1 /* 2 * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000 3 * The Regents of the University of California. All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that: (1) source code distributions 7 * retain the above copyright notice and this paragraph in its entirety, (2) 8 * distributions including binary code include the above copyright notice and 9 * this paragraph in its entirety in the documentation or other materials 10 * provided with the distribution, and (3) all advertising materials mentioning 11 * features or use of this software display the following acknowledgement: 12 * ``This product includes software developed by the University of California, 13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of 14 * the University nor the names of its contributors may be used to endorse 15 * or promote products derived from this software without specific prior 16 * written permission. 17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED 18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF 19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 20 * 21 * Support for splitting captures into multiple files with a maximum 22 * file size: 23 * 24 * Copyright (c) 2001 25 * Seth Webster <swebster@sst.ll.mit.edu> 26 */ 27 28 #include <sys/cdefs.h> 29 #ifndef lint 30 static const char copyright[] _U_ = 31 "@(#) Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000\n\ 32 The Regents of the University of California. All rights reserved.\n"; 33 __RCSID("$NetBSD: tcpdump.c,v 1.12 2015/09/17 14:03:10 nonaka Exp $"); 34 #endif 35 36 /* 37 * tcpdump - monitor tcp/ip traffic on an ethernet. 38 * 39 * First written in 1987 by Van Jacobson, Lawrence Berkeley Laboratory. 40 * Mercilessly hacked and occasionally improved since then via the 41 * combined efforts of Van, Steve McCanne and Craig Leres of LBL. 42 */ 43 44 #ifdef HAVE_CONFIG_H 45 #include "config.h" 46 #endif 47 48 /* 49 * Mac OS X may ship pcap.h from libpcap 0.6 with a libpcap based on 50 * 0.8. That means it has pcap_findalldevs() but the header doesn't 51 * define pcap_if_t, meaning that we can't actually *use* pcap_findalldevs(). 52 */ 53 #ifdef HAVE_PCAP_FINDALLDEVS 54 #ifndef HAVE_PCAP_IF_T 55 #undef HAVE_PCAP_FINDALLDEVS 56 #endif 57 #endif 58 59 #include <tcpdump-stdinc.h> 60 61 #ifdef WIN32 62 #include "w32_fzs.h" 63 extern int strcasecmp (const char *__s1, const char *__s2); 64 extern int SIZE_BUF; 65 #define off_t long 66 #define uint UINT 67 #endif /* WIN32 */ 68 69 #ifdef USE_LIBSMI 70 #include <smi.h> 71 #endif 72 73 #ifdef HAVE_LIBCRYPTO 74 #include <openssl/crypto.h> 75 #endif 76 77 #ifdef HAVE_GETOPT_LONG 78 #include <getopt.h> 79 #else 80 #include "getopt_long.h" 81 #endif 82 /* Capsicum-specific code requires macros from <net/bpf.h>, which will fail 83 * to compile if <pcap.h> has already been included; including the headers 84 * in the opposite order works fine. 85 */ 86 #ifdef HAVE_CAPSICUM 87 #include <sys/capability.h> 88 #include <sys/ioccom.h> 89 #include <net/bpf.h> 90 #include <fcntl.h> 91 #include <libgen.h> 92 #endif /* HAVE_CAPSICUM */ 93 #include <pcap.h> 94 #include <signal.h> 95 #include <stdio.h> 96 #include <stdlib.h> 97 #include <string.h> 98 #include <limits.h> 99 #include <resolv.h> 100 #ifndef WIN32 101 #include <sys/wait.h> 102 #include <sys/resource.h> 103 #include <pwd.h> 104 #include <grp.h> 105 #endif /* WIN32 */ 106 107 /* capabilities convenience library */ 108 /* If a code depends on HAVE_LIBCAP_NG, it depends also on HAVE_CAP_NG_H. 109 * If HAVE_CAP_NG_H is not defined, undefine HAVE_LIBCAP_NG. 110 * Thus, the later tests are done only on HAVE_LIBCAP_NG. 111 */ 112 #ifdef HAVE_LIBCAP_NG 113 #ifdef HAVE_CAP_NG_H 114 #include <cap-ng.h> 115 #else 116 #undef HAVE_LIBCAP_NG 117 #endif /* HAVE_CAP_NG_H */ 118 #endif /* HAVE_LIBCAP_NG */ 119 120 #include "netdissect.h" 121 #include "interface.h" 122 #include "addrtoname.h" 123 #include "machdep.h" 124 #include "setsignal.h" 125 #include "gmt2local.h" 126 #include "pcap-missing.h" 127 128 #ifndef PATH_MAX 129 #define PATH_MAX 1024 130 #endif 131 132 #ifdef SIGINFO 133 #define SIGNAL_REQ_INFO SIGINFO 134 #elif SIGUSR1 135 #define SIGNAL_REQ_INFO SIGUSR1 136 #endif 137 138 netdissect_options Gndo; 139 netdissect_options *gndo = &Gndo; 140 141 static int Dflag; /* list available devices and exit */ 142 static int dflag; /* print filter code */ 143 static int Lflag; /* list available data link types and exit */ 144 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE 145 static int Jflag; /* list available time stamp types */ 146 #endif 147 #ifdef HAVE_PCAP_SETDIRECTION 148 int Qflag = -1; /* restrict captured packet by send/receive direction */ 149 #endif 150 static char *zflag = NULL; /* compress each savefile using a specified command (like gzip or bzip2) */ 151 152 static int infodelay; 153 static int infoprint; 154 155 char *program_name; 156 157 int32_t thiszone; /* seconds offset from gmt to local time */ 158 159 /* Forwards */ 160 static RETSIGTYPE cleanup(int); 161 static RETSIGTYPE child_cleanup(int); 162 static void print_version(void); 163 static void print_usage(void); 164 static void show_dlts_and_exit(const char *device, pcap_t *pd) __attribute__((noreturn)); 165 166 static void print_packet(u_char *, const struct pcap_pkthdr *, const u_char *); 167 static void ndo_default_print(netdissect_options *, const u_char *, u_int); 168 static void dump_packet_and_trunc(u_char *, const struct pcap_pkthdr *, const u_char *); 169 static void dump_packet(u_char *, const struct pcap_pkthdr *, const u_char *); 170 static void droproot(const char *, const char *); 171 static void ndo_error(netdissect_options *ndo, const char *fmt, ...) 172 __attribute__((noreturn)) 173 #ifdef __ATTRIBUTE___FORMAT_OK 174 __attribute__((format (printf, 2, 3))) 175 #endif /* __ATTRIBUTE___FORMAT_OK */ 176 ; 177 static void ndo_warning(netdissect_options *ndo, const char *fmt, ...) 