1 /* 2 * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000 3 * The Regents of the University of California. All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that: (1) source code distributions 7 * retain the above copyright notice and this paragraph in its entirety, (2) 8 * distributions including binary code include the above copyright notice and 9 * this paragraph in its entirety in the documentation or other materials 10 * provided with the distribution, and (3) all advertising materials mentioning 11 * features or use of this software display the following acknowledgement: 12 * ``This product includes software developed by the University of California, 13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of 14 * the University nor the names of its contributors may be used to endorse 15 * or promote products derived from this software without specific prior 16 * written permission. 17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED 18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF 19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 20 * 21 * Support for splitting captures into multiple files with a maximum 22 * file size: 23 * 24 * Copyright (c) 2001 25 * Seth Webster <swebster@sst.ll.mit.edu> 26 */ 27 28 #ifndef lint 29 static const char copyright[] _U_ = 30 "@(#) Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000\n\ 31 The Regents of the University of California. All rights reserved.\n"; 32 #endif 33 34 /* $FreeBSD$ */ 35 36 /* 37 * tcpdump - monitor tcp/ip traffic on an ethernet. 38 * 39 * First written in 1987 by Van Jacobson, Lawrence Berkeley Laboratory. 40 * Mercilessly hacked and occasionally improved since then via the 41 * combined efforts of Van, Steve McCanne and Craig Leres of LBL. 42 */ 43 44 #ifdef HAVE_CONFIG_H 45 #include "config.h" 46 #endif 47 48 /* 49 * Mac OS X may ship pcap.h from libpcap 0.6 with a libpcap based on 50 * 0.8. That means it has pcap_findalldevs() but the header doesn't 51 * define pcap_if_t, meaning that we can't actually *use* pcap_findalldevs(). 52 */ 53 #ifdef HAVE_PCAP_FINDALLDEVS 54 #ifndef HAVE_PCAP_IF_T 55 #undef HAVE_PCAP_FINDALLDEVS 56 #endif 57 #endif 58 59 #include <tcpdump-stdinc.h> 60 61 #ifdef WIN32 62 #include "w32_fzs.h" 63 extern int strcasecmp (const char *__s1, const char *__s2); 64 extern int SIZE_BUF; 65 #define off_t long 66 #define uint UINT 67 #endif /* WIN32 */ 68 69 #ifdef USE_LIBSMI 70 #include <smi.h> 71 #endif 72 73 #ifdef HAVE_LIBCRYPTO 74 #include <openssl/crypto.h> 75 #endif 76 77 #ifdef HAVE_GETOPT_LONG 78 #include <getopt.h> 79 #else 80 #include "getopt_long.h" 81 #endif 82 /* Capsicum-specific code requires macros from <net/bpf.h>, which will fail 83 * to compile if <pcap.h> has already been included; including the headers 84 * in the opposite order works fine. 85 */ 86 #ifdef __FreeBSD__ 87 #include <sys/capsicum.h> 88 #include <sys/sysctl.h> 89 #endif /* __FreeBSD__ */ 90 #ifdef HAVE_CAPSPER 91 #include <libcasper.h> 92 #include <casper/cap_dns.h> 93 #include <sys/nv.h> 94 #include <sys/capability.h> 95 #include <sys/ioccom.h> 96 #include <net/bpf.h> 97 #include <fcntl.h> 98 #include <libgen.h> 99 #endif /* HAVE_CAPSPER */ 100 #include <pcap.h> 101 #include <signal.h> 102 #include <stdio.h> 103 #include <stdlib.h> 104 #include <string.h> 105 #include <limits.h> 106 #ifndef WIN32 107 #include <sys/wait.h> 108 #include <sys/resource.h> 109 #include <pwd.h> 110 #include <grp.h> 111 #endif /* WIN32 */ 112 113 /* capabilities convenience library */ 114 /* If a code depends on HAVE_LIBCAP_NG, it depends also on HAVE_CAP_NG_H. 115 * If HAVE_CAP_NG_H is not defined, undefine HAVE_LIBCAP_NG. 116 * Thus, the later tests are done only on HAVE_LIBCAP_NG. 117 */ 118 #ifdef HAVE_LIBCAP_NG 119 #ifdef HAVE_CAP_NG_H 120 #include <cap-ng.h> 121 #else 122 #undef HAVE_LIBCAP_NG 123 #endif /* HAVE_CAP_NG_H */ 124 #endif /* HAVE_LIBCAP_NG */ 125 126 #include "netdissect.h" 127 #include "interface.h" 128 #include "addrtoname.h" 129 #include "machdep.h" 130 #include "setsignal.h" 131 #include "gmt2local.h" 132 #include "pcap-missing.h" 133 134 #ifndef PATH_MAX 135 #define PATH_MAX 1024 136 #endif 137 138 #ifdef SIGINFO 139 #define SIGNAL_REQ_INFO SIGINFO 140 #elif SIGUSR1 141 #define SIGNAL_REQ_INFO SIGUSR1 142 #endif 143 144 netdissect_options Gndo; 145 netdissect_options *gndo = &Gndo; 146 147 static int Dflag; /* list available devices and exit */ 148 static int dflag; /* print filter code */ 149 static int Lflag; /* list available data link types and exit */ 150 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE 151 static int Jflag; /* list available time stamp types */ 152 #endif 153 #ifdef HAVE_PCAP_SETDIRECTION 154 int Qflag = -1; /* restrict captured packet by send/receive direction */ 155 #endif 156 static char *zflag = NULL; /* compress each savefile using a specified command (like gzip or bzip2) */ 157 158 static int infodelay; 159 static int infoprint; 160 161 char *program_name; 162 163 #ifdef HAVE_CAPSPER 164 cap_channel_t *capdns; 165 #endif 166 167 int32_t thiszone; /* seconds offset from gmt to local time */ 168 169 /* Forwards */ 170 static RETSIGTYPE cleanup(int); 171 static RETSIGTYPE child_cleanup(int); 172 static void print_version(void); 173 static void print_usage(void); 174 static void show_dlts_and_exit(const char *device, pcap_t *pd) __attribute__((noreturn)); 175 176 static void print_packet(u_char *, const struct pcap_pkthdr *, const u_char *); 177 static void ndo_default_print(netdissect_options *, const u_char *, u_int); 178 static void dump_packet_and_trunc(u_char *, const struct pcap_pkthdr *, const u_char *); 179 static void dump_packet(u_char *, const struct pcap_pkthdr *, const u_char *); 180 static void droproot(const char *, const char *); 181 static void ndo_error(netdissect_options *ndo, const char *fmt, ...) 182 __attribute__((noreturn)) 183 #ifdef __ATTRIBUTE___FORMAT_OK 184 __attribute__((format (printf, 2, 3))) 185 #endif /* __ATTRIBUTE___FORMAT_OK */ 186 ; 187 static void ndo_warning(netdissect_options *ndo, const char *fmt, ...) 188 #ifdef __ATTRIBUTE___FORMAT_OK 189 __attribute__((format (printf, 2, 3))) 190 #endif /* __ATTRIBUTE___FORMAT_OK */ 191 ; 192 193 #ifdef SIGNAL_REQ_INFO 194 RETSIGTYPE requestinfo(int); 195 #endif 196 197 #if defined(USE_WIN32_MM_TIMER) 198 #include <MMsystem.h> 199 static UINT timer_id; 200 static void CALLBACK verbose_stats_dump(UINT, UINT, DWORD_PTR, DWORD_PTR, DWORD_PTR); 201 #elif defined(HAVE_ALARM) 202 static void verbose_stats_dump(int sig); 203 #endif 204 205 static void info(int); 206 static u_int packets_captured; 207 208 struct printer { 209 if_printer f; 210 int type; 211 }; 212 213 214 struct ndo_printer { 215 if_ndo_printer f; 216 int type; 217 }; 218 219 220 static const struct printer printers[] = { 221 { NULL, 0 }, 222 }; 223 224 static const struct ndo_printer ndo_printers[] = { 225 { ether_if_print, DLT_EN10MB }, 226 #ifdef DLT_IPNET 227 { ipnet_if_print, DLT_IPNET }, 228 #endif 229 #ifdef DLT_IEEE802_15_4 230 { ieee802_15_4_if_print, DLT_IEEE802_15_4 }, 231 #endif 232 #ifdef DLT_IEEE802_15_4_NOFCS 233 { ieee802_15_4_if_print, DLT_IEEE802_15_4_NOFCS }, 234 #endif 235 #ifdef DLT_PPI 236 { ppi_if_print, DLT_PPI }, 237 #endif 238 #ifdef DLT_NETANALYZER 239 { netanalyzer_if_print, DLT_NETANALYZER }, 240 #endif 241 #ifdef DLT_NETANALYZER_TRANSPARENT 242 { netanalyzer_transparent_if_print, DLT_NETANALYZER_TRANSPARENT }, 243 #endif 244 #if defined(DLT_NFLOG) && defined(HAVE_PCAP_NFLOG_H) 245 { nflog_if_print, DLT_NFLOG}, 246 #endif 247 #ifdef DLT_CIP 248 { cip_if_print, DLT_CIP }, 249 #endif 250 #ifdef DLT_ATM_CLIP 251 { cip_if_print, DLT_ATM_CLIP }, 252 #endif 253 #ifdef DLT_IP_OVER_FC 254 { ipfc_if_print, DLT_IP_OVER_FC }, 255 #endif 256 { null_if_print, DLT_NULL }, 257 #ifdef DLT_LOOP 258 { null_if_print, DLT_LOOP }, 259 #endif 260 #ifdef DLT_APPLE_IP_OVER_IEEE1394 261 { ap1394_if_print, DLT_APPLE_IP_OVER_IEEE1394 }, 262 #endif 263 #if defined(DLT_BLUETOOTH_HCI_H4_WITH_PHDR) && defined(HAVE_PCAP_BLUETOOTH_H) 264 { bt_if_print, DLT_BLUETOOTH_HCI_H4_WITH_PHDR}, 265 #endif 266 #ifdef DLT_LANE8023 267 { lane_if_print, DLT_LANE8023 }, 268 #endif 269 { arcnet_if_print, DLT_ARCNET }, 270 #ifdef DLT_ARCNET_LINUX 271 { arcnet_linux_if_print, DLT_ARCNET_LINUX }, 272 #endif 273 { raw_if_print, DLT_RAW }, 274 #ifdef DLT_IPV4 275 { raw_if_print, DLT_IPV4 }, 276 #endif 277 #ifdef DLT_IPV6 278 { raw_if_print, DLT_IPV6 }, 279 #endif 280 #ifdef HAVE_PCAP_USB_H 281 #ifdef DLT_USB_LINUX 282 { usb_linux_48_byte_print, DLT_USB_LINUX}, 283 #endif /* DLT_USB_LINUX */ 284 #ifdef DLT_USB_LINUX_MMAPPED 285 { usb_linux_64_byte_print, DLT_USB_LINUX_MMAPPED}, 286 #endif /* DLT_USB_LINUX_MMAPPED */ 287 #endif /* HAVE_PCAP_USB_H */ 288 #ifdef DLT_SYMANTEC_FIREWALL 289 { symantec_if_print, DLT_SYMANTEC_FIREWALL }, 290 #endif 291 #ifdef DLT_C_HDLC 292 { chdlc_if_print, DLT_C_HDLC }, 293 #endif 294 #ifdef DLT_HDLC 295 { chdlc_if_print, DLT_HDLC }, 296 #endif 297 #ifdef DLT_PPP_ETHER 298 { pppoe_if_print, DLT_PPP_ETHER }, 299 #endif 300 #if defined(DLT_PFLOG) && defined(HAVE_NET_PFVAR_H) 301 { pflog_if_print, DLT_PFLOG }, 302 #endif 303 { token_if_print, DLT_IEEE802 }, 304 { fddi_if_print, DLT_FDDI }, 305 #ifdef DLT_LINUX_SLL 306 { sll_if_print, DLT_LINUX_SLL }, 307 #endif 308 #ifdef DLT_FR 309 { fr_if_print, DLT_FR }, 310 #endif 311 #ifdef DLT_FRELAY 312 { fr_if_print, DLT_FRELAY }, 313 #endif 314 #ifdef DLT_MFR 315 { mfr_if_print, DLT_MFR }, 316 #endif 317 { atm_if_print, DLT_ATM_RFC1483 }, 318 #ifdef DLT_SUNATM 319 { sunatm_if_print, DLT_SUNATM }, 320 #endif 321 #ifdef DLT_ENC 322 { enc_if_print, DLT_ENC }, 323 #endif 324 { sl_if_print, DLT_SLIP }, 325 #ifdef DLT_SLIP_BSDOS 326 { sl_bsdos_if_print, DLT_SLIP_BSDOS }, 327 #endif 328 #ifdef DLT_LTALK 329 { ltalk_if_print, DLT_LTALK }, 330 #endif 331 #ifdef DLT_JUNIPER_ATM1 332 { juniper_atm1_print, DLT_JUNIPER_ATM1 }, 333 #endif 334 #ifdef DLT_JUNIPER_ATM2 335 { juniper_atm2_print, DLT_JUNIPER_ATM2 }, 336 #endif 337 #ifdef DLT_JUNIPER_MFR 338 { juniper_mfr_print, DLT_JUNIPER_MFR }, 339 #endif 340 #ifdef DLT_JUNIPER_MLFR 341 { juniper_mlfr_print, DLT_JUNIPER_MLFR }, 342 #endif 343 #ifdef DLT_JUNIPER_MLPPP 344 { juniper_mlppp_print, DLT_JUNIPER_MLPPP }, 345 #endif 346 #ifdef DLT_JUNIPER_PPPOE 347 { juniper_pppoe_print, DLT_JUNIPER_PPPOE }, 348 #endif 349 #ifdef DLT_JUNIPER_PPPOE_ATM 350 { juniper_pppoe_atm_print, DLT_JUNIPER_PPPOE_ATM }, 351 #endif 352 #ifdef DLT_JUNIPER_GGSN 353 { juniper_ggsn_print, DLT_JUNIPER_GGSN }, 354 #endif 355 #ifdef DLT_JUNIPER_ES 356 { juniper_es_print, DLT_JUNIPER_ES }, 357 #endif 358 #ifdef DLT_JUNIPER_MONITOR 359 { juniper_monitor_print, DLT_JUNIPER_MONITOR }, 360 #endif 361 #ifdef DLT_JUNIPER_SERVICES 362 { juniper_services_print, DLT_JUNIPER_SERVICES }, 363 #endif 364 #ifdef DLT_JUNIPER_ETHER 365 { juniper_ether_print, DLT_JUNIPER_ETHER }, 366 #endif 367 #ifdef DLT_JUNIPER_PPP 368 { juniper_ppp_print, DLT_JUNIPER_PPP }, 369 #endif 370 #ifdef DLT_JUNIPER_FRELAY 371 { juniper_frelay_print, DLT_JUNIPER_FRELAY }, 372 #endif 373 #ifdef DLT_JUNIPER_CHDLC 374 { juniper_chdlc_print, DLT_JUNIPER_CHDLC }, 375 #endif 376 #ifdef DLT_PKTAP 377 { pktap_if_print, DLT_PKTAP }, 378 #endif 379 #ifdef DLT_IEEE802_11_RADIO 380 { ieee802_11_radio_if_print, DLT_IEEE802_11_RADIO }, 381 #endif 382 #ifdef DLT_IEEE802_11 383 { ieee802_11_if_print, DLT_IEEE802_11}, 384 #endif 385 #ifdef DLT_IEEE802_11_RADIO_AVS 386 { ieee802_11_radio_avs_if_print, DLT_IEEE802_11_RADIO_AVS }, 387 #endif 388 #ifdef DLT_PRISM_HEADER 389 { prism_if_print, DLT_PRISM_HEADER }, 390 #endif 391 { ppp_if_print, DLT_PPP }, 392 #ifdef DLT_PPP_WITHDIRECTION 393 { ppp_if_print, DLT_PPP_WITHDIRECTION }, 394 #endif 395 #ifdef DLT_PPP_BSDOS 396 { ppp_bsdos_if_print, DLT_PPP_BSDOS }, 397 #endif 398 #ifdef DLT_PPP_SERIAL 399 { ppp_hdlc_if_print, DLT_PPP_SERIAL }, 400 #endif 401 { NULL, 0 }, 402 }; 403 404 static const struct tok status_flags[] = { 405 #ifdef PCAP_IF_UP 406 { PCAP_IF_UP, "Up" }, 407 #endif 408 #ifdef PCAP_IF_RUNNING 409 { PCAP_IF_RUNNING, "Running" }, 410 #endif 411 { PCAP_IF_LOOPBACK, "Loopback" }, 412 { 0, NULL } 413 }; 414 415 if_printer 416 lookup_printer(int type) 417 { 418 const struct printer *p; 419 420 for (p = printers; p->f; ++p) 421 if (type == p->type) 422 return p->f; 423 424 return NULL; 425 /* NOTREACHED */ 426 } 427 428 if_ndo_printer 429 lookup_ndo_printer(int type) 430 { 431 const struct ndo_printer *p; 432 433 for (p = ndo_printers; p->f; ++p) 434 if (type == p->type) 435 return p->f; 436 437 #if defined(DLT_USER2) && defined(DLT_PKTAP) 438 /* 439 * Apple incorrectly chose to use DLT_USER2 for their PKTAP 440 * header. 441 * 442 * We map DLT_PKTAP, whether it's DLT_USER2 as it is on Darwin- 443 * based OSes or the same value as LINKTYPE_PKTAP as it is on 444 * other OSes, to LINKTYPE_PKTAP, so files written with 445 * this version of libpcap for a DLT_PKTAP capture have a link- 446 * layer header type of LINKTYPE_PKTAP. 447 * 448 * However, files written on OS X Mavericks for a DLT_PKTAP 449 * capture have a link-layer header type of LINKTYPE_USER2. 450 * If we don't have a printer for DLT_USER2, and type is 451 * DLT_USER2, we look up the printer for DLT_PKTAP and use 452 * that. 453 */ 454 if (type == DLT_USER2) { 455 for (p = ndo_printers; p->f; ++p) 456 if (DLT_PKTAP == p->type) 457 return p->f; 458 } 459 #endif 460 461 return NULL; 462 /* NOTREACHED */ 463 } 464 465 static pcap_t *pd; 466 467 static int supports_monitor_mode; 468 469 extern int optind; 470 extern int opterr; 471 extern char *optarg; 472 473 struct print_info { 474 netdissect_options *ndo; 475 union { 476 if_printer printer; 477 if_ndo_printer ndo_printer; 478 } p; 479 int ndo_type; 480 }; 481 482 struct dump_info { 483 char *WFileName; 484 char *CurrentFileName; 485 pcap_t *pd; 486 pcap_dumper_t *p; 487 #ifdef HAVE_CAPSPER 488 int dirfd; 489 #endif 490 }; 491 492 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE 493 static void 494 show_tstamp_types_and_exit(const char *device, pcap_t *pd) 495 { 496 int n_tstamp_types; 497 int *tstamp_types = 0; 498 const char *tstamp_type_name; 499 int i; 500 501 n_tstamp_types = pcap_list_tstamp_types(pd, &tstamp_types); 502 if (n_tstamp_types < 0) 503 error("%s", pcap_geterr(pd)); 504 505 if (n_tstamp_types == 0) { 506 fprintf(stderr, "Time stamp type cannot be set for %s\n", 507 device); 508 exit(0); 509 } 510 fprintf(stderr, "Time stamp types for %s (use option -j to set):\n", 511 device); 512 for (i = 0; i < n_tstamp_types; i++) { 513 tstamp_type_name = pcap_tstamp_type_val_to_name(tstamp_types[i]); 514 if (tstamp_type_name != NULL) { 515 (void) fprintf(stderr, " %s (%s)\n", tstamp_type_name, 516 pcap_tstamp_type_val_to_description(tstamp_types[i])); 517 } else { 518 (void) fprintf(stderr, " %d\n", tstamp_types[i]); 519 } 520 } 521 pcap_free_tstamp_types(tstamp_types); 522 exit(0); 523 } 524 #endif 525 526 static void 527 show_dlts_and_exit(const char *device, pcap_t *pd) 528 { 529 int n_dlts; 530 int *dlts = 0; 531 const char *dlt_name; 532 533 n_dlts = pcap_list_datalinks(pd, &dlts); 534 if (n_dlts < 0) 535 error("%s", pcap_geterr(pd)); 536 else if (n_dlts == 0 || !dlts) 537 error("No data link types."); 538 539 /* 540 * If the interface is known to support monitor mode, indicate 541 * whether these are the data link types available when not in 542 * monitor mode, if -I wasn't specified, or when in monitor mode, 543 * when -I was specified (the link-layer types available in 544 * monitor mode might be different from the ones available when 545 * not in monitor mode). 546 */ 547 if (supports_monitor_mode) 548 (void) fprintf(stderr, "Data link types for %s %s (use option -y to set):\n", 549 device, 550 Iflag ? "when in monitor mode" : "when not in monitor mode"); 551 else 552 (void) fprintf(stderr, "Data link types for %s (use option -y to set):\n", 553 device); 554 555 while (--n_dlts >= 0) { 556 dlt_name = pcap_datalink_val_to_name(dlts[n_dlts]); 557 if (dlt_name != NULL) { 558 (void) fprintf(stderr, " %s (%s)", dlt_name, 559 pcap_datalink_val_to_description(dlts[n_dlts])); 560 561 /* 562 * OK, does tcpdump handle that type? 563 */ 564 if (lookup_printer(dlts[n_dlts]) == NULL 565 && lookup_ndo_printer(dlts[n_dlts]) == NULL) 566 (void) fprintf(stderr, " (printing not supported)"); 567 fprintf(stderr, "\n"); 568 } else { 569 (void) fprintf(stderr, " DLT %d (printing not supported)\n", 570 dlts[n_dlts]); 571 } 572 } 573 #ifdef HAVE_PCAP_FREE_DATALINKS 574 pcap_free_datalinks(dlts); 575 #endif 576 exit(0); 577 } 578 579 #ifdef HAVE_PCAP_FINDALLDEVS 580 static void 581 show_devices_and_exit (void) 582 { 583 pcap_if_t *devpointer; 584 char ebuf[PCAP_ERRBUF_SIZE]; 585 int i; 586 587 if (pcap_findalldevs(&devpointer, ebuf) < 0) 588 error("%s", ebuf); 589 else { 590 for (i = 0; devpointer != NULL; i++) { 591 printf("%d.%s", i+1, devpointer->name); 592 if (devpointer->description != NULL) 593 printf(" (%s)", devpointer->description); 594 if (devpointer->flags != 0) 595 printf(" [%s]", bittok2str(status_flags, "none", devpointer->flags)); 596 printf("\n"); 597 devpointer = devpointer->next; 598 } 599 } 600 exit(0); 601 } 602 #endif /* HAVE_PCAP_FINDALLDEVS */ 603 604 /* 605 * Short options. 606 * 607 * Note that there we use all letters for short options except for g, k, 608 * o, and P, and those are used by other versions of tcpdump, and we should 609 * only use them for the same purposes that the other versions of tcpdump 610 * use them: 611 * 612 * OS X tcpdump uses -g to force non--v output for IP to be on one 613 * line, making it more "g"repable; 614 * 615 * OS X tcpdump uses -k tospecify that packet comments in pcap-ng files 616 * should be printed; 617 * 618 * OpenBSD tcpdump uses -o to indicate that OS fingerprinting should be done 619 * for hosts sending TCP SYN packets; 620 * 621 * OS X tcpdump uses -P to indicate that -w should write pcap-ng rather 622 * than pcap files. 623 * 624 * OS X tcpdump also uses -Q to specify expressions that match packet 625 * metadata, including but not limited to the packet direction. 626 * The expression syntax is different from a simple "in|out|inout", 627 * and those expressions aren't accepted by OS X tcpdump, but the 628 * equivalents would be "in" = "dir=in", "out" = "dir=out", and 629 * "inout" = "dir=in or dir=out", and the parser could conceivably 630 * special-case "in", "out", and "inout" as expressions for backwards 631 * compatibility, so all is not (yet) lost. 632 */ 633 634 /* 635 * Set up flags that might or might not be supported depending on the 636 * version of libpcap we're using. 637 */ 638 #if defined(HAVE_PCAP_CREATE) || defined(WIN32) 639 #define B_FLAG "B:" 640 #define B_FLAG_USAGE " [ -B size ]" 641 #else /* defined(HAVE_PCAP_CREATE) || defined(WIN32) */ 642 #define B_FLAG 643 #define B_FLAG_USAGE 644 #endif /* defined(HAVE_PCAP_CREATE) || defined(WIN32) */ 645 646 #ifdef HAVE_PCAP_CREATE 647 #define I_FLAG "I" 648 #else /* HAVE_PCAP_CREATE */ 649 #define I_FLAG 650 #endif /* HAVE_PCAP_CREATE */ 651 652 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE 653 #define j_FLAG "j:" 654 #define j_FLAG_USAGE " [ -j tstamptype ]" 655 #define J_FLAG "J" 656 #else /* PCAP_ERROR_TSTAMP_TYPE_NOTSUP */ 657 #define j_FLAG 658 #define j_FLAG_USAGE 659 #define J_FLAG 660 #endif /* PCAP_ERROR_TSTAMP_TYPE_NOTSUP */ 661 662 #ifdef HAVE_PCAP_FINDALLDEVS 663 #define D_FLAG "D" 664 #else 665 #define D_FLAG 666 #endif 667 668 #ifdef HAVE_PCAP_DUMP_FLUSH 669 #define U_FLAG "U" 670 #else 671 #define U_FLAG 672 #endif 673 674 #ifdef HAVE_PCAP_SETDIRECTION 675 #define Q_FLAG "Q:" 676 #else 677 #define Q_FLAG 678 #endif 679 680 #define SHORTOPTS "aAb" B_FLAG "c:C:d" D_FLAG "eE:fF:G:hHi:" I_FLAG j_FLAG J_FLAG "KlLm:M:nNOpq" Q_FLAG "r:Rs:StT:u" U_FLAG "vV:w:W:xXy:Yz:Z:#" 681 682 /* 683 * Long options. 