1 /* 2 * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000 3 * The Regents of the University of California. All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that: (1) source code distributions 7 * retain the above copyright notice and this paragraph in its entirety, (2) 8 * distributions including binary code include the above copyright notice and 9 * this paragraph in its entirety in the documentation or other materials 10 * provided with the distribution, and (3) all advertising materials mentioning 11 * features or use of this software display the following acknowledgement: 12 * ``This product includes software developed by the University of California, 13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of 14 * the University nor the names of its contributors may be used to endorse 15 * or promote products derived from this software without specific prior 16 * written permission. 17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED 18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF 19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 20 * 21 * Support for splitting captures into multiple files with a maximum 22 * file size: 23 * 24 * Copyright (c) 2001 25 * Seth Webster <swebster@sst.ll.mit.edu> 26 */ 27 28 #ifndef lint 29 static const char copyright[] _U_ = 30 "@(#) Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000\n\ 31 The Regents of the University of California. All rights reserved.\n"; 32 #endif 33 34 /* 35 * tcpdump - dump traffic on a network 36 * 37 * First written in 1987 by Van Jacobson, Lawrence Berkeley Laboratory. 38 * Mercilessly hacked and occasionally improved since then via the 39 * combined efforts of Van, Steve McCanne and Craig Leres of LBL. 40 */ 41 42 #ifdef HAVE_CONFIG_H 43 #include "config.h" 44 #endif 45 46 /* 47 * Mac OS X may ship pcap.h from libpcap 0.6 with a libpcap based on 48 * 0.8. That means it has pcap_findalldevs() but the header doesn't 49 * define pcap_if_t, meaning that we can't actually *use* pcap_findalldevs(). 50 */ 51 #ifdef HAVE_PCAP_FINDALLDEVS 52 #ifndef HAVE_PCAP_IF_T 53 #undef HAVE_PCAP_FINDALLDEVS 54 #endif 55 #endif 56 57 #include <netdissect-stdinc.h> 58 59 #include <sys/stat.h> 60 61 #ifdef HAVE_FCNTL_H 62 #include <fcntl.h> 63 #endif 64 65 #ifdef HAVE_LIBCRYPTO 66 #include <openssl/crypto.h> 67 #endif 68 69 #ifdef HAVE_GETOPT_LONG 70 #include <getopt.h> 71 #else 72 #include "getopt_long.h" 73 #endif 74 /* Capsicum-specific code requires macros from <net/bpf.h>, which will fail 75 * to compile if <pcap.h> has already been included; including the headers 76 * in the opposite order works fine. 77 */ 78 #ifdef HAVE_CAPSICUM 79 #include <sys/capsicum.h> 80 #include <sys/nv.h> 81 #include <sys/ioccom.h> 82 #include <net/bpf.h> 83 #include <libgen.h> 84 #ifdef HAVE_CASPER 85 #include <libcasper.h> 86 #include <casper/cap_dns.h> 87 #endif /* HAVE_CASPER */ 88 #endif /* HAVE_CAPSICUM */ 89 #include <pcap.h> 90 #include <signal.h> 91 #include <stdio.h> 92 #include <stdarg.h> 93 #include <stdlib.h> 94 #include <string.h> 95 #include <limits.h> 96 #ifndef _WIN32 97 #include <sys/wait.h> 98 #include <sys/resource.h> 99 #include <pwd.h> 100 #include <grp.h> 101 #endif /* _WIN32 */ 102 103 /* capabilities convenience library */ 104 /* If a code depends on HAVE_LIBCAP_NG, it depends also on HAVE_CAP_NG_H. 105 * If HAVE_CAP_NG_H is not defined, undefine HAVE_LIBCAP_NG. 106 * Thus, the later tests are done only on HAVE_LIBCAP_NG. 107 */ 108 #ifdef HAVE_LIBCAP_NG 109 #ifdef HAVE_CAP_NG_H 110 #include <cap-ng.h> 111 #else 112 #undef HAVE_LIBCAP_NG 113 #endif /* HAVE_CAP_NG_H */ 114 #endif /* HAVE_LIBCAP_NG */ 115 116 #include "netdissect.h" 117 #include "interface.h" 118 #include "addrtoname.h" 119 #include "machdep.h" 120 #include "setsignal.h" 121 #include "gmt2local.h" 122 #include "pcap-missing.h" 123 #include "ascii_strcasecmp.h" 124 125 #include "print.h" 126 127 #ifndef PATH_MAX 128 #define PATH_MAX 1024 129 #endif 130 131 #ifdef SIGINFO 132 #define SIGNAL_REQ_INFO SIGINFO 133 #elif SIGUSR1 134 #define SIGNAL_REQ_INFO SIGUSR1 135 #endif 136 137 static int Bflag; /* buffer size */ 138 static long Cflag; /* rotate dump files after this many bytes */ 139 static int Cflag_count; /* Keep track of which file number we're writing */ 140 static int Dflag; /* list available devices and exit */ 141 /* 142 * This is exported because, in some versions of libpcap, if libpcap 143 * is built with optimizer debugging code (which is *NOT* the default 144 * configuration!), the library *imports*(!) a variable named dflag, 145 * under the expectation that tcpdump is exporting it, to govern 146 * how much debugging information to print when optimizing 147 * the generated BPF code. 148 * 149 * This is a horrible hack; newer versions of libpcap don't import 150 * dflag but, instead, *if* built with optimizer debugging code, 151 * *export* a routine to set that flag. 152 */ 153 int dflag; /* print filter code */ 154 static int Gflag; /* rotate dump files after this many seconds */ 155 static int Gflag_count; /* number of files created with Gflag rotation */ 156 static time_t Gflag_time; /* The last time_t the dump file was rotated. */ 157 static int Lflag; /* list available data link types and exit */ 158 static int Iflag; /* rfmon (monitor) mode */ 159 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE 160 static int Jflag; /* list available time stamp types */ 161 #endif 162 static int jflag = -1; /* packet time stamp source */ 163 static int pflag; /* don't go promiscuous */ 164 #ifdef HAVE_PCAP_SETDIRECTION 165 static int Qflag = -1; /* restrict captured packet by send/receive direction */ 166 #endif 167 static int Uflag; /* "unbuffered" output of dump files */ 168 static int Wflag; /* recycle output files after this number of files */ 169 static int WflagChars; 170 static char *zflag = NULL; /* compress each savefile using a specified command (like gzip or bzip2) */ 171 static int immediate_mode; 172 173 static int infodelay; 174 static int infoprint; 175 176 char *program_name; 177 178 #ifdef HAVE_CASPER 179 cap_channel_t *capdns; 180 #endif 181 182 /* Forwards */ 183 static void error(FORMAT_STRING(const char *), ...) NORETURN PRINTFLIKE(1, 2); 184 static void warning(FORMAT_STRING(const char *), ...) PRINTFLIKE(1, 2); 185 static void exit_tcpdump(int) NORETURN; 186 static RETSIGTYPE cleanup(int); 187 static RETSIGTYPE child_cleanup(int); 188 static void print_version(void); 189 static void print_usage(void); 190 static void show_tstamp_types_and_exit(pcap_t *, const char *device) NORETURN; 191 static void show_dlts_and_exit(pcap_t *, const char *device) NORETURN; 192 #ifdef HAVE_PCAP_FINDALLDEVS 193 static void show_devices_and_exit (void) NORETURN; 194 #endif 195 196 static void print_packet(u_char *, const struct pcap_pkthdr *, const u_char *); 197 static void dump_packet_and_trunc(u_char *, const struct pcap_pkthdr *, const u_char *); 198 static void dump_packet(u_char *, const struct pcap_pkthdr *, const u_char *); 199 static void droproot(const char *, const char *); 200 201 #ifdef SIGNAL_REQ_INFO 202 RETSIGTYPE requestinfo(int); 203 #endif 204 205 #if defined(USE_WIN32_MM_TIMER) 206 #include <MMsystem.h> 207 static UINT timer_id; 208 static void CALLBACK verbose_stats_dump(UINT, UINT, DWORD_PTR, DWORD_PTR, DWORD_PTR); 209 #elif defined(HAVE_ALARM) 210 static void verbose_stats_dump(int sig); 211 #endif 212 213 static void info(int); 214 static u_int packets_captured; 215 216 #ifdef HAVE_PCAP_FINDALLDEVS 217 static const struct tok status_flags[] = { 218 #ifdef PCAP_IF_UP 219 { PCAP_IF_UP, "Up" }, 220 #endif 221 #ifdef PCAP_IF_RUNNING 222 { PCAP_IF_RUNNING, "Running" }, 223 #endif 224 { PCAP_IF_LOOPBACK, "Loopback" }, 225 { 0, NULL } 226 }; 227 #endif 228 229 static pcap_t *pd; 230 231 static int supports_monitor_mode; 232 233 extern int optind; 234 extern int opterr; 235 extern char *optarg; 236 237 struct dump_info { 238 char *WFileName; 239 char *CurrentFileName; 240 pcap_t *pd; 241 pcap_dumper_t *p; 242 #ifdef HAVE_CAPSICUM 243 int dirfd; 244 #endif 245 }; 246 247 #if defined(HAVE_PCAP_SET_PARSER_DEBUG) 248 /* 249 * We have pcap_set_parser_debug() in libpcap; declare it (it's not declared 250 * by any libpcap header, because it's a special hack, only available if 251 * libpcap was configured to include it, and only intended for use by 252 * libpcap developers trying to debug the parser for filter expressions). 253 */ 254 #ifdef _WIN32 255 __declspec(dllimport) 256 #else /* _WIN32 */ 257 extern 258 #endif /* _WIN32 */ 259 void pcap_set_parser_debug(int); 260 #elif defined(HAVE_PCAP_DEBUG) || defined(HAVE_YYDEBUG) 261 /* 262 * We don't have pcap_set_parser_debug() in libpcap, but we do have 263 * pcap_debug or yydebug. Make a local version of pcap_set_parser_debug() 264 * to set the flag, and define HAVE_PCAP_SET_PARSER_DEBUG. 265 */ 266 static void 267 pcap_set_parser_debug(int value) 268 { 269 #ifdef HAVE_PCAP_DEBUG 270 extern int pcap_debug; 271 272 pcap_debug = value; 273 #else /* HAVE_PCAP_DEBUG */ 274 extern int yydebug; 275 276 yydebug = value; 277 #endif /* HAVE_PCAP_DEBUG */ 278 } 279 280 #define HAVE_PCAP_SET_PARSER_DEBUG 281 #endif 282 283 #if defined(HAVE_PCAP_SET_OPTIMIZER_DEBUG) 284 /* 285 * We have pcap_set_optimizer_debug() in libpcap; declare it (it's not declared 286 * by any libpcap header, because it's a special hack, only available if 287 * libpcap was configured to include it, and only intended for use by 288 * libpcap developers trying to debug the optimizer for filter expressions). 289 */ 290 #ifdef _WIN32 291 __declspec(dllimport) 292 #else /* _WIN32 */ 293 extern 294 #endif /* _WIN32 */ 295 void pcap_set_optimizer_debug(int); 296 #endif 297 298 /* VARARGS */ 299 static void 300 error(const char *fmt, ...) 