178 #ifdef __ATTRIBUTE___FORMAT_OK 179 __attribute__((format (printf, 2, 3))) 180 #endif /* __ATTRIBUTE___FORMAT_OK */ 181 ; 182 183 #ifdef SIGNAL_REQ_INFO 184 RETSIGTYPE requestinfo(int); 185 #endif 186 187 #if defined(USE_WIN32_MM_TIMER) 188 #include <MMsystem.h> 189 static UINT timer_id; 190 static void CALLBACK verbose_stats_dump(UINT, UINT, DWORD_PTR, DWORD_PTR, DWORD_PTR); 191 #elif defined(HAVE_ALARM) 192 static void verbose_stats_dump(int sig); 193 #endif 194 195 static void info(int); 196 static u_int packets_captured; 197 198 struct printer { 199 if_printer f; 200 int type; 201 }; 202 203 204 struct ndo_printer { 205 if_ndo_printer f; 206 int type; 207 }; 208 209 210 static const struct printer printers[] = { 211 { NULL, 0 }, 212 }; 213 214 static const struct ndo_printer ndo_printers[] = { 215 { ether_if_print, DLT_EN10MB }, 216 #ifdef DLT_IPNET 217 { ipnet_if_print, DLT_IPNET }, 218 #endif 219 #ifdef DLT_IEEE802_15_4 220 { ieee802_15_4_if_print, DLT_IEEE802_15_4 }, 221 #endif 222 #ifdef DLT_IEEE802_15_4_NOFCS 223 { ieee802_15_4_if_print, DLT_IEEE802_15_4_NOFCS }, 224 #endif 225 #ifdef DLT_PPI 226 { ppi_if_print, DLT_PPI }, 227 #endif 228 #ifdef DLT_NETANALYZER 229 { netanalyzer_if_print, DLT_NETANALYZER }, 230 #endif 231 #ifdef DLT_NETANALYZER_TRANSPARENT 232 { netanalyzer_transparent_if_print, DLT_NETANALYZER_TRANSPARENT }, 233 #endif 234 #if defined(DLT_NFLOG) && defined(HAVE_PCAP_NFLOG_H) 235 { nflog_if_print, DLT_NFLOG}, 236 #endif 237 #ifdef DLT_CIP 238 { cip_if_print, DLT_CIP }, 239 #endif 240 #ifdef DLT_ATM_CLIP 241 { cip_if_print, DLT_ATM_CLIP }, 242 #endif 243 #ifdef DLT_IP_OVER_FC 244 { ipfc_if_print, DLT_IP_OVER_FC }, 245 #endif 246 { null_if_print, DLT_NULL }, 247 #ifdef DLT_LOOP 248 { null_if_print, DLT_LOOP }, 249 #endif 250 #ifdef DLT_APPLE_IP_OVER_IEEE1394 251 { ap1394_if_print, DLT_APPLE_IP_OVER_IEEE1394 }, 252 #endif 253 #if defined(DLT_BLUETOOTH_HCI_H4_WITH_PHDR) && defined(HAVE_PCAP_BLUETOOTH_H) 254 { bt_if_print, DLT_BLUETOOTH_HCI_H4_WITH_PHDR}, 255 #endif 256 #ifdef DLT_LANE8023 257 { lane_if_print, DLT_LANE8023 }, 258 #endif 259 { arcnet_if_print, DLT_ARCNET }, 260 #ifdef DLT_ARCNET_LINUX 261 { arcnet_linux_if_print, DLT_ARCNET_LINUX }, 262 #endif 263 { raw_if_print, DLT_RAW }, 264 #ifdef DLT_IPV4 265 { raw_if_print, DLT_IPV4 }, 266 #endif 267 #ifdef DLT_IPV6 268 { raw_if_print, DLT_IPV6 }, 269 #endif 270 #ifdef HAVE_PCAP_USB_H 271 #ifdef DLT_USB_LINUX 272 { usb_linux_48_byte_print, DLT_USB_LINUX}, 273 #endif /* DLT_USB_LINUX */ 274 #ifdef DLT_USB_LINUX_MMAPPED 275 { usb_linux_64_byte_print, DLT_USB_LINUX_MMAPPED}, 276 #endif /* DLT_USB_LINUX_MMAPPED */ 277 #endif /* HAVE_PCAP_USB_H */ 278 #ifdef DLT_SYMANTEC_FIREWALL 279 { symantec_if_print, DLT_SYMANTEC_FIREWALL }, 280 #endif 281 #ifdef DLT_C_HDLC 282 { chdlc_if_print, DLT_C_HDLC }, 283 #endif 284 #ifdef DLT_HDLC 285 { chdlc_if_print, DLT_HDLC }, 286 #endif 287 #ifdef DLT_PPP_ETHER 288 { pppoe_if_print, DLT_PPP_ETHER }, 289 #endif 290 #if defined(DLT_PFLOG) && defined(HAVE_NET_PFVAR_H) 291 { pflog_if_print, DLT_PFLOG }, 292 #endif 293 { token_if_print, DLT_IEEE802 }, 294 { fddi_if_print, DLT_FDDI }, 295 #ifdef DLT_LINUX_SLL 296 { sll_if_print, DLT_LINUX_SLL }, 297 #endif 298 #ifdef DLT_FR 299 { fr_if_print, DLT_FR }, 300 #endif 301 #ifdef DLT_FRELAY 302 { fr_if_print, DLT_FRELAY }, 303 #endif 304 #ifdef DLT_MFR 305 { mfr_if_print, DLT_MFR }, 306 #endif 307 { atm_if_print, DLT_ATM_RFC1483 }, 308 #ifdef DLT_SUNATM 309 { sunatm_if_print, DLT_SUNATM }, 310 #endif 311 #ifdef DLT_ENC 312 { enc_if_print, DLT_ENC }, 313 #endif 314 { sl_if_print, DLT_SLIP }, 315 #ifdef DLT_SLIP_BSDOS 316 { sl_bsdos_if_print, DLT_SLIP_BSDOS }, 317 #endif 318 #ifdef DLT_LTALK 319 { ltalk_if_print, DLT_LTALK }, 320 #endif 321 #ifdef DLT_JUNIPER_ATM1 322 { juniper_atm1_print, DLT_JUNIPER_ATM1 }, 323 #endif 324 #ifdef DLT_JUNIPER_ATM2 325 { juniper_atm2_print, DLT_JUNIPER_ATM2 }, 326 #endif 327 #ifdef DLT_JUNIPER_MFR 328 { juniper_mfr_print, DLT_JUNIPER_MFR }, 329 #endif 330 #ifdef DLT_JUNIPER_MLFR 331 { juniper_mlfr_print, DLT_JUNIPER_MLFR }, 332 #endif 333 #ifdef DLT_JUNIPER_MLPPP 334 { juniper_mlppp_print, DLT_JUNIPER_MLPPP }, 335 #endif 336 #ifdef DLT_JUNIPER_PPPOE 337 { juniper_pppoe_print, DLT_JUNIPER_PPPOE }, 338 #endif 339 #ifdef DLT_JUNIPER_PPPOE_ATM 340 { juniper_pppoe_atm_print, DLT_JUNIPER_PPPOE_ATM }, 341 #endif 342 #ifdef DLT_JUNIPER_GGSN 343 { juniper_ggsn_print, DLT_JUNIPER_GGSN }, 344 #endif 345 #ifdef DLT_JUNIPER_ES 346 { juniper_es_print, DLT_JUNIPER_ES }, 347 #endif 348 #ifdef DLT_JUNIPER_MONITOR 349 { juniper_monitor_print, DLT_JUNIPER_MONITOR }, 350 #endif 351 #ifdef DLT_JUNIPER_SERVICES 352 { juniper_services_print, DLT_JUNIPER_SERVICES }, 353 #endif 354 #ifdef DLT_JUNIPER_ETHER 355 { juniper_ether_print, DLT_JUNIPER_ETHER }, 356 #endif 357 #ifdef DLT_JUNIPER_PPP 358 { juniper_ppp_print, DLT_JUNIPER_PPP }, 359 #endif 360 #ifdef DLT_JUNIPER_FRELAY 361 { juniper_frelay_print, DLT_JUNIPER_FRELAY }, 362 #endif 363 #ifdef DLT_JUNIPER_CHDLC 364 { juniper_chdlc_print, DLT_JUNIPER_CHDLC }, 365 #endif 366 #ifdef DLT_PKTAP 367 { pktap_if_print, DLT_PKTAP }, 368 #endif 369 #ifdef DLT_IEEE802_11_RADIO 370 { ieee802_11_radio_if_print, DLT_IEEE802_11_RADIO }, 371 #endif 372 #ifdef DLT_IEEE802_11 373 { ieee802_11_if_print, DLT_IEEE802_11}, 374 #endif 375 #ifdef DLT_IEEE802_11_RADIO_AVS 376 { ieee802_11_radio_avs_if_print, DLT_IEEE802_11_RADIO_AVS }, 377 #endif 378 #ifdef DLT_PRISM_HEADER 379 { prism_if_print, DLT_PRISM_HEADER }, 380 #endif 381 { ppp_if_print, DLT_PPP }, 382 #ifdef DLT_PPP_WITHDIRECTION 383 { ppp_if_print, DLT_PPP_WITHDIRECTION }, 384 #endif 385 #ifdef DLT_PPP_BSDOS 386 { ppp_bsdos_if_print, DLT_PPP_BSDOS }, 387 #endif 388 #ifdef