708 error("%s: pcap_set_timeout failed: %s", 1709 device, pcap_statustostr(status)); 1710 if (Bflag != 0) { 1711 status = pcap_set_buffer_size(pd, Bflag); 1712 if (status != 0) 1713 error("%s: Can't set buffer size: %s", 1714 device, pcap_statustostr(status)); 1715 } 1716 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE 1717 if (jflag != -1) { 1718 status = pcap_set_tstamp_type(pd, jflag); 1719 if (status < 0) 1720 error("%s: Can't set time stamp type: %s", 1721 device, pcap_statustostr(status)); 1722 } 1723 #endif 1724 status = pcap_activate(pd); 1725 if (status < 0) { 1726 /* 1727 * pcap_activate() failed. 1728 */ 1729 cp = pcap_geterr(pd); 1730 if (status == PCAP_ERROR) 1731 error("%s", cp); 1732 else if ((status == PCAP_ERROR_NO_SUCH_DEVICE || 1733 status == PCAP_ERROR_PERM_DENIED) && 1734 *cp != '\0') 1735 error("%s: %s\n(%s)", device, 1736 pcap_statustostr(status), cp); 1737 #ifdef __FreeBSD__ 1738 else if (status == PCAP_ERROR_RFMON_NOTSUP && 1739 strncmp(device, "wlan", 4) == 0) { 1740 char parent[8], newdev[8]; 1741 char sysctl[32]; 1742 size_t s = sizeof(parent); 1743 1744 snprintf(sysctl, sizeof(sysctl), 1745 "net.wlan.%d.%%parent", atoi(device + 4)); 1746 sysctlbyname(sysctl, parent, &s, NULL, 0); 1747 strlcpy(newdev, device, sizeof(newdev)); 1748 /* Suggest a new wlan device. */ 1749 newdev[strlen(newdev)-1]++; 1750 error("%s is not a monitor mode VAP\n" 1751 "To create a new monitor mode VAP use:\n" 1752 " ifconfig %s create wlandev %s wlanmode " 1753 "monitor\nand use %s as the tcpdump " 1754 "interface", device, newdev, parent, 1755 newdev); 1756 } 1757 #endif 1758 else 1759 error("%s: %s", device, 1760 pcap_statustostr(status)); 1761 } else if (status > 0) { 1762 /* 1763 * pcap_activate() succeeded, but it's warning us 1764 * of a problem it had. 1765 */ 1766 cp = pcap_geterr(pd); 1767 if (status == PCAP_WARNING) 1768 warning("%s", cp); 1769 else if (status == PCAP_WARNING_PROMISC_NOTSUP && 1770 *cp != '\0') 1771 warning("%s: %s\n(%s)", device, 1772 pcap_statustostr(status), cp); 1773 else 1774 warning("%s: %s", device, 1775 pcap_statustostr(status)); 1776 } 1777 #ifdef HAVE_PCAP_SETDIRECTION 1778 if (Qflag != -1) { 1779 status = pcap_setdirection(pd, Qflag); 1780 if (status != 0) 1781 error("%s: pcap_setdirection() failed: %s", 1782 device, pcap_geterr(pd)); 1783 } 1784 #endif /* HAVE_PCAP_SETDIRECTION */ 1785 #else 1786 *ebuf = '\0'; 1787 pd = pcap_open_live(device, snaplen, !pflag, 1000, ebuf); 1788 if (pd == NULL) 1789 error("%s", ebuf); 1790 else if (*ebuf) 1791 warning("%s", ebuf); 1792 #endif /* HAVE_PCAP_CREATE */ 1793 /* 1794 * Let user own process after socket has been opened. 1795 */ 1796 #ifndef WIN32 1797 if (setgid(getgid()) != 0 || setuid(getuid()) != 0) 1798 fprintf(stderr, "Warning: setgid/setuid failed !\n"); 1799 #endif /* WIN32 */ 1800 #if !defined(HAVE_PCAP_CREATE) && defined(WIN32) 1801 if(Bflag != 0) 1802 if(pcap_setbuff(pd, Bflag)==-1){ 1803 error("%s", pcap_geterr(pd)); 1804 } 1805 #endif /* !defined(HAVE_PCAP_CREATE) && defined(WIN32) */ 1806 if (Lflag) 1807 show_dlts_and_exit(device, pd); 1808 if (gndo->ndo_dlt >= 0) { 1809 #ifdef HAVE_PCAP_SET_DATALINK 1810 if (pcap_set_datalink(pd, gndo->ndo_dlt) < 0) 1811 error("%s", pcap_geterr(pd)); 1812 #else 1813 /* 1814 * We don't actually support changing the 1815 * data link type, so we only let them 1816 * set it to what it already is. 1817 */ 1818 if (gndo->ndo_dlt != pcap_datalink(pd)) { 1819 error("%s is not one of the DLTs supported by this device\n", 1820 gndo->ndo_dltname); 1821 } 1822 #endif 1823 (void)fprintf(stderr, "%s: data link type %s\n", 1824 program_name, gndo->ndo_dltname); 1825 (void)fflush(stderr); 1826 } 1827 i = pcap_snapshot(pd); 1828 if (snaplen < i) { 1829 warning("snaplen raised from %d to %d", snaplen, i); 1830 snaplen = i; 1831 } 1832 if(fflag != 0) { 1833 if (pcap_lookupnet(device, &localnet, &netmask, ebuf) < 0) { 1834 warning("foreign (-f) flag used but: %s", ebuf); 1835 } 1836 } 1837 1838 } 1839 if (infile) 1840 cmdbuf = read_infile(infile); 1841 else 1842 cmdbuf = copy_argv(&argv[optind]); 1843 1844 if (pcap_compile(pd, &fcode, cmdbuf, Oflag, netmask) < 0) 1845 error("%s", pcap_geterr(pd)); 1846 if (dflag) { 1847 bpf_dump(&fcode, dflag); 1848 pcap_close(pd); 1849 free(cmdbuf); 1850 exit(0); 1851 } 1852 1853 #ifdef HAVE_CAPSICUM 1854 if (!nflag) 1855 capdns = capdns_setup(); 1856 #endif /* HAVE_CAPSICUM */ 1857 1858 init_addrtoname(gndo, localnet, netmask); 1859 init_checksum(); 1860 1861 #ifndef WIN32 1862 (void)setsignal(SIGPIPE, cleanup); 1863 (void)setsignal(SIGTERM, cleanup); 1864 (void)setsignal(SIGINT, cleanup); 1865 #endif /* WIN32 */ 1866 #if defined(HAVE_FORK) || defined(HAVE_VFORK) 1867 (void)setsignal(SIGCHLD, child_cleanup); 1868 #endif 1869 /* Cooperate with nohup(1) */ 1870 #ifndef WIN32 1871 if ((oldhandler = setsignal(SIGHUP, cleanup)) != SIG_DFL) 1872 (void)setsignal(SIGHUP, oldhandler); 1873 #endif /* WIN32 */ 1874 1875 #ifndef WIN32 1876 /* 1877 * If a user name was specified with "-Z", attempt to switch to 1878 * that user's UID. This would probably be used with sudo, 1879 * to allow tcpdump to be run in a special restricted 1880 * account (if you just want to allow users to open capture 1881 * devices, and can't just give users that permission, 1882 * you'd make tcpdump set-UID or set-GID). 1883 * 1884 * Tcpdump doesn't necessarily write only to one savefile; 1885 * the general only way to allow a -Z instance to write to 1886 * savefiles as the user under whose UID it's run, rather 1887 * than as the user specified with -Z, would thus be to switch 1888 * to the original user ID before opening a capture file and 1889 * then switch back to the -Z user ID after opening the savefile. 1890 * Switching to the -Z user ID only after opening the first 1891 * savefile doesn't handle the general case. 1892 */ 1893 1894 if (getuid() == 0 || geteuid() == 0) { 1895 #ifdef HAVE_LIBCAP_NG 1896 /* Initialize capng */ 1897 capng_clear(CAPNG_SELECT_BOTH); 1898 if (username) { 1899 capng_updatev( 1900 CAPNG_ADD, 1901 CAPNG_PERMITTED | CAPNG_EFFECTIVE, 1902 CAP_SETUID, 1903 CAP_SETGID, 1904 -1); 1905 } 1906 1907 if (WFileName) { 1908 capng_update( 1909 CAPNG_ADD, 1910 CAPNG_PERMITTED | CAPNG_EFFECTIVE, 1911 CAP_DAC_OVERRIDE 1912 ); 1913 } 1914 capng_apply(CAPNG_SELECT_BOTH); 1915 #endif /* HAVE_LIBCAP_NG */ 1916 if (username || chroot_dir) 1917 droproot(username, chroot_dir); 1918 1919 } 1920 #endif /* WIN32 */ 1921 1922 if (pcap_setfilter(pd, &fcode) < 0) 1923 error("%s", pcap_geterr(pd)); 1924 #ifdef HAVE_CAPSICUM 1925 if (RFileName == NULL && VFileName == NULL) { 1926 static const unsigned long cmds[] = { BIOCGSTATS }; 1927 1928 /* 1929 * The various libpcap devices use a combination of 1930 * read (bpf), ioctl (bpf, netmap), poll (netmap). 1931 * Grant the relevant access rights, sorted by name. 1932 */ 1933 cap_rights_init(&rights, CAP_EVENT, CAP_IOCTL, CAP_READ); 1934 if (cap_rights_limit(pcap_fileno(pd), &rights) < 0 && 1935 errno != ENOSYS) { 1936 error("unable to limit pcap descriptor"); 1937 } 1938 if (cap_ioctls_limit(pcap_fileno(pd), cmds, 1939 sizeof(cmds) / sizeof(cmds[0])) < 0 && errno != ENOSYS) { 1940 error("unable to limit ioctls on pcap descriptor"); 1941 } 1942 } 1943 #endif 1944 if (WFileName) { 1945 pcap_dumper_t *p; 1946 /* Do not exceed the default PATH_MAX for files. */ 1947 dumpinfo.CurrentFileName = (char *)malloc(PATH_MAX + 1); 1948 1949 if (dumpinfo.CurrentFileName == NULL) 1950 error("malloc of dumpinfo.CurrentFileName"); 1951 1952 /* We do not need numbering for dumpfiles if Cflag isn't set. */ 1953 if (Cflag != 0) 1954 MakeFilename(dumpinfo.CurrentFileName, WFileName, 0, WflagChars); 1955 else 1956 MakeFilename(dumpinfo.CurrentFileName, WFileName, 0, 0); 1957 1958 p = pcap_dump_open(pd, dumpinfo.CurrentFileName); 1959 #ifdef HAVE_LIBCAP_NG 1960 /* Give up CAP_DAC_OVERRIDE capability. 1961 * Only allow it to be restored if the -C or -G flag have been 1962 * set since we may need to create more files later on. 1963 */ 1964 capng_update( 1965 CAPNG_DROP, 1966 (Cflag || Gflag ? 