1 /* 2 * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000 3 * The Regents of the University of California. All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that: (1) source code distributions 7 * retain the above copyright notice and this paragraph in its entirety, (2) 8 * distributions including binary code include the above copyright notice and 9 * this paragraph in its entirety in the documentation or other materials 10 * provided with the distribution, and (3) all advertising materials mentioning 11 * features or use of this software display the following acknowledgement: 12 * ``This product includes software developed by the University of California, 13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of 14 * the University nor the names of its contributors may be used to endorse 15 * or promote products derived from this software without specific prior 16 * written permission. 17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED 18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF 19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 20 * 21 * Support for splitting captures into multiple files with a maximum 22 * file size: 23 * 24 * Copyright (c) 2001 25 * Seth Webster <swebster@sst.ll.mit.edu> 26 */ 27 28 #ifndef lint 29 static const char copyright[] _U_ = 30 "@(#) Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000\n\ 31 The Regents of the University of California. All rights reserved.\n"; 32 #endif 33 34 /* $FreeBSD$ */ 35 36 /* 37 * tcpdump - monitor tcp/ip traffic on an ethernet. 38 * 39 * First written in 1987 by Van Jacobson, Lawrence Berkeley Laboratory. 40 * Mercilessly hacked and occasionally improved since then via the 41 * combined efforts of Van, Steve McCanne and Craig Leres of LBL. 42 */ 43 44 #ifdef HAVE_CONFIG_H 45 #include "config.h" 46 #endif 47 48 /* 49 * Mac OS X may ship pcap.h from libpcap 0.6 with a libpcap based on 50 * 0.8. That means it has pcap_findalldevs() but the header doesn't 51 * define pcap_if_t, meaning that we can't actually *use* pcap_findalldevs(). 52 */ 53 #ifdef HAVE_PCAP_FINDALLDEVS 54 #ifndef HAVE_PCAP_IF_T 55 #undef HAVE_PCAP_FINDALLDEVS 56 #endif 57 #endif 58 59 #include <tcpdump-stdinc.h> 60 61 #ifdef WIN32 62 #include "w32_fzs.h" 63 extern int strcasecmp (const char *__s1, const char *__s2); 64 extern int SIZE_BUF; 65 #define off_t long 66 #define uint UINT 67 #endif /* WIN32 */ 68 69 #ifdef USE_LIBSMI 70 #include <smi.h> 71 #endif 72 73 #ifdef HAVE_LIBCRYPTO 74 #include <openssl/crypto.h> 75 #endif 76 77 #ifdef HAVE_GETOPT_LONG 78 #include <getopt.h> 79 #else 80 #include "getopt_long.h" 81 #endif 82 /* Capsicum-specific code requires macros from <net/bpf.h>, which will fail 83 * to compile if <pcap.h> has already been included; including the headers 84 * in the opposite order works fine. 85 */ 86 #ifdef __FreeBSD__ 87 #include <sys/capsicum.h> 88 #include <sys/sysctl.h> 89 #include <libgen.h> 90 #endif /* __FreeBSD__ */ 91 #ifdef HAVE_CASPER 92 #include <libcasper.h> 93 #include <casper/cap_dns.h> 94 #include <sys/nv.h> 95 #include <sys/ioccom.h> 96 #include <net/bpf.h> 97 #include <fcntl.h> 98 #endif /* HAVE_CASPER */ 99 #include <pcap.h> 100 #include <signal.h> 101 #include <stdio.h> 102 #include <stdlib.h> 103 #include <string.h> 104 #include <limits.h> 105 #ifndef WIN32 106 #include <sys/wait.h> 107 #include <sys/resource.h> 108 #include <pwd.h> 109 #include <grp.h> 110 #endif /* WIN32 */ 111 112 /* capabilities convenience library */ 113 /* If a code depends on HAVE_LIBCAP_NG, it depends also on HAVE_CAP_NG_H. 114 * If HAVE_CAP_NG_H is not defined, undefine HAVE_LIBCAP_NG. 115 * Thus, the later tests are done only on HAVE_LIBCAP_NG. 116 */ 117 #ifdef HAVE_LIBCAP_NG 118 #ifdef HAVE_CAP_NG_H 119 #include <cap-ng.h> 120 #else 121 #undef HAVE_LIBCAP_NG 122 #endif /* HAVE_CAP_NG_H */ 123 #endif /* HAVE_LIBCAP_NG */ 124 125 #include "netdissect.h" 126 #include "interface.h" 127 #include "addrtoname.h" 128 #include "machdep.h" 129 #include "setsignal.h" 130 #include "gmt2local.h" 131 #include "pcap-missing.h" 132 133 #ifndef PATH_MAX 134 #define PATH_MAX 1024 135 #endif 136 137 #ifdef SIGINFO 138 #define SIGNAL_REQ_INFO SIGINFO 139 #elif SIGUSR1 140 #define SIGNAL_REQ_INFO SIGUSR1 141 #endif 142 143 netdissect_options Gndo; 144 netdissect_options *gndo = &Gndo; 145 146 static int Dflag; /* list available devices and exit */ 147 static int dflag; /* print filter code */ 148 static int Lflag; /* list available data link types and exit */ 149 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE 150 static int Jflag; /* list available time stamp types */ 151 #endif 152 #ifdef HAVE_PCAP_SETDIRECTION 153 int Qflag = -1; /* restrict captured packet by send/receive direction */ 154 #endif 155 static char *zflag = NULL; /* compress each savefile using a specified command (like gzip or bzip2) */ 156 157 static int infodelay; 158 static int infoprint; 159 160 char *program_name; 161 162 #ifdef HAVE_CASPER 163 cap_channel_t *capdns; 164 #endif 165 166 int32_t thiszone; /* seconds offset from gmt to local time */ 167 168 /* Forwards */ 169 static RETSIGTYPE cleanup(int); 170 static RETSIGTYPE child_cleanup(int); 171 static void print_version(void); 172 static void print_usage(void); 173 static void show_dlts_and_exit(const char *device, pcap_t *pd) __attribute__((noreturn)); 174 175 static void print_packet(u_char *, const struct pcap_pkthdr *, const u_char *); 176 static void ndo_default_print(netdissect_options *, const u_char *, u_int); 177 static void dump_packet_and_trunc(u_char *, const struct pcap_pkthdr *, const u_char *); 178 static void dump_packet(u_char *, const struct pcap_pkthdr *, const u_char *); 179 static void droproot(const char *, const char *); 180 static void ndo_error(netdissect_options *ndo, const char *fmt, ...) 181 __attribute__((noreturn)) 182 #ifdef __ATTRIBUTE___FORMAT_OK 183 __attribute__((format (printf, 2, 3))) 184 #endif /* __ATTRIBUTE___FORMAT_OK */ 185 ; 186 static void ndo_warning(netdissect_options *ndo, const char *fmt, ...) 187 #ifdef __ATTRIBUTE___FORMAT_OK 188 __attribute__((format (printf, 2, 3))) 189 #endif /* __ATTRIBUTE___FORMAT_OK */ 190 ; 191 192 #ifdef SIGNAL_REQ_INFO 193 RETSIGTYPE requestinfo(int); 194 #endif 195 196 #if defined(USE_WIN32_MM_TIMER) 197 #include <MMsystem.h> 198 static UINT timer_id; 199 static void CALLBACK verbose_stats_dump(UINT, UINT, DWORD_PTR, DWORD_PTR, DWORD_PTR); 200 #elif defined(HAVE_ALARM) 201 static void verbose_stats_dump(int sig); 202 #endif 203 204 static void info(int); 205 static u_int packets_captured; 206 207 struct printer { 208 if_printer f; 209 int type; 210 }; 211 212 213 struct ndo_printer { 214 if_ndo_printer f; 215 int type; 216 }; 217 218 219 static const struct printer printers[] = { 220 { NULL, 0 }, 221 }; 222 223 static const struct ndo_printer ndo_printers[] = { 224 { ether_if_print, DLT_EN10MB }, 225 #ifdef DLT_IPNET 226 { ipnet_if_print, DLT_IPNET }, 227 #endif 228 #ifdef DLT_IEEE802_15_4 229 { ieee802_15_4_if_print, DLT_IEEE802_15_4 }, 230 #endif 231 #ifdef DLT_IEEE802_15_4_NOFCS 232 { ieee802_15_4_if_print, DLT_IEEE802_15_4_NOFCS }, 233 #endif 234 #ifdef DLT_PPI 235 { ppi_if_print, DLT_PPI }, 236 #endif 237 #ifdef DLT_NETANALYZER 238 { netanalyzer_if_print, DLT_NETANALYZER }, 239 #endif 240 #ifdef DLT_NETANALYZER_TRANSPARENT 241 { netanalyzer_transparent_if_print, DLT_NETANALYZER_TRANSPARENT }, 242 #endif 243 #if defined(DLT_NFLOG) && defined(HAVE_PCAP_NFLOG_H) 244 { nflog_if_print, DLT_NFLOG}, 245 #endif 246 #ifdef DLT_CIP 247 { cip_if_print, DLT_CIP }, 248 #endif 249 #ifdef DLT_ATM_CLIP 250 { cip_if_print, DLT_ATM_CLIP }, 251 #endif 252 #ifdef DLT_IP_OVER_FC 253 { ipfc_if_print, DLT_IP_OVER_FC }, 254 #endif 255 { null_if_print, DLT_NULL }, 256 #ifdef DLT_LOOP 257 { null_if_print, DLT_LOOP }, 258 #endif 259 #ifdef DLT_APPLE_IP_OVER_IEEE1394 260 { ap1394_if_print, DLT_APPLE_IP_OVER_IEEE1394 }, 261 #endif 262 #if defined(DLT_BLUETOOTH_HCI_H4_WITH_PHDR) && defined(HAVE_PCAP_BLUETOOTH_H) 263 { bt_if_print, DLT_BLUETOOTH_HCI_H4_WITH_PHDR}, 264 #endif 265 #ifdef DLT_LANE8023 266 { lane_if_print, DLT_LANE8023 }, 267 #endif 268 { arcnet_if_print, DLT_ARCNET }, 269 #ifdef DLT_ARCNET_LINUX 270 { arcnet_linux_if_print, DLT_ARCNET_LINUX }, 271 #endif 272 { raw_if_print, DLT_RAW }, 273 #ifdef DLT_IPV4 274 { raw_if_print, DLT_IPV4 }, 275 #endif 276 #ifdef DLT_IPV6 277 { raw_if_print, DLT_IPV6 }, 278 #endif 279 #ifdef HAVE_PCAP_USB_H 280 #ifdef DLT_USB_LINUX 281 { usb_linux_48_byte_print, DLT_USB_LINUX}, 282 #endif /* DLT_USB_LINUX */ 283 #ifdef DLT_USB_LINUX_MMAPPED 284 { usb_linux_64_byte_print, DLT_USB_LINUX_MMAPPED}, 285 #endif /* DLT_USB_LINUX_MMAPPED */ 286 #endif /* HAVE_PCAP_USB_H */ 287 #ifdef DLT_SYMANTEC_FIREWALL 288 { symantec_if_print, DLT_SYMANTEC_FIREWALL }, 289 #endif 290 #ifdef DLT_C_HDLC 291 { chdlc_if_print, DLT_C_HDLC }, 292 #endif 293 #ifdef DLT_HDLC 294 { chdlc_if_print, DLT_HDLC }, 295 #endif 296 #ifdef DLT_PPP_ETHER 297 { pppoe_if_print, DLT_PPP_ETHER }, 298 #endif 299 #if defined(DLT_PFLOG) && defined(HAVE_NET_PFVAR_H) 300 { pflog_if_print, DLT_PFLOG }, 301 #endif 302 { token_if_print, DLT_IEEE802 }, 303 { fddi_if_print, DLT_FDDI }, 304 #ifdef DLT_LINUX_SLL 305 { sll_if_print, DLT_LINUX_SLL }, 306 #endif 307 #ifdef DLT_FR 308 { fr_if_print, DLT_FR }, 309 #endif 310 #ifdef DLT_FRELAY 311 { fr_if_print, DLT_FRELAY }, 312 #endif 313 #ifdef DLT_MFR 314 { mfr_if_print, DLT_MFR }, 315 #endif 316 { atm_if_print, DLT_ATM_RFC1483 }, 317 #ifdef DLT_SUNATM 318 { sunatm_if_print, DLT_SUNATM }, 319 #endif 320 #ifdef DLT_ENC 321 { enc_if_print, DLT_ENC }, 322 #endif 323 { sl_if_print, DLT_SLIP }, 324 #ifdef DLT_SLIP_BSDOS 325 { sl_bsdos_if_print, DLT_SLIP_BSDOS }, 326 #endif 327 #ifdef DLT_LTALK 328 { ltalk_if_print, DLT_LTALK }, 329 #endif 330 #ifdef DLT_JUNIPER_ATM1 331 { juniper_atm1_print, DLT_JUNIPER_ATM1 }, 332 #endif 333 #ifdef DLT_JUNIPER_ATM2 334 { juniper_atm2_print, DLT_JUNIPER_ATM2 }, 335 #endif 336 #ifdef DLT_JUNIPER_MFR 337 { juniper_mfr_print, DLT_JUNIPER_MFR }, 338 #endif 339 #ifdef DLT_JUNIPER_MLFR 340 { juniper_mlfr_print, DLT_JUNIPER_MLFR }, 341 #endif 342 #ifdef DLT_JUNIPER_MLPPP 343 { juniper_mlppp_print, DLT_JUNIPER_MLPPP }, 344 #endif 345 #ifdef DLT_JUNIPER_PPPOE 346 { juniper_pppoe_print, DLT_JUNIPER_PPPOE }, 347 #endif 348 #ifdef DLT_JUNIPER_PPPOE_ATM 349 { juniper_pppoe_atm_print, DLT_JUNIPER_PPPOE_ATM }, 350 #endif 351 #ifdef DLT_JUNIPER_GGSN 352 { juniper_ggsn_print, DLT_JUNIPER_GGSN }, 353 #endif 354 #ifdef DLT_JUNIPER_ES 355 { juniper_es_print, DLT_JUNIPER_ES }, 356 #endif 357 #ifdef DLT_JUNIPER_MONITOR 358 { juniper_monitor_print, DLT_JUNIPER_MONITOR }, 359 #endif 360 #ifdef DLT_JUNIPER_SERVICES 361 { juniper_services_print, DLT_JUNIPER_SERVICES }, 362 #endif 363 #ifdef DLT_JUNIPER_ETHER 364 { juniper_ether_print, DLT_JUNIPER_ETHER }, 365 #endif 366 #ifdef DLT_JUNIPER_PPP 367 { juniper_ppp_print, DLT_JUNIPER_PPP }, 368 #endif 369 #ifdef DLT_JUNIPER_FRELAY 370 { juniper_frelay_print, DLT_JUNIPER_FRELAY }, 371 #endif 372 #ifdef DLT_JUNIPER_CHDLC 373 { juniper_chdlc_print, DLT_JUNIPER_CHDLC }, 374 #endif 375 #ifdef DLT_PKTAP 376 { pktap_if_print, DLT_PKTAP }, 377 #endif 378 #ifdef DLT_IEEE802_11_RADIO 379 { ieee802_11_radio_if_print, DLT_IEEE802_11_RADIO }, 380 #endif 381 #ifdef DLT_IEEE802_11 382 { ieee802_11_if_print, DLT_IEEE802_11}, 383 #endif 384 #ifdef DLT_IEEE802_11_RADIO_AVS 385 { ieee802_11_radio_avs_if_print, DLT_IEEE802_11_RADIO_AVS }, 386 #endif 387 #ifdef DLT_PRISM_HEADER 388 { prism_if_print, DLT_PRISM_HEADER }, 389 #endif 390 { ppp_if_print, DLT_PPP }, 391 #ifdef DLT_PPP_WITHDIRECTION 392 { ppp_if_print, DLT_PPP_WITHDIRECTION }, 393 #endif 394 #ifdef DLT_PPP_BSDOS 395 { ppp_bsdos_if_print, DLT_PPP_BSDOS }, 396 #endif 397 #ifdef DLT_PPP_SERIAL 398 { ppp_hdlc_if_print, DLT_PPP_SERIAL }, 399 #endif 400 { NULL, 0 }, 401 }; 402 403 static const struct tok status_flags[] = { 404 #ifdef PCAP_IF_UP 405 { PCAP_IF_UP, "Up" }, 406 #endif 407 #ifdef PCAP_IF_RUNNING 408 { PCAP_IF_RUNNING, "Running" }, 409 #endif 410 { PCAP_IF_LOOPBACK, "Loopback" }, 411 { 0, NULL } 412 }; 413 414 if_printer 415 lookup_printer(int type) 416 { 417 const struct printer *p; 418 419 for (p = printers; p->f; ++p) 420 if (type == p->type) 421 return p->f; 422 423 return NULL; 424 /* NOTREACHED */ 425 } 426 427 if_ndo_printer 428 lookup_ndo_printer(int type) 429 { 430 const struct ndo_printer *p; 431 432 for (p = ndo_printers; p->f; ++p) 433 if (type == p->type) 434 return p->f; 435 436 #if defined(DLT_USER2) && defined(DLT_PKTAP) 437 /* 438 * Apple incorrectly chose to use DLT_USER2 for their PKTAP 439 * header. 440 * 441 * We map DLT_PKTAP, whether it's DLT_USER2 as it is on Darwin- 442 * based OSes or the same value as LINKTYPE_PKTAP as it is on 443 * other OSes, to LINKTYPE_PKTAP, so files written with 444 * this version of libpcap for a DLT_PKTAP capture have a link- 445 * layer header type of LINKTYPE_PKTAP. 446 * 447 * However, files written on OS X Mavericks for a DLT_PKTAP 448 * capture have a link-layer header type of LINKTYPE_USER2. 449 * If we don't have a printer for DLT_USER2, and type is 450 * DLT_USER2, we look up the printer for DLT_PKTAP and use 451 * that. 452 */ 453 if (type == DLT_USER2) { 454 for (p = ndo_printers; p->f; ++p) 455 if (DLT_PKTAP == p->type) 456 return p->f; 457 } 458 #endif 459 460 return NULL; 461 /* NOTREACHED */ 462 } 463 464 static pcap_t *pd; 465 466 static int supports_monitor_mode; 467 468 extern int optind; 469 extern int opterr; 470 extern char *optarg; 471 472 struct print_info { 473 netdissect_options *ndo; 474 union { 475 if_printer printer; 476 if_ndo_printer ndo_printer; 477 } p; 478 int ndo_type; 479 }; 480 481 struct dump_info { 482 char *WFileName; 483 char *CurrentFileName; 484 pcap_t *pd; 485 pcap_dumper_t *p; 486 #ifdef __FreeBSD__ 487 int dirfd; 488 #endif 489 }; 490 491 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE 492 static void 493 show_tstamp_types_and_exit(const char *device, pcap_t *pd) 494 { 495 int n_tstamp_types; 496 int *tstamp_types = 0; 497 const char *tstamp_type_name; 498 int i; 499 500 n_tstamp_types = pcap_list_tstamp_types(pd, &tstamp_types); 501 if (n_tstamp_types < 0) 502 error("%s", pcap_geterr(pd)); 503 504 if (n_tstamp_types == 0) { 505 fprintf(stderr, "Time stamp type cannot be set for %s\n", 506 device); 507 exit(0); 508 } 509 fprintf(stderr, "Time stamp types for %s (use option -j to set):\n", 510 device); 511 for (i = 0; i < n_tstamp_types; i++) { 512 tstamp_type_name = pcap_tstamp_type_val_to_name(tstamp_types[i]); 513 if (tstamp_type_name != NULL) { 514 (void) fprintf(stderr, " %s (%s)\n", tstamp_type_name, 515 pcap_tstamp_type_val_to_description(tstamp_types[i])); 516 } else { 517 (void) fprintf(stderr, " %d\n", tstamp_types[i]); 518 } 519 } 520 pcap_free_tstamp_types(tstamp_types); 521 exit(0); 522 } 523 #endif 524 525 static void 526 show_dlts_and_exit(const char *device, pcap_t *pd) 527 { 528 int n_dlts; 529 int *dlts = 0; 530 const char *dlt_name; 531 532 n_dlts = pcap_list_datalinks(pd, &dlts); 533 if (n_dlts < 0) 534 error("%s", pcap_geterr(pd)); 535 else if (n_dlts == 0 || !dlts) 536 error("No data link types."); 537 538 /* 539 * If the interface is known to support monitor mode, indicate 540 * whether these are the data link types available when not in 541 * monitor mode, if -I wasn't specified, or when in monitor mode, 542 * when -I was specified (the link-layer types available in 543 * monitor mode might be different from the ones available when 544 * not in monitor mode). 545 */ 546 if (supports_monitor_mode) 547 (void) fprintf(stderr, "Data link types for %s %s (use option -y to set):\n", 548 device, 549 Iflag ? "when in monitor mode" : "when not in monitor mode"); 550 else 551 (void) fprintf(stderr, "Data link types for %s (use option -y to set):\n", 552 device); 553 554 while (--n_dlts >= 0) { 555 dlt_name = pcap_datalink_val_to_name(dlts[n_dlts]); 556 if (dlt_name != NULL) { 557 (void) fprintf(stderr, " %s (%s)", dlt_name, 558 pcap_datalink_val_to_description(dlts[n_dlts])); 559 560 /* 561 * OK, does tcpdump handle that type? 562 */ 563 if (lookup_printer(dlts[n_dlts]) == NULL 564 && lookup_ndo_printer(dlts[n_dlts]) == NULL) 565 (void) fprintf(stderr, " (printing not supported)"); 566 fprintf(stderr, "\n"); 567 } else { 568 (void) fprintf(stderr, " DLT %d (printing not supported)\n", 569 dlts[n_dlts]); 570 } 571 } 572 #ifdef HAVE_PCAP_FREE_DATALINKS 573 pcap_free_datalinks(dlts); 574 #endif 575 exit(0); 576 } 577 578 #ifdef HAVE_PCAP_FINDALLDEVS 579 static void 580 show_devices_and_exit (void) 581 { 582 pcap_if_t *devpointer; 583 char ebuf[PCAP_ERRBUF_SIZE]; 584 int i; 585 586 if (pcap_findalldevs(&devpointer, ebuf) < 0) 587 error("%s", ebuf); 588 else { 589 for (i = 0; devpointer != NULL; i++) { 590 printf("%d.%s", i+1, devpointer->name); 591 if (devpointer->description != NULL) 592 printf(" (%s)", devpointer->description); 593 if (devpointer->flags != 0) 594 printf(" [%s]", bittok2str(status_flags, "none", devpointer->flags)); 595 printf("\n"); 596 devpointer = devpointer->next; 597 } 598 } 599 exit(0); 600 } 601 #endif /* HAVE_PCAP_FINDALLDEVS */ 602 603 /* 604 * Short options. 605 * 606 * Note that there we use all letters for short options except for g, k, 607 * o, and P, and those are used by other versions of tcpdump, and we should 608 * only use them for the same purposes that the other versions of tcpdump 609 * use them: 610 * 611 * OS X tcpdump uses -g to force non--v output for IP to be on one 612 * line, making it more "g"repable; 613 * 614 * OS X tcpdump uses -k tospecify that packet comments in pcap-ng files 615 * should be printed; 616 * 617 * OpenBSD tcpdump uses -o to indicate that OS fingerprinting should be done 618 * for hosts sending TCP SYN packets; 619 * 620 * OS X tcpdump uses -P to indicate that -w should write pcap-ng rather 621 * than pcap files. 622 * 623 * OS X tcpdump also uses -Q to specify expressions that match packet 624 * metadata, including but not limited to the packet direction. 625 * The expression syntax is different from a simple "in|out|inout", 626 * and those expressions aren't accepted by OS X tcpdump, but the 627 * equivalents would be "in" = "dir=in", "out" = "dir=out", and 628 * "inout" = "dir=in or dir=out", and the parser could conceivably 629 * special-case "in", "out", and "inout" as expressions for backwards 630 * compatibility, so all is not (yet) lost. 631 */ 632 633 /* 634 * Set up flags that might or might not be supported depending on the 635 * version of libpcap we're using. 636 */ 637 #if defined(HAVE_PCAP_CREATE) || defined(WIN32) 638 #define B_FLAG "B:" 639 #define B_FLAG_USAGE " [ -B size ]" 640 #else /* defined(HAVE_PCAP_CREATE) || defined(WIN32) */ 641 #define B_FLAG 642 #define B_FLAG_USAGE 643 #endif /* defined(HAVE_PCAP_CREATE) || defined(WIN32) */ 644 645 #ifdef HAVE_PCAP_CREATE 646 #define I_FLAG "I" 647 #else /* HAVE_PCAP_CREATE */ 648 #define I_FLAG 649 #endif /* HAVE_PCAP_CREATE */ 650 651 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE 652 #define j_FLAG "j:" 653 #define j_FLAG_USAGE " [ -j tstamptype ]" 654 #define J_FLAG "J" 655 #else /* PCAP_ERROR_TSTAMP_TYPE_NOTSUP */ 656 #define j_FLAG 657 #define j_FLAG_USAGE 658 #define J_FLAG 659 #endif /* PCAP_ERROR_TSTAMP_TYPE_NOTSUP */ 660 661 #ifdef HAVE_PCAP_FINDALLDEVS 662 #define D_FLAG "D" 663 #else 664 #define D_FLAG 665 #endif 666 667 #ifdef HAVE_PCAP_DUMP_FLUSH 668 #define U_FLAG "U" 669 #else 670 #define U_FLAG 671 #endif 672 673 #ifdef HAVE_PCAP_SETDIRECTION 674 #define Q_FLAG "Q:" 675 #else 676 #define Q_FLAG 677 #endif 678 679 #define SHORTOPTS "aAb" B_FLAG "c:C:d" D_FLAG "eE:fF:G:hHi:" I_FLAG j_FLAG J_FLAG "KlLm:M:nNOpq" Q_FLAG "r:Rs:StT:u" U_FLAG "vV:w:W:xXy:Yz:Z:#" 680 681 /* 682 * Long options. 