DLT_PPP_SERIAL 389 { ppp_hdlc_if_print, DLT_PPP_SERIAL }, 390 #endif 391 #ifdef DLT_PFSYNC 392 { pfsync_if_print, DLT_PFSYNC }, 393 #endif 394 { NULL, 0 }, 395 }; 396 397 static const struct tok status_flags[] = { 398 #ifdef PCAP_IF_UP 399 { PCAP_IF_UP, "Up" }, 400 #endif 401 #ifdef PCAP_IF_RUNNING 402 { PCAP_IF_RUNNING, "Running" }, 403 #endif 404 { PCAP_IF_LOOPBACK, "Loopback" }, 405 { 0, NULL } 406 }; 407 408 if_printer 409 lookup_printer(int type) 410 { 411 const struct printer *p; 412 413 for (p = printers; p->f; ++p) 414 if (type == p->type) 415 return p->f; 416 417 return NULL; 418 /* NOTREACHED */ 419 } 420 421 if_ndo_printer 422 lookup_ndo_printer(int type) 423 { 424 const struct ndo_printer *p; 425 426 for (p = ndo_printers; p->f; ++p) 427 if (type == p->type) 428 return p->f; 429 430 #if defined(DLT_USER2) && defined(DLT_PKTAP) 431 /* 432 * Apple incorrectly chose to use DLT_USER2 for their PKTAP 433 * header. 434 * 435 * We map DLT_PKTAP, whether it's DLT_USER2 as it is on Darwin- 436 * based OSes or the same value as LINKTYPE_PKTAP as it is on 437 * other OSes, to LINKTYPE_PKTAP, so files written with 438 * this version of libpcap for a DLT_PKTAP capture have a link- 439 * layer header type of LINKTYPE_PKTAP. 440 * 441 * However, files written on OS X Mavericks for a DLT_PKTAP 442 * capture have a link-layer header type of LINKTYPE_USER2. 443 * If we don't have a printer for DLT_USER2, and type is 444 * DLT_USER2, we look up the printer for DLT_PKTAP and use 445 * that. 446 */ 447 if (type == DLT_USER2) { 448 for (p = ndo_printers; p->f; ++p) 449 if (DLT_PKTAP == p->type) 450 return p->f; 451 } 452 #endif 453 454 return NULL; 455 /* NOTREACHED */ 456 } 457 458 static pcap_t *pd; 459 460 static int supports_monitor_mode; 461 462 extern int optind; 463 extern int opterr; 464 extern char *optarg; 465 466 struct print_info { 467 netdissect_options *ndo; 468 union { 469 if_printer printer; 470 if_ndo_printer ndo_printer; 471 } p; 472 int ndo_type; 473 }; 474 475 struct dump_info { 476 char *WFileName; 477 char *CurrentFileName; 478 pcap_t *pd; 479 pcap_dumper_t *p; 480 #ifdef HAVE_CAPSICUM 481 int dirfd; 482 #endif 483 }; 484 485 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE 486 static void 487 show_tstamp_types_and_exit(const char *device, pcap_t *pd) 488 { 489 int n_tstamp_types; 490 int *tstamp_types = 0; 491 const char *tstamp_type_name; 492 int i; 493 494 n_tstamp_types = pcap_list_tstamp_types(pd, &tstamp_types); 495 if (n_tstamp_types < 0) 496 error("%s", pcap_geterr(pd)); 497 498 if (n_tstamp_types == 0) { 499 fprintf(stderr, "Time stamp type cannot be set for %s\n", 500 device); 501 exit(0); 502 } 503 fprintf(stderr, "Time stamp types for %s (use option -j to set):\n", 504 device); 505 for (i = 0; i < n_tstamp_types; i++) { 506 tstamp_type_name = pcap_tstamp_type_val_to_name(tstamp_types[i]); 507 if (tstamp_type_name != NULL) { 508 (void) fprintf(stderr, " %s (%s)\n", tstamp_type_name, 509 pcap_tstamp_type_val_to_description(tstamp_types[i])); 510 } else { 511 (void) fprintf(stderr, " %d\n", tstamp_types[i]); 512 } 513 } 514 pcap_free_tstamp_types(tstamp_types); 515 exit(0); 516 } 517 #endif 518 519 static void 520 show_dlts_and_exit(const char *device, pcap_t *pd) 521 { 522 int n_dlts; 523 int *dlts = 0; 524 const char *dlt_name; 525 526 n_dlts = pcap_list_datalinks(pd, &dlts); 527 if (n_dlts < 0) 528 error("%s", pcap_geterr(pd)); 529 else if (n_dlts == 0 || !dlts) 530 error("No data link types."); 531 532 /* 533 * If the interface is known to support monitor mode, indicate 534 * whether these are the data link types available when not in 535 * monitor mode, if -I wasn't specified, or when in monitor mode, 536 * when -I was specified (the link-layer types available in 537 * monitor mode might be different from the ones available when 538 * not in monitor mode). 539 */ 540 if (supports_monitor_mode) 541 (void) fprintf(stderr, "Data link types for %s %s (use option -y to set):\n", 542 device, 543 Iflag ? "when in monitor mode" : "when not in monitor mode"); 544 else 545 (void) fprintf(stderr, "Data link types for %s (use option -y to set):\n", 546 device); 547 548 while (--n_dlts >= 0) { 549 dlt_name = pcap_datalink_val_to_name(dlts[n_dlts]); 550 if (dlt_name != NULL) { 551 (void) fprintf(stderr, " %s (%s)", dlt_name, 552 pcap_datalink_val_to_description(dlts[n_dlts])); 553 554 /* 555 * OK, does tcpdump handle that type? 556 */ 557 if (lookup_printer(dlts[n_dlts]) == NULL 558 && lookup_ndo_printer(dlts[n_dlts]) == NULL) 559 (void) fprintf(stderr, " (printing not supported)"); 560 fprintf(stderr, "\n"); 561 } else { 562 (void) fprintf(stderr, " DLT %d (printing not supported)\n", 563 dlts[n_dlts]); 564 } 565 } 566 #ifdef HAVE_PCAP_FREE_DATALINKS 567 pcap_free_datalinks(dlts); 568 #endif 569 exit(0); 570 } 571 572 #ifdef HAVE_PCAP_FINDALLDEVS 573 static void 574 show_devices_and_exit (void) 575 { 576 pcap_if_t *devpointer; 577 char ebuf[PCAP_ERRBUF_SIZE]; 578 int i; 579 580 if (pcap_findalldevs(&devpointer, ebuf) < 0) 581 error("%s", ebuf); 582 else { 583 for (i = 0; devpointer != NULL; i++) { 584 printf("%d.%s", i+1, devpointer->name); 585 if (devpointer->description != NULL) 586 printf(" (%s)", devpointer->description); 587 if (devpointer->flags != 0) 588 printf(" [%s]", bittok2str(status_flags, "none", devpointer->flags)); 589 printf("\n"); 590 devpointer = devpointer->next; 591 } 592 } 593 exit(0); 594 } 595 #endif /* HAVE_PCAP_FINDALLDEVS */ 596 597 /* 598 * Short options. 