0 : CAPNG_PERMITTED) 1967 | CAPNG_EFFECTIVE, 1968 CAP_DAC_OVERRIDE 1969 ); 1970 capng_apply(CAPNG_SELECT_BOTH); 1971 #endif /* HAVE_LIBCAP_NG */ 1972 if (p == NULL) 1973 error("%s", pcap_geterr(pd)); 1974 #ifdef HAVE_CAPSICUM 1975 set_dumper_capsicum_rights(p); 1976 #endif 1977 if (Cflag != 0 || Gflag != 0) { 1978 #ifdef HAVE_CAPSICUM 1979 dumpinfo.WFileName = strdup(basename(WFileName)); 1980 dumpinfo.dirfd = open(dirname(WFileName), 1981 O_DIRECTORY | O_RDONLY); 1982 if (dumpinfo.dirfd < 0) { 1983 error("unable to open directory %s", 1984 dirname(WFileName)); 1985 } 1986 cap_rights_init(&rights, CAP_CREATE, CAP_FCNTL, 1987 CAP_FTRUNCATE, CAP_LOOKUP, CAP_SEEK, CAP_WRITE); 1988 if (cap_rights_limit(dumpinfo.dirfd, &rights) < 0 && 1989 errno != ENOSYS) { 1990 error("unable to limit directory rights"); 1991 } 1992 if (cap_fcntls_limit(dumpinfo.dirfd, CAP_FCNTL_GETFL) < 0 && 1993 errno != ENOSYS) { 1994 error("unable to limit dump descriptor fcntls"); 1995 } 1996 #else /* !HAVE_CAPSICUM */ 1997 dumpinfo.WFileName = WFileName; 1998 #endif 1999 callback = dump_packet_and_trunc; 2000 dumpinfo.pd = pd; 2001 dumpinfo.p = p; 2002 pcap_userdata = (u_char *)&dumpinfo; 2003 } else { 2004 callback = dump_packet; 2005 pcap_userdata = (u_char *)p; 2006 } 2007 #ifdef HAVE_PCAP_DUMP_FLUSH 2008 if (Uflag) 2009 pcap_dump_flush(p); 2010 #endif 2011 } else { 2012 type = pcap_datalink(pd); 2013 printinfo = get_print_info(type); 2014 callback = print_packet; 2015 pcap_userdata = (u_char *)&printinfo; 2016 } 2017 2018 #ifdef SIGNAL_REQ_INFO 2019 /* 2020 * We can't get statistics when reading from a file rather 2021 * than capturing from a device. 2022 */ 2023 if (RFileName == NULL) 2024 (void)setsignal(SIGNAL_REQ_INFO, requestinfo); 2025 #endif 2026 2027 if (vflag > 0 && WFileName) { 2028 /* 2029 * When capturing to a file, "-v" means tcpdump should, 2030 * every 10 secodns, "v"erbosely report the number of 2031 * packets captured. 2032 */ 2033 #ifdef USE_WIN32_MM_TIMER 2034 /* call verbose_stats_dump() each 1000 +/-100msec */ 2035 timer_id = timeSetEvent(1000, 100, verbose_stats_dump, 0, TIME_PERIODIC); 2036 setvbuf(stderr, NULL, _IONBF, 0); 2037 #elif defined(HAVE_ALARM) 2038 (void)setsignal(SIGALRM, verbose_stats_dump); 2039 alarm(1); 2040 #endif 2041 } 2042 2043 #ifndef WIN32 2044 if (RFileName == NULL) { 2045 /* 2046 * Live capture (if -V was specified, we set RFileName 2047 * to a file from the -V file). Print a message to 2048 * the standard error on UN*X. 2049 */ 2050 if (!vflag && !WFileName) { 2051 (void)fprintf(stderr, 2052 "%s: verbose output suppressed, use -v or -vv for full protocol decode\n", 2053 program_name); 2054 } else 2055 (void)fprintf(stderr, "%s: ", program_name); 2056 dlt = pcap_datalink(pd); 2057 dlt_name = pcap_datalink_val_to_name(dlt); 2058 if (dlt_name == NULL) { 2059 (void)fprintf(stderr, "listening on %s, link-type %u, capture size %u bytes\n", 2060 device, dlt, snaplen); 2061 } else { 2062 (void)fprintf(stderr, "listening on %s, link-type %s (%s), capture size %u bytes\n", 2063 device, dlt_name, 2064 pcap_datalink_val_to_description(dlt), snaplen); 2065 } 2066 (void)fflush(stderr); 2067 } 2068 #endif /* WIN32 */ 2069 2070 #ifdef __FreeBSD__ 2071 cansandbox = (VFileName == NULL && zflag == NULL); 2072 #ifdef HAVE_CAPSICUM 2073 cansandbox = (cansandbox && (nflag || capdns != NULL)); 2074 #else 2075 cansandbox = (cansandbox && nflag); 2076 #endif 2077 if (cansandbox && cap_enter() < 0 && errno != ENOSYS) 2078 error("unable to enter the capability mode"); 2079 #endif /* __FreeBSD__ */ 2080 2081 do { 2082 status = pcap_loop(pd, cnt, callback, pcap_userdata); 2083 if (WFileName == NULL) { 2084 /* 2085 * We're printing packets. Flush the printed output, 2086 * so it doesn't get intermingled with error output. 2087 */ 2088 if (status == -2) { 2089 /* 2090 * We got interrupted, so perhaps we didn't 2091 * manage to finish a line we were printing. 