683 * 684 * We do not currently have long options corresponding to all short 685 * options; we should probably pick appropriate option names for them. 686 * 687 * However, the short options where the number of times the option is 688 * specified matters, such as -v and -d and -t, should probably not 689 * just map to a long option, as saying 690 * 691 * tcpdump --verbose --verbose 692 * 693 * doesn't make sense; it should be --verbosity={N} or something such 694 * as that. 695 * 696 * For long options with no corresponding short options, we define values 697 * outside the range of ASCII graphic characters, make that the last 698 * component of the entry for the long option, and have a case for that 699 * option in the switch statement. 700 */ 701 #define OPTION_VERSION 128 702 #define OPTION_TSTAMP_PRECISION 129 703 #define OPTION_IMMEDIATE_MODE 130 704 705 static const struct option longopts[] = { 706 #if defined(HAVE_PCAP_CREATE) || defined(WIN32) 707 { "buffer-size", required_argument, NULL, 'B' }, 708 #endif 709 { "list-interfaces", no_argument, NULL, 'D' }, 710 { "help", no_argument, NULL, 'h' }, 711 { "interface", required_argument, NULL, 'i' }, 712 #ifdef HAVE_PCAP_CREATE 713 { "monitor-mode", no_argument, NULL, 'I' }, 714 #endif 715 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE 716 { "time-stamp-type", required_argument, NULL, 'j' }, 717 { "list-time-stamp-types", no_argument, NULL, 'J' }, 718 #endif 719 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION 720 { "time-stamp-precision", required_argument, NULL, OPTION_TSTAMP_PRECISION}, 721 #endif 722 { "dont-verify-checksums", no_argument, NULL, 'K' }, 723 { "list-data-link-types", no_argument, NULL, 'L' }, 724 { "no-optimize", no_argument, NULL, 'O' }, 725 { "no-promiscuous-mode", no_argument, NULL, 'p' }, 726 #ifdef HAVE_PCAP_SETDIRECTION 727 { "direction", required_argument, NULL, 'Q' }, 728 #endif 729 { "snapshot-length", required_argument, NULL, 's' }, 730 { "absolute-tcp-sequence-numbers", no_argument, NULL, 'S' }, 731 #ifdef HAVE_PCAP_DUMP_FLUSH 732 { "packet-buffered", no_argument, NULL, 'U' }, 733 #endif 734 { "linktype", required_argument, NULL, 'y' }, 735 #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE 736 { "immediate-mode", no_argument, NULL, OPTION_IMMEDIATE_MODE }, 737 #endif 738 #if defined(HAVE_PCAP_DEBUG) || defined(HAVE_YYDEBUG) 739 { "debug-filter-parser", no_argument, NULL, 'Y' }, 740 #endif 741 { "relinquish-privileges", required_argument, NULL, 'Z' }, 742 { "number", no_argument, NULL, '#' }, 743 { "version", no_argument, NULL, OPTION_VERSION }, 744 { NULL, 0, NULL, 0 } 745 }; 746 747 #ifndef WIN32 748 /* Drop root privileges and chroot if necessary */ 749 static void 750 droproot(const char *username, const char *chroot_dir) 751 { 752 struct passwd *pw = NULL; 753 754 if (chroot_dir && !username) { 755 fprintf(stderr, "tcpdump: Chroot without dropping root is insecure\n"); 756 exit(1); 757 } 758 759 pw = getpwnam(username); 760 if (pw) { 761 if (chroot_dir) { 762 if (chroot(chroot_dir) != 0 || chdir ("/") != 0) { 763 fprintf(stderr, "tcpdump: Couldn't chroot/chdir to '%.64s': %s\n", 764 chroot_dir, pcap_strerror(errno)); 765 exit(1); 766 } 767 } 768 #ifdef HAVE_LIBCAP_NG 769 int ret = capng_change_id(pw->pw_uid, pw->pw_gid, CAPNG_NO_FLAG); 770 if (ret < 0) { 771 fprintf(stderr, "error : ret %d\n", ret); 772 } 773 else { 774 fprintf(stderr, "dropped privs to %s\n", username); 775 } 776 #else 777 if (initgroups(pw->pw_name, pw->pw_gid) != 0 || 778 setgid(pw->pw_gid) != 0 || setuid(pw->pw_uid) != 0) { 779 fprintf(stderr, "tcpdump: Couldn't change to '%.32s' uid=%lu gid=%lu: %s\n", 780 username, 781 (unsigned long)pw->pw_uid, 782 (unsigned long)pw->pw_gid, 783 pcap_strerror(errno)); 784 exit(1); 785 } 786 else { 787 fprintf(stderr, "dropped privs to %s\n", username); 788 } 789 #endif /* HAVE_LIBCAP_NG */ 790 } 791 else { 792 fprintf(stderr, "tcpdump: Couldn't find user '%.32s'\n", 793 username); 794 exit(1); 795 } 796 #ifdef HAVE_LIBCAP_NG 797 /* We don't need CAP_SETUID and CAP_SETGID any more. */ 798 capng_updatev( 799 CAPNG_DROP, 800 CAPNG_EFFECTIVE | CAPNG_PERMITTED, 801 CAP_SETUID, 802 CAP_SETGID, 803 -1); 804 capng_apply(CAPNG_SELECT_BOTH); 805 #endif /* HAVE_LIBCAP_NG */ 806 807 } 808 #endif /* WIN32 */ 809 810 static int 811 getWflagChars(int x) 812 { 813 int c = 0; 814 815 x -= 1; 816 while (x > 0) { 817 c += 1; 818 x /= 10; 819 } 820 821 return c; 822 } 823 824 825 static void 826 MakeFilename(char *buffer, char *orig_name, int cnt, int max_chars) 827 { 828 char *filename = malloc(PATH_MAX + 1); 829 if (filename == NULL) 830 error("Makefilename: malloc"); 831 832 /* Process with strftime if Gflag is set. */ 833 if (Gflag != 0) { 834 struct tm *local_tm; 835 836 /* Convert Gflag_time to a usable format */ 837 if ((local_tm = localtime(&Gflag_time)) == NULL) { 838 error("MakeTimedFilename: localtime"); 839 } 840 841 /* There's no good way to detect an error in strftime since a return 842 * value of 0 isn't necessarily failure. 843 */ 844 strftime(filename, PATH_MAX, orig_name, local_tm); 845 } else { 846 strncpy(filename, orig_name, PATH_MAX); 847 } 848 849 if (cnt == 0 && max_chars == 0) 850 strncpy(buffer, filename, PATH_MAX + 1); 851 else 852 if (snprintf(buffer, PATH_MAX + 1, "%s%0*d", filename, max_chars, cnt) > PATH_MAX) 853 /* Report an error if the filename is too large */ 854 error("too many output files or filename is too long (> %d)", PATH_MAX); 855 free(filename); 856 } 857 858 static int tcpdump_printf(netdissect_options *ndo _U_, 859 const char *fmt, ...) 860 { 861 862 va_list args; 863 int ret; 864 865 va_start(args, fmt); 866 ret=vfprintf(stdout, fmt, args); 867 va_end(args); 868 869 return ret; 870 } 871 872 static struct print_info 873 get_print_info(int type) 874 { 875 struct print_info printinfo; 876 877 printinfo.ndo_type = 1; 878 printinfo.ndo = gndo; 879 printinfo.p.ndo_printer = lookup_ndo_printer(type); 880 if (printinfo.p.ndo_printer == NULL) { 881 printinfo.p.printer = lookup_printer(type); 882 printinfo.ndo_type = 0; 883 if (printinfo.p.printer == NULL) { 884 gndo->ndo_dltname = pcap_datalink_val_to_name(type); 885 if (gndo->ndo_dltname != NULL) 886 error("packet printing is not supported for link type %s: use -w", 887 gndo->ndo_dltname); 888 else 889 error("packet printing is not supported for link type %d: use -w", type); 890 } 891 } 892 return (printinfo); 893 } 894 895 static char * 896 get_next_file(FILE *VFile, char *ptr) 897 { 898 char *ret; 899 900 ret = fgets(ptr, PATH_MAX, VFile); 901 if (!ret) 902 return NULL; 903 904 if (ptr[strlen(ptr) - 1] == '\n') 905 ptr[strlen(ptr) - 1] = '\0'; 906 907 return ret; 908 } 909 910 #ifdef HAVE_CASPER 911 static cap_channel_t * 912 capdns_setup(void) 913 { 914 cap_channel_t *capcas, *capdnsloc; 915 const char *types[1]; 916 int families[2]; 917 918 capcas = cap_init(); 919 if (capcas == NULL) 920 error("unable to create casper process"); 921 capdnsloc = cap_service_open(capcas, "system.dns"); 922 /* Casper capability no longer needed. */ 923 cap_close(capcas); 924 if (capdnsloc == NULL) 925 error("unable to open system.dns service"); 926 /* Limit system.dns to reverse DNS lookups. */ 927 types[0] = "ADDR"; 928 if (cap_dns_type_limit(capdnsloc, types, 1) < 0) 929 error("unable to limit access to system.dns service"); 930 families[0] = AF_INET; 931 families[1] = AF_INET6; 932 if (cap_dns_family_limit(capdnsloc, families, 2) < 0) 933 error("unable to limit access to system.dns service"); 934 935 return (capdnsloc); 936 } 937 #endif /* HAVE_CASPER */ 938 939 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION 940 static int 941 tstamp_precision_from_string(const char *precision) 942 { 943 if (strncmp(precision, "nano", strlen("nano")) == 0) 944 return PCAP_TSTAMP_PRECISION_NANO; 945 946 if (strncmp(precision, "micro", strlen("micro")) == 0) 947 return PCAP_TSTAMP_PRECISION_MICRO; 948 949 return -EINVAL; 950 } 951 952 static const char * 953 tstamp_precision_to_string(int precision) 954 { 955 switch (precision) { 956 957 case PCAP_TSTAMP_PRECISION_MICRO: 958 return "micro"; 959 960 case PCAP_TSTAMP_PRECISION_NANO: 961 return "nano"; 962 963 default: 964 return "unknown"; 965 } 966 } 967 #endif 968 969 #ifdef __FreeBSD__ 970 /* 971 * Ensure that, on a dump file's descriptor, we have all the rights 972 * necessary to make the standard I/O library work with an fdopen()ed 973 * FILE * from that descriptor. 974 * 975 * A long time ago, in a galaxy far far away, AT&T decided that, instead 976 * of providing separate APIs for getting and setting the FD_ flags on a 977 * descriptor, getting and setting the O_ flags on a descriptor, and 978 * locking files, they'd throw them all into a kitchen-sink fcntl() call 979 * along the lines of ioctl(), the fact that ioctl() operations are 980 * largely specific to particular character devices but fcntl() operations 981 * are either generic to all descriptors or generic to all descriptors for 982 * regular files nonwithstanding. 983 * 984 * The Capsicum people decided that fine-grained control of descriptor 985 * operations was required, so that you need to grant permission for 986 * reading, writing, seeking, and fcntl-ing. The latter, courtesy of 987 * AT&T's decision, means that "fcntl-ing" isn't a thing, but a motley 988 * collection of things, so there are *individual* fcntls for which 989 * permission needs to be granted. 990 * 991 * The FreeBSD standard I/O people implemented some optimizations that 992 * requires that the standard I/O routines be able to determine whether 993 * the descriptor for the FILE * is open append-only or not; as that 994 * descriptor could have come from an open() rather than an fopen(), 995 * that requires that it be able to do an F_GETFL fcntl() to read 996 * the O_ flags. 997 * 998 * Tcpdump uses ftell() to determine how much data has been written 999 * to a file in order to, when used with -C, determine when it's time 1000 * to rotate capture files. ftell() therefore needs to do an lseek() 1001 * to find out the file offset and must, thanks to the aforementioned 1002 * optimization, also know whether the descriptor is open append-only 1003 * or not. 1004 * 1005 * The net result of all the above is that we need to grant CAP_SEEK, 1006 * CAP_WRITE, and CAP_FCNTL with the CAP_FCNTL_GETFL subcapability. 