684 * 685 * We do not currently have long options corresponding to all short 686 * options; we should probably pick appropriate option names for them. 687 * 688 * However, the short options where the number of times the option is 689 * specified matters, such as -v and -d and -t, should probably not 690 * just map to a long option, as saying 691 * 692 * tcpdump --verbose --verbose 693 * 694 * doesn't make sense; it should be --verbosity={N} or something such 695 * as that. 696 * 697 * For long options with no corresponding short options, we define values 698 * outside the range of ASCII graphic characters, make that the last 699 * component of the entry for the long option, and have a case for that 700 * option in the switch statement. 701 */ 702 #define OPTION_VERSION 128 703 #define OPTION_TSTAMP_PRECISION 129 704 #define OPTION_IMMEDIATE_MODE 130 705 706 static const struct option longopts[] = { 707 #if defined(HAVE_PCAP_CREATE) || defined(WIN32) 708 { "buffer-size", required_argument, NULL, 'B' }, 709 #endif 710 { "list-interfaces", no_argument, NULL, 'D' }, 711 { "help", no_argument, NULL, 'h' }, 712 { "interface", required_argument, NULL, 'i' }, 713 #ifdef HAVE_PCAP_CREATE 714 { "monitor-mode", no_argument, NULL, 'I' }, 715 #endif 716 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE 717 { "time-stamp-type", required_argument, NULL, 'j' }, 718 { "list-time-stamp-types", no_argument, NULL, 'J' }, 719 #endif 720 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION 721 { "time-stamp-precision", required_argument, NULL, OPTION_TSTAMP_PRECISION}, 722 #endif 723 { "dont-verify-checksums", no_argument, NULL, 'K' }, 724 { "list-data-link-types", no_argument, NULL, 'L' }, 725 { "no-optimize", no_argument, NULL, 'O' }, 726 { "no-promiscuous-mode", no_argument, NULL, 'p' }, 727 #ifdef HAVE_PCAP_SETDIRECTION 728 { "direction", required_argument, NULL, 'Q' }, 729 #endif 730 { "snapshot-length", required_argument, NULL, 's' }, 731 { "absolute-tcp-sequence-numbers", no_argument, NULL, 'S' }, 732 #ifdef HAVE_PCAP_DUMP_FLUSH 733 { "packet-buffered", no_argument, NULL, 'U' }, 734 #endif 735 { "linktype", required_argument, NULL, 'y' }, 736 #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE 737 { "immediate-mode", no_argument, NULL, OPTION_IMMEDIATE_MODE }, 738 #endif 739 #if defined(HAVE_PCAP_DEBUG) || defined(HAVE_YYDEBUG) 740 { "debug-filter-parser", no_argument, NULL, 'Y' }, 741 #endif 742 { "relinquish-privileges", required_argument, NULL, 'Z' }, 743 { "number", no_argument, NULL, '#' }, 744 { "version", no_argument, NULL, OPTION_VERSION }, 745 { NULL, 0, NULL, 0 } 746 }; 747 748 #ifndef WIN32 749 /* Drop root privileges and chroot if necessary */ 750 static void 751 droproot(const char *username, const char *chroot_dir) 752 { 753 struct passwd *pw = NULL; 754 755 if (chroot_dir && !username) { 756 fprintf(stderr, "tcpdump: Chroot without dropping root is insecure\n"); 757 exit(1); 758 } 759 760 pw = getpwnam(username); 761 if (pw) { 762 if (chroot_dir) { 763 if (chroot(chroot_dir) != 0 || chdir ("/") != 0) { 764 fprintf(stderr, "tcpdump: Couldn't chroot/chdir to '%.64s': %s\n", 765 chroot_dir, pcap_strerror(errno)); 766 exit(1); 767 } 768 } 769 #ifdef HAVE_LIBCAP_NG 770 int ret = capng_change_id(pw->pw_uid, pw->pw_gid, CAPNG_NO_FLAG); 771 if (ret < 0) { 772 fprintf(stderr, "error : ret %d\n", ret); 773 } 774 else { 775 fprintf(stderr, "dropped privs to %s\n", username); 776 } 777 #else 778 if (initgroups(pw->pw_name, pw->pw_gid) != 0 || 779 setgid(pw->pw_gid) != 0 || setuid(pw->pw_uid) != 0) { 780 fprintf(stderr, "tcpdump: Couldn't change to '%.32s' uid=%lu gid=%lu: %s\n", 781 username, 782 (unsigned long)pw->pw_uid, 783 (unsigned long)pw->pw_gid, 784 pcap_strerror(errno)); 785 exit(1); 786 } 787 else { 788 fprintf(stderr, "dropped privs to %s\n", username); 789 } 790 #endif /* HAVE_LIBCAP_NG */ 791 } 792 else { 793 fprintf(stderr, "tcpdump: Couldn't find user '%.32s'\n", 794 username); 795 exit(1); 796 } 797 #ifdef HAVE_LIBCAP_NG 798 /* We don't need CAP_SETUID and CAP_SETGID any more. */ 799 capng_updatev( 800 CAPNG_DROP, 801 CAPNG_EFFECTIVE | CAPNG_PERMITTED, 802 CAP_SETUID, 803 CAP_SETGID, 804 -1); 805 capng_apply(CAPNG_SELECT_BOTH); 806 #endif /* HAVE_LIBCAP_NG */ 807 808 } 809 #endif /* WIN32 */ 810 811 static int 812 getWflagChars(int x) 813 { 814 int c = 0; 815 816 x -= 1; 817 while (x > 0) { 818 c += 1; 819 x /= 10; 820 } 821 822 return c; 823 } 824 825 826 static void 827 MakeFilename(char *buffer, char *orig_name, int cnt, int max_chars) 828 { 829 char *filename = malloc(PATH_MAX + 1); 830 if (filename == NULL) 831 error("Makefilename: malloc"); 832 833 /* Process with strftime if Gflag is set. */ 834 if (Gflag != 0) { 835 struct tm *local_tm; 836 837 /* Convert Gflag_time to a usable format */ 838 if ((local_tm = localtime(&Gflag_time)) == NULL) { 839 error("MakeTimedFilename: localtime"); 840 } 841 842 /* There's no good way to detect an error in strftime since a return 843 * value of 0 isn't necessarily failure. 844 */ 845 strftime(filename, PATH_MAX, orig_name, local_tm); 846 } else { 847 strncpy(filename, orig_name, PATH_MAX); 848 } 849 850 if (cnt == 0 && max_chars == 0) 851 strncpy(buffer, filename, PATH_MAX + 1); 852 else 853 if (snprintf(buffer, PATH_MAX + 1, "%s%0*d", filename, max_chars, cnt) > PATH_MAX) 854 /* Report an error if the filename is too large */ 855 error("too many output files or filename is too long (> %d)", PATH_MAX); 856 free(filename); 857 } 858 859 static int tcpdump_printf(netdissect_options *ndo _U_, 860 const char *fmt, ...) 861 { 862 863 va_list args; 864 int ret; 865 866 va_start(args, fmt); 867 ret=vfprintf(stdout, fmt, args); 868 va_end(args); 869 870 return ret; 871 } 872 873 static struct print_info 874 get_print_info(int type) 875 { 876 struct print_info printinfo; 877 878 printinfo.ndo_type = 1; 879 printinfo.ndo = gndo; 880 printinfo.p.ndo_printer = lookup_ndo_printer(type); 881 if (printinfo.p.ndo_printer == NULL) { 882 printinfo.p.printer = lookup_printer(type); 883 printinfo.ndo_type = 0; 884 if (printinfo.p.printer == NULL) { 885 gndo->ndo_dltname = pcap_datalink_val_to_name(type); 886 if (gndo->ndo_dltname != NULL) 887 error("packet printing is not supported for link type %s: use -w", 888 gndo->ndo_dltname); 889 else 890 error("packet printing is not supported for link type %d: use -w", type); 891 } 892 } 893 return (printinfo); 894 } 895 896 static char * 897 get_next_file(FILE *VFile, char *ptr) 898 { 899 char *ret; 900 901 ret = fgets(ptr, PATH_MAX, VFile); 902 if (!ret) 903 return NULL; 904 905 if (ptr[strlen(ptr) - 1] == '\n') 906 ptr[strlen(ptr) - 1] = '\0'; 907 908 return ret; 909 } 910 911 #ifdef HAVE_CAPSPER 912 static cap_channel_t * 913 capdns_setup(void) 914 { 915 cap_channel_t *capcas, *capdnsloc; 916 const char *types[1]; 917 int families[2]; 918 919 capcas = cap_init(); 920 if (capcas == NULL) 921 error("unable to create casper process"); 922 capdnsloc = cap_service_open(capcas, "system.dns"); 923 /* Casper capability no longer needed. */ 924 cap_close(capcas); 925 if (capdnsloc == NULL) 926 error("unable to open system.dns service"); 927 /* Limit system.dns to reverse DNS lookups. */ 928 types[0] = "ADDR"; 929 if (cap_dns_type_limit(capdnsloc, types, 1) < 0) 930 error("unable to limit access to system.dns service"); 931 families[0] = AF_INET; 932 families[1] = AF_INET6; 933 if (cap_dns_family_limit(capdnsloc, families, 2) < 0) 934 error("unable to limit access to system.dns service"); 935 936 return (capdnsloc); 937 } 938 #endif /* HAVE_CAPSPER */ 939 940 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION 941 static int 942 tstamp_precision_from_string(const char *precision) 943 { 944 if (strncmp(precision, "nano", strlen("nano")) == 0) 945 return PCAP_TSTAMP_PRECISION_NANO; 946 947 if (strncmp(precision, "micro", strlen("micro")) == 0) 948 return PCAP_TSTAMP_PRECISION_MICRO; 949 950 return -EINVAL; 951 } 952 953 static const char * 954 tstamp_precision_to_string(int precision) 955 { 956 switch (precision) { 957 958 case PCAP_TSTAMP_PRECISION_MICRO: 959 return "micro"; 960 961 case PCAP_TSTAMP_PRECISION_NANO: 962 return "nano"; 963 964 default: 965 return "unknown"; 966 } 967 } 968 #endif 969 970 #ifdef HAVE_CAPSPER 971 /* 972 * Ensure that, on a dump file's descriptor, we have all the rights 973 * necessary to make the standard I/O library work with an fdopen()ed 974 * FILE * from that descriptor. 975 * 976 * A long time ago, in a galaxy far far away, AT&T decided that, instead 977 * of providing separate APIs for getting and setting the FD_ flags on a 978 * descriptor, getting and setting the O_ flags on a descriptor, and 979 * locking files, they'd throw them all into a kitchen-sink fcntl() call 980 * along the lines of ioctl(), the fact that ioctl() operations are 981 * largely specific to particular character devices but fcntl() operations 982 * are either generic to all descriptors or generic to all descriptors for 983 * regular files nonwithstanding. 984 * 985 * The Capsicum people decided that fine-grained control of descriptor 986 * operations was required, so that you need to grant permission for 987 * reading, writing, seeking, and fcntl-ing. The latter, courtesy of 988 * AT&T's decision, means that "fcntl-ing" isn't a thing, but a motley 989 * collection of things, so there are *individual* fcntls for which 990 * permission needs to be granted. 991 * 992 * The FreeBSD standard I/O people implemented some optimizations that 993 * requires that the standard I/O routines be able to determine whether 994 * the descriptor for the FILE * is open append-only or not; as that 995 * descriptor could have come from an open() rather than an fopen(), 996 * that requires that it be able to do an F_GETFL fcntl() to read 997 * the O_ flags. 998 * 999 * Tcpdump uses ftell() to determine how much data has been written 1000 * to a file in order to, when used with -C, determine when it's time 1001 * to rotate capture files. ftell() therefore needs to do an lseek() 1002 * to find out the file offset and must, thanks to the aforementioned 1003 * optimization, also know whether the descriptor is open append-only 1004 * or not. 1005 * 1006 * The net result of all the above is that we need to grant CAP_SEEK, 1007 * CAP_WRITE, and CAP_FCNTL with the CAP_FCNTL_GETFL subcapability. 