599 * 600 * Note that there we use all letters for short options except for g, k, 601 * o, and P, and those are used by other versions of tcpdump, and we should 602 * only use them for the same purposes that the other versions of tcpdump 603 * use them: 604 * 605 * OS X tcpdump uses -g to force non--v output for IP to be on one 606 * line, making it more "g"repable; 607 * 608 * OS X tcpdump uses -k tospecify that packet comments in pcap-ng files 609 * should be printed; 610 * 611 * OpenBSD tcpdump uses -o to indicate that OS fingerprinting should be done 612 * for hosts sending TCP SYN packets; 613 * 614 * OS X tcpdump uses -P to indicate that -w should write pcap-ng rather 615 * than pcap files. 616 * 617 * OS X tcpdump also uses -Q to specify expressions that match packet 618 * metadata, including but not limited to the packet direction. 619 * The expression syntax is different from a simple "in|out|inout", 620 * and those expressions aren't accepted by OS X tcpdump, but the 621 * equivalents would be "in" = "dir=in", "out" = "dir=out", and 622 * "inout" = "dir=in or dir=out", and the parser could conceivably 623 * special-case "in", "out", and "inout" as expressions for backwards 624 * compatibility, so all is not (yet) lost. 625 */ 626 627 /* 628 * Set up flags that might or might not be supported depending on the 629 * version of libpcap we're using. 630 */ 631 #if defined(HAVE_PCAP_CREATE) || defined(WIN32) 632 #define B_FLAG "B:" 633 #define B_FLAG_USAGE " [ -B size ]" 634 #else /* defined(HAVE_PCAP_CREATE) || defined(WIN32) */ 635 #define B_FLAG 636 #define B_FLAG_USAGE 637 #endif /* defined(HAVE_PCAP_CREATE) || defined(WIN32) */ 638 639 #ifdef HAVE_PCAP_CREATE 640 #define I_FLAG "I" 641 #else /* HAVE_PCAP_CREATE */ 642 #define I_FLAG 643 #endif /* HAVE_PCAP_CREATE */ 644 645 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE 646 #define j_FLAG "j:" 647 #define j_FLAG_USAGE " [ -j tstamptype ]" 648 #define J_FLAG "J" 649 #else /* PCAP_ERROR_TSTAMP_TYPE_NOTSUP */ 650 #define j_FLAG 651 #define j_FLAG_USAGE 652 #define J_FLAG 653 #endif /* PCAP_ERROR_TSTAMP_TYPE_NOTSUP */ 654 655 #ifdef HAVE_PCAP_FINDALLDEVS 656 #define D_FLAG "D" 657 #else 658 #define D_FLAG 659 #endif 660 661 #ifdef HAVE_PCAP_DUMP_FLUSH 662 #define U_FLAG "U" 663 #else 664 #define U_FLAG 665 #endif 666 667 #ifdef HAVE_PCAP_SETDIRECTION 668 #define Q_FLAG "Q:" 669 #else 670 #define Q_FLAG 671 #endif 672 673 #define SHORTOPTS "aAb" B_FLAG "c:C:d" D_FLAG "eE:fF:G:hHi:" I_FLAG j_FLAG J_FLAG "KlLm:M:nNOpq" Q_FLAG "r:Rs:StT:u" U_FLAG "vV:w:W:xXy:Yz:Z:#" 674 675 /* 676 * Long options. 677 * 678 * We do not currently have long options corresponding to all short 679 * options; we should probably pick appropriate option names for them. 680 * 681 * However, the short options where the number of times the option is 682 * specified matters, such as -v and -d and -t, should probably not 683 * just map to a long option, as saying 684 * 685 * tcpdump --verbose --verbose 686 * 687 * doesn't make sense; it should be --verbosity={N} or something such 688 * as that. 689 * 690 * For long options with no corresponding short options, we define values 691 * outside the range of ASCII graphic characters, make that the last 692 * component of the entry for the long option, and have a case for that 693 * option in the switch statement. 694 */ 695 #define OPTION_VERSION 128 696 #define OPTION_TSTAMP_PRECISION 129 697 #define OPTION_IMMEDIATE_MODE 130 698 699 static const struct option longopts[] = { 700 #if defined(HAVE_PCAP_CREATE) || defined(WIN32) 701 { "buffer-size", required_argument, NULL, 'B' }, 702 #endif 703 { "list-interfaces", no_argument, NULL, 'D' }, 704 { "help", no_argument, NULL, 'h' }, 705 { "interface", required_argument, NULL, 'i' }, 706 #ifdef HAVE_PCAP_CREATE 707 { "monitor-mode", no_argument, NULL, 'I' }, 708 #endif 709 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE 710 { "time-stamp-type", required_argument, NULL, 'j' }, 711 { "list-time-stamp-types", no_argument, NULL, 'J' }, 712 #endif 713 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION 714 { "time-stamp-precision", required_argument, NULL, OPTION_TSTAMP_PRECISION}, 715 #endif 716 { "dont-verify-checksums", no_argument, NULL, 'K' }, 717 { "list-data-link-types", no_argument, NULL, 'L' }, 718 { "no-optimize", no_argument, NULL, 'O' }, 719 { "no-promiscuous-mode", no_argument, NULL, 'p' }, 720 #ifdef HAVE_PCAP_SETDIRECTION 721 { "direction", required_argument, NULL, 'Q' }, 722 #endif 723 { "snapshot-length", required_argument, NULL, 's' }, 724 { "absolute-tcp-sequence-numbers", no_argument, NULL, 'S' }, 725 #ifdef HAVE_PCAP_DUMP_FLUSH 726 { "packet-buffered", no_argument, NULL, 'U' }, 727 #endif 728 { "linktype", required_argument, NULL, 'y' }, 729 #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE 730 { "immediate-mode", no_argument, NULL, OPTION_IMMEDIATE_MODE }, 731 #endif 732 #if defined(HAVE_PCAP_DEBUG) || defined(HAVE_YYDEBUG) 733 { "debug-filter-parser", no_argument, NULL, 'Y' }, 734 #endif 735 { "relinquish-privileges", required_argument, NULL, 'Z' }, 736 { "number", no_argument, NULL, '#' }, 737 { "version", no_argument, NULL, OPTION_VERSION }, 738 { NULL, 0, NULL, 0 } 739 }; 740 741 #ifndef WIN32 742 /* Drop root privileges and chroot if necessary */ 743 static void 744 droproot(const char *username, const char *chroot_dir) 745 { 746 struct passwd *pw = NULL; 747 748 if (chroot_dir && !username) { 749 fprintf(stderr, "tcpdump: Chroot without dropping root is insecure\n"); 750 exit(1); 751 } 752 753 pw = getpwnam(username); 754 if (pw) { 755 if (initgroups(pw->pw_name, pw->pw_gid) != 0) { 756 fprintf(stderr, "tcpdump: Couldn't initgroups to " 757 "'%.32s' gid=%lu: %s\n", pw->pw_name, 758 (unsigned long)pw->pw_gid, 759 pcap_strerror(errno)); 760 exit(1); 761 } 762 if (chroot_dir) { 763 setprotoent(1); 764 res_init(); 765 if (chroot(chroot_dir) != 0 || chdir ("/") != 0) { 766 fprintf(stderr, "tcpdump: Couldn't chroot/chdir to '%.64s': %s\n", 767 chroot_dir, pcap_strerror(errno)); 768 exit(1); 769 } 770 } 771 #ifdef HAVE_LIBCAP_NG 772 int ret = capng_change_id(pw->pw_uid, pw->pw_gid, CAPNG_NO_FLAG); 