1007 * 1008 * Perhaps this is the universe's way of saying that either 1009 * 1010 * 1) there needs to be an fopenat() call and a pcap_dump_openat() call 1011 * using it, so that Capsicum-capable tcpdump wouldn't need to do 1012 * an fdopen() 1013 * 1014 * or 1015 * 1016 * 2) there needs to be a cap_fdopen() call in the FreeBSD standard 1017 * I/O library that knows what rights are needed by the standard 1018 * I/O library, based on the open mode, and assigns them, perhaps 1019 * with an additional argument indicating, for example, whether 1020 * seeking should be allowed, so that tcpdump doesn't need to know 1021 * what the standard I/O library happens to require this week. 1022 */ 1023 static void 1024 set_dumper_capsicum_rights(pcap_dumper_t *p) 1025 { 1026 int fd = fileno(pcap_dump_file(p)); 1027 cap_rights_t rights; 1028 1029 cap_rights_init(&rights, CAP_SEEK, CAP_WRITE, CAP_FCNTL); 1030 if (cap_rights_limit(fd, &rights) < 0 && errno != ENOSYS) { 1031 error("unable to limit dump descriptor"); 1032 } 1033 if (cap_fcntls_limit(fd, CAP_FCNTL_GETFL) < 0 && errno != ENOSYS) { 1034 error("unable to limit dump descriptor fcntls"); 1035 } 1036 } 1037 #endif 1038 1039 int 1040 main(int argc, char **argv) 1041 { 1042 register int cnt, op, i; 1043 bpf_u_int32 localnet =0 , netmask = 0; 1044 register char *cp, *infile, *cmdbuf, *device, *RFileName, *VFileName, *WFileName; 1045 pcap_handler callback; 1046 int type; 1047 int dlt; 1048 int new_dlt; 1049 const char *dlt_name; 1050 struct bpf_program fcode; 1051 #ifndef WIN32 1052 RETSIGTYPE (*oldhandler)(int); 1053 #endif 1054 struct print_info printinfo; 1055 struct dump_info dumpinfo; 1056 u_char *pcap_userdata; 1057 char ebuf[PCAP_ERRBUF_SIZE]; 1058 char VFileLine[PATH_MAX + 1]; 1059 char *username = NULL; 1060 char *chroot_dir = NULL; 1061 char *ret = NULL; 1062 char *end; 1063 #ifdef HAVE_PCAP_FINDALLDEVS 1064 pcap_if_t *devpointer; 1065 int devnum; 1066 #endif 1067 int status; 1068 FILE *VFile; 1069 #ifdef __FreeBSD__ 1070 cap_rights_t rights; 1071 #endif /* !__FreeBSD__ */ 1072 int cansandbox; 1073 1074 #ifdef WIN32 1075 if(wsockinit() != 0) return 1; 1076 #endif /* WIN32 */ 1077 1078 jflag=-1; /* not set */ 1079 gndo->ndo_Oflag=1; 1080 gndo->ndo_Rflag=1; 1081 gndo->ndo_dlt=-1; 1082 gndo->ndo_default_print=ndo_default_print; 1083 gndo->ndo_printf=tcpdump_printf; 1084 gndo->ndo_error=ndo_error; 1085 gndo->ndo_warning=ndo_warning; 1086 gndo->ndo_snaplen = DEFAULT_SNAPLEN; 1087 gndo->ndo_immediate = 0; 1088 1089 cnt = -1; 1090 device = NULL; 1091 infile = NULL; 1092 RFileName = NULL; 1093 VFileName = NULL; 1094 VFile = NULL; 1095 WFileName = NULL; 1096 dlt = -1; 1097 if ((cp = strrchr(argv[0], '/')) != NULL) 1098 program_name = cp + 1; 1099 else 1100 program_name = argv[0]; 1101 1102 /* 1103 * On platforms where the CPU doesn't support unaligned loads, 1104 * force unaligned accesses to abort with SIGBUS, rather than 1105 * being fixed up (slowly) by the OS kernel; on those platforms, 1106 * misaligned accesses are bugs, and we want tcpdump to crash so 1107 * that the bugs are reported. 1108 */ 1109 if (abort_on_misalignment(ebuf, sizeof(ebuf)) < 0) 1110 error("%s", ebuf); 1111 1112 #ifdef USE_LIBSMI 1113 smiInit("tcpdump"); 1114 #endif 1115 1116 while ( 1117 (op = getopt_long(argc, argv, SHORTOPTS, longopts, NULL)) != -1) 1118 switch (op) { 1119 1120 case 'a': 1121 /* compatibility for old -a */ 1122 break; 1123 1124 case 'A': 1125 ++Aflag; 1126 break; 1127 1128 case 'b': 1129 ++bflag; 1130 break; 1131 1132 #if defined(HAVE_PCAP_CREATE) || defined(WIN32) 1133 case 'B': 1134 Bflag = atoi(optarg)*1024; 1135 if (Bflag <= 0) 1136 error("invalid packet buffer size %s", optarg); 1137 break; 1138 #endif /* defined(HAVE_PCAP_CREATE) || defined(WIN32) */ 1139 1140 case 'c': 1141 cnt = atoi(optarg); 1142 if (cnt <= 0) 1143 error("invalid packet count %s", optarg); 1144 break; 1145 1146 case 'C': 1147 Cflag = atoi(optarg) * 1000000; 1148 if (Cflag < 0) 1149 error("invalid file size %s", optarg); 1150 break; 1151 1152 case 'd': 1153 ++dflag; 1154 break; 1155 1156 case 'D': 1157 Dflag++; 1158 break; 1159 1160 case 'L': 1161 Lflag++; 1162 break; 1163 1164 case 'e': 1165 ++eflag; 1166 break; 1167 1168 case 'E': 1169 #ifndef HAVE_LIBCRYPTO 1170 warning("crypto code not compiled in"); 1171 #endif 1172 gndo->ndo_espsecret = optarg; 1173 break; 1174 1175 case 'f': 1176 ++fflag; 1177 break; 1178 1179 case 'F': 1180 infile = optarg; 1181 break; 1182 1183 case 'G': 1184 Gflag = atoi(optarg); 1185 if (Gflag < 0) 1186 error("invalid number of seconds %s", optarg); 1187 1188 /* We will create one file initially. */ 1189 Gflag_count = 0; 1190 1191 /* Grab the current time for rotation use. */ 1192 if ((Gflag_time = time(NULL)) == (time_t)-1) { 1193 error("main: can't get current time: %s", 1194 pcap_strerror(errno)); 1195 } 1196 break; 1197 1198 case 'h': 1199 print_usage(); 1200 exit(0); 1201 break; 1202 1203 case 'H': 1204 ++Hflag; 1205 break; 1206 1207 case 'i': 1208 if (optarg[0] == '0' && optarg[1] == 0) 1209 error("Invalid adapter index"); 1210 1211 #ifdef HAVE_PCAP_FINDALLDEVS 1212 /* 1213 * If the argument is a number, treat it as 1214 * an index into the list of adapters, as 1215 * printed by "tcpdump -D". 1216 * 1217 * This should be OK on UNIX systems, as interfaces 1218 * shouldn't have names that begin with digits. 1219 * It can be useful on Windows, where more than 1220 * one interface can have the same name. 1221 */ 1222 devnum = strtol(optarg, &end, 10); 1223 if (optarg != end && *end == '\0') { 1224 if (devnum < 0) 1225 error("Invalid adapter index"); 1226 1227 if (pcap_findalldevs(&devpointer, ebuf) < 0) 1228 error("%s", ebuf); 1229 else { 1230 /* 1231 * Look for the devnum-th entry 1232 * in the list of devices 1233 * (1-based). 1234 */ 1235 for (i = 0; 1236 i < devnum-1 && devpointer != NULL; 1237 i++, devpointer = devpointer->next) 1238 ; 1239 if (devpointer == NULL) 1240 error("Invalid adapter index"); 1241 } 1242 device = devpointer->name; 1243 break; 1244 } 1245 #endif /* HAVE_PCAP_FINDALLDEVS */ 1246 device = optarg; 1247 break; 1248 1249 #ifdef HAVE_PCAP_CREATE 1250 case 'I': 1251 ++Iflag; 1252 break; 1253 #endif /* HAVE_PCAP_CREATE */ 1254 1255 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE 1256 case 'j': 1257 jflag = pcap_tstamp_type_name_to_val(optarg); 1258 if (jflag < 0) 1259 error("invalid time stamp type %s", optarg); 1260 break; 1261 1262 case 'J': 1263 Jflag++; 1264 break; 1265 #endif 1266 1267 case 'l': 1268 #ifdef WIN32 1269 /* 1270 * _IOLBF is the same as _IOFBF in Microsoft's C 1271 * libraries; the only alternative they offer 1272 * is _IONBF. 1273 * 1274 * XXX - this should really be checking for MSVC++, 1275 * not WIN32, if, for example, MinGW has its own 1276 * C library that is more UNIX-compatible. 1277 */ 1278 setvbuf(stdout, NULL, _IONBF, 0); 1279 #else /* WIN32 */ 1280 #ifdef HAVE_SETLINEBUF 1281 setlinebuf(stdout); 1282 #else 1283 setvbuf(stdout, NULL, _IOLBF, 0); 1284 #endif 1285 #endif /* WIN32 */ 1286 break; 1287 1288 case 'K': 1289 ++Kflag; 1290 break; 1291 1292 case 'm': 1293 #ifdef USE_LIBSMI 1294 if (smiLoadModule(optarg) == 0) { 1295 error("could not load MIB module %s", optarg); 1296 } 1297 sflag = 1; 1298 #else 1299 (void)fprintf(stderr, "%s: ignoring option `-m %s' ", 1300 program_name, optarg); 1301 (void)fprintf(stderr, "(no libsmi support)\n"); 1302 #endif 1303 break; 1304 1305 case 'M': 1306 /* TCP-MD5 shared secret */ 1307 #ifndef HAVE_LIBCRYPTO 1308 warning("crypto code not compiled in"); 1309 #endif 1310 sigsecret = optarg; 1311 break; 1312 1313 case 'n': 1314 ++nflag; 1315 break; 1316 1317 case 'N': 1318 ++Nflag; 1319 break; 1320 1321 case 'O': 1322 Oflag = 0; 1323 break; 1324 1325 case 'p': 1326 ++pflag; 1327 break; 1328 1329 case 'q': 1330 ++qflag; 1331 ++suppress_default_print; 1332 break; 1333 1334 #ifdef HAVE_PCAP_SETDIRECTION 1335 case 'Q': 1336 if (strcasecmp(optarg, "in") == 0) 1337 Qflag = PCAP_D_IN; 1338 else if (strcasecmp(optarg, "out") == 0) 1339 Qflag = PCAP_D_OUT; 1340 else if (strcasecmp(optarg, "inout") == 0) 1341 Qflag = PCAP_D_INOUT; 1342 else 1343 error("unknown capture direction `%s'", optarg); 1344 break; 1345 #endif /* HAVE_PCAP_SETDIRECTION */ 1346 1347 case 'r': 1348 RFileName = optarg; 1349 break; 1350 1351 case 'R': 1352 Rflag = 0; 1353 break; 1354 1355 case 's': 1356 snaplen = strtol(optarg, &end, 0); 1357 if (optarg == end || *end != '\0' 1358 || snaplen < 0 || snaplen > MAXIMUM_SNAPLEN) 1359 error("invalid snaplen %s", optarg); 1360 else if (snaplen == 0) 1361 snaplen = MAXIMUM_SNAPLEN; 1362 break; 1363 1364 case 'S': 1365 ++Sflag; 1366 break; 1367 1368 case 't': 1369 ++tflag; 1370 break; 1371 1372 case 'T': 1373 if (strcasecmp(optarg, "vat") == 0) 1374 packettype = PT_VAT; 1375 else if (strcasecmp(optarg, "wb") == 0) 1376 packettype = PT_WB; 1377 else if (strcasecmp(optarg, "rpc") == 0) 1378 packettype = PT_RPC; 1379 else if (strcasecmp(optarg, "rtp") == 0) 1380 packettype = PT_RTP; 1381 else if (strcasecmp(optarg, "rtcp") == 0) 1382 packettype = PT_RTCP; 1383 else if (strcasecmp(optarg, "snmp") == 0) 1384 packettype = PT_SNMP; 1385 else if (strcasecmp(optarg, "cnfp") == 0) 1386 packettype = PT_CNFP; 1387 else if (strcasecmp(optarg, "tftp") == 0) 1388 packettype = PT_TFTP; 1389 else if (strcasecmp(optarg, "aodv") == 0) 1390 packettype = PT_AODV; 1391 else if (strcasecmp(optarg, "carp") == 0) 1392 packettype = PT_CARP; 1393 else if (strcasecmp(optarg, "radius") == 0) 1394 packettype = PT_RADIUS; 1395 else if (strcasecmp(optarg, "zmtp1") == 0) 1396 packettype = PT_ZMTP1; 1397 else if (strcasecmp(optarg, "vxlan") == 0) 1398 packettype = PT_VXLAN; 1399 else if (strcasecmp(optarg, "pgm") == 0) 1400 packettype = PT_PGM; 1401 else if (strcasecmp(optarg, "pgm_zmtp1") == 0) 1402 packettype = PT_PGM_ZMTP1; 1403 else if (strcasecmp(optarg, "lmp") == 0) 1404 packettype = PT_LMP; 1405 else 1406 error("unknown packet type `%s'", optarg); 1407 break; 1408 1409 case 'u': 1410 ++uflag; 1411 break; 1412 1413 #ifdef HAVE_PCAP_DUMP_FLUSH 1414 case 'U': 1415 ++Uflag; 1416 break; 1417 #endif 1418 1419 case 'v': 1420 ++vflag; 1421 break; 1422 1423 case 'V': 1424 VFileName = optarg; 1425 break; 