2092 * Print an extra newline, just in case. 2093 */ 2094 putchar('\n'); 2095 } 2096 (void)fflush(stdout); 2097 } 2098 if (status == -2) { 2099 /* 2100 * We got interrupted. If we are reading multiple 2101 * files (via -V) set these so that we stop. 2102 */ 2103 VFileName = NULL; 2104 ret = NULL; 2105 } 2106 if (status == -1) { 2107 /* 2108 * Error. Report it. 2109 */ 2110 (void)fprintf(stderr, "%s: pcap_loop: %s\n", 2111 program_name, pcap_geterr(pd)); 2112 } 2113 if (RFileName == NULL) { 2114 /* 2115 * We're doing a live capture. Report the capture 2116 * statistics. 2117 */ 2118 info(1); 2119 } 2120 pcap_close(pd); 2121 if (VFileName != NULL) { 2122 ret = get_next_file(VFile, VFileLine); 2123 if (ret) { 2124 RFileName = VFileLine; 2125 pd = pcap_open_offline(RFileName, ebuf); 2126 if (pd == NULL) 2127 error("%s", ebuf); 2128 #ifdef HAVE_CAPSICUM 2129 cap_rights_init(&rights, CAP_READ); 2130 if (cap_rights_limit(fileno(pcap_file(pd)), 2131 &rights) < 0 && errno != ENOSYS) { 2132 error("unable to limit pcap descriptor"); 2133 } 2134 #endif 2135 new_dlt = pcap_datalink(pd); 2136 if (WFileName && new_dlt != dlt) 2137 error("%s: new dlt does not match original", RFileName); 2138 printinfo = get_print_info(new_dlt); 2139 dlt_name = pcap_datalink_val_to_name(new_dlt); 2140 if (dlt_name == NULL) { 2141 fprintf(stderr, "reading from file %s, link-type %u\n", 2142 RFileName, new_dlt); 2143 } else { 2144 fprintf(stderr, 2145 "reading from file %s, link-type %s (%s)\n", 2146 RFileName, dlt_name, 2147 pcap_datalink_val_to_description(new_dlt)); 2148 } 2149 if (pcap_compile(pd, &fcode, cmdbuf, Oflag, netmask) < 0) 2150 error("%s", pcap_geterr(pd)); 2151 if (pcap_setfilter(pd, &fcode) < 0) 2152 error("%s", pcap_geterr(pd)); 2153 } 2154 } 2155 } 2156 while (ret != NULL); 2157 2158 free(cmdbuf); 2159 exit(status == -1 ? 1 : 0); 2160 } 2161 2162 /* make a clean exit on interrupts */ 2163 static RETSIGTYPE 2164 cleanup(int signo _U_) 2165 { 2166 #ifdef USE_WIN32_MM_TIMER 2167 if (timer_id) 2168 timeKillEvent(timer_id); 2169 timer_id = 0; 2170 #elif defined(HAVE_ALARM) 2171 alarm(0); 2172 #endif 2173 2174 #ifdef HAVE_PCAP_BREAKLOOP 2175 /* 2176 * We have "pcap_breakloop()"; use it, so that we do as little 2177 * as possible in the signal handler (it's probably not safe 2178 * to do anything with standard I/O streams in a signal handler - 2179 * the ANSI C standard doesn't say it is). 2180 */ 2181 pcap_breakloop(pd); 2182 #else 2183 /* 2184 * We don't have "pcap_breakloop()"; this isn't safe, but 2185 * it's the best we can do. Print the summary if we're 2186 * not reading from a savefile - i.e., if we're doing a 2187 * live capture - and exit. 2188 */ 2189 if (pd != NULL && pcap_file(pd) == NULL) { 2190 /* 2191 * We got interrupted, so perhaps we didn't 2192 * manage to finish a line we were printing. 2193 * Print an extra newline, just in case. 2194 */ 2195 putchar('\n'); 2196 (void)fflush(stdout); 2197 info(1); 2198 } 2199 exit(0); 2200 #endif 2201 } 2202 2203 /* 2204 On windows, we do not use a fork, so we do not care less about 2205 waiting a child processes to die 2206 */ 2207 #if defined(HAVE_FORK) || defined(HAVE_VFORK) 2208 static RETSIGTYPE 2209 child_cleanup(int signo _U_) 2210 { 2211 wait(NULL); 2212 } 2213 #endif /* HAVE_FORK && HAVE_VFORK */ 2214 2215 static void 2216 info(register int verbose) 2217 { 2218 struct pcap_stat stat; 2219 2220 /* 2221 * Older versions of libpcap didn't set ps_ifdrop on some 2222 * platforms; initialize it to 0 to handle that. 2223 */ 2224 stat.ps_ifdrop = 0; 2225 if (pcap_stats(pd, &stat) < 0) { 2226 (void)fprintf(stderr, "pcap_stats: %s\n", pcap_geterr(pd)); 2227 infoprint = 0; 2228 return; 2229 } 2230 2231 if (!verbose) 2232 fprintf(stderr, "%s: ", program_name); 2233 2234 (void)fprintf(stderr, "%u packet%s captured", packets_captured, 2235 PLURAL_SUFFIX(packets_captured)); 2236 if (!verbose) 2237 fputs(", ", stderr); 2238 else 2239 putc('\n', stderr); 2240 (void)fprintf(stderr, "%u packet%s received by filter", stat.ps_recv, 2241 PLURAL_SUFFIX(stat.ps_recv)); 2242 if (!verbose) 2243 fputs(", ", stderr); 2244 else 2245 putc('\n', stderr); 2246 (void)fprintf(stderr, "%u packet%s dropped by kernel", stat.ps_drop, 2247 PLURAL_SUFFIX(stat.ps_drop)); 2248 if (stat.ps_ifdrop != 0) { 2249 if (!verbose) 2250 fputs(", ", stderr); 2251 else 2252 putc('\n', stderr); 2253 (void)fprintf(stderr, "%u packet%s dropped by interface\n", 2254 stat.ps_ifdrop, PLURAL_SUFFIX(stat.ps_ifdrop)); 2255 } else 2256 putc('\n', stderr); 2257 infoprint = 0; 2258 } 2259 2260 #if defined(HAVE_FORK) || defined(HAVE_VFORK) 2261 static void 2262 compress_savefile(const char *filename) 2263 { 2264 # ifdef HAVE_FORK 2265 if (fork()) 2266 # else 2267 if (vfork()) 2268 # endif 2269 return; 2270 /* 2271 * Set to lowest priority so that this doesn't disturb the capture 2272 */ 2273 #ifdef NZERO 2274 setpriority(PRIO_PROCESS, 0, NZERO - 1); 2275 #else 2276 setpriority(PRIO_PROCESS, 0, 19); 2277 #endif 2278 if (execlp(zflag, zflag, filename, (char *)NULL) == -1) 2279 fprintf(stderr, 2280 "compress_savefile:execlp(%s, %s): %s\n", 2281 zflag, 2282 filename, 2283 strerror(errno)); 2284 # ifdef HAVE_FORK 2285 exit(1); 2286 # else 2287 _exit(1); 2288 # endif 2289 } 2290 #else /* HAVE_FORK && HAVE_VFORK */ 2291 static void 2292 compress_savefile(const char *filename) 2293 { 2294 fprintf(stderr, 2295 "compress_savefile failed. Functionality not implemented under your system\n"); 2296 } 2297 #endif /* HAVE_FORK && HAVE_VFORK */ 2298 2299 static void 2300 dump_packet_and_trunc(u_char *user, const struct pcap_pkthdr *h, const u_char *sp) 2301 { 2302 struct dump_info *dump_info; 2303 2304 ++packets_captured; 2305 2306 ++infodelay; 2307 2308 dump_info = (struct dump_info *)user; 2309 2310 /* 2311 * XXX - this won't force the file to rotate on the specified time 2312 * boundary, but it will rotate on the first packet received after the 2313 * specified Gflag number of seconds. Note: if a Gflag time boundary 2314 * and a Cflag size boundary coincide, the time rotation will occur 2315 * first thereby cancelling the Cflag boundary (since the file should 2316 * be 0). 2317 */ 2318 if (Gflag != 0) { 2319 /* Check if it is time to rotate */ 2320 time_t t; 2321 2322 /* Get the current time */ 2323 if ((t = time(NULL)) == (time_t)-1) { 2324 error("dump_and_trunc_packet: can't get current_time: %s", 2325 pcap_strerror(errno)); 2326 } 2327 2328 2329 /* If the time is greater than the specified window, rotate */ 2330 if (t - Gflag_time >= Gflag) { 2331 #ifdef HAVE_CAPSICUM 2332 FILE *fp; 2333 int fd; 2334 #endif 2335 2336 /* Update the Gflag_time */ 2337 Gflag_time = t; 2338 /* Update Gflag_count */ 2339 Gflag_count++; 2340 /* 2341 * Close the current file and open a new one. 2342 */ 2343 pcap_dump_close(dump_info->p); 2344 2345 /* 2346 * Compress the file we just closed, if the user asked for it 2347 */ 2348 if (zflag != NULL) 2349 compress_savefile(dump_info->CurrentFileName); 2350 2351 /* 2352 * Check to see if we've exceeded the Wflag (when 2353 * not using Cflag). 2354 */ 2355 if (Cflag == 0 && Wflag > 0 && Gflag_count >= Wflag) { 2356 (void)fprintf(stderr, "Maximum file limit reached: %d\n", 2357 Wflag); 2358 exit(0); 2359 /* NOTREACHED */ 2360 } 2361 if (dump_info->CurrentFileName != NULL) 2362 free(dump_info->CurrentFileName); 2363 /* Allocate space for max filename + \0. */ 2364 dump_info->CurrentFileName = (char *)malloc(PATH_MAX + 1); 2365 if (dump_info->CurrentFileName == NULL) 2366 error("dump_packet_and_trunc: malloc"); 2367 /* 2368 * Gflag was set otherwise we wouldn't be here. Reset the count 2369 * so multiple files would end with 1,2,3 in the filename. 2370 * The counting is handled with the -C flow after this. 2371 */ 2372 Cflag_count = 0; 2373 2374 /* 2375 * This is always the first file in the Cflag 2376 * rotation: e.g. 0 2377 * We also don't need numbering if Cflag is not set. 2378 */ 2379 if (Cflag != 0) 2380 MakeFilename(dump_info->CurrentFileName, dump_info->WFileName, 0, 2381 WflagChars); 2382 else 2383 MakeFilename(dump_info->CurrentFileName, dump_info->WFileName, 0, 0); 2384 2385 #ifdef HAVE_LIBCAP_NG 2386 capng_update(CAPNG_ADD, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE); 2387 capng_apply(CAPNG_SELECT_BOTH); 2388 #endif /* HAVE_LIBCAP_NG */ 2389 #ifdef HAVE_CAPSICUM 2390 fd = openat(dump_info->dirfd, 2391 