1008 * 1009 * Perhaps this is the universe's way of saying that either 1010 * 1011 * 1) there needs to be an fopenat() call and a pcap_dump_openat() call 1012 * using it, so that Capsicum-capable tcpdump wouldn't need to do 1013 * an fdopen() 1014 * 1015 * or 1016 * 1017 * 2) there needs to be a cap_fdopen() call in the FreeBSD standard 1018 * I/O library that knows what rights are needed by the standard 1019 * I/O library, based on the open mode, and assigns them, perhaps 1020 * with an additional argument indicating, for example, whether 1021 * seeking should be allowed, so that tcpdump doesn't need to know 1022 * what the standard I/O library happens to require this week. 1023 */ 1024 static void 1025 set_dumper_capsicum_rights(pcap_dumper_t *p) 1026 { 1027 int fd = fileno(pcap_dump_file(p)); 1028 cap_rights_t rights; 1029 1030 cap_rights_init(&rights, CAP_SEEK, CAP_WRITE, CAP_FCNTL); 1031 if (cap_rights_limit(fd, &rights) < 0 && errno != ENOSYS) { 1032 error("unable to limit dump descriptor"); 1033 } 1034 if (cap_fcntls_limit(fd, CAP_FCNTL_GETFL) < 0 && errno != ENOSYS) { 1035 error("unable to limit dump descriptor fcntls"); 1036 } 1037 } 1038 #endif 1039 1040 int 1041 main(int argc, char **argv) 1042 { 1043 register int cnt, op, i; 1044 bpf_u_int32 localnet =0 , netmask = 0; 1045 register char *cp, *infile, *cmdbuf, *device, *RFileName, *VFileName, *WFileName; 1046 pcap_handler callback; 1047 int type; 1048 int dlt; 1049 int new_dlt; 1050 const char *dlt_name; 1051 struct bpf_program fcode; 1052 #ifndef WIN32 1053 RETSIGTYPE (*oldhandler)(int); 1054 #endif 1055 struct print_info printinfo; 1056 struct dump_info dumpinfo; 1057 u_char *pcap_userdata; 1058 char ebuf[PCAP_ERRBUF_SIZE]; 1059 char VFileLine[PATH_MAX + 1]; 1060 char *username = NULL; 1061 char *chroot_dir = NULL; 1062 char *ret = NULL; 1063 char *end; 1064 #ifdef HAVE_PCAP_FINDALLDEVS 1065 pcap_if_t *devpointer; 1066 int devnum; 1067 #endif 1068 int status; 1069 FILE *VFile; 1070 #ifdef HAVE_CAPSPER 1071 cap_rights_t rights; 1072 #endif /* HAVE_CAPSPER */ 1073 int cansandbox; 1074 1075 #ifdef WIN32 1076 if(wsockinit() != 0) return 1; 1077 #endif /* WIN32 */ 1078 1079 jflag=-1; /* not set */ 1080 gndo->ndo_Oflag=1; 1081 gndo->ndo_Rflag=1; 1082 gndo->ndo_dlt=-1; 1083 gndo->ndo_default_print=ndo_default_print; 1084 gndo->ndo_printf=tcpdump_printf; 1085 gndo->ndo_error=ndo_error; 1086 gndo->ndo_warning=ndo_warning; 1087 gndo->ndo_snaplen = DEFAULT_SNAPLEN; 1088 gndo->ndo_immediate = 0; 1089 1090 cnt = -1; 1091 device = NULL; 1092 infile = NULL; 1093 RFileName = NULL; 1094 VFileName = NULL; 1095 VFile = NULL; 1096 WFileName = NULL; 1097 dlt = -1; 1098 if ((cp = strrchr(argv[0], '/')) != NULL) 1099 program_name = cp + 1; 1100 else 1101 program_name = argv[0]; 1102 1103 /* 1104 * On platforms where the CPU doesn't support unaligned loads, 1105 * force unaligned accesses to abort with SIGBUS, rather than 1106 * being fixed up (slowly) by the OS kernel; on those platforms, 1107 * misaligned accesses are bugs, and we want tcpdump to crash so 1108 * that the bugs are reported. 1109 */ 1110 if (abort_on_misalignment(ebuf, sizeof(ebuf)) < 0) 1111 error("%s", ebuf); 1112 1113 #ifdef USE_LIBSMI 1114 smiInit("tcpdump"); 1115 #endif 1116 1117 while ( 1118 (op = getopt_long(argc, argv, SHORTOPTS, longopts, NULL)) != -1) 1119 switch (op) { 1120 1121 case 'a': 1122 /* compatibility for old -a */ 1123 break; 1124 1125 case 'A': 1126 ++Aflag; 1127 break; 1128 1129 case 'b': 1130 ++bflag; 1131 break; 1132 1133 #if defined(HAVE_PCAP_CREATE) || defined(WIN32) 1134 case 'B': 1135 Bflag = atoi(optarg)*1024; 1136 if (Bflag <= 0) 1137 error("invalid packet buffer size %s", optarg); 1138 break; 1139 #endif /* defined(HAVE_PCAP_CREATE) || defined(WIN32) */ 1140 1141 case 'c': 1142 cnt = atoi(optarg); 1143 if (cnt <= 0) 1144 error("invalid packet count %s", optarg); 1145 break; 1146 1147 case 'C': 1148 Cflag = atoi(optarg) * 1000000; 1149 if (Cflag < 0) 1150 error("invalid file size %s", optarg); 1151 break; 1152 1153 case 'd': 1154 ++dflag; 1155 break; 1156 1157 case 'D': 1158 Dflag++; 1159 break; 1160 1161 case 'L': 1162 Lflag++; 1163 break; 1164 1165 case 'e': 1166 ++eflag; 1167 break; 1168 1169 case 'E': 1170 #ifndef HAVE_LIBCRYPTO 1171 warning("crypto code not compiled in"); 1172 #endif 1173 gndo->ndo_espsecret = optarg; 1174 break; 1175 1176 case 'f': 1177 ++fflag; 1178 break; 1179 1180 case 'F': 1181 infile = optarg; 1182 break; 1183 1184 case 'G': 1185 Gflag = atoi(optarg); 1186 if (Gflag < 0) 1187 error("invalid number of seconds %s", optarg); 1188 1189 /* We will create one file initially. */ 1190 Gflag_count = 0; 1191 1192 /* Grab the current time for rotation use. */ 1193 if ((Gflag_time = time(NULL)) == (time_t)-1) { 1194 error("main: can't get current time: %s", 1195 pcap_strerror(errno)); 1196 } 1197 break; 1198 1199 case 'h': 1200 print_usage(); 1201 exit(0); 1202 break; 1203 1204 case 'H': 1205 ++Hflag; 1206 break; 1207 1208 case 'i': 1209 if (optarg[0] == '0' && optarg[1] == 0) 1210 error("Invalid adapter index"); 1211 1212 #ifdef HAVE_PCAP_FINDALLDEVS 1213 /* 1214 * If the argument is a number, treat it as 1215 * an index into the list of adapters, as 1216 * printed by "tcpdump -D". 1217 * 1218 * This should be OK on UNIX systems, as interfaces 1219 * shouldn't have names that begin with digits. 1220 * It can be useful on Windows, where more than 1221 * one interface can have the same name. 1222 */ 1223 devnum = strtol(optarg, &end, 10); 1224 if (optarg != end && *end == '\0') { 1225 if (devnum < 0) 1226 error("Invalid adapter index"); 1227 1228 if (pcap_findalldevs(&devpointer, ebuf) < 0) 1229 error("%s", ebuf); 1230 else { 1231 /* 1232 * Look for the devnum-th entry 1233 * in the list of devices 1234 * (1-based). 1235 */ 1236 for (i = 0; 1237 i < devnum-1 && devpointer != NULL; 1238 i++, devpointer = devpointer->next) 1239 ; 1240 if (devpointer == NULL) 1241 error("Invalid adapter index"); 1242 } 1243 device = devpointer->name; 1244 break; 1245 } 1246 #endif /* HAVE_PCAP_FINDALLDEVS */ 1247 device = optarg; 1248 break; 1249 1250 #ifdef HAVE_PCAP_CREATE 1251 case 'I': 1252 ++Iflag; 1253 break; 1254 #endif /* HAVE_PCAP_CREATE */ 1255 1256 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE 1257 case 'j': 1258 jflag = pcap_tstamp_type_name_to_val(optarg); 1259 if (jflag < 0) 1260 error("invalid time stamp type %s", optarg); 1261 break; 1262 1263 case 'J': 1264 Jflag++; 1265 break; 1266 #endif 1267 1268 case 'l': 1269 #ifdef WIN32 1270 /* 1271 * _IOLBF is the same as _IOFBF in Microsoft's C 1272 * libraries; the only alternative they offer 1273 * is _IONBF. 1274 * 1275 * XXX - this should really be checking for MSVC++, 1276 * not WIN32, if, for example, MinGW has its own 1277 * C library that is more UNIX-compatible. 1278 */ 1279 setvbuf(stdout, NULL, _IONBF, 0); 1280 #else /* WIN32 */ 1281 #ifdef HAVE_SETLINEBUF 1282 setlinebuf(stdout); 1283 #else 1284 setvbuf(stdout, NULL, _IOLBF, 0); 1285 #endif 1286 #endif /* WIN32 */ 1287 break; 1288 1289 case 'K': 1290 ++Kflag; 1291 break; 1292 1293 case 'm': 1294 #ifdef USE_LIBSMI 1295 if (smiLoadModule(optarg) == 0) { 1296 error("could not load MIB module %s", optarg); 1297 } 1298 sflag = 1; 1299 #else 1300 (void)fprintf(stderr, "%s: ignoring option `-m %s' ", 1301 program_name, optarg); 1302 (void)fprintf(stderr, "(no libsmi support)\n"); 1303 #endif 1304 break; 1305 1306 case 'M': 1307 /* TCP-MD5 shared secret */ 1308 #ifndef HAVE_LIBCRYPTO 1309 warning("crypto code not compiled in"); 1310 #endif 1311 sigsecret = optarg; 1312 break; 1313 1314 case 'n': 1315 ++nflag; 1316 break; 1317 1318 case 'N': 1319 ++Nflag; 1320 break; 1321 1322 case 'O': 1323 Oflag = 0; 1324 break; 1325 1326 case 'p': 1327 ++pflag; 1328 break; 1329 1330 case 'q': 1331 ++qflag; 1332 ++suppress_default_print; 1333 break; 1334 1335 #ifdef HAVE_PCAP_SETDIRECTION 1336 case 'Q': 1337 if (strcasecmp(optarg, "in") == 0) 1338 Qflag = PCAP_D_IN; 1339 else if (strcasecmp(optarg, "out") == 0) 1340 Qflag = PCAP_D_OUT; 1341 else if (strcasecmp(optarg, "inout") == 0) 1342 Qflag = PCAP_D_INOUT; 1343 else 1344 error("unknown capture direction `%s'", optarg); 1345 break; 1346 #endif /* HAVE_PCAP_SETDIRECTION */ 1347 1348 case 'r': 1349 RFileName = optarg; 1350 break; 1351 1352 case 'R': 1353 Rflag = 0; 1354 break; 1355 1356 case 's': 1357 snaplen = strtol(optarg, &end, 0); 1358 if (optarg == end || *end != '\0' 1359 || snaplen < 0 || snaplen > MAXIMUM_SNAPLEN) 1360 error("invalid snaplen %s", optarg); 1361 else if (snaplen == 0) 1362 snaplen = MAXIMUM_SNAPLEN; 1363 break; 1364 1365 case 'S': 1366 ++Sflag; 1367 break; 1368 1369 case 't': 1370 ++tflag; 1371 break; 1372 1373 case 'T': 1374 if (strcasecmp(optarg, "vat") == 0) 1375 packettype = PT_VAT; 1376 else if (strcasecmp(optarg, "wb") == 0) 1377 packettype = PT_WB; 1378 else if (strcasecmp(optarg, "rpc") == 0) 1379 packettype = PT_RPC; 1380 else if (strcasecmp(optarg, "rtp") == 0) 1381 packettype = PT_RTP; 1382 else if (strcasecmp(optarg, "rtcp") == 0) 1383 packettype = PT_RTCP; 1384 else if (strcasecmp(optarg, "snmp") == 0) 1385 packettype = PT_SNMP; 1386 else if (strcasecmp(optarg, "cnfp") == 0) 1387 packettype = PT_CNFP; 1388 else if (strcasecmp(optarg, "tftp") == 0) 1389 packettype = PT_TFTP; 1390 else if (strcasecmp(optarg, "aodv") == 0) 1391 packettype = PT_AODV; 1392 else if (strcasecmp(optarg, "carp") == 0) 1393 packettype = PT_CARP; 1394 else if (strcasecmp(optarg, "radius") == 0) 1395 packettype = PT_RADIUS; 1396 else if (strcasecmp(optarg, "zmtp1") == 0) 1397 packettype = PT_ZMTP1; 1398 else if (strcasecmp(optarg, "vxlan") == 0) 1399 packettype = PT_VXLAN; 1400 else if (strcasecmp(optarg, "pgm") == 0) 1401 packettype = PT_PGM; 1402 else if (strcasecmp(optarg, "pgm_zmtp1") == 0) 1403 packettype = PT_PGM_ZMTP1; 1404 else if (strcasecmp(optarg, "lmp") == 0) 1405 packettype = PT_LMP; 1406 else 1407 error("unknown packet type `%s'", optarg); 1408 break; 1409 1410 case 'u': 1411 ++uflag; 1412 break; 1413 1414 #ifdef HAVE_PCAP_DUMP_FLUSH 1415 case 'U': 1416 ++Uflag; 1417 break; 1418 #endif 1419 1420 case 'v': 1421 ++vflag; 1422 break; 1423 1424 case 'V': 1425 VFileName = optarg; 