1426 1427 case 'w': 1428 WFileName = optarg; 1429 break; 1430 1431 case 'W': 1432 Wflag = atoi(optarg); 1433 if (Wflag < 0) 1434 error("invalid number of output files %s", optarg); 1435 WflagChars = getWflagChars(Wflag); 1436 break; 1437 1438 case 'x': 1439 ++xflag; 1440 ++suppress_default_print; 1441 break; 1442 1443 case 'X': 1444 ++Xflag; 1445 ++suppress_default_print; 1446 break; 1447 1448 case 'y': 1449 gndo->ndo_dltname = optarg; 1450 gndo->ndo_dlt = 1451 pcap_datalink_name_to_val(gndo->ndo_dltname); 1452 if (gndo->ndo_dlt < 0) 1453 error("invalid data link type %s", gndo->ndo_dltname); 1454 break; 1455 1456 #if defined(HAVE_PCAP_DEBUG) || defined(HAVE_YYDEBUG) 1457 case 'Y': 1458 { 1459 /* Undocumented flag */ 1460 #ifdef HAVE_PCAP_DEBUG 1461 extern int pcap_debug; 1462 pcap_debug = 1; 1463 #else 1464 extern int yydebug; 1465 yydebug = 1; 1466 #endif 1467 } 1468 break; 1469 #endif 1470 case 'z': 1471 zflag = strdup(optarg); 1472 break; 1473 1474 case 'Z': 1475 username = strdup(optarg); 1476 break; 1477 1478 case '#': 1479 gndo->ndo_packet_number = 1; 1480 break; 1481 1482 case OPTION_VERSION: 1483 print_version(); 1484 exit(0); 1485 break; 1486 1487 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION 1488 case OPTION_TSTAMP_PRECISION: 1489 gndo->ndo_tstamp_precision = tstamp_precision_from_string(optarg); 1490 if (gndo->ndo_tstamp_precision < 0) 1491 error("unsupported time stamp precision"); 1492 break; 1493 #endif 1494 1495 #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE 1496 case OPTION_IMMEDIATE_MODE: 1497 gndo->ndo_immediate = 1; 1498 break; 1499 #endif 1500 1501 default: 1502 print_usage(); 1503 exit(1); 1504 /* NOTREACHED */ 1505 } 1506 1507 #ifdef HAVE_PCAP_FINDALLDEVS 1508 if (Dflag) 1509 show_devices_and_exit(); 1510 #endif 1511 1512 switch (tflag) { 1513 1514 case 0: /* Default */ 1515 case 4: /* Default + Date*/ 1516 thiszone = gmt2local(0); 1517 break; 1518 1519 case 1: /* No time stamp */ 1520 case 2: /* Unix timeval style */ 1521 case 3: /* Microseconds since previous packet */ 1522 case 5: /* Microseconds since first packet */ 1523 break; 1524 1525 default: /* Not supported */ 1526 error("only -t, -tt, -ttt, -tttt and -ttttt are supported"); 1527 break; 1528 } 1529 1530 if (fflag != 0 && (VFileName != NULL || RFileName != NULL)) 1531 error("-f can not be used with -V or -r"); 1532 1533 if (VFileName != NULL && RFileName != NULL) 1534 error("-V and -r are mutually exclusive."); 1535 1536 #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE 1537 /* 1538 * If we're printing dissected packets to the standard output 1539 * rather than saving raw packets to a file, and the standard 1540 * output is a terminal, use immediate mode, as the user's 1541 * probably expecting to see packets pop up immediately. 1542 */ 1543 if (WFileName == NULL && isatty(1)) 1544 gndo->ndo_immediate = 1; 1545 #endif 1546 1547 #ifdef WITH_CHROOT 1548 /* if run as root, prepare for chrooting */ 1549 if (getuid() == 0 || geteuid() == 0) { 1550 /* future extensibility for cmd-line arguments */ 1551 if (!chroot_dir) 1552 chroot_dir = WITH_CHROOT; 1553 } 1554 #endif 1555 1556 #ifdef WITH_USER 1557 /* if run as root, prepare for dropping root privileges */ 1558 if (getuid() == 0 || geteuid() == 0) { 1559 /* Run with '-Z root' to restore old behaviour */ 1560 if (!username) 1561 username = WITH_USER; 1562 } 1563 #endif 1564 1565 if (RFileName != NULL || VFileName != NULL) { 1566 /* 1567 * If RFileName is non-null, it's the pathname of a 1568 * savefile to read. If VFileName is non-null, it's 1569 * the pathname of a file containing a list of pathnames 1570 * (one per line) of savefiles to read. 1571 * 1572 * In either case, we're reading a savefile, not doing 1573 * a live capture. 1574 */ 1575 #ifndef WIN32 1576 /* 1577 * We don't need network access, so relinquish any set-UID 1578 * or set-GID privileges we have (if any). 1579 * 1580 * We do *not* want set-UID privileges when opening a 1581 * trace file, as that might let the user read other 1582 * people's trace files (especially if we're set-UID 1583 * root). 1584 */ 1585 if (setgid(getgid()) != 0 || setuid(getuid()) != 0 ) 1586 fprintf(stderr, "Warning: setgid/setuid failed !\n"); 1587 #endif /* WIN32 */ 1588 if (VFileName != NULL) { 1589 if (VFileName[0] == '-' && VFileName[1] == '\0') 1590 VFile = stdin; 1591 else 1592 VFile = fopen(VFileName, "r"); 1593 1594 if (VFile == NULL) 1595 error("Unable to open file: %s\n", strerror(errno)); 1596 1597 ret = get_next_file(VFile, VFileLine); 1598 if (!ret) 1599 error("Nothing in %s\n", VFileName); 1600 RFileName = VFileLine; 1601 } 1602 1603 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION 1604 pd = pcap_open_offline_with_tstamp_precision(RFileName, 1605 gndo->ndo_tstamp_precision, ebuf); 1606 #else 1607 pd = pcap_open_offline(RFileName, ebuf); 1608 #endif 1609 1610 if (pd == NULL) 1611 error("%s", ebuf); 1612 #ifdef HAVE_CASPER 1613 cap_rights_init(&rights, CAP_READ); 1614 if (cap_rights_limit(fileno(pcap_file(pd)), &rights) < 0 && 1615 errno != ENOSYS) { 1616 error("unable to limit pcap descriptor"); 1617 } 1618 #endif 1619 dlt = pcap_datalink(pd); 1620 dlt_name = pcap_datalink_val_to_name(dlt); 1621 if (dlt_name == NULL) { 1622 fprintf(stderr, "reading from file %s, link-type %u\n", 1623 RFileName, dlt); 1624 } else { 1625 fprintf(stderr, 1626 "reading from file %s, link-type %s (%s)\n", 1627 RFileName, dlt_name, 1628 pcap_datalink_val_to_description(dlt)); 1629 } 1630 } else { 1631 /* 1632 * We're doing a live capture. 1633 */ 1634 if (device == NULL) { 1635 device = pcap_lookupdev(ebuf); 1636 if (device == NULL) 1637 error("%s", ebuf); 1638 } 1639 #ifdef WIN32 1640 /* 1641 * Print a message to the standard error on Windows. 1642 * XXX - why do it here, with a different message? 1643 */ 1644 if(strlen(device) == 1) /* we assume that an ASCII string is always longer than 1 char */ 1645 { /* a Unicode string has a \0 as second byte (so strlen() is 1) */ 1646 fprintf(stderr, "%s: listening on %ws\n", program_name, device); 1647 } 1648 else 1649 { 1650 fprintf(stderr, "%s: listening on %s\n", program_name, device); 1651 } 1652 1653 fflush(stderr); 1654 #endif /* WIN32 */ 1655 #ifdef HAVE_PCAP_CREATE 1656 pd = pcap_create(device, ebuf); 1657 if (pd == NULL) 1658 error("%s", ebuf); 1659 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE 1660 if (Jflag) 1661 show_tstamp_types_and_exit(device, pd); 1662 #endif 1663 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION 1664 status = pcap_set_tstamp_precision(pd, gndo->ndo_tstamp_precision); 1665 if (status != 0) 1666 error("%s: Can't set %ssecond time stamp precision: %s", 1667 device, 1668 tstamp_precision_to_string(gndo->ndo_tstamp_precision), 1669 pcap_statustostr(status)); 1670 #endif 1671 1672 #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE 1673 if (gndo->ndo_immediate) { 1674 status = pcap_set_immediate_mode(pd, 1); 1675 if (status != 0) 1676 error("%s: Can't set immediate mode: %s", 1677 device, 1678 pcap_statustostr(status)); 1679 } 1680 #endif 1681 /* 1682 * Is this an interface that supports monitor mode? 1683 */ 1684 if (pcap_can_set_rfmon(pd) == 1) 1685 supports_monitor_mode = 1; 1686 else 1687 supports_monitor_mode = 0; 1688 status = pcap_set_snaplen(pd, snaplen); 1689 if (status != 0) 1690 error("%s: Can't set snapshot length: %s", 1691 device, pcap_statustostr(status)); 1692 status = pcap_set_promisc(pd, !pflag); 1693 if (status != 0) 1694 error("%s: Can't set promiscuous mode: %s", 1695 device, pcap_statustostr(status)); 1696 if (Iflag) { 1697 status = pcap_set_rfmon(pd, 1); 1698 if (status != 0) 1699 error("%s: Can't set monitor mode: %s", 1700 device, pcap_statustostr(status)); 1701 } 1702 status = pcap_set_timeout(pd, 1000); 1703 if (status != 0) 1704 error("%s: pcap_set_timeout failed: %s", 1705 device, pcap_statustostr(status)); 1706 if (Bflag != 0) { 1707 status = pcap_set_buffer_size(pd, Bflag); 1708 if (status != 0) 1709 error("%s: Can't set buffer size: %s", 1710 device, pcap_statustostr(status)); 1711 } 1712 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE 1713 if (jflag != -1) { 1714 status = pcap_set_tstamp_type(pd, jflag); 1715 if (status < 0) 1716 error("%s: Can't set time stamp type: %s", 1717 device, pcap_statustostr(status)); 1718 } 1719 #endif 1720 status = pcap_activate(pd); 1721 if (status < 0) { 1722 /* 1723 * pcap_activate() failed. 1724 */ 1725 cp = pcap_geterr(pd); 1726 if (status == PCAP_ERROR) 1727 error("%s", cp); 1728 else if ((status == PCAP_ERROR_NO_SUCH_DEVICE || 1729 status == PCAP_ERROR_PERM_DENIED) && 1730 *cp != '\0') 1731 error("%s: %s\n(%s)", device, 1732 pcap_statustostr(status), cp); 1733 #ifdef __FreeBSD__ 1734 else if (status == PCAP_ERROR_RFMON_NOTSUP && 1735 strncmp(device, "wlan", 4) == 0) { 1736 char parent[8], newdev[8]; 1737 char sysctl[32]; 1738 size_t s = sizeof(parent); 1739 1740 snprintf(sysctl, sizeof(sysctl), 1741 "net.wlan.%d.%%parent", atoi(device + 4)); 1742 sysctlbyname(sysctl, parent, &s, NULL, 0); 1743 strlcpy(newdev, device, sizeof(newdev)); 1744 /* Suggest a new wlan device. */ 1745 newdev[strlen(newdev)-1]++; 1746 error("%s is not a monitor mode VAP\n" 1747 "To create a new monitor mode VAP use:\n" 1748 " ifconfig %s create wlandev %s wlanmode " 1749 "monitor\nand use %s as the tcpdump " 1750 "interface", device, newdev, parent, 1751 newdev); 1752 } 1753 #endif 1754 else 1755 error("%s: %s", device, 1756 pcap_statustostr(status)); 1757 } else if (status > 0) { 1758 /* 1759 * pcap_activate() succeeded, but it's warning us 1760 * of a problem it had. 1761 */ 1762 cp = pcap_geterr(pd); 1763 if (status == PCAP_WARNING) 1764 warning("%s", cp); 1765 else if (status == PCAP_WARNING_PROMISC_NOTSUP && 1766 *cp != '\0') 1767 warning("%s: %s\n(%s)", device, 1768 pcap_statustostr(status), cp); 1769 else 1770 warning("%s: %s", device, 1771 pcap_statustostr(status)); 1772 } 1773 #ifdef HAVE_PCAP_SETDIRECTION 1774 if (Qflag != -1) { 1775 status = pcap_setdirection(pd, Qflag); 1776 if (status != 0) 1777 error("%s: pcap_setdirection() failed: %s", 1778 device, pcap_geterr(pd)); 1779 } 1780 #endif /* HAVE_PCAP_SETDIRECTION */ 1781 #else 1782 *ebuf = '\0'; 1783 pd = pcap_open_live(device, snaplen, !pflag, 1000, ebuf); 1784 if (pd == NULL) 1785 error("%s", ebuf); 1786 else if (*ebuf) 1787 warning("%s", ebuf); 1788 #endif /* HAVE_PCAP_CREATE */ 1789 /* 1790 * Let user own process after socket has been opened. 