dump_info->CurrentFileName, 2392 O_CREAT | O_WRONLY | O_TRUNC, 0644); 2393 if (fd < 0) { 2394 error("unable to open file %s", 2395 dump_info->CurrentFileName); 2396 } 2397 fp = fdopen(fd, "w"); 2398 if (fp == NULL) { 2399 error("unable to fdopen file %s", 2400 dump_info->CurrentFileName); 2401 } 2402 dump_info->p = pcap_dump_fopen(dump_info->pd, fp); 2403 #else /* !HAVE_CAPSICUM */ 2404 dump_info->p = pcap_dump_open(dump_info->pd, dump_info->CurrentFileName); 2405 #endif 2406 #ifdef HAVE_LIBCAP_NG 2407 capng_update(CAPNG_DROP, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE); 2408 capng_apply(CAPNG_SELECT_BOTH); 2409 #endif /* HAVE_LIBCAP_NG */ 2410 if (dump_info->p == NULL) 2411 error("%s", pcap_geterr(pd)); 2412 #ifdef HAVE_CAPSICUM 2413 set_dumper_capsicum_rights(dump_info->p); 2414 #endif 2415 } 2416 } 2417 2418 /* 2419 * XXX - this won't prevent capture files from getting 2420 * larger than Cflag - the last packet written to the 2421 * file could put it over Cflag. 2422 */ 2423 if (Cflag != 0) { 2424 long size = pcap_dump_ftell(dump_info->p); 2425 2426 if (size == -1) 2427 error("ftell fails on output file"); 2428 if (size > Cflag) { 2429 #ifdef HAVE_CAPSICUM 2430 FILE *fp; 2431 int fd; 2432 #endif 2433 2434 /* 2435 * Close the current file and open a new one. 2436 */ 2437 pcap_dump_close(dump_info->p); 2438 2439 /* 2440 * Compress the file we just closed, if the user 2441 * asked for it. 2442 */ 2443 if (zflag != NULL) 2444 compress_savefile(dump_info->CurrentFileName); 2445 2446 Cflag_count++; 2447 if (Wflag > 0) { 2448 if (Cflag_count >= Wflag) 2449 Cflag_count = 0; 2450 } 2451 if (dump_info->CurrentFileName != NULL) 2452 free(dump_info->CurrentFileName); 2453 dump_info->CurrentFileName = (char *)malloc(PATH_MAX + 1); 2454 if (dump_info->CurrentFileName == NULL) 2455 error("dump_packet_and_trunc: malloc"); 2456 MakeFilename(dump_info->CurrentFileName, dump_info->WFileName, Cflag_count, WflagChars); 2457 #ifdef HAVE_LIBCAP_NG 2458 capng_update(CAPNG_ADD, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE); 2459 capng_apply(CAPNG_SELECT_BOTH); 2460 #endif /* HAVE_LIBCAP_NG */ 2461 #ifdef HAVE_CAPSICUM 2462 fd = openat(dump_info->dirfd, dump_info->CurrentFileName, 2463 O_CREAT | O_WRONLY | O_TRUNC, 0644); 2464 if (fd < 0) { 2465 error("unable to open file %s", 2466 dump_info->CurrentFileName); 2467 } 2468 fp = fdopen(fd, "w"); 2469 if (fp == NULL) { 2470 error("unable to fdopen file %s", 2471 dump_info->CurrentFileName); 2472 } 2473 dump_info->p = pcap_dump_fopen(dump_info->pd, fp); 2474 #else /* !HAVE_CAPSICUM */ 2475 dump_info->p = pcap_dump_open(dump_info->pd, dump_info->CurrentFileName); 2476 #endif 2477 #ifdef HAVE_LIBCAP_NG 2478 capng_update(CAPNG_DROP, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE); 2479 capng_apply(CAPNG_SELECT_BOTH); 2480 #endif /* HAVE_LIBCAP_NG */ 2481 if (dump_info->p == NULL) 2482 error("%s", pcap_geterr(pd)); 2483 #ifdef HAVE_CAPSICUM 2484 set_dumper_capsicum_rights(dump_info->p); 2485 #endif 2486 } 2487 } 2488 2489 pcap_dump((u_char *)dump_info->p, h, sp); 2490 #ifdef HAVE_PCAP_DUMP_FLUSH 2491 if (Uflag) 2492 pcap_dump_flush(dump_info->p); 2493 #endif 2494 2495 --infodelay; 2496 if (infoprint) 2497 info(0); 2498 } 2499 2500 static void 2501 dump_packet(u_char *user, const struct pcap_pkthdr *h, const u_char *sp) 2502 { 2503 ++packets_captured; 2504 2505 ++infodelay; 2506 2507 pcap_dump(user, h, sp); 2508 #ifdef HAVE_PCAP_DUMP_FLUSH 2509 if (Uflag) 2510 pcap_dump_flush((pcap_dumper_t *)user); 2511 #endif 2512 2513 --infodelay; 2514 if (infoprint) 2515 info(0); 2516 } 2517 2518 static void 2519 print_packet(u_char *user, const struct pcap_pkthdr *h, const u_char *sp) 2520 { 2521 struct print_info *print_info; 2522 u_int hdrlen; 2523 netdissect_options *ndo; 2524 2525 ++packets_captured; 2526 2527 ++infodelay; 2528 2529 print_info = (struct print_info *)user; 2530 ndo = print_info->ndo; 2531 2532 if(ndo->ndo_packet_number) 2533 ND_PRINT((ndo, "%5u ", packets_captured)); 2534 2535 ts_print(ndo, &h->ts); 2536 2537 /* 2538 * Some printers want to check that they're not walking off the 2539 * end of the packet. 