1426 break; 1427 1428 case 'w': 1429 WFileName = optarg; 1430 break; 1431 1432 case 'W': 1433 Wflag = atoi(optarg); 1434 if (Wflag < 0) 1435 error("invalid number of output files %s", optarg); 1436 WflagChars = getWflagChars(Wflag); 1437 break; 1438 1439 case 'x': 1440 ++xflag; 1441 ++suppress_default_print; 1442 break; 1443 1444 case 'X': 1445 ++Xflag; 1446 ++suppress_default_print; 1447 break; 1448 1449 case 'y': 1450 gndo->ndo_dltname = optarg; 1451 gndo->ndo_dlt = 1452 pcap_datalink_name_to_val(gndo->ndo_dltname); 1453 if (gndo->ndo_dlt < 0) 1454 error("invalid data link type %s", gndo->ndo_dltname); 1455 break; 1456 1457 #if defined(HAVE_PCAP_DEBUG) || defined(HAVE_YYDEBUG) 1458 case 'Y': 1459 { 1460 /* Undocumented flag */ 1461 #ifdef HAVE_PCAP_DEBUG 1462 extern int pcap_debug; 1463 pcap_debug = 1; 1464 #else 1465 extern int yydebug; 1466 yydebug = 1; 1467 #endif 1468 } 1469 break; 1470 #endif 1471 case 'z': 1472 zflag = strdup(optarg); 1473 break; 1474 1475 case 'Z': 1476 username = strdup(optarg); 1477 break; 1478 1479 case '#': 1480 gndo->ndo_packet_number = 1; 1481 break; 1482 1483 case OPTION_VERSION: 1484 print_version(); 1485 exit(0); 1486 break; 1487 1488 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION 1489 case OPTION_TSTAMP_PRECISION: 1490 gndo->ndo_tstamp_precision = tstamp_precision_from_string(optarg); 1491 if (gndo->ndo_tstamp_precision < 0) 1492 error("unsupported time stamp precision"); 1493 break; 1494 #endif 1495 1496 #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE 1497 case OPTION_IMMEDIATE_MODE: 1498 gndo->ndo_immediate = 1; 1499 break; 1500 #endif 1501 1502 default: 1503 print_usage(); 1504 exit(1); 1505 /* NOTREACHED */ 1506 } 1507 1508 #ifdef HAVE_PCAP_FINDALLDEVS 1509 if (Dflag) 1510 show_devices_and_exit(); 1511 #endif 1512 1513 switch (tflag) { 1514 1515 case 0: /* Default */ 1516 case 4: /* Default + Date*/ 1517 thiszone = gmt2local(0); 1518 break; 1519 1520 case 1: /* No time stamp */ 1521 case 2: /* Unix timeval style */ 1522 case 3: /* Microseconds since previous packet */ 1523 case 5: /* Microseconds since first packet */ 1524 break; 1525 1526 default: /* Not supported */ 1527 error("only -t, -tt, -ttt, -tttt and -ttttt are supported"); 1528 break; 1529 } 1530 1531 if (fflag != 0 && (VFileName != NULL || RFileName != NULL)) 1532 error("-f can not be used with -V or -r"); 1533 1534 if (VFileName != NULL && RFileName != NULL) 1535 error("-V and -r are mutually exclusive."); 1536 1537 #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE 1538 /* 1539 * If we're printing dissected packets to the standard output 1540 * rather than saving raw packets to a file, and the standard 1541 * output is a terminal, use immediate mode, as the user's 1542 * probably expecting to see packets pop up immediately. 1543 */ 1544 if (WFileName == NULL && isatty(1)) 1545 gndo->ndo_immediate = 1; 1546 #endif 1547 1548 #ifdef WITH_CHROOT 1549 /* if run as root, prepare for chrooting */ 1550 if (getuid() == 0 || geteuid() == 0) { 1551 /* future extensibility for cmd-line arguments */ 1552 if (!chroot_dir) 1553 chroot_dir = WITH_CHROOT; 1554 } 1555 #endif 1556 1557 #ifdef WITH_USER 1558 /* if run as root, prepare for dropping root privileges */ 1559 if (getuid() == 0 || geteuid() == 0) { 1560 /* Run with '-Z root' to restore old behaviour */ 1561 if (!username) 1562 username = WITH_USER; 1563 } 1564 #endif 1565 1566 if (RFileName != NULL || VFileName != NULL) { 1567 /* 1568 * If RFileName is non-null, it's the pathname of a 1569 * savefile to read. If VFileName is non-null, it's 1570 * the pathname of a file containing a list of pathnames 1571 * (one per line) of savefiles to read. 1572 * 1573 * In either case, we're reading a savefile, not doing 1574 * a live capture. 1575 */ 1576 #ifndef WIN32 1577 /* 1578 * We don't need network access, so relinquish any set-UID 1579 * or set-GID privileges we have (if any). 1580 * 1581 * We do *not* want set-UID privileges when opening a 1582 * trace file, as that might let the user read other 1583 * people's trace files (especially if we're set-UID 1584 * root). 1585 */ 1586 if (setgid(getgid()) != 0 || setuid(getuid()) != 0 ) 1587 fprintf(stderr, "Warning: setgid/setuid failed !\n"); 1588 #endif /* WIN32 */ 1589 if (VFileName != NULL) { 1590 if (VFileName[0] == '-' && VFileName[1] == '\0') 1591 VFile = stdin; 1592 else 1593 VFile = fopen(VFileName, "r"); 1594 1595 if (VFile == NULL) 1596 error("Unable to open file: %s\n", strerror(errno)); 1597 1598 ret = get_next_file(VFile, VFileLine); 1599 if (!ret) 1600 error("Nothing in %s\n", VFileName); 1601 RFileName = VFileLine; 1602 } 1603 1604 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION 1605 pd = pcap_open_offline_with_tstamp_precision(RFileName, 1606 gndo->ndo_tstamp_precision, ebuf); 1607 #else 1608 pd = pcap_open_offline(RFileName, ebuf); 1609 #endif 1610 1611 if (pd == NULL) 1612 error("%s", ebuf); 1613 #ifdef HAVE_CAPSPER 1614 cap_rights_init(&rights, CAP_READ); 1615 if (cap_rights_limit(fileno(pcap_file(pd)), &rights) < 0 && 1616 errno != ENOSYS) { 1617 error("unable to limit pcap descriptor"); 1618 } 1619 #endif 1620 dlt = pcap_datalink(pd); 1621 dlt_name = pcap_datalink_val_to_name(dlt); 1622 if (dlt_name == NULL) { 1623 fprintf(stderr, "reading from file %s, link-type %u\n", 1624 RFileName, dlt); 1625 } else { 1626 fprintf(stderr, 1627 "reading from file %s, link-type %s (%s)\n", 1628 RFileName, dlt_name, 1629 pcap_datalink_val_to_description(dlt)); 1630 } 1631 } else { 1632 /* 1633 * We're doing a live capture. 1634 */ 1635 if (device == NULL) { 1636 device = pcap_lookupdev(ebuf); 1637 if (device == NULL) 1638 error("%s", ebuf); 1639 } 1640 #ifdef WIN32 1641 /* 1642 * Print a message to the standard error on Windows. 1643 * XXX - why do it here, with a different message? 1644 */ 1645 if(strlen(device) == 1) /* we assume that an ASCII string is always longer than 1 char */ 1646 { /* a Unicode string has a \0 as second byte (so strlen() is 1) */ 1647 fprintf(stderr, "%s: listening on %ws\n", program_name, device); 1648 } 1649 else 1650 { 1651 fprintf(stderr, "%s: listening on %s\n", program_name, device); 1652 } 1653 1654 fflush(stderr); 1655 #endif /* WIN32 */ 1656 #ifdef HAVE_PCAP_CREATE 1657 pd = pcap_create(device, ebuf); 1658 if (pd == NULL) 1659 error("%s", ebuf); 1660 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE 1661 if (Jflag) 1662 show_tstamp_types_and_exit(device, pd); 1663 #endif 1664 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION 1665 status = pcap_set_tstamp_precision(pd, gndo->ndo_tstamp_precision); 1666 if (status != 0) 1667 error("%s: Can't set %ssecond time stamp precision: %s", 1668 device, 1669 tstamp_precision_to_string(gndo->ndo_tstamp_precision), 1670 pcap_statustostr(status)); 1671 #endif 1672 1673 #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE 1674 if (gndo->ndo_immediate) { 1675 status = pcap_set_immediate_mode(pd, 1); 1676 if (status != 0) 1677 error("%s: Can't set immediate mode: %s", 1678 device, 1679 pcap_statustostr(status)); 1680 } 1681 #endif 1682 /* 1683 * Is this an interface that supports monitor mode? 1684 */ 1685 if (pcap_can_set_rfmon(pd) == 1) 1686 supports_monitor_mode = 1; 1687 else 1688 supports_monitor_mode = 0; 1689 status = pcap_set_snaplen(pd, snaplen); 1690 if (status != 0) 1691 error("%s: Can't set snapshot length: %s", 1692 device, pcap_statustostr(status)); 1693 status = pcap_set_promisc(pd, !pflag); 1694 if (status != 0) 1695 error("%s: Can't set promiscuous mode: %s", 1696 device, pcap_statustostr(status)); 1697 if (Iflag) { 1698 status = pcap_set_rfmon(pd, 1); 1699 if (status != 0) 1700 error("%s: Can't set monitor mode: %s", 1701 device, pcap_statustostr(status)); 1702 } 1703 status = pcap_set_timeout(pd, 1000); 1704 if (status != 0) 1705 error("%s: pcap_set_timeout failed: %s", 1706 device, pcap_statustostr(status)); 1707 if (Bflag != 0) { 1708 status = pcap_set_buffer_size(pd, Bflag); 1709 if (status != 0) 1710 error("%s: Can't set buffer size: %s", 1711 device, pcap_statustostr(status)); 1712 } 1713 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE 1714 if (jflag != -1) { 1715 status = pcap_set_tstamp_type(pd, jflag); 1716 if (status < 0) 1717 error("%s: Can't set time stamp type: %s", 1718 device, pcap_statustostr(status)); 1719 } 1720 #endif 1721 status = pcap_activate(pd); 1722 if (status < 0) { 1723 /* 1724 * pcap_activate() failed. 1725 */ 1726 cp = pcap_geterr(pd); 1727 if (status == PCAP_ERROR) 1728 error("%s", cp); 1729 else if ((status == PCAP_ERROR_NO_SUCH_DEVICE || 1730 status == PCAP_ERROR_PERM_DENIED) && 1731 *cp != '\0') 1732 error("%s: %s\n(%s)", device, 1733 pcap_statustostr(status), cp); 1734 #ifdef __FreeBSD__ 1735 else if (status == PCAP_ERROR_RFMON_NOTSUP && 1736 strncmp(device, "wlan", 4) == 0) { 1737 char parent[8], newdev[8]; 1738 char sysctl[32]; 1739 size_t s = sizeof(parent); 1740 1741 snprintf(sysctl, sizeof(sysctl), 1742 "net.wlan.%d.%%parent", atoi(device + 4)); 1743 sysctlbyname(sysctl, parent, &s, NULL, 0); 1744 strlcpy(newdev, device, sizeof(newdev)); 1745 /* Suggest a new wlan device. */ 1746 newdev[strlen(newdev)-1]++; 1747 error("%s is not a monitor mode VAP\n" 1748 "To create a new monitor mode VAP use:\n" 1749 " ifconfig %s create wlandev %s wlanmode " 1750 "monitor\nand use %s as the tcpdump " 1751 "interface", device, newdev, parent, 1752 newdev); 1753 } 1754 #endif 1755 else 1756 error("%s: %s", device, 1757 pcap_statustostr(status)); 1758 } else if (status > 0) { 1759 /* 1760 * pcap_activate() succeeded, but it's warning us 1761 * of a problem it had. 1762 */ 1763 cp = pcap_geterr(pd); 1764 if (status == PCAP_WARNING) 1765 warning("%s", cp); 1766 else if (status == PCAP_WARNING_PROMISC_NOTSUP && 1767 *cp != '\0') 1768 warning("%s: %s\n(%s)", device, 1769 pcap_statustostr(status), cp); 1770 else 1771 warning("%s: %s", device, 1772 pcap_statustostr(status)); 1773 } 1774 #ifdef HAVE_PCAP_SETDIRECTION 1775 if (Qflag != -1) { 1776 status = pcap_setdirection(pd, Qflag); 1777 if (status != 0) 1778 error("%s: pcap_setdirection() failed: %s", 1779 device, pcap_geterr(pd)); 1780 } 1781 #endif /* HAVE_PCAP_SETDIRECTION */ 1782 #else 1783 *ebuf = '\0'; 1784 pd = pcap_open_live(device, snaplen, !pflag, 1000, ebuf); 1785 if (pd == NULL) 1786 error("%s", ebuf); 1787 else if (*ebuf) 1788 warning("%s", ebuf); 1789 #endif /* HAVE_PCAP_CREATE */ 1790 /* 1791 * Let user own process after socket has been opened. 