301 { 302 va_list ap; 303 304 (void)fprintf(stderr, "%s: ", program_name); 305 va_start(ap, fmt); 306 (void)vfprintf(stderr, fmt, ap); 307 va_end(ap); 308 if (*fmt) { 309 fmt += strlen(fmt); 310 if (fmt[-1] != '\n') 311 (void)fputc('\n', stderr); 312 } 313 exit_tcpdump(1); 314 /* NOTREACHED */ 315 } 316 317 /* VARARGS */ 318 static void 319 warning(const char *fmt, ...) 320 { 321 va_list ap; 322 323 (void)fprintf(stderr, "%s: WARNING: ", program_name); 324 va_start(ap, fmt); 325 (void)vfprintf(stderr, fmt, ap); 326 va_end(ap); 327 if (*fmt) { 328 fmt += strlen(fmt); 329 if (fmt[-1] != '\n') 330 (void)fputc('\n', stderr); 331 } 332 } 333 334 static void 335 exit_tcpdump(int status) 336 { 337 nd_cleanup(); 338 exit(status); 339 } 340 341 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE 342 static void 343 show_tstamp_types_and_exit(pcap_t *pc, const char *device) 344 { 345 int n_tstamp_types; 346 int *tstamp_types = 0; 347 const char *tstamp_type_name; 348 int i; 349 350 n_tstamp_types = pcap_list_tstamp_types(pc, &tstamp_types); 351 if (n_tstamp_types < 0) 352 error("%s", pcap_geterr(pc)); 353 354 if (n_tstamp_types == 0) { 355 fprintf(stderr, "Time stamp type cannot be set for %s\n", 356 device); 357 exit_tcpdump(0); 358 } 359 fprintf(stderr, "Time stamp types for %s (use option -j to set):\n", 360 device); 361 for (i = 0; i < n_tstamp_types; i++) { 362 tstamp_type_name = pcap_tstamp_type_val_to_name(tstamp_types[i]); 363 if (tstamp_type_name != NULL) { 364 (void) fprintf(stderr, " %s (%s)\n", tstamp_type_name, 365 pcap_tstamp_type_val_to_description(tstamp_types[i])); 366 } else { 367 (void) fprintf(stderr, " %d\n", tstamp_types[i]); 368 } 369 } 370 pcap_free_tstamp_types(tstamp_types); 371 exit_tcpdump(0); 372 } 373 #endif 374 375 static void 376 show_dlts_and_exit(pcap_t *pc, const char *device) 377 { 378 int n_dlts, i; 379 int *dlts = 0; 380 const char *dlt_name; 381 382 n_dlts = pcap_list_datalinks(pc, &dlts); 383 if (n_dlts < 0) 384 error("%s", pcap_geterr(pc)); 385 else if (n_dlts == 0 || !dlts) 386 error("No data link types."); 387 388 /* 389 * If the interface is known to support monitor mode, indicate 390 * whether these are the data link types available when not in 391 * monitor mode, if -I wasn't specified, or when in monitor mode, 392 * when -I was specified (the link-layer types available in 393 * monitor mode might be different from the ones available when 394 * not in monitor mode). 395 */ 396 if (supports_monitor_mode) 397 (void) fprintf(stderr, "Data link types for %s %s (use option -y to set):\n", 398 device, 399 Iflag ? "when in monitor mode" : "when not in monitor mode"); 400 else 401 (void) fprintf(stderr, "Data link types for %s (use option -y to set):\n", 402 device); 403 404 for (i = 0; i < n_dlts; i++) { 405 dlt_name = pcap_datalink_val_to_name(dlts[i]); 406 if (dlt_name != NULL) { 407 (void) fprintf(stderr, " %s (%s)", dlt_name, 408 pcap_datalink_val_to_description(dlts[i])); 409 410 /* 411 * OK, does tcpdump handle that type? 412 */ 413 if (!has_printer(dlts[i])) 414 (void) fprintf(stderr, " (printing not supported)"); 415 fprintf(stderr, "\n"); 416 } else { 417 (void) fprintf(stderr, " DLT %d (printing not supported)\n", 418 dlts[i]); 419 } 420 } 421 #ifdef HAVE_PCAP_FREE_DATALINKS 422 pcap_free_datalinks(dlts); 423 #endif 424 exit_tcpdump(0); 425 } 426 427 #ifdef HAVE_PCAP_FINDALLDEVS 428 static void 429 show_devices_and_exit (void) 430 { 431 pcap_if_t *dev, *devlist; 432 char ebuf[PCAP_ERRBUF_SIZE]; 433 int i; 434 435 if (pcap_findalldevs(&devlist, ebuf) < 0) 436 error("%s", ebuf); 437 for (i = 0, dev = devlist; dev != NULL; i++, dev = dev->next) { 438 printf("%d.%s", i+1, dev->name); 439 if (dev->description != NULL) 440 printf(" (%s)", dev->description); 441 if (dev->flags != 0) 442 printf(" [%s]", bittok2str(status_flags, "none", dev->flags)); 443 printf("\n"); 444 } 445 pcap_freealldevs(devlist); 446 exit_tcpdump(0); 447 } 448 #endif /* HAVE_PCAP_FINDALLDEVS */ 449 450 /* 451 * Short options. 452 * 453 * Note that there we use all letters for short options except for g, k, 454 * o, and P, and those are used by other versions of tcpdump, and we should 455 * only use them for the same purposes that the other versions of tcpdump 456 * use them: 457 * 458 * OS X tcpdump uses -g to force non--v output for IP to be on one 459 * line, making it more "g"repable; 460 * 461 * OS X tcpdump uses -k to specify that packet comments in pcap-ng files 462 * should be printed; 463 * 464 * OpenBSD tcpdump uses -o to indicate that OS fingerprinting should be done 465 * for hosts sending TCP SYN packets; 466 * 467 * OS X tcpdump uses -P to indicate that -w should write pcap-ng rather 468 * than pcap files. 469 * 470 * OS X tcpdump also uses -Q to specify expressions that match packet 471 * metadata, including but not limited to the packet direction. 472 * The expression syntax is different from a simple "in|out|inout", 473 * and those expressions aren't accepted by OS X tcpdump, but the 474 * equivalents would be "in" = "dir=in", "out" = "dir=out", and 475 * "inout" = "dir=in or dir=out", and the parser could conceivably 476 * special-case "in", "out", and "inout" as expressions for backwards 477 * compatibility, so all is not (yet) lost. 478 */ 479 480 /* 481 * Set up flags that might or might not be supported depending on the 482 * version of libpcap we're using. 483 */ 484 #if defined(HAVE_PCAP_CREATE) || defined(_WIN32) 485 #define B_FLAG "B:" 486 #define B_FLAG_USAGE " [ -B size ]" 487 #else /* defined(HAVE_PCAP_CREATE) || defined(_WIN32) */ 488 #define B_FLAG 489 #define B_FLAG_USAGE 490 #endif /* defined(HAVE_PCAP_CREATE) || defined(_WIN32) */ 491 492 #ifdef HAVE_PCAP_CREATE 493 #define I_FLAG "I" 494 #else /* HAVE_PCAP_CREATE */ 495 #define I_FLAG 496 #endif /* HAVE_PCAP_CREATE */ 497 498 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE 499 #define j_FLAG "j:" 500 #define j_FLAG_USAGE " [ -j tstamptype ]" 501 #define J_FLAG "J" 502 #else /* PCAP_ERROR_TSTAMP_TYPE_NOTSUP */ 503 #define j_FLAG 504 #define j_FLAG_USAGE 505 #define J_FLAG 506 #endif /* PCAP_ERROR_TSTAMP_TYPE_NOTSUP */ 507 508 #ifdef HAVE_PCAP_FINDALLDEVS 509 #define D_FLAG "D" 510 #else 511 #define D_FLAG 512 #endif 513 514 #ifdef HAVE_PCAP_DUMP_FLUSH 515 #define U_FLAG "U" 516 #else 517 #define U_FLAG 518 #endif 519 520 #ifdef HAVE_PCAP_SETDIRECTION 521 #define Q_FLAG "Q:" 522 #else 523 #define Q_FLAG 524 #endif 525 526 #define SHORTOPTS "aAb" B_FLAG "c:C:d" D_FLAG "eE:fF:G:hHi:" I_FLAG j_FLAG J_FLAG "KlLm:M:nNOpq" Q_FLAG "r:s:StT:u" U_FLAG "vV:w:W:xXy:Yz:Z:#" 527 528 /* 529 * Long options. 530 * 531 * We do not currently have long options corresponding to all short 532 * options; we should probably pick appropriate option names for them. 533 * 534 * However, the short options where the number of times the option is 535 * specified matters, such as -v and -d and -t, should probably not 536 * just map to a long option, as saying 537 * 538 * tcpdump --verbose --verbose 539 * 540 * doesn't make sense; it should be --verbosity={N} or something such 541 * as that. 542 * 543 * For long options with no corresponding short options, we define values 544 * outside the range of ASCII graphic characters, make that the last 545 * component of the entry for the long option, and have a case for that 546 * option in the switch statement. 547 */ 548 #define OPTION_VERSION 128 549 #define OPTION_TSTAMP_PRECISION 129 550 #define OPTION_IMMEDIATE_MODE 130 551 552 static const struct option longopts[] = { 553 #if defined(HAVE_PCAP_CREATE) || defined(_WIN32) 554 { "buffer-size", required_argument, NULL, 'B' }, 555 #endif 556 { "list-interfaces", no_argument, NULL, 'D' }, 557 { "help", no_argument, NULL, 'h' }, 558 { "interface", required_argument, NULL, 'i' }, 559 #ifdef HAVE_PCAP_CREATE 560 { "monitor-mode", no_argument, NULL, 'I' }, 561 #endif 562 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE 563 { "time-stamp-type", required_argument, NULL, 'j' }, 564 { "list-time-stamp-types", no_argument, NULL, 'J' }, 565 #endif 566 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION 567 { "time-stamp-precision", required_argument, NULL, OPTION_TSTAMP_PRECISION}, 568 #endif 569 { "dont-verify-checksums", no_argument, NULL, 'K' }, 570 { "list-data-link-types", no_argument, NULL, 'L' }, 571 { "no-optimize", no_argument, NULL, 'O' }, 572 { "no-promiscuous-mode", no_argument, NULL, 'p' }, 573 #ifdef HAVE_PCAP_SETDIRECTION 574 { "direction", required_argument, NULL, 'Q' }, 575 #endif 576 { "snapshot-length", required_argument, NULL, 's' }, 577 { "absolute-tcp-sequence-numbers", no_argument, NULL, 'S' }, 578 #ifdef HAVE_PCAP_DUMP_FLUSH 579 { "packet-buffered", no_argument, NULL, 'U' }, 580 #endif 581 { "linktype", required_argument, NULL, 'y' }, 582 #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE 583 { "immediate-mode", no_argument, NULL, OPTION_IMMEDIATE_MODE }, 584 #endif 585 #ifdef HAVE_PCAP_SET_PARSER_DEBUG 586 { "debug-filter-parser", no_argument, NULL, 'Y' }, 587 #endif 588 { "relinquish-privileges", required_argument, NULL, 'Z' }, 589 { "number", no_argument, NULL, '#' }, 590 { "version", no_argument, NULL, OPTION_VERSION }, 591 { NULL, 0, NULL, 0 } 592 }; 593 594 #ifndef _WIN32 595 /* Drop root privileges and chroot if necessary */ 596 static void 597 droproot(const char *username, const char *chroot_dir) 598 { 599 struct passwd *pw = NULL; 600 601 if (chroot_dir && !username) { 602 fprintf(stderr, "%s: Chroot without dropping root is insecure\n", 603 program_name); 604 exit_tcpdump(1); 605 } 606 607 pw = getpwnam(username); 608 if (pw) { 609 if (chroot_dir) { 610 if (chroot(chroot_dir) != 0 || chdir ("/") != 0) { 611 fprintf(stderr, "%s: Couldn't chroot/chdir to '%.64s': %s\n", 612 program_name, chroot_dir, pcap_strerror(errno)); 613 exit_tcpdump(1); 614 } 615 } 616 #ifdef HAVE_LIBCAP_NG 617 { 618 int ret = capng_change_id(pw->pw_uid, pw->pw_gid, CAPNG_NO_FLAG); 619 if (ret < 