2540 * Rather than pass it all the way down, we set this member 2541 * of the netdissect_options structure. 2542 */ 2543 ndo->ndo_snapend = sp + h->caplen; 2544 2545 if(print_info->ndo_type) { 2546 hdrlen = (*print_info->p.ndo_printer)(print_info->ndo, h, sp); 2547 } else { 2548 hdrlen = (*print_info->p.printer)(h, sp); 2549 } 2550 2551 /* 2552 * Restore the original snapend, as a printer might have 2553 * changed it. 2554 */ 2555 ndo->ndo_snapend = sp + h->caplen; 2556 if (ndo->ndo_Xflag) { 2557 /* 2558 * Print the raw packet data in hex and ASCII. 2559 */ 2560 if (ndo->ndo_Xflag > 1) { 2561 /* 2562 * Include the link-layer header. 2563 */ 2564 hex_and_ascii_print(ndo, "\n\t", sp, h->caplen); 2565 } else { 2566 /* 2567 * Don't include the link-layer header - and if 2568 * we have nothing past the link-layer header, 2569 * print nothing. 2570 */ 2571 if (h->caplen > hdrlen) 2572 hex_and_ascii_print(ndo, "\n\t", sp + hdrlen, 2573 h->caplen - hdrlen); 2574 } 2575 } else if (ndo->ndo_xflag) { 2576 /* 2577 * Print the raw packet data in hex. 2578 */ 2579 if (ndo->ndo_xflag > 1) { 2580 /* 2581 * Include the link-layer header. 2582 */ 2583 hex_print(ndo, "\n\t", sp, h->caplen); 2584 } else { 2585 /* 2586 * Don't include the link-layer header - and if 2587 * we have nothing past the link-layer header, 2588 * print nothing. 2589 */ 2590 if (h->caplen > hdrlen) 2591 hex_print(ndo, "\n\t", sp + hdrlen, 2592 h->caplen - hdrlen); 2593 } 2594 } else if (ndo->ndo_Aflag) { 2595 /* 2596 * Print the raw packet data in ASCII. 2597 */ 2598 if (ndo->ndo_Aflag > 1) { 2599 /* 2600 * Include the link-layer header. 2601 */ 2602 ascii_print(ndo, sp, h->caplen); 2603 } else { 2604 /* 2605 * Don't include the link-layer header - and if 2606 * we have nothing past the link-layer header, 2607 * print nothing. 2608 */ 2609 if (h->caplen > hdrlen) 2610 ascii_print(ndo, sp + hdrlen, h->caplen - hdrlen); 2611 } 2612 } 2613 2614 putchar('\n'); 2615 2616 --infodelay; 2617 if (infoprint) 2618 info(0); 2619 } 2620 2621 #ifdef WIN32 2622 /* 2623 * XXX - there should really be libpcap calls to get the version 2624 * number as a string (the string would be generated from #defines 2625 * at run time, so that it's not generated from string constants 2626 * in the library, as, on many UNIX systems, those constants would 2627 * be statically linked into the application executable image, and 2628 * would thus reflect the version of libpcap on the system on 2629 * which the application was *linked*, not the system on which it's 2630 * *running*. 2631 * 2632 * That routine should be documented, unlike the "version[]" 2633 * string, so that UNIX vendors providing their own libpcaps 2634 * don't omit it (as a couple of vendors have...). 2635 * 2636 * Packet.dll should perhaps also export a routine to return the 2637 * version number of the Packet.dll code, to supply the 2638 * "Wpcap_version" information on Windows. 2639 */ 2640 char WDversion[]="current-git.tcpdump.org"; 2641 #if !defined(HAVE_GENERATED_VERSION) 2642 char version[]="current-git.tcpdump.org"; 2643 #endif 2644 char pcap_version[]="current-git.tcpdump.org"; 2645 char Wpcap_version[]="3.1"; 2646 #endif 2647 2648 /* 2649 * By default, print the specified data out in hex and ASCII. 2650 */ 2651 static void 2652 ndo_default_print(netdissect_options *ndo, const u_char *bp, u_int length) 2653 { 2654 hex_and_ascii_print(ndo, "\n\t", bp, length); /* pass on lf and indentation string */ 2655 } 2656 2657 void 2658 default_print(const u_char *bp, u_int length) 2659 { 2660 ndo_default_print(gndo, bp, length); 2661 } 2662 2663 #ifdef SIGNAL_REQ_INFO 2664 RETSIGTYPE requestinfo(int signo _U_) 2665 { 2666 if (infodelay) 2667 ++infoprint; 2668 else 2669 info(0); 2670 } 2671 #endif 2672 2673 /* 2674 * Called once each second in verbose mode while dumping to file 2675 */ 2676 #ifdef USE_WIN32_MM_TIMER 2677 void CALLBACK verbose_stats_dump (UINT timer_id _U_, UINT msg _U_, DWORD_PTR arg _U_, 2678 DWORD_PTR dw1 _U_, DWORD_PTR dw2 _U_) 2679 { 