1792 */ 1793 #ifndef WIN32 1794 if (setgid(getgid()) != 0 || setuid(getuid()) != 0) 1795 fprintf(stderr, "Warning: setgid/setuid failed !\n"); 1796 #endif /* WIN32 */ 1797 #if !defined(HAVE_PCAP_CREATE) && defined(WIN32) 1798 if(Bflag != 0) 1799 if(pcap_setbuff(pd, Bflag)==-1){ 1800 error("%s", pcap_geterr(pd)); 1801 } 1802 #endif /* !defined(HAVE_PCAP_CREATE) && defined(WIN32) */ 1803 if (Lflag) 1804 show_dlts_and_exit(device, pd); 1805 if (gndo->ndo_dlt >= 0) { 1806 #ifdef HAVE_PCAP_SET_DATALINK 1807 if (pcap_set_datalink(pd, gndo->ndo_dlt) < 0) 1808 error("%s", pcap_geterr(pd)); 1809 #else 1810 /* 1811 * We don't actually support changing the 1812 * data link type, so we only let them 1813 * set it to what it already is. 1814 */ 1815 if (gndo->ndo_dlt != pcap_datalink(pd)) { 1816 error("%s is not one of the DLTs supported by this device\n", 1817 gndo->ndo_dltname); 1818 } 1819 #endif 1820 (void)fprintf(stderr, "%s: data link type %s\n", 1821 program_name, gndo->ndo_dltname); 1822 (void)fflush(stderr); 1823 } 1824 i = pcap_snapshot(pd); 1825 if (snaplen < i) { 1826 warning("snaplen raised from %d to %d", snaplen, i); 1827 snaplen = i; 1828 } 1829 if(fflag != 0) { 1830 if (pcap_lookupnet(device, &localnet, &netmask, ebuf) < 0) { 1831 warning("foreign (-f) flag used but: %s", ebuf); 1832 } 1833 } 1834 1835 } 1836 if (infile) 1837 cmdbuf = read_infile(infile); 1838 else 1839 cmdbuf = copy_argv(&argv[optind]); 1840 1841 if (pcap_compile(pd, &fcode, cmdbuf, Oflag, netmask) < 0) 1842 error("%s", pcap_geterr(pd)); 1843 if (dflag) { 1844 bpf_dump(&fcode, dflag); 1845 pcap_close(pd); 1846 free(cmdbuf); 1847 exit(0); 1848 } 1849 1850 #ifdef HAVE_CAPSPER 1851 if (!nflag) 1852 capdns = capdns_setup(); 1853 #endif /* HAVE_CAPSPER */ 1854 1855 init_addrtoname(gndo, localnet, netmask); 1856 init_checksum(); 1857 1858 #ifndef WIN32 1859 (void)setsignal(SIGPIPE, cleanup); 1860 (void)setsignal(SIGTERM, cleanup); 1861 (void)setsignal(SIGINT, cleanup); 1862 #endif /* WIN32 */ 1863 #if defined(HAVE_FORK) || defined(HAVE_VFORK) 1864 (void)setsignal(SIGCHLD, child_cleanup); 1865 #endif 1866 /* Cooperate with nohup(1) */ 1867 #ifndef WIN32 1868 if ((oldhandler = setsignal(SIGHUP, cleanup)) != SIG_DFL) 1869 (void)setsignal(SIGHUP, oldhandler); 1870 #endif /* WIN32 */ 1871 1872 #ifndef WIN32 1873 /* 1874 * If a user name was specified with "-Z", attempt to switch to 1875 * that user's UID. This would probably be used with sudo, 1876 * to allow tcpdump to be run in a special restricted 1877 * account (if you just want to allow users to open capture 1878 * devices, and can't just give users that permission, 1879 * you'd make tcpdump set-UID or set-GID). 1880 * 1881 * Tcpdump doesn't necessarily write only to one savefile; 1882 * the general only way to allow a -Z instance to write to 1883 * savefiles as the user under whose UID it's run, rather 1884 * than as the user specified with -Z, would thus be to switch 1885 * to the original user ID before opening a capture file and 1886 * then switch back to the -Z user ID after opening the savefile. 1887 * Switching to the -Z user ID only after opening the first 1888 * savefile doesn't handle the general case. 1889 */ 1890 1891 if (getuid() == 0 || geteuid() == 0) { 1892 #ifdef HAVE_LIBCAP_NG 1893 /* Initialize capng */ 1894 capng_clear(CAPNG_SELECT_BOTH); 1895 if (username) { 1896 capng_updatev( 1897 CAPNG_ADD, 1898 CAPNG_PERMITTED | CAPNG_EFFECTIVE, 1899 CAP_SETUID, 1900 CAP_SETGID, 1901 -1); 1902 } 1903 1904 if (WFileName) { 1905 capng_update( 1906 CAPNG_ADD, 1907 CAPNG_PERMITTED | CAPNG_EFFECTIVE, 1908 CAP_DAC_OVERRIDE 1909 ); 1910 } 1911 capng_apply(CAPNG_SELECT_BOTH); 1912 #endif /* HAVE_LIBCAP_NG */ 1913 if (username || chroot_dir) 1914 droproot(username, chroot_dir); 1915 1916 } 1917 #endif /* WIN32 */ 1918 1919 if (pcap_setfilter(pd, &fcode) < 0) 1920 error("%s", pcap_geterr(pd)); 1921 #ifdef HAVE_CAPSPER 1922 if (RFileName == NULL && VFileName == NULL) { 1923 static const unsigned long cmds[] = { BIOCGSTATS }; 1924 1925 /* 1926 * The various libpcap devices use a combination of 1927 * read (bpf), ioctl (bpf, netmap), poll (netmap). 1928 * Grant the relevant access rights, sorted by name. 1929 */ 1930 cap_rights_init(&rights, CAP_EVENT, CAP_IOCTL, CAP_READ); 1931 if (cap_rights_limit(pcap_fileno(pd), &rights) < 0 && 1932 errno != ENOSYS) { 1933 error("unable to limit pcap descriptor"); 1934 } 1935 if (cap_ioctls_limit(pcap_fileno(pd), cmds, 1936 sizeof(cmds) / sizeof(cmds[0])) < 0 && errno != ENOSYS) { 1937 error("unable to limit ioctls on pcap descriptor"); 1938 } 1939 } 1940 #endif 1941 if (WFileName) { 1942 pcap_dumper_t *p; 1943 /* Do not exceed the default PATH_MAX for files. */ 1944 dumpinfo.CurrentFileName = (char *)malloc(PATH_MAX + 1); 1945 1946 if (dumpinfo.CurrentFileName == NULL) 1947 error("malloc of dumpinfo.CurrentFileName"); 1948 1949 /* We do not need numbering for dumpfiles if Cflag isn't set. */ 1950 if (Cflag != 0) 1951 MakeFilename(dumpinfo.CurrentFileName, WFileName, 0, WflagChars); 1952 else 1953 MakeFilename(dumpinfo.CurrentFileName, WFileName, 0, 0); 1954 1955 p = pcap_dump_open(pd, dumpinfo.CurrentFileName); 1956 #ifdef HAVE_LIBCAP_NG 1957 /* Give up CAP_DAC_OVERRIDE capability. 1958 * Only allow it to be restored if the -C or -G flag have been 1959 * set since we may need to create more files later on. 1960 */ 1961 capng_update( 1962 CAPNG_DROP, 1963 (Cflag || Gflag ? 0 : CAPNG_PERMITTED) 1964 | CAPNG_EFFECTIVE, 1965 CAP_DAC_OVERRIDE 1966 ); 1967 capng_apply(CAPNG_SELECT_BOTH); 1968 #endif /* HAVE_LIBCAP_NG */ 1969 if (p == NULL) 1970 error("%s", pcap_geterr(pd)); 1971 #ifdef HAVE_CAPSPER 1972 set_dumper_capsicum_rights(p); 1973 #endif 1974 if (Cflag != 0 || Gflag != 0) { 1975 #ifdef HAVE_CAPSPER 1976 dumpinfo.WFileName = strdup(basename(WFileName)); 1977 dumpinfo.dirfd = open(dirname(WFileName), 1978 O_DIRECTORY | O_RDONLY); 1979 if (dumpinfo.dirfd < 0) { 1980 error("unable to open directory %s", 1981 dirname(WFileName)); 1982 } 1983 cap_rights_init(&rights, CAP_CREATE, CAP_FCNTL, 1984 CAP_FTRUNCATE, CAP_LOOKUP, CAP_SEEK, CAP_WRITE); 1985 if (cap_rights_limit(dumpinfo.dirfd, &rights) < 0 && 1986 errno != ENOSYS) { 1987 error("unable to limit directory rights"); 1988 } 1989 if (cap_fcntls_limit(dumpinfo.dirfd, CAP_FCNTL_GETFL) < 0 && 1990 errno != ENOSYS) { 1991 error("unable to limit dump descriptor fcntls"); 1992 } 1993 #else /* !HAVE_CAPSPER */ 1994 dumpinfo.WFileName = WFileName; 1995 #endif 1996 callback = dump_packet_and_trunc; 1997 dumpinfo.pd = pd; 1998 dumpinfo.p = p; 1999 pcap_userdata = (u_char *)&dumpinfo; 2000 } else { 2001 callback = dump_packet; 2002 pcap_userdata = (u_char *)p; 2003 } 2004 #ifdef HAVE_PCAP_DUMP_FLUSH 2005 if (Uflag) 2006 pcap_dump_flush(p); 2007 #endif 2008 } else { 2009 type = pcap_datalink(pd); 2010 printinfo = get_print_info(type); 2011 callback = print_packet; 2012 pcap_userdata = (u_char *)&printinfo; 2013 } 2014 2015 #ifdef SIGNAL_REQ_INFO 2016 /* 2017 * We can't get statistics when reading from a file rather 2018 * than capturing from a device. 2019 */ 2020 if (RFileName == NULL) 2021 (void)setsignal(SIGNAL_REQ_INFO, requestinfo); 2022 #endif 2023 2024 if (vflag > 0 && WFileName) { 2025 /* 2026 * When capturing to a file, "-v" means tcpdump should, 2027 * every 10 secodns, "v"erbosely report the number of 2028 * packets captured. 2029 */ 2030 #ifdef USE_WIN32_MM_TIMER 2031 /* call verbose_stats_dump() each 1000 +/-100msec */ 2032 timer_id = timeSetEvent(1000, 100, verbose_stats_dump, 0, TIME_PERIODIC); 2033 setvbuf(stderr, NULL, _IONBF, 0); 2034 #elif defined(HAVE_ALARM) 2035 (void)setsignal(SIGALRM, verbose_stats_dump); 2036 alarm(1); 2037 #endif 2038 } 2039 2040 #ifndef WIN32 2041 if (RFileName == NULL) { 2042 /* 2043 * Live capture (if -V was specified, we set RFileName 2044 * to a file from the -V file). Print a message to 2045 * the standard error on UN*X. 2046 */ 2047 if (!vflag && !WFileName) { 2048 (void)fprintf(stderr, 2049 "%s: verbose output suppressed, use -v or -vv for full protocol decode\n", 2050 program_name); 2051 } else 2052 (void)fprintf(stderr, "%s: ", program_name); 2053 dlt = pcap_datalink(pd); 2054 dlt_name = pcap_datalink_val_to_name(dlt); 2055 if (dlt_name == NULL) { 2056 (void)fprintf(stderr, "listening on %s, link-type %u, capture size %u bytes\n", 2057 device, dlt, snaplen); 2058 } else { 2059 (void)fprintf(stderr, "listening on %s, link-type %s (%s), capture size %u bytes\n", 2060 device, dlt_name, 2061 pcap_datalink_val_to_description(dlt), snaplen); 2062 } 2063 (void)fflush(stderr); 2064 } 2065 #endif /* WIN32 */ 2066 2067 #ifdef __FreeBSD__ 2068 cansandbox = (VFileName == NULL && zflag == NULL); 2069 #ifdef HAVE_CAPSPER 2070 cansandbox = (cansandbox && (nflag || capdns != NULL)); 2071 #else 2072 cansandbox = (cansandbox && nflag); 2073 #endif 2074 if (cansandbox && cap_enter() < 0 && errno != ENOSYS) 2075 error("unable to enter the capability mode"); 2076 #endif /* __FreeBSD__ */ 2077 2078 do { 2079 status = pcap_loop(pd, cnt, callback, pcap_userdata); 2080 if (WFileName == NULL) { 2081 /* 2082 * We're printing packets. Flush the printed output, 2083 * so it doesn't get intermingled with error output. 2084 */ 2085 if (status == -2) { 2086 /* 2087 * We got interrupted, so perhaps we didn't 2088 * manage to finish a line we were printing. 2089 * Print an extra newline, just in case. 2090 */ 2091 putchar('\n'); 2092 } 2093 (void)fflush(stdout); 2094 } 2095 if (status == -2) { 2096 /* 2097 * We got interrupted. If we are reading multiple 2098 * files (via -V) set these so that we stop. 2099 */ 2100 VFileName = NULL; 2101 ret = NULL; 2102 } 2103 if (status == -1) { 2104 /* 2105 * Error. Report it. 2106 */ 2107 (void)fprintf(stderr, "%s: pcap_loop: %s\n", 2108 program_name, pcap_geterr(pd)); 2109 } 2110 if (RFileName == NULL) { 2111 /* 2112 * We're doing a live capture. Report the capture 2113 * statistics. 