773 if (ret < 0) { 774 fprintf(stderr, "error : ret %d\n", ret); 775 } 776 else { 777 // fprintf(stderr, "dropped privs to %s\n", username); 778 } 779 #else 780 if (initgroups(pw->pw_name, pw->pw_gid) != 0 || 781 setgid(pw->pw_gid) != 0 || setuid(pw->pw_uid) != 0) { 782 fprintf(stderr, "tcpdump: Couldn't change to '%.32s' uid=%lu gid=%lu: %s\n", 783 username, 784 (unsigned long)pw->pw_uid, 785 (unsigned long)pw->pw_gid, 786 pcap_strerror(errno)); 787 exit(1); 788 } 789 else { 790 // fprintf(stderr, "dropped privs to %s\n", username); 791 } 792 #endif /* HAVE_LIBCAP_NG */ 793 } 794 else { 795 fprintf(stderr, "tcpdump: Couldn't find user '%.32s'\n", 796 username); 797 exit(1); 798 } 799 #ifdef HAVE_LIBCAP_NG 800 /* We don't need CAP_SETUID and CAP_SETGID any more. */ 801 capng_updatev( 802 CAPNG_DROP, 803 CAPNG_EFFECTIVE | CAPNG_PERMITTED, 804 CAP_SETUID, 805 CAP_SETGID, 806 -1); 807 capng_apply(CAPNG_SELECT_BOTH); 808 #endif /* HAVE_LIBCAP_NG */ 809 810 } 811 #endif /* WIN32 */ 812 813 static int 814 getWflagChars(int x) 815 { 816 int c = 0; 817 818 x -= 1; 819 while (x > 0) { 820 c += 1; 821 x /= 10; 822 } 823 824 return c; 825 } 826 827 828 static void 829 MakeFilename(char *buffer, char *orig_name, int cnt, int max_chars) 830 { 831 char *filename = malloc(PATH_MAX + 1); 832 if (filename == NULL) 833 error("Makefilename: malloc"); 834 835 /* Process with strftime if Gflag is set. */ 836 if (Gflag != 0) { 837 struct tm *local_tm; 838 839 /* Convert Gflag_time to a usable format */ 840 if ((local_tm = localtime(&Gflag_time)) == NULL) { 841 error("MakeTimedFilename: localtime"); 842 } 843 844 /* There's no good way to detect an error in strftime since a return 845 * value of 0 isn't necessarily failure. 846 */ 847 strftime(filename, PATH_MAX, orig_name, local_tm); 848 } else { 849 strncpy(filename, orig_name, PATH_MAX); 850 } 851 852 if (cnt == 0 && max_chars == 0) 853 strncpy(buffer, filename, PATH_MAX + 1); 854 else 855 if (snprintf(buffer, PATH_MAX + 1, "%s%0*d", filename, max_chars, cnt) > PATH_MAX) 856 /* Report an error if the filename is too large */ 857 error("too many output files or filename is too long (> %d)", PATH_MAX); 858 free(filename); 859 } 860 861 static int tcpdump_printf(netdissect_options *ndo _U_, 862 const char *fmt, ...) 863 { 864 865 va_list args; 866 int ret; 867 868 va_start(args, fmt); 869 ret=vfprintf(stdout, fmt, args); 870 va_end(args); 871 872 return ret; 873 } 874 875 static struct print_info 876 get_print_info(int type) 877 { 878 struct print_info printinfo; 879 880 printinfo.ndo_type = 1; 881 printinfo.ndo = gndo; 882 printinfo.p.ndo_printer = lookup_ndo_printer(type); 883 if (printinfo.p.ndo_printer == NULL) { 884 printinfo.p.printer = lookup_printer(type); 885 printinfo.ndo_type = 0; 886 if (printinfo.p.printer == NULL) { 887 gndo->ndo_dltname = pcap_datalink_val_to_name(type); 888 if (gndo->ndo_dltname != NULL) 889 error("packet printing is not supported for link type %s: use -w", 890 gndo->ndo_dltname); 891 else 892 error("packet printing is not supported for link type %d: use -w", type); 893 } 894 } 895 return (printinfo); 896 } 897 898 static char * 899 get_next_file(FILE *VFile, char *ptr) 900 { 901 char *ret; 902 903 ret = fgets(ptr, PATH_MAX, VFile); 904 if (!ret) 905 return NULL; 906 907 if (ptr[strlen(ptr) - 1] == '\n') 908 ptr[strlen(ptr) - 1] = '\0'; 909 910 return ret; 911 } 912 913 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION 914 static int 915 tstamp_precision_from_string(const char *precision) 916 { 917 if (strncmp(precision, "nano", strlen("nano")) == 0) 918 return PCAP_TSTAMP_PRECISION_NANO; 919 920 if (strncmp(precision, "micro", strlen("micro")) == 0) 921 return PCAP_TSTAMP_PRECISION_MICRO; 922 923 return -EINVAL; 924 } 925 926 static const char * 927 tstamp_precision_to_string(int precision) 928 { 929 switch (precision) { 930 931 case PCAP_TSTAMP_PRECISION_MICRO: 932 return "micro"; 933 934 case PCAP_TSTAMP_PRECISION_NANO: 935 return "nano"; 936 937 default: 938 return "unknown"; 939 } 940 } 941 #endif 942 943 #ifdef HAVE_CAPSICUM 944 /* 945 * Ensure that, on a dump file's descriptor, we have all the rights 946 * necessary to make the standard I/O library work with an fdopen()ed 947 * FILE * from that descriptor. 948 * 949 * A long time ago, in a galaxy far far away, AT&T decided that, instead 950 * of providing separate APIs for getting and setting the FD_ flags on a 951 * descriptor, getting and setting the O_ flags on a descriptor, and 952 * locking files, they'd throw them all into a kitchen-sink fcntl() call 953 * along the lines of ioctl(), the fact that ioctl() operations are 954 * largely specific to particular character devices but fcntl() operations 955 * are either generic to all descriptors or generic to all descriptors for 956 * regular files nonwithstanding. 957 * 958 * The Capsicum people decided that fine-grained control of descriptor 959 * operations was required, so that you need to grant permission for 960 * reading, writing, seeking, and fcntl-ing. The latter, courtesy of 961 * AT&T's decision, means that "fcntl-ing" isn't a thing, but a motley 962 * collection of things, so there are *individual* fcntls for which 963 * permission needs to be granted. 964 * 965 * The FreeBSD standard I/O people implemented some optimizations that 966 * requires that the standard I/O routines be able to determine whether 967 * the descriptor for the FILE * is open append-only or not; as that 968 * descriptor could have come from an open() rather than an fopen(), 969 * that requires that it be able to do an F_GETFL fcntl() to read 970 * the O_ flags. 