0) 620 error("capng_change_id(): return %d\n", ret); 621 else 622 fprintf(stderr, "dropped privs to %s\n", username); 623 } 624 #else 625 if (initgroups(pw->pw_name, pw->pw_gid) != 0 || 626 setgid(pw->pw_gid) != 0 || setuid(pw->pw_uid) != 0) { 627 fprintf(stderr, "%s: Couldn't change to '%.32s' uid=%lu gid=%lu: %s\n", 628 program_name, username, 629 (unsigned long)pw->pw_uid, 630 (unsigned long)pw->pw_gid, 631 pcap_strerror(errno)); 632 exit_tcpdump(1); 633 } 634 else { 635 fprintf(stderr, "dropped privs to %s\n", username); 636 } 637 #endif /* HAVE_LIBCAP_NG */ 638 } 639 else { 640 fprintf(stderr, "%s: Couldn't find user '%.32s'\n", 641 program_name, username); 642 exit_tcpdump(1); 643 } 644 #ifdef HAVE_LIBCAP_NG 645 /* We don't need CAP_SETUID, CAP_SETGID and CAP_SYS_CHROOT any more. */ 646 capng_updatev( 647 CAPNG_DROP, 648 CAPNG_EFFECTIVE | CAPNG_PERMITTED, 649 CAP_SETUID, 650 CAP_SETGID, 651 CAP_SYS_CHROOT, 652 -1); 653 capng_apply(CAPNG_SELECT_BOTH); 654 #endif /* HAVE_LIBCAP_NG */ 655 656 } 657 #endif /* _WIN32 */ 658 659 static int 660 getWflagChars(int x) 661 { 662 int c = 0; 663 664 x -= 1; 665 while (x > 0) { 666 c += 1; 667 x /= 10; 668 } 669 670 return c; 671 } 672 673 674 static void 675 MakeFilename(char *buffer, char *orig_name, int cnt, int max_chars) 676 { 677 char *filename = malloc(PATH_MAX + 1); 678 if (filename == NULL) 679 error("Makefilename: malloc"); 680 681 /* Process with strftime if Gflag is set. */ 682 if (Gflag != 0) { 683 struct tm *local_tm; 684 685 /* Convert Gflag_time to a usable format */ 686 if ((local_tm = localtime(&Gflag_time)) == NULL) { 687 error("MakeTimedFilename: localtime"); 688 } 689 690 /* There's no good way to detect an error in strftime since a return 691 * value of 0 isn't necessarily failure. 692 */ 693 strftime(filename, PATH_MAX, orig_name, local_tm); 694 } else { 695 strncpy(filename, orig_name, PATH_MAX); 696 } 697 698 if (cnt == 0 && max_chars == 0) 699 strncpy(buffer, filename, PATH_MAX + 1); 700 else 701 if (snprintf(buffer, PATH_MAX + 1, "%s%0*d", filename, max_chars, cnt) > PATH_MAX) 702 /* Report an error if the filename is too large */ 703 error("too many output files or filename is too long (> %d)", PATH_MAX); 704 free(filename); 705 } 706 707 static char * 708 get_next_file(FILE *VFile, char *ptr) 709 { 710 char *ret; 711 size_t len; 712 713 ret = fgets(ptr, PATH_MAX, VFile); 714 if (!ret) 715 return NULL; 716 717 len = strlen (ptr); 718 if (len > 0 && ptr[len - 1] == '\n') 719 ptr[len - 1] = '\0'; 720 721 return ret; 722 } 723 724 #ifdef HAVE_CASPER 725 static cap_channel_t * 726 capdns_setup(void) 727 { 728 cap_channel_t *capcas, *capdnsloc; 729 const char *types[1]; 730 int families[2]; 731 732 capcas = cap_init(); 733 if (capcas == NULL) 734 error("unable to create casper process"); 735 capdnsloc = cap_service_open(capcas, "system.dns"); 736 /* Casper capability no longer needed. */ 737 cap_close(capcas); 738 if (capdnsloc == NULL) 739 error("unable to open system.dns service"); 740 /* Limit system.dns to reverse DNS lookups. */ 741 types[0] = "ADDR2NAME"; 742 if (cap_dns_type_limit(capdnsloc, types, 1) < 0) 743 error("unable to limit access to system.dns service"); 744 families[0] = AF_INET; 745 families[1] = AF_INET6; 746 if (cap_dns_family_limit(capdnsloc, families, 2) < 0) 747 error("unable to limit access to system.dns service"); 748 749 return (capdnsloc); 750 } 751 #endif /* HAVE_CASPER */ 752 753 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION 754 static int 755 tstamp_precision_from_string(const char *precision) 756 { 757 if (strncmp(precision, "nano", strlen("nano")) == 0) 758 return PCAP_TSTAMP_PRECISION_NANO; 759 760 if (strncmp(precision, "micro", strlen("micro")) == 0) 761 return PCAP_TSTAMP_PRECISION_MICRO; 762 763 return -EINVAL; 764 } 765 766 static const char * 767 tstamp_precision_to_string(int precision) 768 { 769 switch (precision) { 770 771 case PCAP_TSTAMP_PRECISION_MICRO: 772 return "micro"; 773 774 case PCAP_TSTAMP_PRECISION_NANO: 775 return "nano"; 776 777 default: 778 return "unknown"; 779 } 780 } 781 #endif 782 783 #ifdef HAVE_CAPSICUM 784 /* 785 * Ensure that, on a dump file's descriptor, we have all the rights 786 * necessary to make the standard I/O library work with an fdopen()ed 787 * FILE * from that descriptor. 788 * 789 * A long time ago, in a galaxy far far away, AT&T decided that, instead 790 * of providing separate APIs for getting and setting the FD_ flags on a 791 * descriptor, getting and setting the O_ flags on a descriptor, and 792 * locking files, they'd throw them all into a kitchen-sink fcntl() call 793 * along the lines of ioctl(), the fact that ioctl() operations are 794 * largely specific to particular character devices but fcntl() operations 795 * are either generic to all descriptors or generic to all descriptors for 796 * regular files nonwithstanding. 797 * 798 * The Capsicum people decided that fine-grained control of descriptor 799 * operations was required, so that you need to grant permission for 800 * reading, writing, seeking, and fcntl-ing. The latter, courtesy of 801 * AT&T's decision, means that "fcntl-ing" isn't a thing, but a motley 802 * collection of things, so there are *individual* fcntls for which 803 * permission needs to be granted. 804 * 805 * The FreeBSD standard I/O people implemented some optimizations that 806 * requires that the standard I/O routines be able to determine whether 807 * the descriptor for the FILE * is open append-only or not; as that 808 * descriptor could have come from an open() rather than an fopen(), 809 * that requires that it be able to do an F_GETFL fcntl() to read 810 * the O_ flags. 811 * 812 * Tcpdump uses ftell() to determine how much data has been written 813 * to a file in order to, when used with -C, determine when it's time 814 * to rotate capture files. ftell() therefore needs to do an lseek() 815 * to find out the file offset and must, thanks to the aforementioned 816 * optimization, also know whether the descriptor is open append-only 817 * or not. 818 * 819 * The net result of all the above is that we need to grant CAP_SEEK, 820 * CAP_WRITE, and CAP_FCNTL with the CAP_FCNTL_GETFL subcapability. 821 * 822 * Perhaps this is the universe's way of saying that either 823 * 824 * 1) there needs to be an fopenat() call and a pcap_dump_openat() call 825 * using it, so that Capsicum-capable tcpdump wouldn't need to do 826 * an fdopen() 827 * 828 * or 829 * 830 * 2) there needs to be a cap_fdopen() call in the FreeBSD standard 831 * I/O library that knows what rights are needed by the standard 832 * I/O library, based on the open mode, and assigns them, perhaps 833 * with an additional argument indicating, for example, whether 834 * seeking should be allowed, so that tcpdump doesn't need to know 835 * what the standard I/O library happens to require this week. 836 */ 837 static void 838 set_dumper_capsicum_rights(pcap_dumper_t *p) 839 { 840 int fd = fileno(pcap_dump_file(p)); 841 cap_rights_t rights; 842 843 cap_rights_init(&rights, CAP_SEEK, CAP_WRITE, CAP_FCNTL); 844 if (cap_rights_limit(fd, &rights) < 0 && errno != ENOSYS) { 845 error("unable to limit dump descriptor"); 846 } 847 if (cap_fcntls_limit(fd, CAP_FCNTL_GETFL) < 0 && errno != ENOSYS) { 848 error("unable to limit dump descriptor fcntls"); 849 } 850 } 851 #endif 852 853 /* 854 * Copy arg vector into a new buffer, concatenating arguments with spaces. 855 */ 856 static char * 857 copy_argv(register char **argv) 858 { 859 register char **p; 860 register u_int len = 0; 861 char *buf; 862 char *src, *dst; 863 864 p = argv; 865 if (*p == NULL) 866 return 0; 867 868 while (*p) 869 len += strlen(*p++) + 1; 870 871 buf = (char *)malloc(len); 872 if (buf == NULL) 873 error("copy_argv: malloc"); 874 875 p = argv; 876 dst = buf; 877 while ((src = *p++) != NULL) { 878 while ((*dst++ = *src++) != '\0') 879 ; 880 dst[-1] = ' '; 881 } 882 dst[-1] = '\0'; 883 884 return buf; 885 } 886 887 /* 888 * On Windows, we need to open the file in binary mode, so that 889 * we get all the bytes specified by the size we get from "fstat()". 890 * On UNIX, that's not necessary. O_BINARY is defined on Windows; 891 * we define it as 0 if it's not defined, so it does nothing. 892 */ 893 #ifndef O_BINARY 894 #define O_BINARY 0 895 #endif 896 897 static char * 898 read_infile(char *fname) 899 { 900 register int i, fd, cc; 901 register char *cp; 902 struct stat buf; 903 904 fd = open(fname, O_RDONLY|O_BINARY); 905 if (fd < 0) 906 error("can't open %s: %s", fname, pcap_strerror(errno)); 907 908 if (fstat(fd, &buf) < 0) 909 error("can't stat %s: %s", fname, pcap_strerror(errno)); 910 911 cp = malloc((u_int)buf.st_size + 1); 912 if (cp == NULL) 913 error("malloc(%d) for %s: %s", (u_int)buf.st_size + 1, 914 fname, pcap_strerror(errno)); 915 cc = read(fd, cp, (u_int)buf.st_size); 916 if (cc < 0) 917 error("read %s: %s", fname, pcap_strerror(errno)); 918 if (cc != buf.st_size) 919 error("short read %s (%d != %d)", fname, cc, (int)buf.st_size); 920 921 close(fd); 922 /* replace "# comment" with spaces */ 923 for (i = 0; i < cc; i++) { 924 if (cp[i] == '#') 925 while (i < cc && cp[i] != '\n') 926 cp[i++] = ' '; 927 } 928 cp[cc] = '\0'; 929 return (cp); 930 } 931 932 #ifdef HAVE_PCAP_FINDALLDEVS 933 static long 934 parse_interface_number(const char *device) 935 { 936 long devnum; 937 char *end; 938 939 devnum = strtol(device, &end, 10); 940 if (device != end && *end == '\0') { 941 /* 942 * It's all-numeric, but is it a valid number? 943 */ 944 if (devnum <= 0) { 945 /* 946 * No, it's not an ordinal. 947 */ 948 error("Invalid adapter index"); 949 } 950 return (devnum); 951 } else { 952 /* 953 * It's not all-numeric; return -1, so our caller 954 * knows that. 955 */ 956 return (-1); 957 } 958 } 959 960 static char * 961 find_interface_by_number(long devnum) 962 { 963 pcap_if_t *dev, *devlist; 964 long i; 965 char ebuf[PCAP_ERRBUF_SIZE]; 966 char *device; 967 968 if (pcap_findalldevs(&devlist, ebuf) < 0) 969 error("%s", ebuf); 970 /* 971 * Look for the devnum-th entry in the list of devices (1-based). 