2114 */ 2115 info(1); 2116 } 2117 pcap_close(pd); 2118 if (VFileName != NULL) { 2119 ret = get_next_file(VFile, VFileLine); 2120 if (ret) { 2121 RFileName = VFileLine; 2122 pd = pcap_open_offline(RFileName, ebuf); 2123 if (pd == NULL) 2124 error("%s", ebuf); 2125 #ifdef HAVE_CAPSPER 2126 cap_rights_init(&rights, CAP_READ); 2127 if (cap_rights_limit(fileno(pcap_file(pd)), 2128 &rights) < 0 && errno != ENOSYS) { 2129 error("unable to limit pcap descriptor"); 2130 } 2131 #endif 2132 new_dlt = pcap_datalink(pd); 2133 if (WFileName && new_dlt != dlt) 2134 error("%s: new dlt does not match original", RFileName); 2135 printinfo = get_print_info(new_dlt); 2136 dlt_name = pcap_datalink_val_to_name(new_dlt); 2137 if (dlt_name == NULL) { 2138 fprintf(stderr, "reading from file %s, link-type %u\n", 2139 RFileName, new_dlt); 2140 } else { 2141 fprintf(stderr, 2142 "reading from file %s, link-type %s (%s)\n", 2143 RFileName, dlt_name, 2144 pcap_datalink_val_to_description(new_dlt)); 2145 } 2146 if (pcap_compile(pd, &fcode, cmdbuf, Oflag, netmask) < 0) 2147 error("%s", pcap_geterr(pd)); 2148 if (pcap_setfilter(pd, &fcode) < 0) 2149 error("%s", pcap_geterr(pd)); 2150 } 2151 } 2152 } 2153 while (ret != NULL); 2154 2155 free(cmdbuf); 2156 exit(status == -1 ? 1 : 0); 2157 } 2158 2159 /* make a clean exit on interrupts */ 2160 static RETSIGTYPE 2161 cleanup(int signo _U_) 2162 { 2163 #ifdef USE_WIN32_MM_TIMER 2164 if (timer_id) 2165 timeKillEvent(timer_id); 2166 timer_id = 0; 2167 #elif defined(HAVE_ALARM) 2168 alarm(0); 2169 #endif 2170 2171 #ifdef HAVE_PCAP_BREAKLOOP 2172 /* 2173 * We have "pcap_breakloop()"; use it, so that we do as little 2174 * as possible in the signal handler (it's probably not safe 2175 * to do anything with standard I/O streams in a signal handler - 2176 * the ANSI C standard doesn't say it is). 2177 */ 2178 pcap_breakloop(pd); 2179 #else 2180 /* 2181 * We don't have "pcap_breakloop()"; this isn't safe, but 2182 * it's the best we can do. Print the summary if we're 2183 * not reading from a savefile - i.e., if we're doing a 2184 * live capture - and exit. 2185 */ 2186 if (pd != NULL && pcap_file(pd) == NULL) { 2187 /* 2188 * We got interrupted, so perhaps we didn't 2189 * manage to finish a line we were printing. 2190 * Print an extra newline, just in case. 2191 */ 2192 putchar('\n'); 2193 (void)fflush(stdout); 2194 info(1); 2195 } 2196 exit(0); 2197 #endif 2198 } 2199 2200 /* 2201 On windows, we do not use a fork, so we do not care less about 2202 waiting a child processes to die 2203 */ 2204 #if defined(HAVE_FORK) || defined(HAVE_VFORK) 2205 static RETSIGTYPE 2206 child_cleanup(int signo _U_) 2207 { 2208 wait(NULL); 2209 } 2210 #endif /* HAVE_FORK && HAVE_VFORK */ 2211 2212 static void 2213 info(register int verbose) 2214 { 2215 struct pcap_stat stat; 2216 2217 /* 2218 * Older versions of libpcap didn't set ps_ifdrop on some 2219 * platforms; initialize it to 0 to handle that. 2220 */ 2221 stat.ps_ifdrop = 0; 2222 if (pcap_stats(pd, &stat) < 0) { 2223 (void)fprintf(stderr, "pcap_stats: %s\n", pcap_geterr(pd)); 2224 infoprint = 0; 2225 return; 2226 } 2227 2228 if (!verbose) 2229 fprintf(stderr, "%s: ", program_name); 2230 2231 (void)fprintf(stderr, "%u packet%s captured", packets_captured, 2232 PLURAL_SUFFIX(packets_captured)); 2233 if (!verbose) 2234 fputs(", ", stderr); 2235 else 2236 putc('\n', stderr); 2237 (void)fprintf(stderr, "%u packet%s received by filter", stat.ps_recv, 2238 PLURAL_SUFFIX(stat.ps_recv)); 2239 if (!verbose) 2240 fputs(", ", stderr); 2241 else 2242 putc('\n', stderr); 2243 (void)fprintf(stderr, "%u packet%s dropped by kernel", stat.ps_drop, 2244 PLURAL_SUFFIX(stat.ps_drop)); 2245 if (stat.ps_ifdrop != 0) { 2246 if (!verbose) 2247 fputs(", ", stderr); 2248 else 2249 putc('\n', stderr); 2250 (void)fprintf(stderr, "%u packet%s dropped by interface\n", 2251 stat.ps_ifdrop, PLURAL_SUFFIX(stat.ps_ifdrop)); 2252 } else 2253 putc('\n', stderr); 2254 infoprint = 0; 2255 } 2256 2257 #if defined(HAVE_FORK) || defined(HAVE_VFORK) 2258 static void 2259 compress_savefile(const char *filename) 2260 { 2261 # ifdef HAVE_FORK 2262 if (fork()) 2263 # else 2264 if (vfork()) 2265 # endif 2266 return; 2267 /* 2268 * Set to lowest priority so that this doesn't disturb the capture 2269 */ 2270 #ifdef NZERO 2271 setpriority(PRIO_PROCESS, 0, NZERO - 1); 2272 #else 2273 setpriority(PRIO_PROCESS, 0, 19); 2274 #endif 2275 if (execlp(zflag, zflag, filename, (char *)NULL) == -1) 2276 fprintf(stderr, 2277 "compress_savefile:execlp(%s, %s): %s\n", 2278 zflag, 2279 filename, 2280 strerror(errno)); 2281 # ifdef HAVE_FORK 2282 exit(1); 2283 # else 2284 _exit(1); 2285 # endif 2286 } 2287 #else /* HAVE_FORK && HAVE_VFORK */ 2288 static void 2289 compress_savefile(const char *filename) 2290 { 2291 fprintf(stderr, 2292 "compress_savefile failed. Functionality not implemented under your system\n"); 2293 } 2294 #endif /* HAVE_FORK && HAVE_VFORK */ 2295 2296 static void 2297 dump_packet_and_trunc(u_char *user, const struct pcap_pkthdr *h, const u_char *sp) 2298 { 2299 struct dump_info *dump_info; 2300 2301 ++packets_captured; 2302 2303 ++infodelay; 2304 2305 dump_info = (struct dump_info *)user; 2306 2307 /* 2308 * XXX - this won't force the file to rotate on the specified time 2309 * boundary, but it will rotate on the first packet received after the 2310 * specified Gflag number of seconds. Note: if a Gflag time boundary 2311 * and a Cflag size boundary coincide, the time rotation will occur 2312 * first thereby cancelling the Cflag boundary (since the file should 2313 * be 0). 2314 */ 2315 if (Gflag != 0) { 2316 /* Check if it is time to rotate */ 2317 time_t t; 2318 2319 /* Get the current time */ 2320 if ((t = time(NULL)) == (time_t)-1) { 2321 error("dump_and_trunc_packet: can't get current_time: %s", 2322 pcap_strerror(errno)); 2323 } 2324 2325 2326 /* If the time is greater than the specified window, rotate */ 2327 if (t - Gflag_time >= Gflag) { 2328 #ifdef HAVE_CAPSPER 2329 FILE *fp; 2330 int fd; 2331 #endif 2332 2333 /* Update the Gflag_time */ 2334 Gflag_time = t; 2335 /* Update Gflag_count */ 2336 Gflag_count++; 2337 /* 2338 * Close the current file and open a new one. 2339 */ 2340 pcap_dump_close(dump_info->p); 2341 2342 /* 2343 * Compress the file we just closed, if the user asked for it 2344 */ 2345 if (zflag != NULL) 2346 compress_savefile(dump_info->CurrentFileName); 2347 2348 /* 2349 * Check to see if we've exceeded the Wflag (when 2350 * not using Cflag). 2351 */ 2352 if (Cflag == 0 && Wflag > 0 && Gflag_count >= Wflag) { 2353 (void)fprintf(stderr, "Maximum file limit reached: %d\n", 2354 Wflag); 2355 exit(0); 2356 /* NOTREACHED */ 2357 } 2358 if (dump_info->CurrentFileName != NULL) 2359 free(dump_info->CurrentFileName); 2360 /* Allocate space for max filename + \0. */ 2361 dump_info->CurrentFileName = (char *)malloc(PATH_MAX + 1); 2362 if (dump_info->CurrentFileName == NULL) 2363 error("dump_packet_and_trunc: malloc"); 2364 /* 2365 * Gflag was set otherwise we wouldn't be here. Reset the count 2366 * so multiple files would end with 1,2,3 in the filename. 2367 * The counting is handled with the -C flow after this. 2368 */ 2369 Cflag_count = 0; 2370 2371 /* 2372 * This is always the first file in the Cflag 2373 * rotation: e.g. 0 2374 * We also don't need numbering if Cflag is not set. 2375 */ 2376 if (Cflag != 0) 2377 MakeFilename(dump_info->CurrentFileName, dump_info->WFileName, 0, 2378 WflagChars); 2379 else 2380 MakeFilename(dump_info->CurrentFileName, dump_info->WFileName, 0, 0); 2381 2382 #ifdef HAVE_LIBCAP_NG 2383 capng_update(CAPNG_ADD, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE); 2384 capng_apply(CAPNG_SELECT_BOTH); 2385 #endif /* HAVE_LIBCAP_NG */ 2386 #ifdef HAVE_CAPSPER 2387 fd = openat(dump_info->dirfd, 2388 dump_info->CurrentFileName, 2389 O_CREAT | O_WRONLY | O_TRUNC, 0644); 2390 if (fd < 0) { 2391 error("unable to open file %s", 2392 dump_info->CurrentFileName); 2393 } 2394 fp = fdopen(fd, "w"); 2395 if (fp == NULL) { 2396 error("unable to fdopen file %s", 2397 dump_info->CurrentFileName); 2398 } 2399 dump_info->p = pcap_dump_fopen(dump_info->pd, fp); 2400 #else /* !HAVE_CAPSPER */ 2401 dump_info->p = pcap_dump_open(dump_info->pd, dump_info->CurrentFileName); 2402 #endif 2403 #ifdef HAVE_LIBCAP_NG 2404 capng_update(CAPNG_DROP, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE); 2405 capng_apply(CAPNG_SELECT_BOTH); 2406 #endif /* HAVE_LIBCAP_NG */ 2407 if (dump_info->p == NULL) 2408 error("%s", pcap_geterr(pd)); 2409 #ifdef HAVE_CAPSPER 2410 set_dumper_capsicum_rights(dump_info->p); 2411 #endif 2412 } 2413 } 2414 2415 /* 2416 * XXX - this won't prevent capture files from getting 2417 * larger than Cflag - the last packet written to the 2418 * file could put it over Cflag. 