971 * 972 * Tcpdump uses ftell() to determine how much data has been written 973 * to a file in order to, when used with -C, determine when it's time 974 * to rotate capture files. ftell() therefore needs to do an lseek() 975 * to find out the file offset and must, thanks to the aforementioned 976 * optimization, also know whether the descriptor is open append-only 977 * or not. 978 * 979 * The net result of all the above is that we need to grant CAP_SEEK, 980 * CAP_WRITE, and CAP_FCNTL with the CAP_FCNTL_GETFL subcapability. 981 * 982 * Perhaps this is the universe's way of saying that either 983 * 984 * 1) there needs to be an fopenat() call and a pcap_dump_openat() call 985 * using it, so that Capsicum-capable tcpdump wouldn't need to do 986 * an fdopen() 987 * 988 * or 989 * 990 * 2) there needs to be a cap_fdopen() call in the FreeBSD standard 991 * I/O library that knows what rights are needed by the standard 992 * I/O library, based on the open mode, and assigns them, perhaps 993 * with an additional argument indicating, for example, whether 994 * seeking should be allowed, so that tcpdump doesn't need to know 995 * what the standard I/O library happens to require this week. 996 */ 997 static void 998 set_dumper_capsicum_rights(pcap_dumper_t *p) 999 { 1000 int fd = fileno(pcap_dump_file(p)); 1001 cap_rights_t rights; 1002 1003 cap_rights_init(&rights, CAP_SEEK, CAP_WRITE, CAP_FCNTL); 1004 if (cap_rights_limit(fd, &rights) < 0 && errno != ENOSYS) { 1005 error("unable to limit dump descriptor"); 1006 } 1007 if (cap_fcntls_limit(fd, CAP_FCNTL_GETFL) < 0 && errno != ENOSYS) { 1008 error("unable to limit dump descriptor fcntls"); 1009 } 1010 } 1011 #endif 1012 1013 int 1014 main(int argc, char **argv) 1015 { 1016 register int cnt, op, i; 1017 bpf_u_int32 localnet =0 , netmask = 0; 1018 register char *cp, *infile, *cmdbuf, *device, *RFileName, *VFileName, *WFileName; 1019 pcap_handler callback; 1020 int type; 1021 int dlt; 1022 int new_dlt; 1023 const char *dlt_name; 1024 struct bpf_program fcode; 1025 #ifndef WIN32 1026 RETSIGTYPE (*oldhandler)(int); 1027 #endif 1028 struct print_info printinfo; 1029 struct dump_info dumpinfo; 1030 u_char *pcap_userdata; 1031 char ebuf[PCAP_ERRBUF_SIZE]; 1032 char VFileLine[PATH_MAX + 1]; 1033 char *username = NULL; 1034 char *chroot_dir = NULL; 1035 char *ret = NULL; 1036 char *end; 1037 #ifdef HAVE_PCAP_FINDALLDEVS 1038 pcap_if_t *devpointer; 1039 int devnum; 1040 #endif 1041 int status; 1042 FILE *VFile; 1043 #ifdef HAVE_CAPSICUM 1044 cap_rights_t rights; 1045 int cansandbox; 1046 #endif /* HAVE_CAPSICUM */ 1047 1048 #ifdef WIN32 1049 if(wsockinit() != 0) return 1; 1050 #endif /* WIN32 */ 1051 1052 jflag=-1; /* not set */ 1053 gndo->ndo_Oflag=1; 1054 gndo->ndo_Rflag=1; 1055 gndo->ndo_dlt=-1; 1056 gndo->ndo_default_print=ndo_default_print; 1057 gndo->ndo_printf=tcpdump_printf; 1058 gndo->ndo_error=ndo_error; 1059 gndo->ndo_warning=ndo_warning; 1060 gndo->ndo_snaplen = DEFAULT_SNAPLEN; 1061 gndo->ndo_immediate = 0; 1062 1063 cnt = -1; 1064 device = NULL; 1065 infile = NULL; 1066 RFileName = NULL; 1067 VFileName = NULL; 1068 VFile = NULL; 1069 WFileName = NULL; 1070 dlt = -1; 1071 if ((cp = strrchr(argv[0], '/')) != NULL) 1072 program_name = cp + 1; 1073 else 1074 program_name = argv[0]; 1075 1076 /* 1077 * On platforms where the CPU doesn't support unaligned loads, 1078 * force unaligned accesses to abort with SIGBUS, rather than 1079 * being fixed up (slowly) by the OS kernel; on those platforms, 1080 * misaligned accesses are bugs, and we want tcpdump to crash so 1081 * that the bugs are reported. 1082 */ 1083 if (abort_on_misalignment(ebuf, sizeof(ebuf)) < 0) 1084 error("%s", ebuf); 1085 1086 #ifdef USE_LIBSMI 1087 smiInit("tcpdump"); 1088 #endif 1089 1090 while ( 1091 (op = getopt_long(argc, argv, SHORTOPTS, longopts, NULL)) != -1) 1092 switch (op) { 1093 1094 case 'a': 1095 /* compatibility for old -a */ 1096 break; 1097 1098 case 'A': 1099 ++Aflag; 1100 break; 1101 1102 case 'b': 1103 ++bflag; 1104 break; 1105 1106 #if defined(HAVE_PCAP_CREATE) || defined(WIN32) 1107 case 'B': 1108 Bflag = atoi(optarg)*1024; 1109 if (Bflag <= 0) 1110 error("invalid packet buffer size %s", optarg); 1111 break; 1112 #endif /* defined(HAVE_PCAP_CREATE) || defined(WIN32) */ 1113 1114 case 'c': 1115 cnt = atoi(optarg); 1116 if (cnt <= 0) 1117 error("invalid packet count %s", optarg); 1118 break; 1119 1120 case 'C': 1121 Cflag = atoi(optarg) * 1000000; 1122 if (Cflag < 0) 1123 error("invalid file size %s", optarg); 1124 break; 1125 1126 case 'd': 1127 ++dflag; 1128 break; 1129 1130 case 'D': 1131 Dflag++; 1132 break; 1133 1134 case 'L': 1135 Lflag++; 1136 break; 1137 1138 case 'e': 1139 ++eflag; 1140 break; 1141 1142 case 'E': 1143 #ifndef HAVE_LIBCRYPTO 1144 warning("crypto code not compiled in"); 1145 #endif 1146 gndo->ndo_espsecret = optarg; 1147 break; 1148 1149 case 'f': 1150 ++fflag; 1151 break; 1152 1153 case 'F': 1154 infile = optarg; 1155 break; 1156 1157 case 'G': 1158 Gflag = atoi(optarg); 1159 if (Gflag < 0) 1160 error("invalid number of seconds %s", optarg); 1161 1162 /* We will create one file initially. */ 1163 Gflag_count = 0; 1164 1165 /* Grab the current time for rotation use. */ 1166 if ((Gflag_time = time(NULL)) == (time_t)-1) { 1167 error("main: can't get current time: %s", 1168 pcap_strerror(errno)); 1169 } 1170 break; 1171 1172 case 'h': 1173 print_usage(); 1174 exit(0); 1175 break; 1176 1177 case 'H': 1178 ++Hflag; 1179 break; 1180 1181 case 'i': 1182 if (optarg[0] == '0' && optarg[1] == 0) 1183 error("Invalid adapter index"); 1184 1185 #ifdef HAVE_PCAP_FINDALLDEVS 1186 /* 1187 * If the argument is a number, treat it as 1188 * an index into the list of adapters, as 1189 * printed by "tcpdump -D". 1190 * 1191 * This should be OK on UNIX systems, as interfaces 1192 * shouldn't have names that begin with digits. 