972 */ 973 for (i = 0, dev = devlist; i < devnum-1 && dev != NULL; 974 i++, dev = dev->next) 975 ; 976 if (dev == NULL) 977 error("Invalid adapter index"); 978 device = strdup(dev->name); 979 pcap_freealldevs(devlist); 980 return (device); 981 } 982 #endif 983 984 static pcap_t * 985 open_interface(const char *device, netdissect_options *ndo, char *ebuf) 986 { 987 pcap_t *pc; 988 #ifdef HAVE_PCAP_CREATE 989 int status; 990 char *cp; 991 #endif 992 993 #ifdef HAVE_PCAP_CREATE 994 pc = pcap_create(device, ebuf); 995 if (pc == NULL) { 996 /* 997 * If this failed with "No such device", that means 998 * the interface doesn't exist; return NULL, so that 999 * the caller can see whether the device name is 1000 * actually an interface index. 1001 */ 1002 if (strstr(ebuf, "No such device") != NULL) 1003 return (NULL); 1004 error("%s", ebuf); 1005 } 1006 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE 1007 if (Jflag) 1008 show_tstamp_types_and_exit(pc, device); 1009 #endif 1010 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION 1011 status = pcap_set_tstamp_precision(pc, ndo->ndo_tstamp_precision); 1012 if (status != 0) 1013 error("%s: Can't set %ssecond time stamp precision: %s", 1014 device, 1015 tstamp_precision_to_string(ndo->ndo_tstamp_precision), 1016 pcap_statustostr(status)); 1017 #endif 1018 1019 #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE 1020 if (immediate_mode) { 1021 status = pcap_set_immediate_mode(pc, 1); 1022 if (status != 0) 1023 error("%s: Can't set immediate mode: %s", 1024 device, 1025 pcap_statustostr(status)); 1026 } 1027 #endif 1028 /* 1029 * Is this an interface that supports monitor mode? 1030 */ 1031 if (pcap_can_set_rfmon(pc) == 1) 1032 supports_monitor_mode = 1; 1033 else 1034 supports_monitor_mode = 0; 1035 status = pcap_set_snaplen(pc, ndo->ndo_snaplen); 1036 if (status != 0) 1037 error("%s: Can't set snapshot length: %s", 1038 device, pcap_statustostr(status)); 1039 status = pcap_set_promisc(pc, !pflag); 1040 if (status != 0) 1041 error("%s: Can't set promiscuous mode: %s", 1042 device, pcap_statustostr(status)); 1043 if (Iflag) { 1044 status = pcap_set_rfmon(pc, 1); 1045 if (status != 0) 1046 error("%s: Can't set monitor mode: %s", 1047 device, pcap_statustostr(status)); 1048 } 1049 status = pcap_set_timeout(pc, 1000); 1050 if (status != 0) 1051 error("%s: pcap_set_timeout failed: %s", 1052 device, pcap_statustostr(status)); 1053 if (Bflag != 0) { 1054 status = pcap_set_buffer_size(pc, Bflag); 1055 if (status != 0) 1056 error("%s: Can't set buffer size: %s", 1057 device, pcap_statustostr(status)); 1058 } 1059 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE 1060 if (jflag != -1) { 1061 status = pcap_set_tstamp_type(pc, jflag); 1062 if (status < 0) 1063 error("%s: Can't set time stamp type: %s", 1064 device, pcap_statustostr(status)); 1065 else if (status > 0) 1066 warning("When trying to set timestamp type '%s' on %s: %s", 1067 pcap_tstamp_type_val_to_name(jflag), device, 1068 pcap_statustostr(status)); 1069 } 1070 #endif 1071 status = pcap_activate(pc); 1072 if (status < 0) { 1073 /* 1074 * pcap_activate() failed. 1075 */ 1076 cp = pcap_geterr(pc); 1077 if (status == PCAP_ERROR) 1078 error("%s", cp); 1079 else if (status == PCAP_ERROR_NO_SUCH_DEVICE) { 1080 /* 1081 * Return an error for our caller to handle. 1082 */ 1083 snprintf(ebuf, PCAP_ERRBUF_SIZE, "%s: %s\n(%s)", 1084 device, pcap_statustostr(status), cp); 1085 pcap_close(pc); 1086 return (NULL); 1087 } else if (status == PCAP_ERROR_PERM_DENIED && *cp != '\0') 1088 error("%s: %s\n(%s)", device, 1089 pcap_statustostr(status), cp); 1090 else 1091 error("%s: %s", device, 1092 pcap_statustostr(status)); 1093 } else if (status > 0) { 1094 /* 1095 * pcap_activate() succeeded, but it's warning us 1096 * of a problem it had. 1097 */ 1098 cp = pcap_geterr(pc); 1099 if (status == PCAP_WARNING) 1100 warning("%s", cp); 1101 else if (status == PCAP_WARNING_PROMISC_NOTSUP && 1102 *cp != '\0') 1103 warning("%s: %s\n(%s)", device, 1104 pcap_statustostr(status), cp); 1105 else 1106 warning("%s: %s", device, 1107 pcap_statustostr(status)); 1108 } 1109 #ifdef HAVE_PCAP_SETDIRECTION 1110 if (Qflag != -1) { 1111 status = pcap_setdirection(pc, Qflag); 1112 if (status != 0) 1113 error("%s: pcap_setdirection() failed: %s", 1114 device, pcap_geterr(pc)); 1115 } 1116 #endif /* HAVE_PCAP_SETDIRECTION */ 1117 #else /* HAVE_PCAP_CREATE */ 1118 *ebuf = '\0'; 1119 pc = pcap_open_live(device, ndo->ndo_snaplen, !pflag, 1000, ebuf); 1120 if (pc == NULL) { 1121 /* 1122 * If this failed with "No such device", that means 1123 * the interface doesn't exist; return NULL, so that 1124 * the caller can see whether the device name is 1125 * actually an interface index. 1126 */ 1127 if (strstr(ebuf, "No such device") != NULL) 1128 return (NULL); 1129 error("%s", ebuf); 1130 } 1131 if (*ebuf) 1132 warning("%s", ebuf); 1133 #endif /* HAVE_PCAP_CREATE */ 1134 1135 return (pc); 1136 } 1137 1138 int 1139 main(int argc, char **argv) 1140 { 1141 register int cnt, op, i; 1142 bpf_u_int32 localnet =0 , netmask = 0; 1143 int timezone_offset = 0; 1144 register char *cp, *infile, *cmdbuf, *device, *RFileName, *VFileName, *WFileName; 1145 pcap_handler callback; 1146 int dlt; 1147 const char *dlt_name; 1148 struct bpf_program fcode; 1149 #ifndef _WIN32 1150 RETSIGTYPE (*oldhandler)(int); 1151 #endif 1152 struct dump_info dumpinfo; 1153 u_char *pcap_userdata; 1154 char ebuf[PCAP_ERRBUF_SIZE]; 1155 char VFileLine[PATH_MAX + 1]; 1156 char *username = NULL; 1157 char *chroot_dir = NULL; 1158 char *ret = NULL; 1159 char *end; 1160 #ifdef HAVE_PCAP_FINDALLDEVS 1161 pcap_if_t *devlist; 1162 long devnum; 1163 #endif 1164 int status; 1165 FILE *VFile; 1166 #ifdef HAVE_CAPSICUM 1167 cap_rights_t rights; 1168 int cansandbox; 1169 #endif /* HAVE_CAPSICUM */ 1170 int Oflag = 1; /* run filter code optimizer */ 1171 int yflag_dlt = -1; 1172 const char *yflag_dlt_name = NULL; 1173 1174 netdissect_options Ndo; 1175 netdissect_options *ndo = &Ndo; 1176 1177 /* 1178 * Initialize the netdissect code. 1179 */ 1180 if (nd_init(ebuf, sizeof ebuf) == -1) 1181 error("%s", ebuf); 1182 1183 memset(ndo, 0, sizeof(*ndo)); 1184 ndo_set_function_pointers(ndo); 1185 ndo->ndo_snaplen = DEFAULT_SNAPLEN; 1186 1187 cnt = -1; 1188 device = NULL; 1189 infile = NULL; 1190 RFileName = NULL; 1191 VFileName = NULL; 1192 VFile = NULL; 1193 WFileName = NULL; 1194 dlt = -1; 1195 if ((cp = strrchr(argv[0], '/')) != NULL) 1196 ndo->program_name = program_name = cp + 1; 1197 else 1198 ndo->program_name = program_name = argv[0]; 1199 1200 #ifdef _WIN32 1201 if (pcap_wsockinit() != 0) 1202 error("Attempting to initialize Winsock failed"); 1203 #endif /* _WIN32 */ 1204 1205 /* 1206 * On platforms where the CPU doesn't support unaligned loads, 1207 * force unaligned accesses to abort with SIGBUS, rather than 1208 * being fixed up (slowly) by the OS kernel; on those platforms, 1209 * misaligned accesses are bugs, and we want tcpdump to crash so 1210 * that the bugs are reported. 1211 */ 1212 if (abort_on_misalignment(ebuf, sizeof(ebuf)) < 0) 1213 error("%s", ebuf); 1214 1215 while ( 1216 (op = getopt_long(argc, argv, SHORTOPTS, longopts, NULL)) != -1) 1217 switch (op) { 1218 1219 case 'a': 1220 /* compatibility for old -a */ 1221 break; 1222 1223 case 'A': 1224 ++ndo->ndo_Aflag; 1225 break; 1226 1227 case 'b': 1228 ++ndo->ndo_bflag; 1229 break; 1230 1231 #if defined(HAVE_PCAP_CREATE) || defined(_WIN32) 1232 case 'B': 1233 Bflag = atoi(optarg)*1024; 1234 if (Bflag <= 0) 1235 error("invalid packet buffer size %s", optarg); 1236 break; 1237 #endif /* defined(HAVE_PCAP_CREATE) || defined(_WIN32) */ 1238 1239 case 'c': 1240 cnt = atoi(optarg); 1241 if (cnt <= 0) 1242 error("invalid packet count %s", optarg); 1243 break; 1244 1245 case 'C': 1246 Cflag = atoi(optarg) * 1000000; 1247 if (Cflag <= 0) 1248 error("invalid file size %s", optarg); 1249 break; 1250 1251 case 'd': 1252 ++dflag; 1253 break; 1254 1255 case 'D': 1256 Dflag++; 1257 break; 1258 1259 case 'L': 1260 Lflag++; 1261 break; 1262 1263 case 'e': 1264 ++ndo->ndo_eflag; 1265 break; 1266 1267 case 'E': 1268 #ifndef HAVE_LIBCRYPTO 1269 warning("crypto code not compiled in"); 1270 #endif 1271 ndo->ndo_espsecret = optarg; 1272 break; 1273 1274 case 'f': 1275 ++ndo->ndo_fflag; 1276 break; 1277 1278 case 'F': 1279 infile = optarg; 1280 break; 1281 1282 case 'G': 1283 Gflag = atoi(optarg); 1284 if (Gflag < 0) 1285 error("invalid number of seconds %s", optarg); 1286 1287 /* We will create one file initially. */ 1288 Gflag_count = 0; 1289 1290 /* Grab the current time for rotation use. */ 1291 if ((Gflag_time = time(NULL)) == (time_t)-1) { 1292 error("main: can't get current time: %s", 1293 pcap_strerror(errno)); 1294 } 1295 break; 1296 1297 case 'h': 1298 print_usage(); 1299 exit_tcpdump(0); 1300 break; 1301 1302 case 'H': 1303 ++ndo->ndo_Hflag; 1304 break; 1305 1306 case 'i': 1307 device = optarg; 1308 break; 1309 1310 #ifdef HAVE_PCAP_CREATE 1311 case 'I': 1312 ++Iflag; 1313 break; 1314 #endif /* HAVE_PCAP_CREATE */ 1315 1316 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE 1317 case 'j': 1318 jflag = pcap_tstamp_type_name_to_val(optarg); 1319 if (jflag < 0) 1320 error("invalid time stamp type %s", optarg); 1321 break; 1322 1323 case 'J': 1324 Jflag++; 1325 break; 1326 #endif 1327 1328 case 'l': 1329 #ifdef _WIN32 1330 /* 1331 * _IOLBF is the same as _IOFBF in Microsoft's C 1332 * libraries; the only alternative they offer 1333 * is _IONBF. 1334 * 1335 * XXX - this should really be checking for MSVC++, 1336 * not _WIN32, if, for example, MinGW has its own 1337 * C library that is more UNIX-compatible. 