1791 */ 1792 #ifndef WIN32 1793 if (setgid(getgid()) != 0 || setuid(getuid()) != 0) 1794 fprintf(stderr, "Warning: setgid/setuid failed !\n"); 1795 #endif /* WIN32 */ 1796 #if !defined(HAVE_PCAP_CREATE) && defined(WIN32) 1797 if(Bflag != 0) 1798 if(pcap_setbuff(pd, Bflag)==-1){ 1799 error("%s", pcap_geterr(pd)); 1800 } 1801 #endif /* !defined(HAVE_PCAP_CREATE) && defined(WIN32) */ 1802 if (Lflag) 1803 show_dlts_and_exit(device, pd); 1804 if (gndo->ndo_dlt >= 0) { 1805 #ifdef HAVE_PCAP_SET_DATALINK 1806 if (pcap_set_datalink(pd, gndo->ndo_dlt) < 0) 1807 error("%s", pcap_geterr(pd)); 1808 #else 1809 /* 1810 * We don't actually support changing the 1811 * data link type, so we only let them 1812 * set it to what it already is. 1813 */ 1814 if (gndo->ndo_dlt != pcap_datalink(pd)) { 1815 error("%s is not one of the DLTs supported by this device\n", 1816 gndo->ndo_dltname); 1817 } 1818 #endif 1819 (void)fprintf(stderr, "%s: data link type %s\n", 1820 program_name, gndo->ndo_dltname); 1821 (void)fflush(stderr); 1822 } 1823 i = pcap_snapshot(pd); 1824 if (snaplen < i) { 1825 warning("snaplen raised from %d to %d", snaplen, i); 1826 snaplen = i; 1827 } 1828 if(fflag != 0) { 1829 if (pcap_lookupnet(device, &localnet, &netmask, ebuf) < 0) { 1830 warning("foreign (-f) flag used but: %s", ebuf); 1831 } 1832 } 1833 1834 } 1835 if (infile) 1836 cmdbuf = read_infile(infile); 1837 else 1838 cmdbuf = copy_argv(&argv[optind]); 1839 1840 if (pcap_compile(pd, &fcode, cmdbuf, Oflag, netmask) < 0) 1841 error("%s", pcap_geterr(pd)); 1842 if (dflag) { 1843 bpf_dump(&fcode, dflag); 1844 pcap_close(pd); 1845 free(cmdbuf); 1846 exit(0); 1847 } 1848 1849 #ifdef HAVE_CASPER 1850 if (!nflag) 1851 capdns = capdns_setup(); 1852 #endif /* HAVE_CASPER */ 1853 1854 init_addrtoname(gndo, localnet, netmask); 1855 init_checksum(); 1856 1857 #ifndef WIN32 1858 (void)setsignal(SIGPIPE, cleanup); 1859 (void)setsignal(SIGTERM, cleanup); 1860 (void)setsignal(SIGINT, cleanup); 1861 #endif /* WIN32 */ 1862 #if defined(HAVE_FORK) || defined(HAVE_VFORK) 1863 (void)setsignal(SIGCHLD, child_cleanup); 1864 #endif 1865 /* Cooperate with nohup(1) */ 1866 #ifndef WIN32 1867 if ((oldhandler = setsignal(SIGHUP, cleanup)) != SIG_DFL) 1868 (void)setsignal(SIGHUP, oldhandler); 1869 #endif /* WIN32 */ 1870 1871 #ifndef WIN32 1872 /* 1873 * If a user name was specified with "-Z", attempt to switch to 1874 * that user's UID. This would probably be used with sudo, 1875 * to allow tcpdump to be run in a special restricted 1876 * account (if you just want to allow users to open capture 1877 * devices, and can't just give users that permission, 1878 * you'd make tcpdump set-UID or set-GID). 1879 * 1880 * Tcpdump doesn't necessarily write only to one savefile; 1881 * the general only way to allow a -Z instance to write to 1882 * savefiles as the user under whose UID it's run, rather 1883 * than as the user specified with -Z, would thus be to switch 1884 * to the original user ID before opening a capture file and 1885 * then switch back to the -Z user ID after opening the savefile. 1886 * Switching to the -Z user ID only after opening the first 1887 * savefile doesn't handle the general case. 1888 */ 1889 1890 if (getuid() == 0 || geteuid() == 0) { 1891 #ifdef HAVE_LIBCAP_NG 1892 /* Initialize capng */ 1893 capng_clear(CAPNG_SELECT_BOTH); 1894 if (username) { 1895 capng_updatev( 1896 CAPNG_ADD, 1897 CAPNG_PERMITTED | CAPNG_EFFECTIVE, 1898 CAP_SETUID, 1899 CAP_SETGID, 1900 -1); 1901 } 1902 1903 if (WFileName) { 1904 capng_update( 1905 CAPNG_ADD, 1906 CAPNG_PERMITTED | CAPNG_EFFECTIVE, 1907 CAP_DAC_OVERRIDE 1908 ); 1909 } 1910 capng_apply(CAPNG_SELECT_BOTH); 1911 #endif /* HAVE_LIBCAP_NG */ 1912 if (username || chroot_dir) 1913 droproot(username, chroot_dir); 1914 1915 } 1916 #endif /* WIN32 */ 1917 1918 if (pcap_setfilter(pd, &fcode) < 0) 1919 error("%s", pcap_geterr(pd)); 1920 #ifdef HAVE_CASPER 1921 if (RFileName == NULL && VFileName == NULL) { 1922 static const unsigned long cmds[] = { BIOCGSTATS }; 1923 1924 /* 1925 * The various libpcap devices use a combination of 1926 * read (bpf), ioctl (bpf, netmap), poll (netmap). 1927 * Grant the relevant access rights, sorted by name. 1928 */ 1929 cap_rights_init(&rights, CAP_EVENT, CAP_IOCTL, CAP_READ); 1930 if (cap_rights_limit(pcap_fileno(pd), &rights) < 0 && 1931 errno != ENOSYS) { 1932 error("unable to limit pcap descriptor"); 1933 } 1934 if (cap_ioctls_limit(pcap_fileno(pd), cmds, 1935 sizeof(cmds) / sizeof(cmds[0])) < 0 && errno != ENOSYS) { 1936 error("unable to limit ioctls on pcap descriptor"); 1937 } 1938 } 1939 #endif 1940 if (WFileName) { 1941 pcap_dumper_t *p; 1942 /* Do not exceed the default PATH_MAX for files. */ 1943 dumpinfo.CurrentFileName = (char *)malloc(PATH_MAX + 1); 1944 1945 if (dumpinfo.CurrentFileName == NULL) 1946 error("malloc of dumpinfo.CurrentFileName"); 1947 1948 /* We do not need numbering for dumpfiles if Cflag isn't set. */ 1949 if (Cflag != 0) 1950 MakeFilename(dumpinfo.CurrentFileName, WFileName, 0, WflagChars); 1951 else 1952 MakeFilename(dumpinfo.CurrentFileName, WFileName, 0, 0); 1953 1954 p = pcap_dump_open(pd, dumpinfo.CurrentFileName); 1955 #ifdef HAVE_LIBCAP_NG 1956 /* Give up CAP_DAC_OVERRIDE capability. 1957 * Only allow it to be restored if the -C or -G flag have been 1958 * set since we may need to create more files later on. 1959 */ 1960 capng_update( 1961 CAPNG_DROP, 1962 (Cflag || Gflag ? 0 : CAPNG_PERMITTED) 1963 | CAPNG_EFFECTIVE, 1964 CAP_DAC_OVERRIDE 1965 ); 1966 capng_apply(CAPNG_SELECT_BOTH); 1967 #endif /* HAVE_LIBCAP_NG */ 1968 if (p == NULL) 1969 error("%s", pcap_geterr(pd)); 1970 #ifdef __FreeBSD__ 1971 set_dumper_capsicum_rights(p); 1972 #endif 1973 if (Cflag != 0 || Gflag != 0) { 1974 #ifdef __FreeBSD__ 1975 dumpinfo.WFileName = strdup(basename(WFileName)); 1976 dumpinfo.dirfd = open(dirname(WFileName), 1977 O_DIRECTORY | O_RDONLY); 1978 if (dumpinfo.dirfd < 0) { 1979 error("unable to open directory %s", 1980 dirname(WFileName)); 1981 } 1982 cap_rights_init(&rights, CAP_CREATE, CAP_FCNTL, 1983 CAP_FTRUNCATE, CAP_LOOKUP, CAP_SEEK, CAP_WRITE); 1984 if (cap_rights_limit(dumpinfo.dirfd, &rights) < 0 && 1985 errno != ENOSYS) { 1986 error("unable to limit directory rights"); 1987 } 1988 if (cap_fcntls_limit(dumpinfo.dirfd, CAP_FCNTL_GETFL) < 0 && 1989 errno != ENOSYS) { 1990 error("unable to limit dump descriptor fcntls"); 1991 } 1992 #else /* !__FreeBSD__ */ 1993 dumpinfo.WFileName = WFileName; 1994 #endif 1995 callback = dump_packet_and_trunc; 1996 dumpinfo.pd = pd; 1997 dumpinfo.p = p; 1998 pcap_userdata = (u_char *)&dumpinfo; 1999 } else { 2000 callback = dump_packet; 2001 pcap_userdata = (u_char *)p; 2002 } 2003 #ifdef HAVE_PCAP_DUMP_FLUSH 2004 if (Uflag) 2005 pcap_dump_flush(p); 2006 #endif 2007 } else { 2008 type = pcap_datalink(pd); 2009 printinfo = get_print_info(type); 2010 callback = print_packet; 2011 pcap_userdata = (u_char *)&printinfo; 2012 } 2013 2014 #ifdef SIGNAL_REQ_INFO 2015 /* 2016 * We can't get statistics when reading from a file rather 2017 * than capturing from a device. 2018 */ 2019 if (RFileName == NULL) 2020 (void)setsignal(SIGNAL_REQ_INFO, requestinfo); 2021 #endif 2022 2023 if (vflag > 0 && WFileName) { 2024 /* 2025 * When capturing to a file, "-v" means tcpdump should, 2026 * every 10 secodns, "v"erbosely report the number of 2027 * packets captured. 2028 */ 2029 #ifdef USE_WIN32_MM_TIMER 2030 /* call verbose_stats_dump() each 1000 +/-100msec */ 2031 timer_id = timeSetEvent(1000, 100, verbose_stats_dump, 0, TIME_PERIODIC); 2032 setvbuf(stderr, NULL, _IONBF, 0); 2033 #elif defined(HAVE_ALARM) 2034 (void)setsignal(SIGALRM, verbose_stats_dump); 2035 alarm(1); 2036 #endif 2037 } 2038 2039 #ifndef WIN32 2040 if (RFileName == NULL) { 2041 /* 2042 * Live capture (if -V was specified, we set RFileName 2043 * to a file from the -V file). Print a message to 2044 * the standard error on UN*X. 2045 */ 2046 if (!vflag && !WFileName) { 2047 (void)fprintf(stderr, 2048 "%s: verbose output suppressed, use -v or -vv for full protocol decode\n", 2049 program_name); 2050 } else 2051 (void)fprintf(stderr, "%s: ", program_name); 2052 dlt = pcap_datalink(pd); 2053 dlt_name = pcap_datalink_val_to_name(dlt); 2054 if (dlt_name == NULL) { 2055 (void)fprintf(stderr, "listening on %s, link-type %u, capture size %u bytes\n", 2056 device, dlt, snaplen); 2057 } else { 2058 (void)fprintf(stderr, "listening on %s, link-type %s (%s), capture size %u bytes\n", 2059 device, dlt_name, 2060 pcap_datalink_val_to_description(dlt), snaplen); 2061 } 2062 (void)fflush(stderr); 2063 } 2064 #endif /* WIN32 */ 2065 2066 #ifdef __FreeBSD__ 2067 cansandbox = (VFileName == NULL && zflag == NULL); 2068 #ifdef HAVE_CASPER 2069 cansandbox = (cansandbox && (nflag || capdns != NULL)); 2070 #else 2071 cansandbox = (cansandbox && nflag); 2072 #endif 2073 if (cansandbox && cap_enter() < 0 && errno != ENOSYS) 2074 error("unable to enter the capability mode"); 2075 #endif /* __FreeBSD__ */ 2076 2077 do { 2078 status = pcap_loop(pd, cnt, callback, pcap_userdata); 2079 if (WFileName == NULL) { 2080 /* 2081 * We're printing packets. Flush the printed output, 2082 * so it doesn't get intermingled with error output. 2083 */ 2084 if (status == -2) { 2085 /* 2086 * We got interrupted, so perhaps we didn't 2087 * manage to finish a line we were printing. 2088 * Print an extra newline, just in case. 2089 */ 2090 putchar('\n'); 2091 } 2092 (void)fflush(stdout); 2093 } 2094 if (status == -2) { 2095 /* 2096 * We got interrupted. If we are reading multiple 2097 * files (via -V) set these so that we stop. 2098 */ 2099 VFileName = NULL; 2100 ret = NULL; 2101 } 2102 if (status == -1) { 2103 /* 2104 * Error. Report it. 2105 */ 2106 (void)fprintf(stderr, "%s: pcap_loop: %s\n", 2107 program_name, pcap_geterr(pd)); 2108 } 2109 if (RFileName == NULL) { 2110 /* 2111 * We're doing a live capture. Report the capture 2112 * statistics. 