2680 struct pcap_stat stat; 2681 2682 if (infodelay == 0 && pcap_stats(pd, &stat) >= 0) 2683 fprintf(stderr, "Got %u\r", packets_captured); 2684 } 2685 #elif defined(HAVE_ALARM) 2686 static void verbose_stats_dump(int sig _U_) 2687 { 2688 struct pcap_stat stat; 2689 2690 if (infodelay == 0 && pcap_stats(pd, &stat) >= 0) 2691 fprintf(stderr, "Got %u\r", packets_captured); 2692 alarm(1); 2693 } 2694 #endif 2695 2696 USES_APPLE_DEPRECATED_API 2697 static void 2698 print_version(void) 2699 { 2700 extern char version[]; 2701 #ifndef HAVE_PCAP_LIB_VERSION 2702 #if defined(WIN32) || defined(HAVE_PCAP_VERSION) 2703 extern char pcap_version[]; 2704 #else /* defined(WIN32) || defined(HAVE_PCAP_VERSION) */ 2705 static char pcap_version[] = "unknown"; 2706 #endif /* defined(WIN32) || defined(HAVE_PCAP_VERSION) */ 2707 #endif /* HAVE_PCAP_LIB_VERSION */ 2708 2709 #ifdef HAVE_PCAP_LIB_VERSION 2710 #ifdef WIN32 2711 (void)fprintf(stderr, "%s version %s, based on tcpdump version %s\n", program_name, WDversion, version); 2712 #else /* WIN32 */ 2713 (void)fprintf(stderr, "%s version %s\n", program_name, version); 2714 #endif /* WIN32 */ 2715 (void)fprintf(stderr, "%s\n",pcap_lib_version()); 2716 #else /* HAVE_PCAP_LIB_VERSION */ 2717 #ifdef WIN32 2718 (void)fprintf(stderr, "%s version %s, based on tcpdump version %s\n", program_name, WDversion, version); 2719 (void)fprintf(stderr, "WinPcap version %s, based on libpcap version %s\n",Wpcap_version, pcap_version); 2720 #else /* WIN32 */ 2721 (void)fprintf(stderr, "%s version %s\n", program_name, version); 2722 (void)fprintf(stderr, "libpcap version %s\n", pcap_version); 2723 #endif /* WIN32 */ 2724 #endif /* HAVE_PCAP_LIB_VERSION */ 2725 2726 #if defined(HAVE_LIBCRYPTO) && defined(SSLEAY_VERSION) 2727 (void)fprintf (stderr, "%s\n", SSLeay_version(SSLEAY_VERSION)); 2728 #endif 2729 2730 #ifdef USE_LIBSMI 2731 (void)fprintf (stderr, "SMI-library: %s\n", smi_version_string); 2732 #endif 2733 } 2734 USES_APPLE_RST 2735 2736 static void 2737 print_usage(void) 2738 { 2739 print_version(); 2740 (void)fprintf(stderr, 2741 "Usage: %s [-aAbd" D_FLAG "efhH" I_FLAG J_FLAG "KlLnNOpqRStu" U_FLAG "vxX#]" B_FLAG_USAGE " [ -c count ]\n", program_name); 2742 (void)fprintf(stderr, 2743 "\t\t[ -C file_size ] [ -E algo:secret ] [ -F file ] [ -G seconds ]\n"); 2744 (void)fprintf(stderr, 2745 "\t\t[ -i interface ]" j_FLAG_USAGE " [ -M secret ] [ --number ]\n"); 2746 #ifdef HAVE_PCAP_SETDIRECTION 2747 (void)fprintf(stderr, 2748 "\t\t[ -Q in|out|inout ]\n"); 2749 #endif 2750 (void)fprintf(stderr, 2751 "\t\t[ -r file ] [ -s snaplen ] "); 2752 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION 2753 (void)fprintf(stderr, "[ --time-stamp-precision precision ]\n"); 2754 (void)fprintf(stderr, 2755 "\t\t"); 2756 #endif 2757 #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE 2758 (void)fprintf(stderr, "[ --immediate-mode ] "); 2759 #endif 2760 (void)fprintf(stderr, "[ -T type ] [ --version ] [ -V file ]\n"); 2761 (void)fprintf(stderr, 2762 "\t\t[ -w file ] [ -W filecount ] [ -y datalinktype ] [ -z command ]\n"); 2763 (void)fprintf(stderr, 2764 "\t\t[ -Z user ] [ expression ]\n"); 2765 } 2766 2767 2768 2769 /* VARARGS */ 2770 static void 2771 ndo_error(netdissect_options *ndo _U_, const char *fmt, ...) 2772 { 2773 va_list ap; 2774 2775 (void)fprintf(stderr, "%s: ", program_name); 2776 va_start(ap, fmt); 2777 (void)vfprintf(stderr, fmt, ap); 2778 va_end(ap); 2779 if (*fmt) { 2780 fmt += strlen(fmt); 2781 if (fmt[-1] != '\n') 2782 (void)fputc('\n', stderr); 2783 } 2784 exit(1); 2785 /* NOTREACHED */ 2786 } 2787 2788 /* VARARGS */ 2789 static void 2790 ndo_warning(netdissect_options *ndo _U_, const char *fmt, ...) 2791 { 2792 va_list ap; 2793 2794 (void)fprintf(stderr, "%s: WARNING: ", program_name); 2795 va_start(ap, fmt); 2796 (void)vfprintf(stderr, fmt, ap); 2797 va_end(ap); 2798 if (*fmt) { 2799 fmt += strlen(fmt); 2800 if (fmt[-1] != '\n') 2801 (void)fputc('\n', stderr); 2802 } 2803 } 2804 /* 2805 * Local Variables: 2806 * c-style: whitesmith 2807 * c-basic-offset: 8 2808 * End: 2809 */ 2810