1338 */ 1339 setvbuf(stdout, NULL, _IONBF, 0); 1340 #else /* _WIN32 */ 1341 #ifdef HAVE_SETLINEBUF 1342 setlinebuf(stdout); 1343 #else 1344 setvbuf(stdout, NULL, _IOLBF, 0); 1345 #endif 1346 #endif /* _WIN32 */ 1347 break; 1348 1349 case 'K': 1350 ++ndo->ndo_Kflag; 1351 break; 1352 1353 case 'm': 1354 if (nd_have_smi_support()) { 1355 if (nd_load_smi_module(optarg, ebuf, sizeof ebuf) == -1) 1356 error("%s", ebuf); 1357 } else { 1358 (void)fprintf(stderr, "%s: ignoring option `-m %s' ", 1359 program_name, optarg); 1360 (void)fprintf(stderr, "(no libsmi support)\n"); 1361 } 1362 break; 1363 1364 case 'M': 1365 /* TCP-MD5 shared secret */ 1366 #ifndef HAVE_LIBCRYPTO 1367 warning("crypto code not compiled in"); 1368 #endif 1369 ndo->ndo_sigsecret = optarg; 1370 break; 1371 1372 case 'n': 1373 ++ndo->ndo_nflag; 1374 break; 1375 1376 case 'N': 1377 ++ndo->ndo_Nflag; 1378 break; 1379 1380 case 'O': 1381 Oflag = 0; 1382 break; 1383 1384 case 'p': 1385 ++pflag; 1386 break; 1387 1388 case 'q': 1389 ++ndo->ndo_qflag; 1390 ++ndo->ndo_suppress_default_print; 1391 break; 1392 1393 #ifdef HAVE_PCAP_SETDIRECTION 1394 case 'Q': 1395 if (ascii_strcasecmp(optarg, "in") == 0) 1396 Qflag = PCAP_D_IN; 1397 else if (ascii_strcasecmp(optarg, "out") == 0) 1398 Qflag = PCAP_D_OUT; 1399 else if (ascii_strcasecmp(optarg, "inout") == 0) 1400 Qflag = PCAP_D_INOUT; 1401 else 1402 error("unknown capture direction `%s'", optarg); 1403 break; 1404 #endif /* HAVE_PCAP_SETDIRECTION */ 1405 1406 case 'r': 1407 RFileName = optarg; 1408 break; 1409 1410 case 's': 1411 ndo->ndo_snaplen = strtol(optarg, &end, 0); 1412 if (optarg == end || *end != '\0' 1413 || ndo->ndo_snaplen < 0 || ndo->ndo_snaplen > MAXIMUM_SNAPLEN) 1414 error("invalid snaplen %s", optarg); 1415 else if (ndo->ndo_snaplen == 0) 1416 ndo->ndo_snaplen = MAXIMUM_SNAPLEN; 1417 break; 1418 1419 case 'S': 1420 ++ndo->ndo_Sflag; 1421 break; 1422 1423 case 't': 1424 ++ndo->ndo_tflag; 1425 break; 1426 1427 case 'T': 1428 if (ascii_strcasecmp(optarg, "vat") == 0) 1429 ndo->ndo_packettype = PT_VAT; 1430 else if (ascii_strcasecmp(optarg, "wb") == 0) 1431 ndo->ndo_packettype = PT_WB; 1432 else if (ascii_strcasecmp(optarg, "rpc") == 0) 1433 ndo->ndo_packettype = PT_RPC; 1434 else if (ascii_strcasecmp(optarg, "rtp") == 0) 1435 ndo->ndo_packettype = PT_RTP; 1436 else if (ascii_strcasecmp(optarg, "rtcp") == 0) 1437 ndo->ndo_packettype = PT_RTCP; 1438 else if (ascii_strcasecmp(optarg, "snmp") == 0) 1439 ndo->ndo_packettype = PT_SNMP; 1440 else if (ascii_strcasecmp(optarg, "cnfp") == 0) 1441 ndo->ndo_packettype = PT_CNFP; 1442 else if (ascii_strcasecmp(optarg, "tftp") == 0) 1443 ndo->ndo_packettype = PT_TFTP; 1444 else if (ascii_strcasecmp(optarg, "aodv") == 0) 1445 ndo->ndo_packettype = PT_AODV; 1446 else if (ascii_strcasecmp(optarg, "carp") == 0) 1447 ndo->ndo_packettype = PT_CARP; 1448 else if (ascii_strcasecmp(optarg, "radius") == 0) 1449 ndo->ndo_packettype = PT_RADIUS; 1450 else if (ascii_strcasecmp(optarg, "zmtp1") == 0) 1451 ndo->ndo_packettype = PT_ZMTP1; 1452 else if (ascii_strcasecmp(optarg, "vxlan") == 0) 1453 ndo->ndo_packettype = PT_VXLAN; 1454 else if (ascii_strcasecmp(optarg, "pgm") == 0) 1455 ndo->ndo_packettype = PT_PGM; 1456 else if (ascii_strcasecmp(optarg, "pgm_zmtp1") == 0) 1457 ndo->ndo_packettype = PT_PGM_ZMTP1; 1458 else if (ascii_strcasecmp(optarg, "lmp") == 0) 1459 ndo->ndo_packettype = PT_LMP; 1460 else if (ascii_strcasecmp(optarg, "resp") == 0) 1461 ndo->ndo_packettype = PT_RESP; 1462 else 1463 error("unknown packet type `%s'", optarg); 1464 break; 1465 1466 case 'u': 1467 ++ndo->ndo_uflag; 1468 break; 1469 1470 #ifdef HAVE_PCAP_DUMP_FLUSH 1471 case 'U': 1472 ++Uflag; 1473 break; 1474 #endif 1475 1476 case 'v': 1477 ++ndo->ndo_vflag; 1478 break; 1479 1480 case 'V': 1481 VFileName = optarg; 1482 break; 1483 1484 case 'w': 1485 WFileName = optarg; 1486 break; 1487 1488 case 'W': 1489 Wflag = atoi(optarg); 1490 if (Wflag <= 0) 1491 error("invalid number of output files %s", optarg); 1492 WflagChars = getWflagChars(Wflag); 1493 break; 1494 1495 case 'x': 1496 ++ndo->ndo_xflag; 1497 ++ndo->ndo_suppress_default_print; 1498 break; 1499 1500 case 'X': 1501 ++ndo->ndo_Xflag; 1502 ++ndo->ndo_suppress_default_print; 1503 break; 1504 1505 case 'y': 1506 yflag_dlt_name = optarg; 1507 yflag_dlt = 1508 pcap_datalink_name_to_val(yflag_dlt_name); 1509 if (yflag_dlt < 0) 1510 error("invalid data link type %s", yflag_dlt_name); 1511 break; 1512 1513 #ifdef HAVE_PCAP_SET_PARSER_DEBUG 1514 case 'Y': 1515 { 1516 /* Undocumented flag */ 1517 pcap_set_parser_debug(1); 1518 } 1519 break; 1520 #endif 1521 case 'z': 1522 zflag = optarg; 1523 break; 1524 1525 case 'Z': 1526 username = optarg; 1527 break; 1528 1529 case '#': 1530 ndo->ndo_packet_number = 1; 1531 break; 1532 1533 case OPTION_VERSION: 1534 print_version(); 1535 exit_tcpdump(0); 1536 break; 1537 1538 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION 1539 case OPTION_TSTAMP_PRECISION: 1540 ndo->ndo_tstamp_precision = tstamp_precision_from_string(optarg); 1541 if (ndo->ndo_tstamp_precision < 0) 1542 error("unsupported time stamp precision"); 1543 break; 1544 #endif 1545 1546 #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE 1547 case OPTION_IMMEDIATE_MODE: 1548 immediate_mode = 1; 1549 break; 1550 #endif 1551 1552 default: 1553 print_usage(); 1554 exit_tcpdump(1); 1555 /* NOTREACHED */ 1556 } 1557 1558 #ifdef HAVE_PCAP_FINDALLDEVS 1559 if (Dflag) 1560 show_devices_and_exit(); 1561 #endif 1562 1563 switch (ndo->ndo_tflag) { 1564 1565 case 0: /* Default */ 1566 case 4: /* Default + Date*/ 1567 timezone_offset = gmt2local(0); 1568 break; 1569 1570 case 1: /* No time stamp */ 1571 case 2: /* Unix timeval style */ 1572 case 3: /* Microseconds since previous packet */ 1573 case 5: /* Microseconds since first packet */ 1574 break; 1575 1576 default: /* Not supported */ 1577 error("only -t, -tt, -ttt, -tttt and -ttttt are supported"); 1578 break; 1579 } 1580 1581 if (ndo->ndo_fflag != 0 && (VFileName != NULL || RFileName != NULL)) 1582 error("-f can not be used with -V or -r"); 1583 1584 if (VFileName != NULL && RFileName != NULL) 1585 error("-V and -r are mutually exclusive."); 1586 1587 #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE 1588 /* 1589 * If we're printing dissected packets to the standard output 1590 * rather than saving raw packets to a file, and the standard 1591 * output is a terminal, use immediate mode, as the user's 1592 * probably expecting to see packets pop up immediately. 1593 */ 1594 if (WFileName == NULL && isatty(1)) 1595 immediate_mode = 1; 1596 #endif 1597 1598 #ifdef WITH_CHROOT 1599 /* if run as root, prepare for chrooting */ 1600 if (getuid() == 0 || geteuid() == 0) { 1601 /* future extensibility for cmd-line arguments */ 1602 if (!chroot_dir) 1603 chroot_dir = WITH_CHROOT; 1604 } 1605 #endif 1606 1607 #ifdef WITH_USER 1608 /* if run as root, prepare for dropping root privileges */ 1609 if (getuid() == 0 || geteuid() == 0) { 1610 /* Run with '-Z root' to restore old behaviour */ 1611 if (!username) 1612 username = WITH_USER; 1613 } 1614 #endif 1615 1616 if (RFileName != NULL || VFileName != NULL) { 1617 /* 1618 * If RFileName is non-null, it's the pathname of a 1619 * savefile to read. If VFileName is non-null, it's 1620 * the pathname of a file containing a list of pathnames 1621 * (one per line) of savefiles to read. 1622 * 1623 * In either case, we're reading a savefile, not doing 1624 * a live capture. 1625 */ 1626 #ifndef _WIN32 1627 /* 1628 * We don't need network access, so relinquish any set-UID 1629 * or set-GID privileges we have (if any). 1630 * 1631 * We do *not* want set-UID privileges when opening a 1632 * trace file, as that might let the user read other 1633 * people's trace files (especially if we're set-UID 1634 * root). 1635 */ 1636 if (setgid(getgid()) != 0 || setuid(getuid()) != 0 ) 1637 fprintf(stderr, "Warning: setgid/setuid failed !\n"); 1638 #endif /* _WIN32 */ 1639 if (VFileName != NULL) { 1640 if (VFileName[0] == '-' && VFileName[1] == '\0') 1641 VFile = stdin; 1642 else 1643 VFile = fopen(VFileName, "r"); 1644 1645 if (VFile == NULL) 1646 error("Unable to open file: %s\n", pcap_strerror(errno)); 1647 1648 ret = get_next_file(VFile, VFileLine); 1649 if (!ret) 1650 error("Nothing in %s\n", VFileName); 1651 RFileName = VFileLine; 1652 } 1653 1654 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION 1655 pd = pcap_open_offline_with_tstamp_precision(RFileName, 1656 ndo->ndo_tstamp_precision, ebuf); 1657 #else 1658 pd = pcap_open_offline(RFileName, ebuf); 1659 #endif 1660 1661 if (pd == NULL) 1662 error("%s", ebuf); 1663 #ifdef HAVE_CAPSICUM 1664 cap_rights_init(&rights, CAP_READ); 1665 if (cap_rights_limit(fileno(pcap_file(pd)), &rights) < 0 && 1666 errno != ENOSYS) { 1667 error("unable to limit pcap descriptor"); 1668 } 1669 #endif 1670 dlt = pcap_datalink(pd); 1671 dlt_name = pcap_datalink_val_to_name(dlt); 1672 if (dlt_name == NULL) { 1673 fprintf(stderr, "reading from file %s, link-type %u\n", 1674 RFileName, dlt); 1675 } else { 1676 fprintf(stderr, 1677 "reading from file %s, link-type %s (%s)\n", 1678 RFileName, dlt_name, 1679 pcap_datalink_val_to_description(dlt)); 1680 } 1681 } else { 1682 /* 1683 * We're doing a live capture. 1684 */ 1685 if (device == NULL) { 1686 /* 1687 * No interface was specified. Pick one. 1688 */ 1689 #ifdef HAVE_PCAP_FINDALLDEVS 1690 /* 1691 * Find the list of interfaces, and pick 1692 * the first interface. 1693 */ 1694 if (pcap_findalldevs(&devlist, ebuf) >= 0 && 1695 devlist != NULL) { 1696 device = strdup(devlist->name); 1697 pcap_freealldevs(devlist); 1698 } 1699 #else /* HAVE_PCAP_FINDALLDEVS */ 1700 /* 1701 * Use whatever interface pcap_lookupdev() 1702 * chooses. 