1193 * It can be useful on Windows, where more than 1194 * one interface can have the same name. 1195 */ 1196 devnum = strtol(optarg, &end, 10); 1197 if (optarg != end && *end == '\0') { 1198 if (devnum < 0) 1199 error("Invalid adapter index"); 1200 1201 if (pcap_findalldevs(&devpointer, ebuf) < 0) 1202 error("%s", ebuf); 1203 else { 1204 /* 1205 * Look for the devnum-th entry 1206 * in the list of devices 1207 * (1-based). 1208 */ 1209 for (i = 0; 1210 i < devnum-1 && devpointer != NULL; 1211 i++, devpointer = devpointer->next) 1212 ; 1213 if (devpointer == NULL) 1214 error("Invalid adapter index"); 1215 } 1216 device = devpointer->name; 1217 break; 1218 } 1219 #endif /* HAVE_PCAP_FINDALLDEVS */ 1220 device = optarg; 1221 break; 1222 1223 #ifdef HAVE_PCAP_CREATE 1224 case 'I': 1225 ++Iflag; 1226 break; 1227 #endif /* HAVE_PCAP_CREATE */ 1228 1229 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE 1230 case 'j': 1231 jflag = pcap_tstamp_type_name_to_val(optarg); 1232 if (jflag < 0) 1233 error("invalid time stamp type %s", optarg); 1234 break; 1235 1236 case 'J': 1237 Jflag++; 1238 break; 1239 #endif 1240 1241 case 'l': 1242 #ifdef WIN32 1243 /* 1244 * _IOLBF is the same as _IOFBF in Microsoft's C 1245 * libraries; the only alternative they offer 1246 * is _IONBF. 1247 * 1248 * XXX - this should really be checking for MSVC++, 1249 * not WIN32, if, for example, MinGW has its own 1250 * C library that is more UNIX-compatible. 1251 */ 1252 setvbuf(stdout, NULL, _IONBF, 0); 1253 #else /* WIN32 */ 1254 #ifdef HAVE_SETLINEBUF 1255 setlinebuf(stdout); 1256 #else 1257 setvbuf(stdout, NULL, _IOLBF, 0); 1258 #endif 1259 #endif /* WIN32 */ 1260 break; 1261 1262 case 'K': 1263 ++Kflag; 1264 break; 1265 1266 case 'm': 1267 #ifdef USE_LIBSMI 1268 if (smiLoadModule(optarg) == 0) { 1269 error("could not load MIB module %s", optarg); 1270 } 1271 sflag = 1; 1272 #else 1273 (void)fprintf(stderr, "%s: ignoring option `-m %s' ", 1274 program_name, optarg); 1275 (void)fprintf(stderr, "(no libsmi support)\n"); 1276 #endif 1277 break; 1278 1279 case 'M': 1280 /* TCP-MD5 shared secret */ 1281 #ifndef HAVE_LIBCRYPTO 1282 warning("crypto code not compiled in"); 1283 #endif 1284 sigsecret = optarg; 1285 break; 1286 1287 case 'n': 1288 ++nflag; 1289 break; 1290 1291 case 'N': 1292 ++Nflag; 1293 break; 1294 1295 case 'O': 1296 Oflag = 0; 1297 break; 1298 1299 case 'p': 1300 ++pflag; 1301 break; 1302 1303 case 'q': 1304 ++qflag; 1305 ++suppress_default_print; 1306 break; 1307 1308 #ifdef HAVE_PCAP_SETDIRECTION 1309 case 'Q': 1310 if (strcasecmp(optarg, "in") == 0) 1311 Qflag = PCAP_D_IN; 1312 else if (strcasecmp(optarg, "out") == 0) 1313 Qflag = PCAP_D_OUT; 1314 else if (strcasecmp(optarg, "inout") == 0) 1315 Qflag = PCAP_D_INOUT; 1316 else 1317 error("unknown capture direction `%s'", optarg); 1318 break; 1319 #endif /* HAVE_PCAP_SETDIRECTION */ 1320 1321 case 'r': 1322 RFileName = optarg; 1323 break; 1324 1325 case 'R': 1326 Rflag = 0; 1327 break; 1328 1329 case 's': 1330 snaplen = strtol(optarg, &end, 0); 1331 if (optarg == end || *end != '\0' 1332 || snaplen < 0 || snaplen > MAXIMUM_SNAPLEN) 1333 error("invalid snaplen %s", optarg); 1334 else if (snaplen == 0) 1335 snaplen = MAXIMUM_SNAPLEN; 1336 break; 1337 1338 case 'S': 1339 ++Sflag; 1340 break; 1341 1342 case 't': 1343 ++tflag; 1344 break; 1345 1346 case 'T': 1347 if (strcasecmp(optarg, "vat") == 0) 1348 packettype = PT_VAT; 1349 else if (strcasecmp(optarg, "wb") == 0) 1350 packettype = PT_WB; 1351 else if (strcasecmp(optarg, "rpc") == 0) 1352 packettype = PT_RPC; 1353 else if (strcasecmp(optarg, "rtp") == 0) 1354 packettype = PT_RTP; 1355 else if (strcasecmp(optarg, "rtcp") == 0) 1356 packettype = PT_RTCP; 1357 else if (strcasecmp(optarg, "snmp") == 0) 1358 packettype = PT_SNMP; 1359 else if (strcasecmp(optarg, "cnfp") == 0) 1360 packettype = PT_CNFP; 1361 else if (strcasecmp(optarg, "tftp") == 0) 1362 packettype = PT_TFTP; 1363 else if (strcasecmp(optarg, "aodv") == 0) 1364 packettype = PT_AODV; 1365 else if (strcasecmp(optarg, "carp") == 0) 1366 packettype = PT_CARP; 1367 else if (strcasecmp(optarg, "radius") == 0) 1368 packettype = PT_RADIUS; 1369 else if (strcasecmp(optarg, "zmtp1") == 0) 1370 packettype = PT_ZMTP1; 1371 else if (strcasecmp(optarg, "vxlan") == 0) 1372 packettype = PT_VXLAN; 1373 else if (strcasecmp(optarg, "pgm") == 0) 1374 packettype = PT_PGM; 1375 else if (strcasecmp(optarg, "pgm_zmtp1") == 0) 1376 packettype = PT_PGM_ZMTP1; 1377 else if (strcasecmp(optarg, "lmp") == 0) 1378 packettype = PT_LMP; 1379 else 1380 error("unknown packet type `%s'", optarg); 1381 break; 1382 1383 case 'u': 1384 ++uflag; 1385 break; 1386 1387 #ifdef HAVE_PCAP_DUMP_FLUSH 1388 case 'U': 1389 ++Uflag; 1390 break; 1391 #endif 1392 1393 case 'v': 1394 ++vflag; 1395 break; 1396 1397 case 'V': 1398 VFileName = optarg; 1399 break; 1400 1401 case 'w': 1402 WFileName = optarg; 1403 break; 1404 1405 case 'W': 1406 Wflag = atoi(optarg); 1407 if (Wflag < 0) 1408 error("invalid number of output files %s", optarg); 1409 WflagChars = getWflagChars(Wflag); 1410 break; 1411 1412 case 'x': 1413 ++xflag; 1414 ++suppress_default_print; 1415 break; 1416 1417 case 'X': 1418 ++Xflag; 1419 ++suppress_default_print; 1420 break; 1421 1422 case 'y': 1423 gndo->ndo_dltname = optarg; 1424 gndo->ndo_dlt = 1425 pcap_datalink_name_to_val(gndo->ndo_dltname); 1426 if (gndo->ndo_dlt < 0) 1427 error("invalid data link type %s", gndo->ndo_dltname); 1428 break; 1429 1430 #if defined(HAVE_PCAP_DEBUG) || defined(HAVE_YYDEBUG) 1431 case 'Y': 1432 { 1433 /* Undocumented flag */ 1434 #ifdef HAVE_PCAP_DEBUG 1435 extern int pcap_debug; 1436 pcap_debug = 1; 1437 #else 1438 extern int yydebug; 1439 yydebug = 1; 1440 #endif 1441 } 1442 break; 1443 #endif 1444 case 'z': 1445 zflag = strdup(optarg); 1446 break; 1447 1448 case 'Z': 1449 username = strdup(optarg); 1450 break; 1451 1452 case '#': 1453 gndo->ndo_packet_number = 1; 1454 break; 1455 1456 case OPTION_VERSION: 1457 print_version(); 