2419 */ 2420 if (Cflag != 0) { 2421 long size = pcap_dump_ftell(dump_info->p); 2422 2423 if (size == -1) 2424 error("ftell fails on output file"); 2425 if (size > Cflag) { 2426 #ifdef HAVE_CAPSPER 2427 FILE *fp; 2428 int fd; 2429 #endif 2430 2431 /* 2432 * Close the current file and open a new one. 2433 */ 2434 pcap_dump_close(dump_info->p); 2435 2436 /* 2437 * Compress the file we just closed, if the user 2438 * asked for it. 2439 */ 2440 if (zflag != NULL) 2441 compress_savefile(dump_info->CurrentFileName); 2442 2443 Cflag_count++; 2444 if (Wflag > 0) { 2445 if (Cflag_count >= Wflag) 2446 Cflag_count = 0; 2447 } 2448 if (dump_info->CurrentFileName != NULL) 2449 free(dump_info->CurrentFileName); 2450 dump_info->CurrentFileName = (char *)malloc(PATH_MAX + 1); 2451 if (dump_info->CurrentFileName == NULL) 2452 error("dump_packet_and_trunc: malloc"); 2453 MakeFilename(dump_info->CurrentFileName, dump_info->WFileName, Cflag_count, WflagChars); 2454 #ifdef HAVE_LIBCAP_NG 2455 capng_update(CAPNG_ADD, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE); 2456 capng_apply(CAPNG_SELECT_BOTH); 2457 #endif /* HAVE_LIBCAP_NG */ 2458 #ifdef HAVE_CAPSPER 2459 fd = openat(dump_info->dirfd, dump_info->CurrentFileName, 2460 O_CREAT | O_WRONLY | O_TRUNC, 0644); 2461 if (fd < 0) { 2462 error("unable to open file %s", 2463 dump_info->CurrentFileName); 2464 } 2465 fp = fdopen(fd, "w"); 2466 if (fp == NULL) { 2467 error("unable to fdopen file %s", 2468 dump_info->CurrentFileName); 2469 } 2470 dump_info->p = pcap_dump_fopen(dump_info->pd, fp); 2471 #else /* !HAVE_CAPSPER */ 2472 dump_info->p = pcap_dump_open(dump_info->pd, dump_info->CurrentFileName); 2473 #endif 2474 #ifdef HAVE_LIBCAP_NG 2475 capng_update(CAPNG_DROP, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE); 2476 capng_apply(CAPNG_SELECT_BOTH); 2477 #endif /* HAVE_LIBCAP_NG */ 2478 if (dump_info->p == NULL) 2479 error("%s", pcap_geterr(pd)); 2480 #ifdef HAVE_CAPSPER 2481 set_dumper_capsicum_rights(dump_info->p); 2482 #endif 2483 } 2484 } 2485 2486 pcap_dump((u_char *)dump_info->p, h, sp); 2487 #ifdef HAVE_PCAP_DUMP_FLUSH 2488 if (Uflag) 2489 pcap_dump_flush(dump_info->p); 2490 #endif 2491 2492 --infodelay; 2493 if (infoprint) 2494 info(0); 2495 } 2496 2497 static void 2498 dump_packet(u_char *user, const struct pcap_pkthdr *h, const u_char *sp) 2499 { 2500 ++packets_captured; 2501 2502 ++infodelay; 2503 2504 pcap_dump(user, h, sp); 2505 #ifdef HAVE_PCAP_DUMP_FLUSH 2506 if (Uflag) 2507 pcap_dump_flush((pcap_dumper_t *)user); 2508 #endif 2509 2510 --infodelay; 2511 if (infoprint) 2512 info(0); 2513 } 2514 2515 static void 2516 print_packet(u_char *user, const struct pcap_pkthdr *h, const u_char *sp) 2517 { 2518 struct print_info *print_info; 2519 u_int hdrlen; 2520 netdissect_options *ndo; 2521 2522 ++packets_captured; 2523 2524 ++infodelay; 2525 2526 print_info = (struct print_info *)user; 2527 ndo = print_info->ndo; 2528 2529 if(ndo->ndo_packet_number) 2530 ND_PRINT((ndo, "%5u ", packets_captured)); 2531 2532 ts_print(ndo, &h->ts); 2533 2534 /* 2535 * Some printers want to check that they're not walking off the 2536 * end of the packet. 2537 * Rather than pass it all the way down, we set this member 2538 * of the netdissect_options structure. 2539 */ 2540 ndo->ndo_snapend = sp + h->caplen; 2541 2542 if(print_info->ndo_type) { 2543 hdrlen = (*print_info->p.ndo_printer)(print_info->ndo, h, sp); 2544 } else { 2545 hdrlen = (*print_info->p.printer)(h, sp); 2546 } 2547 2548 /* 2549 * Restore the original snapend, as a printer might have 2550 * changed it. 2551 */ 2552 ndo->ndo_snapend = sp + h->caplen; 2553 if (ndo->ndo_Xflag) { 2554 /* 2555 * Print the raw packet data in hex and ASCII. 2556 */ 2557 if (ndo->ndo_Xflag > 1) { 2558 /* 2559 * Include the link-layer header. 2560 */ 2561 hex_and_ascii_print(ndo, "\n\t", sp, h->caplen); 2562 } else { 2563 /* 2564 * Don't include the link-layer header - and if 2565 * we have nothing past the link-layer header, 2566 * print nothing. 2567 */ 2568 if (h->caplen > hdrlen) 2569 hex_and_ascii_print(ndo, "\n\t", sp + hdrlen, 2570 h->caplen - hdrlen); 2571 } 2572 } else if (ndo->ndo_xflag) { 2573 /* 2574 * Print the raw packet data in hex. 2575 */ 2576 if (ndo->ndo_xflag > 1) { 2577 /* 2578 * Include the link-layer header. 2579 */ 2580 hex_print(ndo, "\n\t", sp, h->caplen); 2581 } else { 2582 /* 2583 * Don't include the link-layer header - and if 2584 * we have nothing past the link-layer header, 2585 * print nothing. 2586 */ 2587 if (h->caplen > hdrlen) 2588 hex_print(ndo, "\n\t", sp + hdrlen, 2589 h->caplen - hdrlen); 2590 } 2591 } else if (ndo->ndo_Aflag) { 2592 /* 2593 * Print the raw packet data in ASCII. 2594 */ 2595 if (ndo->ndo_Aflag > 1) { 2596 /* 2597 * Include the link-layer header. 2598 */ 2599 ascii_print(ndo, sp, h->caplen); 2600 } else { 2601 /* 2602 * Don't include the link-layer header - and if 2603 * we have nothing past the link-layer header, 2604 * print nothing. 2605 */ 2606 if (h->caplen > hdrlen) 2607 ascii_print(ndo, sp + hdrlen, h->caplen - hdrlen); 2608 } 2609 } 2610 2611 putchar('\n'); 2612 2613 --infodelay; 2614 if (infoprint) 2615 info(0); 2616 } 2617 2618 #ifdef WIN32 2619 /* 2620 * XXX - there should really be libpcap calls to get the version 2621 * number as a string (the string would be generated from #defines 2622 * at run time, so that it's not generated from string constants 2623 * in the library, as, on many UNIX systems, those constants would 2624 * be statically linked into the application executable image, and 2625 * would thus reflect the version of libpcap on the system on 2626 * which the application was *linked*, not the system on which it's 2627 * *running*. 2628 * 2629 * That routine should be documented, unlike the "version[]" 2630 * string, so that UNIX vendors providing their own libpcaps 2631 * don't omit it (as a couple of vendors have...). 2632 * 2633 * Packet.dll should perhaps also export a routine to return the 2634 * version number of the Packet.dll code, to supply the 2635 * "Wpcap_version" information on Windows. 2636 */ 2637 char WDversion[]="current-git.tcpdump.org"; 2638 #if !defined(HAVE_GENERATED_VERSION) 2639 char version[]="current-git.tcpdump.org"; 2640 #endif 2641 char pcap_version[]="current-git.tcpdump.org"; 2642 char Wpcap_version[]="3.1"; 2643 #endif 2644 2645 /* 2646 * By default, print the specified data out in hex and ASCII. 2647 */ 2648 static void 2649 ndo_default_print(netdissect_options *ndo, const u_char *bp, u_int length) 2650 { 2651 hex_and_ascii_print(ndo, "\n\t", bp, length); /* pass on lf and indentation string */ 2652 } 2653 2654 void 2655 default_print(const u_char *bp, u_int length) 2656 { 2657 ndo_default_print(gndo, bp, length); 2658 } 2659 2660 #ifdef SIGNAL_REQ_INFO 2661 RETSIGTYPE requestinfo(int signo _U_) 2662 { 2663 if (infodelay) 2664 ++infoprint; 2665 else 2666 info(0); 2667 } 2668 #endif 2669 2670 /* 2671 * Called once each second in verbose mode while dumping to file 2672 */ 2673 #ifdef USE_WIN32_MM_TIMER 2674 void CALLBACK verbose_stats_dump (UINT timer_id _U_, UINT msg _U_, DWORD_PTR arg _U_, 2675 DWORD_PTR dw1 _U_, DWORD_PTR dw2 _U_) 2676 { 2677 struct pcap_stat stat; 2678 2679 if (infodelay == 0 && pcap_stats(pd, &stat) >= 0) 2680 fprintf(stderr, "Got %u\r", packets_captured); 2681 } 2682 #elif defined(HAVE_ALARM) 2683 static void verbose_stats_dump(int sig _U_) 2684 { 2685 struct pcap_stat stat; 2686 2687 if (infodelay == 0 && pcap_stats(pd, &stat) >= 0) 2688 fprintf(stderr, "Got %u\r", packets_captured); 2689 alarm(1); 2690 } 2691 #endif 2692 2693 USES_APPLE_DEPRECATED_API 2694 static void 2695 print_version(void) 2696 { 2697 extern char version[]; 2698 #ifndef HAVE_PCAP_LIB_VERSION 2699 #if defined(WIN32) || defined(HAVE_PCAP_VERSION) 2700 extern char pcap_version[]; 2701 #else /* defined(WIN32) || defined(HAVE_PCAP_VERSION) */ 2702 static char pcap_version[] = "unknown"; 2703 #endif /* defined(WIN32) || defined(HAVE_PCAP_VERSION) */ 2704 #endif /* HAVE_PCAP_LIB_VERSION */ 2705 2706 #ifdef HAVE_PCAP_LIB_VERSION 2707 #ifdef WIN32 2708 (void)fprintf(stderr, "%s version %s, based on tcpdump version %s\n", program_name, WDversion, version); 2709 #else /* WIN32 */ 2710 (void)fprintf(stderr, "%s version %s\n", program_name, version); 2711 #endif /* WIN32 */ 2712 (void)fprintf(stderr, "%s\n",pcap_lib_version()); 2713 #else /* HAVE_PCAP_LIB_VERSION */ 2714 #ifdef WIN32 2715 (void)fprintf(stderr, "%s version %s, based on tcpdump version %s\n", program_name, WDversion, version); 2716 (void)fprintf(stderr, "WinPcap version %s, based on libpcap version %s\n",Wpcap_version, pcap_version); 2717 #else /* WIN32 */ 2718 (void)fprintf(stderr, "%s version %s\n", program_name, version); 2719 (void)fprintf(stderr, "libpcap version %s\n", pcap_version); 2720 #endif /* WIN32 */ 2721 #endif /* HAVE_PCAP_LIB_VERSION */ 2722 2723 #if defined(HAVE_LIBCRYPTO) && defined(SSLEAY_VERSION) 2724 (void)fprintf (stderr, "%s\n", SSLeay_version(SSLEAY_VERSION)); 2725 #endif 2726 2727 #ifdef USE_LIBSMI 2728 (void)fprintf (stderr, "SMI-library: %s\n", smi_version_string); 2729 #endif 2730 } 2731 USES_APPLE_RST 2732 2733 static void 2734 print_usage(void) 2735 { 2736 print_version(); 2737 (void)fprintf(stderr, 2738 "Usage: %s [-aAbd" D_FLAG "efhH" I_FLAG J_FLAG "KlLnNOpqRStu" U_FLAG "vxX#]" B_FLAG_USAGE " [ -c count ]\n", program_name); 2739 (void)fprintf(stderr, 2740 "\t\t[ -C file_size ] [ -E algo:secret ] [ -F file ] [ -G seconds ]\n"); 2741 (void)fprintf(stderr, 2742 "\t\t[ -i interface ]" j_FLAG_USAGE " [ -M secret ] [ --number ]\n"); 2743 #ifdef HAVE_PCAP_SETDIRECTION 2744 (void)fprintf(stderr, 2745 "\t\t[ -Q in|out|inout ]\n"); 2746 #endif 2747 (void)fprintf(stderr, 2748 "\t\t[ -r file ] [ -s snaplen ] "); 2749 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION 2750 (void)fprintf(stderr, "[ --time-stamp-precision precision ]\n"); 2751 (void)fprintf(stderr, 2752 "\t\t"); 2753 #endif 2754 #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE 2755 (void)fprintf(stderr, "[ --immediate-mode ] "); 2756 #endif 2757 (void)fprintf(stderr, "[ -T type ] [ --version ] [ -V file ]\n"); 2758 (void)fprintf(stderr, 2759 "\t\t[ -w file ] [ -W filecount ] [ -y datalinktype ] [ -z command ]\n"); 2760 (void)fprintf(stderr, 2761 "\t\t[ -Z user ] [ expression ]\n"); 2762 } 2763 2764 2765 2766 /* VARARGS */ 2767 static void 2768 ndo_error(netdissect_options *ndo _U_, const char *fmt, ...) 2769 { 2770 va_list ap; 2771 2772 (void)fprintf(stderr, "%s: ", program_name); 2773 va_start(ap, fmt); 2774 (void)vfprintf(stderr, fmt, ap); 2775 va_end(ap); 2776 if (*fmt) { 2777 fmt += strlen(fmt); 2778 if (fmt[-1] != '\n') 2779 (void)fputc('\n', stderr); 2780 } 2781 exit(1); 2782 /* NOTREACHED */ 2783 } 2784 2785 /* VARARGS */ 2786 static void 2787 ndo_warning(netdissect_options *ndo _U_, const char *fmt, ...) 2788 { 2789 va_list ap; 2790 2791 (void)fprintf(stderr, "%s: WARNING: ", program_name); 2792 va_start(ap, fmt); 2793 (void)vfprintf(stderr, fmt, ap); 2794 va_end(ap); 2795 if (*fmt) { 2796 fmt += strlen(fmt); 2797 if (fmt[-1] != '\n') 2798 (void)fputc('\n', stderr); 2799 } 2800 } 2801 /* 2802 * Local Variables: 2803 * c-style: whitesmith 2804 * c-basic-offset: 8 2805 * End: 2806 */ 2807