1703 */ 1704 device = pcap_lookupdev(ebuf); 1705 #endif 1706 if (device == NULL) 1707 error("%s", ebuf); 1708 } 1709 1710 /* 1711 * Try to open the interface with the specified name. 1712 */ 1713 pd = open_interface(device, ndo, ebuf); 1714 if (pd == NULL) { 1715 /* 1716 * That failed. If we can get a list of 1717 * interfaces, and the interface name 1718 * is purely numeric, try to use it as 1719 * a 1-based index in the list of 1720 * interfaces. 1721 */ 1722 #ifdef HAVE_PCAP_FINDALLDEVS 1723 devnum = parse_interface_number(device); 1724 if (devnum == -1) { 1725 /* 1726 * It's not a number; just report 1727 * the open error and fail. 1728 */ 1729 error("%s", ebuf); 1730 } 1731 1732 /* 1733 * OK, it's a number; try to find the 1734 * interface with that index, and try 1735 * to open it. 1736 * 1737 * find_interface_by_number() exits if it 1738 * couldn't be found. 1739 */ 1740 device = find_interface_by_number(devnum); 1741 pd = open_interface(device, ndo, ebuf); 1742 if (pd == NULL) 1743 error("%s", ebuf); 1744 #else /* HAVE_PCAP_FINDALLDEVS */ 1745 /* 1746 * We can't get a list of interfaces; just 1747 * fail. 1748 */ 1749 error("%s", ebuf); 1750 #endif /* HAVE_PCAP_FINDALLDEVS */ 1751 } 1752 1753 /* 1754 * Let user own process after socket has been opened. 1755 */ 1756 #ifndef _WIN32 1757 if (setgid(getgid()) != 0 || setuid(getuid()) != 0) 1758 fprintf(stderr, "Warning: setgid/setuid failed !\n"); 1759 #endif /* _WIN32 */ 1760 #if !defined(HAVE_PCAP_CREATE) && defined(_WIN32) 1761 if(Bflag != 0) 1762 if(pcap_setbuff(pd, Bflag)==-1){ 1763 error("%s", pcap_geterr(pd)); 1764 } 1765 #endif /* !defined(HAVE_PCAP_CREATE) && defined(_WIN32) */ 1766 if (Lflag) 1767 show_dlts_and_exit(pd, device); 1768 if (yflag_dlt >= 0) { 1769 #ifdef HAVE_PCAP_SET_DATALINK 1770 if (pcap_set_datalink(pd, yflag_dlt) < 0) 1771 error("%s", pcap_geterr(pd)); 1772 #else 1773 /* 1774 * We don't actually support changing the 1775 * data link type, so we only let them 1776 * set it to what it already is. 1777 */ 1778 if (yflag_dlt != pcap_datalink(pd)) { 1779 error("%s is not one of the DLTs supported by this device\n", 1780 yflag_dlt_name); 1781 } 1782 #endif 1783 (void)fprintf(stderr, "%s: data link type %s\n", 1784 program_name, yflag_dlt_name); 1785 (void)fflush(stderr); 1786 } 1787 i = pcap_snapshot(pd); 1788 if (ndo->ndo_snaplen < i) { 1789 warning("snaplen raised from %d to %d", ndo->ndo_snaplen, i); 1790 ndo->ndo_snaplen = i; 1791 } 1792 if(ndo->ndo_fflag != 0) { 1793 if (pcap_lookupnet(device, &localnet, &netmask, ebuf) < 0) { 1794 warning("foreign (-f) flag used but: %s", ebuf); 1795 } 1796 } 1797 1798 } 1799 if (infile) 1800 cmdbuf = read_infile(infile); 1801 else 1802 cmdbuf = copy_argv(&argv[optind]); 1803 1804 #ifdef HAVE_PCAP_SET_OPTIMIZER_DEBUG 1805 pcap_set_optimizer_debug(dflag); 1806 #endif 1807 if (pcap_compile(pd, &fcode, cmdbuf, Oflag, netmask) < 0) 1808 error("%s", pcap_geterr(pd)); 1809 if (dflag) { 1810 bpf_dump(&fcode, dflag); 1811 pcap_close(pd); 1812 free(cmdbuf); 1813 pcap_freecode(&fcode); 1814 exit_tcpdump(0); 1815 } 1816 1817 #ifdef HAVE_CASPER 1818 if (!ndo->ndo_nflag) 1819 capdns = capdns_setup(); 1820 #endif /* HAVE_CASPER */ 1821 1822 init_print(ndo, localnet, netmask, timezone_offset); 1823 1824 #ifndef _WIN32 1825 (void)setsignal(SIGPIPE, cleanup); 1826 (void)setsignal(SIGTERM, cleanup); 1827 (void)setsignal(SIGINT, cleanup); 1828 #endif /* _WIN32 */ 1829 #if defined(HAVE_FORK) || defined(HAVE_VFORK) 1830 (void)setsignal(SIGCHLD, child_cleanup); 1831 #endif 1832 /* Cooperate with nohup(1) */ 1833 #ifndef _WIN32 1834 if ((oldhandler = setsignal(SIGHUP, cleanup)) != SIG_DFL) 1835 (void)setsignal(SIGHUP, oldhandler); 1836 #endif /* _WIN32 */ 1837 1838 #ifndef _WIN32 1839 /* 1840 * If a user name was specified with "-Z", attempt to switch to 1841 * that user's UID. This would probably be used with sudo, 1842 * to allow tcpdump to be run in a special restricted 1843 * account (if you just want to allow users to open capture 1844 * devices, and can't just give users that permission, 1845 * you'd make tcpdump set-UID or set-GID). 1846 * 1847 * Tcpdump doesn't necessarily write only to one savefile; 1848 * the general only way to allow a -Z instance to write to 1849 * savefiles as the user under whose UID it's run, rather 1850 * than as the user specified with -Z, would thus be to switch 1851 * to the original user ID before opening a capture file and 1852 * then switch back to the -Z user ID after opening the savefile. 1853 * Switching to the -Z user ID only after opening the first 1854 * savefile doesn't handle the general case. 1855 */ 1856 1857 if (getuid() == 0 || geteuid() == 0) { 1858 #ifdef HAVE_LIBCAP_NG 1859 /* Initialize capng */ 1860 capng_clear(CAPNG_SELECT_BOTH); 1861 if (username) { 1862 capng_updatev( 1863 CAPNG_ADD, 1864 CAPNG_PERMITTED | CAPNG_EFFECTIVE, 1865 CAP_SETUID, 1866 CAP_SETGID, 1867 -1); 1868 } 1869 if (chroot_dir) { 1870 capng_update( 1871 CAPNG_ADD, 1872 CAPNG_PERMITTED | CAPNG_EFFECTIVE, 1873 CAP_SYS_CHROOT 1874 ); 1875 } 1876 1877 if (WFileName) { 1878 capng_update( 1879 CAPNG_ADD, 1880 CAPNG_PERMITTED | CAPNG_EFFECTIVE, 1881 CAP_DAC_OVERRIDE 1882 ); 1883 } 1884 capng_apply(CAPNG_SELECT_BOTH); 1885 #endif /* HAVE_LIBCAP_NG */ 1886 if (username || chroot_dir) 1887 droproot(username, chroot_dir); 1888 1889 } 1890 #endif /* _WIN32 */ 1891 1892 if (pcap_setfilter(pd, &fcode) < 0) 1893 error("%s", pcap_geterr(pd)); 1894 #ifdef HAVE_CAPSICUM 1895 if (RFileName == NULL && VFileName == NULL && pcap_fileno(pd) != -1) { 1896 static const unsigned long cmds[] = { BIOCGSTATS, BIOCROTZBUF }; 1897 1898 /* 1899 * The various libpcap devices use a combination of 1900 * read (bpf), ioctl (bpf, netmap), poll (netmap) 1901 * so we add the relevant access rights. 1902 */ 1903 cap_rights_init(&rights, CAP_IOCTL, CAP_READ, CAP_EVENT); 1904 if (cap_rights_limit(pcap_fileno(pd), &rights) < 0 && 1905 errno != ENOSYS) { 1906 error("unable to limit pcap descriptor"); 1907 } 1908 if (cap_ioctls_limit(pcap_fileno(pd), cmds, 1909 sizeof(cmds) / sizeof(cmds[0])) < 0 && errno != ENOSYS) { 1910 error("unable to limit ioctls on pcap descriptor"); 1911 } 1912 } 1913 #endif 1914 if (WFileName) { 1915 pcap_dumper_t *p; 1916 /* Do not exceed the default PATH_MAX for files. */ 1917 dumpinfo.CurrentFileName = (char *)malloc(PATH_MAX + 1); 1918 1919 if (dumpinfo.CurrentFileName == NULL) 1920 error("malloc of dumpinfo.CurrentFileName"); 1921 1922 /* We do not need numbering for dumpfiles if Cflag isn't set. */ 1923 if (Cflag != 0) 1924 MakeFilename(dumpinfo.CurrentFileName, WFileName, 0, WflagChars); 1925 else 1926 MakeFilename(dumpinfo.CurrentFileName, WFileName, 0, 0); 1927 1928 p = pcap_dump_open(pd, dumpinfo.CurrentFileName); 1929 #ifdef HAVE_LIBCAP_NG 1930 /* Give up CAP_DAC_OVERRIDE capability. 1931 * Only allow it to be restored if the -C or -G flag have been 1932 * set since we may need to create more files later on. 1933 */ 1934 capng_update( 1935 CAPNG_DROP, 1936 (Cflag || Gflag ? 0 : CAPNG_PERMITTED) 1937 | CAPNG_EFFECTIVE, 1938 CAP_DAC_OVERRIDE 1939 ); 1940 capng_apply(CAPNG_SELECT_BOTH); 1941 #endif /* HAVE_LIBCAP_NG */ 1942 if (p == NULL) 1943 error("%s", pcap_geterr(pd)); 1944 #ifdef HAVE_CAPSICUM 1945 set_dumper_capsicum_rights(p); 1946 #endif 1947 if (Cflag != 0 || Gflag != 0) { 1948 #ifdef HAVE_CAPSICUM 1949 dumpinfo.WFileName = strdup(basename(WFileName)); 1950 if (dumpinfo.WFileName == NULL) { 1951 error("Unable to allocate memory for file %s", 1952 WFileName); 1953 } 1954 dumpinfo.dirfd = open(dirname(WFileName), 1955 O_DIRECTORY | O_RDONLY); 1956 if (dumpinfo.dirfd < 0) { 1957 error("unable to open directory %s", 1958 dirname(WFileName)); 1959 } 1960 cap_rights_init(&rights, CAP_CREATE, CAP_FCNTL, 1961 CAP_FTRUNCATE, CAP_LOOKUP, CAP_SEEK, CAP_WRITE); 1962 if (cap_rights_limit(dumpinfo.dirfd, &rights) < 0 && 1963 errno != ENOSYS) { 1964 error("unable to limit directory rights"); 1965 } 1966 if (cap_fcntls_limit(dumpinfo.dirfd, CAP_FCNTL_GETFL) < 0 && 1967 errno != ENOSYS) { 1968 error("unable to limit dump descriptor fcntls"); 1969 } 1970 #else /* !HAVE_CAPSICUM */ 1971 dumpinfo.WFileName = WFileName; 1972 #endif 1973 callback = dump_packet_and_trunc; 1974 dumpinfo.pd = pd; 1975 dumpinfo.p = p; 1976 pcap_userdata = (u_char *)&dumpinfo; 1977 } else { 1978 callback = dump_packet; 1979 pcap_userdata = (u_char *)p; 1980 } 1981 #ifdef HAVE_PCAP_DUMP_FLUSH 1982 if (Uflag) 1983 pcap_dump_flush(p); 1984 #endif 1985 } else { 1986 dlt = pcap_datalink(pd); 1987 ndo->ndo_if_printer = get_if_printer(ndo, dlt); 1988 callback = print_packet; 1989 pcap_userdata = (u_char *)ndo; 1990 } 1991 1992 #ifdef SIGNAL_REQ_INFO 1993 /* 1994 * We can't get statistics when reading from a file rather 1995 * than capturing from a device. 1996 */ 1997 if (RFileName == NULL) 1998 (void)setsignal(SIGNAL_REQ_INFO, requestinfo); 1999 #endif 2000 2001 if (ndo->ndo_vflag > 0 && WFileName) { 2002 /* 2003 * When capturing to a file, "-v" means tcpdump should, 2004 * every 10 seconds, "v"erbosely report the number of 2005 * packets captured. 