2113 */ 2114 info(1); 2115 } 2116 pcap_close(pd); 2117 if (VFileName != NULL) { 2118 ret = get_next_file(VFile, VFileLine); 2119 if (ret) { 2120 RFileName = VFileLine; 2121 pd = pcap_open_offline(RFileName, ebuf); 2122 if (pd == NULL) 2123 error("%s", ebuf); 2124 #ifdef HAVE_CASPER 2125 cap_rights_init(&rights, CAP_READ); 2126 if (cap_rights_limit(fileno(pcap_file(pd)), 2127 &rights) < 0 && errno != ENOSYS) { 2128 error("unable to limit pcap descriptor"); 2129 } 2130 #endif 2131 new_dlt = pcap_datalink(pd); 2132 if (WFileName && new_dlt != dlt) 2133 error("%s: new dlt does not match original", RFileName); 2134 printinfo = get_print_info(new_dlt); 2135 dlt_name = pcap_datalink_val_to_name(new_dlt); 2136 if (dlt_name == NULL) { 2137 fprintf(stderr, "reading from file %s, link-type %u\n", 2138 RFileName, new_dlt); 2139 } else { 2140 fprintf(stderr, 2141 "reading from file %s, link-type %s (%s)\n", 2142 RFileName, dlt_name, 2143 pcap_datalink_val_to_description(new_dlt)); 2144 } 2145 if (pcap_compile(pd, &fcode, cmdbuf, Oflag, netmask) < 0) 2146 error("%s", pcap_geterr(pd)); 2147 if (pcap_setfilter(pd, &fcode) < 0) 2148 error("%s", pcap_geterr(pd)); 2149 } 2150 } 2151 } 2152 while (ret != NULL); 2153 2154 free(cmdbuf); 2155 exit(status == -1 ? 1 : 0); 2156 } 2157 2158 /* make a clean exit on interrupts */ 2159 static RETSIGTYPE 2160 cleanup(int signo _U_) 2161 { 2162 #ifdef USE_WIN32_MM_TIMER 2163 if (timer_id) 2164 timeKillEvent(timer_id); 2165 timer_id = 0; 2166 #elif defined(HAVE_ALARM) 2167 alarm(0); 2168 #endif 2169 2170 #ifdef HAVE_PCAP_BREAKLOOP 2171 /* 2172 * We have "pcap_breakloop()"; use it, so that we do as little 2173 * as possible in the signal handler (it's probably not safe 2174 * to do anything with standard I/O streams in a signal handler - 2175 * the ANSI C standard doesn't say it is). 2176 */ 2177 pcap_breakloop(pd); 2178 #else 2179 /* 2180 * We don't have "pcap_breakloop()"; this isn't safe, but 2181 * it's the best we can do. Print the summary if we're 2182 * not reading from a savefile - i.e., if we're doing a 2183 * live capture - and exit. 2184 */ 2185 if (pd != NULL && pcap_file(pd) == NULL) { 2186 /* 2187 * We got interrupted, so perhaps we didn't 2188 * manage to finish a line we were printing. 2189 * Print an extra newline, just in case. 2190 */ 2191 putchar('\n'); 2192 (void)fflush(stdout); 2193 info(1); 2194 } 2195 exit(0); 2196 #endif 2197 } 2198 2199 /* 2200 On windows, we do not use a fork, so we do not care less about 2201 waiting a child processes to die 2202 */ 2203 #if defined(HAVE_FORK) || defined(HAVE_VFORK) 2204 static RETSIGTYPE 2205 child_cleanup(int signo _U_) 2206 { 2207 wait(NULL); 2208 } 2209 #endif /* HAVE_FORK && HAVE_VFORK */ 2210 2211 static void 2212 info(register int verbose) 2213 { 2214 struct pcap_stat stat; 2215 2216 /* 2217 * Older versions of libpcap didn't set ps_ifdrop on some 2218 * platforms; initialize it to 0 to handle that. 2219 */ 2220 stat.ps_ifdrop = 0; 2221 if (pcap_stats(pd, &stat) < 0) { 2222 (void)fprintf(stderr, "pcap_stats: %s\n", pcap_geterr(pd)); 2223 infoprint = 0; 2224 return; 2225 } 2226 2227 if (!verbose) 2228 fprintf(stderr, "%s: ", program_name); 2229 2230 (void)fprintf(stderr, "%u packet%s captured", packets_captured, 2231 PLURAL_SUFFIX(packets_captured)); 2232 if (!verbose) 2233 fputs(", ", stderr); 2234 else 2235 putc('\n', stderr); 2236 (void)fprintf(stderr, "%u packet%s received by filter", stat.ps_recv, 2237 PLURAL_SUFFIX(stat.ps_recv)); 2238 if (!verbose) 2239 fputs(", ", stderr); 2240 else 2241 putc('\n', stderr); 2242 (void)fprintf(stderr, "%u packet%s dropped by kernel", stat.ps_drop, 2243 PLURAL_SUFFIX(stat.ps_drop)); 2244 if (stat.ps_ifdrop != 0) { 2245 if (!verbose) 2246 fputs(", ", stderr); 2247 else 2248 putc('\n', stderr); 2249 (void)fprintf(stderr, "%u packet%s dropped by interface\n", 2250 stat.ps_ifdrop, PLURAL_SUFFIX(stat.ps_ifdrop)); 2251 } else 2252 putc('\n', stderr); 2253 infoprint = 0; 2254 } 2255 2256 #if defined(HAVE_FORK) || defined(HAVE_VFORK) 2257 static void 2258 compress_savefile(const char *filename) 2259 { 2260 # ifdef HAVE_FORK 2261 if (fork()) 2262 # else 2263 if (vfork()) 2264 # endif 2265 return; 2266 /* 2267 * Set to lowest priority so that this doesn't disturb the capture 2268 */ 2269 #ifdef NZERO 2270 setpriority(PRIO_PROCESS, 0, NZERO - 1); 2271 #else 2272 setpriority(PRIO_PROCESS, 0, 19); 2273 #endif 2274 if (execlp(zflag, zflag, filename, (char *)NULL) == -1) 2275 fprintf(stderr, 2276 "compress_savefile:execlp(%s, %s): %s\n", 2277 zflag, 2278 filename, 2279 strerror(errno)); 2280 # ifdef HAVE_FORK 2281 exit(1); 2282 # else 2283 _exit(1); 2284 # endif 2285 } 2286 #else /* HAVE_FORK && HAVE_VFORK */ 2287 static void 2288 compress_savefile(const char *filename) 2289 { 2290 fprintf(stderr, 2291 "compress_savefile failed. Functionality not implemented under your system\n"); 2292 } 2293 #endif /* HAVE_FORK && HAVE_VFORK */ 2294 2295 static void 2296 dump_packet_and_trunc(u_char *user, const struct pcap_pkthdr *h, const u_char *sp) 2297 { 2298 struct dump_info *dump_info; 2299 2300 ++packets_captured; 2301 2302 ++infodelay; 2303 2304 dump_info = (struct dump_info *)user; 2305 2306 /* 2307 * XXX - this won't force the file to rotate on the specified time 2308 * boundary, but it will rotate on the first packet received after the 2309 * specified Gflag number of seconds. Note: if a Gflag time boundary 2310 * and a Cflag size boundary coincide, the time rotation will occur 2311 * first thereby cancelling the Cflag boundary (since the file should 2312 * be 0). 2313 */ 2314 if (Gflag != 0) { 2315 /* Check if it is time to rotate */ 2316 time_t t; 2317 2318 /* Get the current time */ 2319 if ((t = time(NULL)) == (time_t)-1) { 2320 error("dump_and_trunc_packet: can't get current_time: %s", 2321 pcap_strerror(errno)); 2322 } 2323 2324 2325 /* If the time is greater than the specified window, rotate */ 2326 if (t - Gflag_time >= Gflag) { 2327 #ifdef __FreeBSD__ 2328 FILE *fp; 2329 int fd; 2330 #endif 2331 2332 /* Update the Gflag_time */ 2333 Gflag_time = t; 2334 /* Update Gflag_count */ 2335 Gflag_count++; 2336 /* 2337 * Close the current file and open a new one. 2338 */ 2339 pcap_dump_close(dump_info->p); 2340 2341 /* 2342 * Compress the file we just closed, if the user asked for it 2343 */ 2344 if (zflag != NULL) 2345 compress_savefile(dump_info->CurrentFileName); 2346 2347 /* 2348 * Check to see if we've exceeded the Wflag (when 2349 * not using Cflag). 2350 */ 2351 if (Cflag == 0 && Wflag > 0 && Gflag_count >= Wflag) { 2352 (void)fprintf(stderr, "Maximum file limit reached: %d\n", 2353 Wflag); 2354 exit(0); 2355 /* NOTREACHED */ 2356 } 2357 if (dump_info->CurrentFileName != NULL) 2358 free(dump_info->CurrentFileName); 2359 /* Allocate space for max filename + \0. */ 2360 dump_info->CurrentFileName = (char *)malloc(PATH_MAX + 1); 2361 if (dump_info->CurrentFileName == NULL) 2362 error("dump_packet_and_trunc: malloc"); 2363 /* 2364 * Gflag was set otherwise we wouldn't be here. Reset the count 2365 * so multiple files would end with 1,2,3 in the filename. 2366 * The counting is handled with the -C flow after this. 2367 */ 2368 Cflag_count = 0; 2369 2370 /* 2371 * This is always the first file in the Cflag 2372 * rotation: e.g. 0 2373 * We also don't need numbering if Cflag is not set. 2374 */ 2375 if (Cflag != 0) 2376 MakeFilename(dump_info->CurrentFileName, dump_info->WFileName, 0, 2377 WflagChars); 2378 else 2379 MakeFilename(dump_info->CurrentFileName, dump_info->WFileName, 0, 0); 2380 2381 #ifdef HAVE_LIBCAP_NG 2382 capng_update(CAPNG_ADD, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE); 2383 capng_apply(CAPNG_SELECT_BOTH); 2384 #endif /* HAVE_LIBCAP_NG */ 2385 #ifdef __FreeBSD__ 2386 fd = openat(dump_info->dirfd, 2387 dump_info->CurrentFileName, 2388 O_CREAT | O_WRONLY | O_TRUNC, 0644); 2389 if (fd < 0) { 2390 error("unable to open file %s", 2391 dump_info->CurrentFileName); 2392 } 2393 fp = fdopen(fd, "w"); 2394 if (fp == NULL) { 2395 error("unable to fdopen file %s", 2396 dump_info->CurrentFileName); 2397 } 2398 dump_info->p = pcap_dump_fopen(dump_info->pd, fp); 2399 #else /* !__FreeBSD__ */ 2400 dump_info->p = pcap_dump_open(dump_info->pd, dump_info->CurrentFileName); 2401 #endif 2402 #ifdef HAVE_LIBCAP_NG 2403 capng_update(CAPNG_DROP, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE); 2404 capng_apply(CAPNG_SELECT_BOTH); 2405 #endif /* HAVE_LIBCAP_NG */ 2406 if (dump_info->p == NULL) 2407 error("%s", pcap_geterr(pd)); 2408 #ifdef __FreeBSD__ 2409 set_dumper_capsicum_rights(dump_info->p); 2410 #endif 2411 } 2412 } 2413 2414 /* 2415 * XXX - this won't prevent capture files from getting 2416 * larger than Cflag - the last packet written to the 2417 * file could put it over Cflag. 2418 */ 2419 if (Cflag != 0) { 2420 long size = pcap_dump_ftell(dump_info->p); 2421 2422 if (size == -1) 2423 error("ftell fails on output file"); 2424 if (size > Cflag) { 2425 #ifdef __FreeBSD__ 2426 FILE *fp; 2427 int fd; 2428 #endif 2429 2430 /* 2431 * Close the current file and open a new one. 2432 */ 2433 pcap_dump_close(dump_info->p); 2434 2435 /* 2436 * Compress the file we just closed, if the user 2437 * asked for it. 2438 */ 2439 if (zflag != NULL) 2440 compress_savefile(dump_info->CurrentFileName); 2441 2442 Cflag_count++; 2443 if (Wflag > 0) { 2444 if (Cflag_count >= Wflag) 2445 Cflag_count = 0; 2446 } 2447 if (dump_info->CurrentFileName != NULL) 2448 free(dump_info->CurrentFileName); 2449 dump_info->CurrentFileName = (char *)malloc(PATH_MAX + 1); 2450 if (dump_info->CurrentFileName == NULL) 2451 error("dump_packet_and_trunc: malloc"); 2452 MakeFilename(dump_info->CurrentFileName, dump_info->WFileName, Cflag_count, WflagChars); 2453 #ifdef HAVE_LIBCAP_NG 2454 capng_update(CAPNG_ADD, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE); 2455 capng_apply(CAPNG_SELECT_BOTH); 2456 #endif /* HAVE_LIBCAP_NG */ 2457 #ifdef __FreeBSD__ 2458 fd = openat(dump_info->dirfd, dump_info->CurrentFileName, 2459 O_CREAT | O_WRONLY | O_TRUNC, 0644); 2460 if (fd < 0) { 2461 error("unable to open file %s", 2462 dump_info->CurrentFileName); 2463 } 2464 fp = fdopen(fd, "w"); 2465 if (fp == NULL) { 2466 error("unable to fdopen file %s", 2467 dump_info->CurrentFileName); 2468 } 2469 dump_info->p = pcap_dump_fopen(dump_info->pd, fp); 2470 #else /* !