2006 */ 2007 #ifdef USE_WIN32_MM_TIMER 2008 /* call verbose_stats_dump() each 1000 +/-100msec */ 2009 timer_id = timeSetEvent(1000, 100, verbose_stats_dump, 0, TIME_PERIODIC); 2010 setvbuf(stderr, NULL, _IONBF, 0); 2011 #elif defined(HAVE_ALARM) 2012 (void)setsignal(SIGALRM, verbose_stats_dump); 2013 alarm(1); 2014 #endif 2015 } 2016 2017 if (RFileName == NULL) { 2018 /* 2019 * Live capture (if -V was specified, we set RFileName 2020 * to a file from the -V file). Print a message to 2021 * the standard error on UN*X. 2022 */ 2023 if (!ndo->ndo_vflag && !WFileName) { 2024 (void)fprintf(stderr, 2025 "%s: verbose output suppressed, use -v or -vv for full protocol decode\n", 2026 program_name); 2027 } else 2028 (void)fprintf(stderr, "%s: ", program_name); 2029 dlt = pcap_datalink(pd); 2030 dlt_name = pcap_datalink_val_to_name(dlt); 2031 if (dlt_name == NULL) { 2032 (void)fprintf(stderr, "listening on %s, link-type %u, capture size %u bytes\n", 2033 device, dlt, ndo->ndo_snaplen); 2034 } else { 2035 (void)fprintf(stderr, "listening on %s, link-type %s (%s), capture size %u bytes\n", 2036 device, dlt_name, 2037 pcap_datalink_val_to_description(dlt), ndo->ndo_snaplen); 2038 } 2039 (void)fflush(stderr); 2040 } 2041 2042 #ifdef HAVE_CAPSICUM 2043 cansandbox = (VFileName == NULL && zflag == NULL && 2044 ndo->ndo_espsecret == NULL); 2045 #ifdef HAVE_CASPER 2046 cansandbox = (cansandbox && (ndo->ndo_nflag || capdns != NULL)); 2047 #else 2048 cansandbox = (cansandbox && ndo->ndo_nflag); 2049 #endif /* HAVE_CASPER */ 2050 cansandbox = (cansandbox && (pcap_fileno(pd) != -1 || 2051 RFileName != NULL)); 2052 2053 if (cansandbox && cap_enter() < 0 && errno != ENOSYS) 2054 error("unable to enter the capability mode"); 2055 #endif /* HAVE_CAPSICUM */ 2056 2057 do { 2058 status = pcap_loop(pd, cnt, callback, pcap_userdata); 2059 if (WFileName == NULL) { 2060 /* 2061 * We're printing packets. Flush the printed output, 2062 * so it doesn't get intermingled with error output. 2063 */ 2064 if (status == -2) { 2065 /* 2066 * We got interrupted, so perhaps we didn't 2067 * manage to finish a line we were printing. 2068 * Print an extra newline, just in case. 2069 */ 2070 putchar('\n'); 2071 } 2072 (void)fflush(stdout); 2073 } 2074 if (status == -2) { 2075 /* 2076 * We got interrupted. If we are reading multiple 2077 * files (via -V) set these so that we stop. 2078 */ 2079 VFileName = NULL; 2080 ret = NULL; 2081 } 2082 if (status == -1) { 2083 /* 2084 * Error. Report it. 2085 */ 2086 (void)fprintf(stderr, "%s: pcap_loop: %s\n", 2087 program_name, pcap_geterr(pd)); 2088 } 2089 if (RFileName == NULL) { 2090 /* 2091 * We're doing a live capture. Report the capture 2092 * statistics. 2093 */ 2094 info(1); 2095 } 2096 pcap_close(pd); 2097 if (VFileName != NULL) { 2098 ret = get_next_file(VFile, VFileLine); 2099 if (ret) { 2100 int new_dlt; 2101 2102 RFileName = VFileLine; 2103 pd = pcap_open_offline(RFileName, ebuf); 2104 if (pd == NULL) 2105 error("%s", ebuf); 2106 #ifdef HAVE_CAPSICUM 2107 cap_rights_init(&rights, CAP_READ); 2108 if (cap_rights_limit(fileno(pcap_file(pd)), 2109 &rights) < 0 && errno != ENOSYS) { 2110 error("unable to limit pcap descriptor"); 2111 } 2112 #endif 2113 new_dlt = pcap_datalink(pd); 2114 if (new_dlt != dlt) { 2115 /* 2116 * The new file has a different 2117 * link-layer header type from the 2118 * previous one. 2119 */ 2120 if (WFileName != NULL) { 2121 /* 2122 * We're writing raw packets 2123 * that match the filter to 2124 * a pcap file. pcap files 2125 * don't support multiple 2126 * different link-layer 2127 * header types, so we fail 2128 * here. 2129 */ 2130 error("%s: new dlt does not match original", RFileName); 2131 } 2132 2133 /* 2134 * We're printing the decoded packets; 2135 * switch to the new DLT. 2136 * 2137 * To do that, we need to change 2138 * the printer, change the DLT name, 2139 * and recompile the filter with 2140 * the new DLT. 2141 */ 2142 dlt = new_dlt; 2143 ndo->ndo_if_printer = get_if_printer(ndo, dlt); 2144 if (pcap_compile(pd, &fcode, cmdbuf, Oflag, netmask) < 0) 2145 error("%s", pcap_geterr(pd)); 2146 } 2147 2148 /* 2149 * Set the filter on the new file. 2150 */ 2151 if (pcap_setfilter(pd, &fcode) < 0) 2152 error("%s", pcap_geterr(pd)); 2153 2154 /* 2155 * Report the new file. 2156 */ 2157 dlt_name = pcap_datalink_val_to_name(dlt); 2158 if (dlt_name == NULL) { 2159 fprintf(stderr, "reading from file %s, link-type %u\n", 2160 RFileName, dlt); 2161 } else { 2162 fprintf(stderr, 2163 "reading from file %s, link-type %s (%s)\n", 2164 RFileName, dlt_name, 2165 pcap_datalink_val_to_description(dlt)); 2166 } 2167 } 2168 } 2169 } 2170 while (ret != NULL); 2171 2172 free(cmdbuf); 2173 pcap_freecode(&fcode); 2174 exit_tcpdump(status == -1 ? 1 : 0); 2175 } 2176 2177 /* make a clean exit on interrupts */ 2178 static RETSIGTYPE 2179 cleanup(int signo _U_) 2180 { 2181 #ifdef USE_WIN32_MM_TIMER 2182 if (timer_id) 2183 timeKillEvent(timer_id); 2184 timer_id = 0; 2185 #elif defined(HAVE_ALARM) 2186 alarm(0); 2187 #endif 2188 2189 #ifdef HAVE_PCAP_BREAKLOOP 2190 /* 2191 * We have "pcap_breakloop()"; use it, so that we do as little 2192 * as possible in the signal handler (it's probably not safe 2193 * to do anything with standard I/O streams in a signal handler - 2194 * the ANSI C standard doesn't say it is). 2195 */ 2196 pcap_breakloop(pd); 2197 #else 2198 /* 2199 * We don't have "pcap_breakloop()"; this isn't safe, but 2200 * it's the best we can do. Print the summary if we're 2201 * not reading from a savefile - i.e., if we're doing a 2202 * live capture - and exit. 2203 */ 2204 if (pd != NULL && pcap_file(pd) == NULL) { 2205 /* 2206 * We got interrupted, so perhaps we didn't 2207 * manage to finish a line we were printing. 2208 * Print an extra newline, just in case. 2209 */ 2210 putchar('\n'); 2211 (void)fflush(stdout); 2212 info(1); 2213 } 2214 exit_tcpdump(0); 2215 #endif 2216 } 2217 2218 /* 2219 On windows, we do not use a fork, so we do not care less about 2220 waiting a child processes to die 2221 */ 2222 #if defined(HAVE_FORK) || defined(HAVE_VFORK) 2223 static RETSIGTYPE 2224 child_cleanup(int signo _U_) 2225 { 2226 wait(NULL); 2227 } 2228 #endif /* HAVE_FORK && HAVE_VFORK */ 2229 2230 static void 2231 info(register int verbose) 2232 { 2233 struct pcap_stat stats; 2234 2235 /* 2236 * Older versions of libpcap didn't set ps_ifdrop on some 2237 * platforms; initialize it to 0 to handle that. 2238 */ 2239 stats.ps_ifdrop = 0; 2240 if (pcap_stats(pd, &stats) < 0) { 2241 (void)fprintf(stderr, "pcap_stats: %s\n", pcap_geterr(pd)); 2242 infoprint = 0; 2243 return; 2244 } 2245 2246 if (!verbose) 2247 fprintf(stderr, "%s: ", program_name); 2248 2249 (void)fprintf(stderr, "%u packet%s captured", packets_captured, 2250 PLURAL_SUFFIX(packets_captured)); 2251 if (!verbose) 2252 fputs(", ", stderr); 2253 else 2254 putc('\n', stderr); 2255 (void)fprintf(stderr, "%u packet%s received by filter", stats.ps_recv, 2256 PLURAL_SUFFIX(stats.ps_recv)); 2257 if (!verbose) 2258 fputs(", ", stderr); 2259 else 2260 putc('\n', stderr); 2261 (void)fprintf(stderr, "%u packet%s dropped by kernel", stats.ps_drop, 2262 PLURAL_SUFFIX(stats.ps_drop)); 2263 if (stats.ps_ifdrop != 0) { 2264 if (!verbose) 2265 fputs(", ", stderr); 2266 else 2267 putc('\n', stderr); 2268 (void)fprintf(stderr, "%u packet%s dropped by interface\n", 2269 stats.ps_ifdrop, PLURAL_SUFFIX(stats.ps_ifdrop)); 2270 } else 2271 putc('\n', stderr); 2272 infoprint = 0; 2273 } 2274 2275 #if defined(HAVE_FORK) || defined(HAVE_VFORK) 2276 #ifdef HAVE_FORK 2277 #define fork_subprocess() fork() 2278 #else 2279 #define fork_subprocess() vfork() 2280 #endif 2281 static void 2282 compress_savefile(const char *filename) 2283 { 2284 pid_t child; 2285 2286 child = fork_subprocess(); 2287 if (child == -1) { 2288 fprintf(stderr, 2289 "compress_savefile: fork failed: %s\n", 2290 pcap_strerror(errno)); 2291 return; 2292 } 2293 if (child != 0) { 2294 /* Parent process. */ 2295 return; 2296 } 2297 2298 /* 2299 * Child process. 2300 * Set to lowest priority so that this doesn't disturb the capture. 2301 */ 2302 #ifdef NZERO 2303 setpriority(PRIO_PROCESS, 0, NZERO - 1); 2304 #else 2305 setpriority(PRIO_PROCESS, 0, 19); 2306 #endif 2307 if (execlp(zflag, zflag, filename, (char *)NULL) == -1) 2308 fprintf(stderr, 2309 "compress_savefile: execlp(%s, %s) failed: %s\n", 2310 zflag, 2311 filename, 2312 pcap_strerror(errno)); 2313 #ifdef HAVE_FORK 2314 exit(1); 2315 #else 2316 _exit(1); 2317 #endif 2318 } 2319 #else /* HAVE_FORK && HAVE_VFORK */ 2320 static void 2321 compress_savefile(const char *filename) 2322 { 2323 fprintf(stderr, 2324 "compress_savefile failed. Functionality not implemented under your system\n"); 2325 } 2326 #endif /* HAVE_FORK && HAVE_VFORK */ 2327 2328 static void 2329 dump_packet_and_trunc(u_char *user, const struct pcap_pkthdr *h, const u_char *sp) 2330 { 2331 struct dump_info *dump_info; 2332 2333 ++packets_captured; 2334 2335 ++infodelay; 2336 2337 dump_info = (struct dump_info *)user; 2338 2339 /* 2340 * XXX - this won't force the file to rotate on the specified time 2341 * boundary, but it will rotate on the first packet received after the 2342 * specified Gflag number of seconds. Note: if a Gflag time boundary 2343 * and a Cflag size boundary coincide, the time rotation will occur 2344 * first thereby cancelling the Cflag boundary (since the file should 2345 * be 0). 2346 */ 2347 if (Gflag != 0) { 2348 /* Check if it is time to rotate */ 2349 time_t t; 2350 2351 /* Get the current time */ 2352 if ((t = time(NULL)) == (time_t)-1) { 2353 error("dump_and_trunc_packet: can't get current_time: %s", 2354 pcap_strerror(errno)); 2355 } 2356 2357 2358 /* If the time is greater than the specified window, rotate */ 2359 if (t - Gflag_time >= Gflag) { 2360 #ifdef HAVE_CAPSICUM 2361 FILE *fp; 2362 int fd; 2363 #endif 2364 2365 /* Update the Gflag_time */ 2366 Gflag_time = t; 2367 /* Update Gflag_count */ 2368 Gflag_count++; 2369 /* 2370 * Close the current file and open a new one. 2371 */ 2372 pcap_dump_close(dump_info->p); 2373 2374 /* 2375 * Compress the file we just closed, if the user asked for it 2376 */ 2377 if (zflag != NULL) 2378 compress_savefile(dump_info->CurrentFileName); 2379 2380 /* 2381 * Check to see if we've exceeded the Wflag (when 2382 * not using Cflag). 2383 */ 2384 if (Cflag == 0 && Wflag > 0 && Gflag_count >= Wflag) { 2385 (void)fprintf(stderr, "Maximum file limit reached: %d\n", 2386 Wflag); 2387 info(1); 2388 exit_tcpdump(0); 2389 /* NOTREACHED */ 2390 } 2391 if (dump_info->CurrentFileName != NULL) 2392 free(dump_info->CurrentFileName); 2393 /* Allocate space for max filename + \0. */ 2394 dump_info->CurrentFileName = (char *)malloc(PATH_MAX + 1); 2395 if (dump_info->CurrentFileName == NULL) 2396 error("dump_packet_and_trunc: malloc"); 2397 /* 2398 * Gflag was set otherwise we wouldn't be here. Reset the count 2399 * so multiple files would end with 1,2,3 in the filename. 