__FreeBSD__ */ 2471 dump_info->p = pcap_dump_open(dump_info->pd, dump_info->CurrentFileName); 2472 #endif 2473 #ifdef HAVE_LIBCAP_NG 2474 capng_update(CAPNG_DROP, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE); 2475 capng_apply(CAPNG_SELECT_BOTH); 2476 #endif /* HAVE_LIBCAP_NG */ 2477 if (dump_info->p == NULL) 2478 error("%s", pcap_geterr(pd)); 2479 #ifdef __FreeBSD__ 2480 set_dumper_capsicum_rights(dump_info->p); 2481 #endif 2482 } 2483 } 2484 2485 pcap_dump((u_char *)dump_info->p, h, sp); 2486 #ifdef HAVE_PCAP_DUMP_FLUSH 2487 if (Uflag) 2488 pcap_dump_flush(dump_info->p); 2489 #endif 2490 2491 --infodelay; 2492 if (infoprint) 2493 info(0); 2494 } 2495 2496 static void 2497 dump_packet(u_char *user, const struct pcap_pkthdr *h, const u_char *sp) 2498 { 2499 ++packets_captured; 2500 2501 ++infodelay; 2502 2503 pcap_dump(user, h, sp); 2504 #ifdef HAVE_PCAP_DUMP_FLUSH 2505 if (Uflag) 2506 pcap_dump_flush((pcap_dumper_t *)user); 2507 #endif 2508 2509 --infodelay; 2510 if (infoprint) 2511 info(0); 2512 } 2513 2514 static void 2515 print_packet(u_char *user, const struct pcap_pkthdr *h, const u_char *sp) 2516 { 2517 struct print_info *print_info; 2518 u_int hdrlen; 2519 netdissect_options *ndo; 2520 2521 ++packets_captured; 2522 2523 ++infodelay; 2524 2525 print_info = (struct print_info *)user; 2526 ndo = print_info->ndo; 2527 2528 if(ndo->ndo_packet_number) 2529 ND_PRINT((ndo, "%5u ", packets_captured)); 2530 2531 ts_print(ndo, &h->ts); 2532 2533 /* 2534 * Some printers want to check that they're not walking off the 2535 * end of the packet. 2536 * Rather than pass it all the way down, we set this member 2537 * of the netdissect_options structure. 2538 */ 2539 ndo->ndo_snapend = sp + h->caplen; 2540 2541 if(print_info->ndo_type) { 2542 hdrlen = (*print_info->p.ndo_printer)(print_info->ndo, h, sp); 2543 } else { 2544 hdrlen = (*print_info->p.printer)(h, sp); 2545 } 2546 2547 /* 2548 * Restore the original snapend, as a printer might have 2549 * changed it. 2550 */ 2551 ndo->ndo_snapend = sp + h->caplen; 2552 if (ndo->ndo_Xflag) { 2553 /* 2554 * Print the raw packet data in hex and ASCII. 2555 */ 2556 if (ndo->ndo_Xflag > 1) { 2557 /* 2558 * Include the link-layer header. 2559 */ 2560 hex_and_ascii_print(ndo, "\n\t", sp, h->caplen); 2561 } else { 2562 /* 2563 * Don't include the link-layer header - and if 2564 * we have nothing past the link-layer header, 2565 * print nothing. 2566 */ 2567 if (h->caplen > hdrlen) 2568 hex_and_ascii_print(ndo, "\n\t", sp + hdrlen, 2569 h->caplen - hdrlen); 2570 } 2571 } else if (ndo->ndo_xflag) { 2572 /* 2573 * Print the raw packet data in hex. 2574 */ 2575 if (ndo->ndo_xflag > 1) { 2576 /* 2577 * Include the link-layer header. 2578 */ 2579 hex_print(ndo, "\n\t", sp, h->caplen); 2580 } else { 2581 /* 2582 * Don't include the link-layer header - and if 2583 * we have nothing past the link-layer header, 2584 * print nothing. 2585 */ 2586 if (h->caplen > hdrlen) 2587 hex_print(ndo, "\n\t", sp + hdrlen, 2588 h->caplen - hdrlen); 2589 } 2590 } else if (ndo->ndo_Aflag) { 2591 /* 2592 * Print the raw packet data in ASCII. 2593 */ 2594 if (ndo->ndo_Aflag > 1) { 2595 /* 2596 * Include the link-layer header. 2597 */ 2598 ascii_print(ndo, sp, h->caplen); 2599 } else { 2600 /* 2601 * Don't include the link-layer header - and if 2602 * we have nothing past the link-layer header, 2603 * print nothing. 2604 */ 2605 if (h->caplen > hdrlen) 2606 ascii_print(ndo, sp + hdrlen, h->caplen - hdrlen); 2607 } 2608 } 2609 2610 putchar('\n'); 2611 2612 --infodelay; 2613 if (infoprint) 2614 info(0); 2615 } 2616 2617 #ifdef WIN32 2618 /* 2619 * XXX - there should really be libpcap calls to get the version 2620 * number as a string (the string would be generated from #defines 2621 * at run time, so that it's not generated from string constants 2622 * in the library, as, on many UNIX systems, those constants would 2623 * be statically linked into the application executable image, and 2624 * would thus reflect the version of libpcap on the system on 2625 * which the application was *linked*, not the system on which it's 2626 * *running*. 2627 * 2628 * That routine should be documented, unlike the "version[]" 2629 * string, so that UNIX vendors providing their own libpcaps 2630 * don't omit it (as a couple of vendors have...). 2631 * 2632 * Packet.dll should perhaps also export a routine to return the 2633 * version number of the Packet.dll code, to supply the 2634 * "Wpcap_version" information on Windows. 2635 */ 2636 char WDversion[]="current-git.tcpdump.org"; 2637 #if !defined(HAVE_GENERATED_VERSION) 2638 char version[]="current-git.tcpdump.org"; 2639 #endif 2640 char pcap_version[]="current-git.tcpdump.org"; 2641 char Wpcap_version[]="3.1"; 2642 #endif 2643 2644 /* 2645 * By default, print the specified data out in hex and ASCII. 2646 */ 2647 static void 2648 ndo_default_print(netdissect_options *ndo, const u_char *bp, u_int length) 2649 { 2650 hex_and_ascii_print(ndo, "\n\t", bp, length); /* pass on lf and indentation string */ 2651 } 2652 2653 void 2654 default_print(const u_char *bp, u_int length) 2655 { 2656 ndo_default_print(gndo, bp, length); 2657 } 2658 2659 #ifdef SIGNAL_REQ_INFO 2660 RETSIGTYPE requestinfo(int signo _U_) 2661 { 2662 if (infodelay) 2663 ++infoprint; 2664 else 2665 info(0); 2666 } 2667 #endif 2668 2669 /* 2670 * Called once each second in verbose mode while dumping to file 2671 */ 2672 #ifdef USE_WIN32_MM_TIMER 2673 void CALLBACK verbose_stats_dump (UINT timer_id _U_, UINT msg _U_, DWORD_PTR arg _U_, 2674 DWORD_PTR dw1 _U_, DWORD_PTR dw2 _U_) 2675 { 2676 struct pcap_stat stat; 2677 2678 if (infodelay == 0 && pcap_stats(pd, &stat) >= 0) 2679 fprintf(stderr, "Got %u\r", packets_captured); 2680 } 2681 #elif defined(HAVE_ALARM) 2682 static void verbose_stats_dump(int sig _U_) 2683 { 2684 struct pcap_stat stat; 2685 2686 if (infodelay == 0 && pcap_stats(pd, &stat) >= 0) 2687 fprintf(stderr, "Got %u\r", packets_captured); 2688 alarm(1); 2689 } 2690 #endif 2691 2692 USES_APPLE_DEPRECATED_API 2693 static void 2694 print_version(void) 2695 { 2696 extern char version[]; 2697 #ifndef HAVE_PCAP_LIB_VERSION 2698 #if defined(WIN32) || defined(HAVE_PCAP_VERSION) 2699 extern char pcap_version[]; 2700 #else /* defined(WIN32) || defined(HAVE_PCAP_VERSION) */ 2701 static char pcap_version[] = "unknown"; 2702 #endif /* defined(WIN32) || defined(HAVE_PCAP_VERSION) */ 2703 #endif /* HAVE_PCAP_LIB_VERSION */ 2704 2705 #ifdef HAVE_PCAP_LIB_VERSION 2706 #ifdef WIN32 2707 (void)fprintf(stderr, "%s version %s, based on tcpdump version %s\n", program_name, WDversion, version); 2708 #else /* WIN32 */ 2709 (void)fprintf(stderr, "%s version %s\n", program_name, version); 2710 #endif /* WIN32 */ 2711 (void)fprintf(stderr, "%s\n",pcap_lib_version()); 2712 #else /* HAVE_PCAP_LIB_VERSION */ 2713 #ifdef WIN32 2714 (void)fprintf(stderr, "%s version %s, based on tcpdump version %s\n", program_name, WDversion, version); 2715 (void)fprintf(stderr, "WinPcap version %s, based on libpcap version %s\n",Wpcap_version, pcap_version); 2716 #else /* WIN32 */ 2717 (void)fprintf(stderr, "%s version %s\n", program_name, version); 2718 (void)fprintf(stderr, "libpcap version %s\n", pcap_version); 2719 #endif /* WIN32 */ 2720 #endif /* HAVE_PCAP_LIB_VERSION */ 2721 2722 #if defined(HAVE_LIBCRYPTO) && defined(SSLEAY_VERSION) 2723 (void)fprintf (stderr, "%s\n", SSLeay_version(SSLEAY_VERSION)); 2724 #endif 2725 2726 #ifdef USE_LIBSMI 2727 (void)fprintf (stderr, "SMI-library: %s\n", smi_version_string); 2728 #endif 2729 } 2730 USES_APPLE_RST 2731 2732 static void 2733 print_usage(void) 2734 { 2735 print_version(); 2736 (void)fprintf(stderr, 2737 "Usage: %s [-aAbd" D_FLAG "efhH" I_FLAG J_FLAG "KlLnNOpqRStu" U_FLAG "vxX#]" B_FLAG_USAGE " [ -c count ]\n", program_name); 2738 (void)fprintf(stderr, 2739 "\t\t[ -C file_size ] [ -E algo:secret ] [ -F file ] [ -G seconds ]\n"); 2740 (void)fprintf(stderr, 2741 "\t\t[ -i interface ]" j_FLAG_USAGE " [ -M secret ] [ --number ]\n"); 2742 #ifdef HAVE_PCAP_SETDIRECTION 2743 (void)fprintf(stderr, 2744 "\t\t[ -Q in|out|inout ]\n"); 2745 #endif 2746 (void)fprintf(stderr, 2747 "\t\t[ -r file ] [ -s snaplen ] "); 2748 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION 2749 (void)fprintf(stderr, "[ --time-stamp-precision precision ]\n"); 2750 (void)fprintf(stderr, 2751 "\t\t"); 2752 #endif 2753 #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE 2754 (void)fprintf(stderr, "[ --immediate-mode ] "); 2755 #endif 2756 (void)fprintf(stderr, "[ -T type ] [ --version ] [ -V file ]\n"); 2757 (void)fprintf(stderr, 2758 "\t\t[ -w file ] [ -W filecount ] [ -y datalinktype ] [ -z command ]\n"); 2759 (void)fprintf(stderr, 2760 "\t\t[ -Z user ] [ expression ]\n"); 2761 } 2762 2763 2764 2765 /* VARARGS */ 2766 static void 2767 ndo_error(netdissect_options *ndo _U_, const char *fmt, ...) 2768 { 2769 va_list ap; 2770 2771 (void)fprintf(stderr, "%s: ", program_name); 2772 va_start(ap, fmt); 2773 (void)vfprintf(stderr, fmt, ap); 2774 va_end(ap); 2775 if (*fmt) { 2776 fmt += strlen(fmt); 2777 if (fmt[-1] != '\n') 2778 (void)fputc('\n', stderr); 2779 } 2780 exit(1); 2781 /* NOTREACHED */ 2782 } 2783 2784 /* VARARGS */ 2785 static void 2786 ndo_warning(netdissect_options *ndo _U_, const char *fmt, ...) 2787 { 2788 va_list ap; 2789 2790 (void)fprintf(stderr, "%s: WARNING: ", program_name); 2791 va_start(ap, fmt); 2792 (void)vfprintf(stderr, fmt, ap); 2793 va_end(ap); 2794 if (*fmt) { 2795 fmt += strlen(fmt); 2796 if (fmt[-1] != '\n') 2797 (void)fputc('\n', stderr); 2798 } 2799 } 2800 /* 2801 * Local Variables: 2802 * c-style: whitesmith 2803 * c-basic-offset: 8 2804 * End: 2805 */ 2806