2400 * The counting is handled with the -C flow after this. 2401 */ 2402 Cflag_count = 0; 2403 2404 /* 2405 * This is always the first file in the Cflag 2406 * rotation: e.g. 0 2407 * We also don't need numbering if Cflag is not set. 2408 */ 2409 if (Cflag != 0) 2410 MakeFilename(dump_info->CurrentFileName, dump_info->WFileName, 0, 2411 WflagChars); 2412 else 2413 MakeFilename(dump_info->CurrentFileName, dump_info->WFileName, 0, 0); 2414 2415 #ifdef HAVE_LIBCAP_NG 2416 capng_update(CAPNG_ADD, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE); 2417 capng_apply(CAPNG_SELECT_BOTH); 2418 #endif /* HAVE_LIBCAP_NG */ 2419 #ifdef HAVE_CAPSICUM 2420 fd = openat(dump_info->dirfd, 2421 dump_info->CurrentFileName, 2422 O_CREAT | O_WRONLY | O_TRUNC, 0644); 2423 if (fd < 0) { 2424 error("unable to open file %s", 2425 dump_info->CurrentFileName); 2426 } 2427 fp = fdopen(fd, "w"); 2428 if (fp == NULL) { 2429 error("unable to fdopen file %s", 2430 dump_info->CurrentFileName); 2431 } 2432 dump_info->p = pcap_dump_fopen(dump_info->pd, fp); 2433 #else /* !HAVE_CAPSICUM */ 2434 dump_info->p = pcap_dump_open(dump_info->pd, dump_info->CurrentFileName); 2435 #endif 2436 #ifdef HAVE_LIBCAP_NG 2437 capng_update(CAPNG_DROP, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE); 2438 capng_apply(CAPNG_SELECT_BOTH); 2439 #endif /* HAVE_LIBCAP_NG */ 2440 if (dump_info->p == NULL) 2441 error("%s", pcap_geterr(pd)); 2442 #ifdef HAVE_CAPSICUM 2443 set_dumper_capsicum_rights(dump_info->p); 2444 #endif 2445 } 2446 } 2447 2448 /* 2449 * XXX - this won't prevent capture files from getting 2450 * larger than Cflag - the last packet written to the 2451 * file could put it over Cflag. 2452 */ 2453 if (Cflag != 0) { 2454 long size = pcap_dump_ftell(dump_info->p); 2455 2456 if (size == -1) 2457 error("ftell fails on output file"); 2458 if (size > Cflag) { 2459 #ifdef HAVE_CAPSICUM 2460 FILE *fp; 2461 int fd; 2462 #endif 2463 2464 /* 2465 * Close the current file and open a new one. 2466 */ 2467 pcap_dump_close(dump_info->p); 2468 2469 /* 2470 * Compress the file we just closed, if the user 2471 * asked for it. 2472 */ 2473 if (zflag != NULL) 2474 compress_savefile(dump_info->CurrentFileName); 2475 2476 Cflag_count++; 2477 if (Wflag > 0) { 2478 if (Cflag_count >= Wflag) 2479 Cflag_count = 0; 2480 } 2481 if (dump_info->CurrentFileName != NULL) 2482 free(dump_info->CurrentFileName); 2483 dump_info->CurrentFileName = (char *)malloc(PATH_MAX + 1); 2484 if (dump_info->CurrentFileName == NULL) 2485 error("dump_packet_and_trunc: malloc"); 2486 MakeFilename(dump_info->CurrentFileName, dump_info->WFileName, Cflag_count, WflagChars); 2487 #ifdef HAVE_LIBCAP_NG 2488 capng_update(CAPNG_ADD, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE); 2489 capng_apply(CAPNG_SELECT_BOTH); 2490 #endif /* HAVE_LIBCAP_NG */ 2491 #ifdef HAVE_CAPSICUM 2492 fd = openat(dump_info->dirfd, dump_info->CurrentFileName, 2493 O_CREAT | O_WRONLY | O_TRUNC, 0644); 2494 if (fd < 0) { 2495 error("unable to open file %s", 2496 dump_info->CurrentFileName); 2497 } 2498 fp = fdopen(fd, "w"); 2499 if (fp == NULL) { 2500 error("unable to fdopen file %s", 2501 dump_info->CurrentFileName); 2502 } 2503 dump_info->p = pcap_dump_fopen(dump_info->pd, fp); 2504 #else /* !HAVE_CAPSICUM */ 2505 dump_info->p = pcap_dump_open(dump_info->pd, dump_info->CurrentFileName); 2506 #endif 2507 #ifdef HAVE_LIBCAP_NG 2508 capng_update(CAPNG_DROP, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE); 2509 capng_apply(CAPNG_SELECT_BOTH); 2510 #endif /* HAVE_LIBCAP_NG */ 2511 if (dump_info->p == NULL) 2512 error("%s", pcap_geterr(pd)); 2513 #ifdef HAVE_CAPSICUM 2514 set_dumper_capsicum_rights(dump_info->p); 2515 #endif 2516 } 2517 } 2518 2519 pcap_dump((u_char *)dump_info->p, h, sp); 2520 #ifdef HAVE_PCAP_DUMP_FLUSH 2521 if (Uflag) 2522 pcap_dump_flush(dump_info->p); 2523 #endif 2524 2525 --infodelay; 2526 if (infoprint) 2527 info(0); 2528 } 2529 2530 static void 2531 dump_packet(u_char *user, const struct pcap_pkthdr *h, const u_char *sp) 2532 { 2533 ++packets_captured; 2534 2535 ++infodelay; 2536 2537 pcap_dump(user, h, sp); 2538 #ifdef HAVE_PCAP_DUMP_FLUSH 2539 if (Uflag) 2540 pcap_dump_flush((pcap_dumper_t *)user); 2541 #endif 2542 2543 --infodelay; 2544 if (infoprint) 2545 info(0); 2546 } 2547 2548 static void 2549 print_packet(u_char *user, const struct pcap_pkthdr *h, const u_char *sp) 2550 { 2551 ++packets_captured; 2552 2553 ++infodelay; 2554 2555 pretty_print_packet((netdissect_options *)user, h, sp, packets_captured); 2556 2557 --infodelay; 2558 if (infoprint) 2559 info(0); 2560 } 2561 2562 #ifdef _WIN32 2563 /* 2564 * XXX - there should really be libpcap calls to get the version 2565 * number as a string (the string would be generated from #defines 2566 * at run time, so that it's not generated from string constants 2567 * in the library, as, on many UNIX systems, those constants would 2568 * be statically linked into the application executable image, and 2569 * would thus reflect the version of libpcap on the system on 2570 * which the application was *linked*, not the system on which it's 2571 * *running*. 2572 * 2573 * That routine should be documented, unlike the "version[]" 2574 * string, so that UNIX vendors providing their own libpcaps 2575 * don't omit it (as a couple of vendors have...). 2576 * 2577 * Packet.dll should perhaps also export a routine to return the 2578 * version number of the Packet.dll code, to supply the 2579 * "Wpcap_version" information on Windows. 2580 */ 2581 char WDversion[]="current-git.tcpdump.org"; 2582 #if !defined(HAVE_GENERATED_VERSION) 2583 char version[]="current-git.tcpdump.org"; 2584 #endif 2585 char pcap_version[]="current-git.tcpdump.org"; 2586 char Wpcap_version[]="3.1"; 2587 #endif 2588 2589 #ifdef SIGNAL_REQ_INFO 2590 RETSIGTYPE requestinfo(int signo _U_) 2591 { 2592 if (infodelay) 2593 ++infoprint; 2594 else 2595 info(0); 2596 } 2597 #endif 2598 2599 /* 2600 * Called once each second in verbose mode while dumping to file 2601 */ 2602 #ifdef USE_WIN32_MM_TIMER 2603 void CALLBACK verbose_stats_dump (UINT timer_id _U_, UINT msg _U_, DWORD_PTR arg _U_, 2604 DWORD_PTR dw1 _U_, DWORD_PTR dw2 _U_) 2605 { 2606 if (infodelay == 0) 2607 fprintf(stderr, "Got %u\r", packets_captured); 2608 } 2609 #elif defined(HAVE_ALARM) 2610 static void verbose_stats_dump(int sig _U_) 2611 { 2612 if (infodelay == 0) 2613 fprintf(stderr, "Got %u\r", packets_captured); 2614 alarm(1); 2615 } 2616 #endif 2617 2618 USES_APPLE_DEPRECATED_API 2619 static void 2620 print_version(void) 2621 { 2622 extern char version[]; 2623 #ifndef HAVE_PCAP_LIB_VERSION 2624 #if defined(_WIN32) || defined(HAVE_PCAP_VERSION) 2625 extern char pcap_version[]; 2626 #else /* defined(_WIN32) || defined(HAVE_PCAP_VERSION) */ 2627 static char pcap_version[] = "unknown"; 2628 #endif /* defined(_WIN32) || defined(HAVE_PCAP_VERSION) */ 2629 #endif /* HAVE_PCAP_LIB_VERSION */ 2630 const char *smi_version_string; 2631 2632 #ifdef HAVE_PCAP_LIB_VERSION 2633 #ifdef _WIN32 2634 (void)fprintf(stderr, "%s version %s, based on tcpdump version %s\n", program_name, WDversion, version); 2635 #else /* _WIN32 */ 2636 (void)fprintf(stderr, "%s version %s\n", program_name, version); 2637 #endif /* _WIN32 */ 2638 (void)fprintf(stderr, "%s\n",pcap_lib_version()); 2639 #else /* HAVE_PCAP_LIB_VERSION */ 2640 #ifdef _WIN32 2641 (void)fprintf(stderr, "%s version %s, based on tcpdump version %s\n", program_name, WDversion, version); 2642 (void)fprintf(stderr, "WinPcap version %s, based on libpcap version %s\n",Wpcap_version, pcap_version); 2643 #else /* _WIN32 */ 2644 (void)fprintf(stderr, "%s version %s\n", program_name, version); 2645 (void)fprintf(stderr, "libpcap version %s\n", pcap_version); 2646 #endif /* _WIN32 */ 2647 #endif /* HAVE_PCAP_LIB_VERSION */ 2648 2649 #if defined(HAVE_LIBCRYPTO) && defined(SSLEAY_VERSION) 2650 (void)fprintf (stderr, "%s\n", SSLeay_version(SSLEAY_VERSION)); 2651 #endif 2652 2653 smi_version_string = nd_smi_version_string(); 2654 if (smi_version_string != NULL) 2655 (void)fprintf (stderr, "SMI-library: %s\n", smi_version_string); 2656 2657 #if defined(__SANITIZE_ADDRESS__) 2658 (void)fprintf (stderr, "Compiled with AddressSanitizer/GCC.\n"); 2659 #elif defined(__has_feature) 2660 # if __has_feature(address_sanitizer) 2661 (void)fprintf (stderr, "Compiled with AddressSanitizer/CLang.\n"); 2662 # endif 2663 #endif /* __SANITIZE_ADDRESS__ or __has_feature */ 2664 } 2665 USES_APPLE_RST 2666 2667 static void 2668 print_usage(void) 2669 { 2670 print_version(); 2671 (void)fprintf(stderr, 2672 "Usage: %s [-aAbd" D_FLAG "efhH" I_FLAG J_FLAG "KlLnNOpqStu" U_FLAG "vxX#]" B_FLAG_USAGE " [ -c count ]\n", program_name); 2673 (void)fprintf(stderr, 2674 "\t\t[ -C file_size ] [ -E algo:secret ] [ -F file ] [ -G seconds ]\n"); 2675 (void)fprintf(stderr, 2676 "\t\t[ -i interface ]" j_FLAG_USAGE " [ -M secret ] [ --number ]\n"); 2677 #ifdef HAVE_PCAP_SETDIRECTION 2678 (void)fprintf(stderr, 2679 "\t\t[ -Q in|out|inout ]\n"); 2680 #endif 2681 (void)fprintf(stderr, 2682 "\t\t[ -r file ] [ -s snaplen ] "); 2683 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION 2684 (void)fprintf(stderr, "[ --time-stamp-precision precision ]\n"); 2685 (void)fprintf(stderr, 2686 "\t\t"); 2687 #endif 2688 #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE 2689 (void)fprintf(stderr, "[ --immediate-mode ] "); 2690 #endif 2691 (void)fprintf(stderr, "[ -T type ] [ --version ] [ -V file ]\n"); 2692 (void)fprintf(stderr, 2693 "\t\t[ -w file ] [ -W filecount ] [ -y datalinktype ] [ -z postrotate-command ]\n"); 2694 (void)fprintf(stderr, 2695 "\t\t[ -Z user ] [ expression ]\n"); 2696 } 2697 /* 2698 * Local Variables: 2699 * c-style: whitesmith 2700 * c-basic-offset: 8 2701 * End: 2702 */ 2703