1458 exit(0); 1459 break; 1460 1461 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION 1462 case OPTION_TSTAMP_PRECISION: 1463 gndo->ndo_tstamp_precision = tstamp_precision_from_string(optarg); 1464 if (gndo->ndo_tstamp_precision < 0) 1465 error("unsupported time stamp precision"); 1466 break; 1467 #endif 1468 1469 #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE 1470 case OPTION_IMMEDIATE_MODE: 1471 gndo->ndo_immediate = 1; 1472 break; 1473 #endif 1474 1475 default: 1476 print_usage(); 1477 exit(1); 1478 /* NOTREACHED */ 1479 } 1480 1481 #ifdef HAVE_PCAP_FINDALLDEVS 1482 if (Dflag) 1483 show_devices_and_exit(); 1484 #endif 1485 1486 switch (tflag) { 1487 1488 case 0: /* Default */ 1489 case 4: /* Default + Date*/ 1490 thiszone = gmt2local(0); 1491 break; 1492 1493 case 1: /* No time stamp */ 1494 case 2: /* Unix timeval style */ 1495 case 3: /* Microseconds since previous packet */ 1496 case 5: /* Microseconds since first packet */ 1497 break; 1498 1499 default: /* Not supported */ 1500 error("only -t, -tt, -ttt, -tttt and -ttttt are supported"); 1501 break; 1502 } 1503 1504 if (fflag != 0 && (VFileName != NULL || RFileName != NULL)) 1505 error("-f can not be used with -V or -r"); 1506 1507 if (VFileName != NULL && RFileName != NULL) 1508 error("-V and -r are mutually exclusive."); 1509 1510 #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE 1511 /* 1512 * If we're printing dissected packets to the standard output 1513 * rather than saving raw packets to a file, and the standard 1514 * output is a terminal, use immediate mode, as the user's 1515 * probably expecting to see packets pop up immediately. 1516 */ 1517 if (WFileName == NULL && isatty(1)) 1518 gndo->ndo_immediate = 1; 1519 #endif 1520 1521 #ifdef WITH_CHROOT 1522 /* if run as root, prepare for chrooting */ 1523 if (getuid() == 0 || geteuid() == 0) { 1524 /* future extensibility for cmd-line arguments */ 1525 if (!chroot_dir) 1526 chroot_dir = WITH_CHROOT; 1527 } 1528 #endif 1529 1530 #ifdef WITH_USER 1531 /* if run as root, prepare for dropping root privileges */ 1532 if (getuid() == 0 || geteuid() == 0) { 1533 /* Run with '-Z root' to restore old behaviour */ 1534 if (!username) 1535 username = WITH_USER; 1536 } 1537 #endif 1538 1539 if (RFileName != NULL || VFileName != NULL) { 1540 /* 1541 * If RFileName is non-null, it's the pathname of a 1542 * savefile to read. If VFileName is non-null, it's 1543 * the pathname of a file containing a list of pathnames 1544 * (one per line) of savefiles to read. 1545 * 1546 * In either case, we're reading a savefile, not doing 1547 * a live capture. 1548 */ 1549 #ifndef WIN32 1550 /* 1551 * We don't need network access, so relinquish any set-UID 1552 * or set-GID privileges we have (if any). 1553 * 1554 * We do *not* want set-UID privileges when opening a 1555 * trace file, as that might let the user read other 1556 * people's trace files (especially if we're set-UID 1557 * root). 1558 */ 1559 if (setgid(getgid()) != 0 || setuid(getuid()) != 0 ) 1560 fprintf(stderr, "Warning: setgid/setuid failed !\n"); 1561 #endif /* WIN32 */ 1562 if (VFileName != NULL) { 1563 if (VFileName[0] == '-' && VFileName[1] == '\0') 1564 VFile = stdin; 1565 else 1566 VFile = fopen(VFileName, "r"); 1567 1568 if (VFile == NULL) 1569 error("Unable to open file: %s\n", strerror(errno)); 1570 1571 ret = get_next_file(VFile, VFileLine); 1572 if (!ret) 1573 error("Nothing in %s\n", VFileName); 1574 RFileName = VFileLine; 1575 } 1576 1577 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION 1578 pd = pcap_open_offline_with_tstamp_precision(RFileName, 1579 gndo->ndo_tstamp_precision, ebuf); 1580 #else 1581 pd = pcap_open_offline(RFileName, ebuf); 1582 #endif 1583 1584 if (pd == NULL) 1585 error("%s", ebuf); 1586 #ifdef HAVE_CAPSICUM 1587 cap_rights_init(&rights, CAP_READ); 1588 if (cap_rights_limit(fileno(pcap_file(pd)), &rights) < 0 && 1589 errno != ENOSYS) { 1590 error("unable to limit pcap descriptor"); 1591 } 1592 #endif 1593 dlt = pcap_datalink(pd); 1594 dlt_name = pcap_datalink_val_to_name(dlt); 1595 if (dlt_name == NULL) { 1596 fprintf(stderr, "reading from file %s, link-type %u\n", 1597 RFileName, dlt); 1598 } else { 1599 fprintf(stderr, 1600 "reading from file %s, link-type %s (%s)\n", 1601 RFileName, dlt_name, 1602 pcap_datalink_val_to_description(dlt)); 1603 } 1604 } else { 1605 /* 1606 * We're doing a live capture. 1607 */ 1608 if (device == NULL) { 1609 device = pcap_lookupdev(ebuf); 1610 if (device == NULL) 1611 error("%s", ebuf); 1612 } 1613 #ifdef WIN32 1614 /* 1615 * Print a message to the standard error on Windows. 1616 * XXX - why do it here, with a different message? 1617 */ 1618 if(strlen(device) == 1) /* we assume that an ASCII string is always longer than 1 char */ 1619 { /* a Unicode string has a \0 as second byte (so strlen() is 1) */ 1620 fprintf(stderr, "%s: listening on %ws\n", program_name, device); 1621 } 1622 else 1623 { 1624 fprintf(stderr, "%s: listening on %s\n", program_name, device); 1625 } 1626 1627 fflush(stderr); 1628 #endif /* WIN32 */ 1629 #ifdef HAVE_PCAP_CREATE 1630 pd = pcap_create(device, ebuf); 1631 if (pd == NULL) 1632 error("%s", ebuf); 1633 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE 1634 if (Jflag) 1635 show_tstamp_types_and_exit(device, pd); 1636 #endif 1637 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION 1638 status = pcap_set_tstamp_precision(pd, gndo->ndo_tstamp_precision); 1639 if (status != 0) 1640 error("%s: Can't set %ssecond time stamp precision: %s", 1641 device, 1642 tstamp_precision_to_string(gndo->ndo_tstamp_precision), 1643 pcap_statustostr(status)); 1644 #endif 1645 1646 #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE 1647 if (gndo->ndo_immediate) { 1648 status = pcap_set_immediate_mode(pd, 1); 1649 if (status != 0) 1650 error("%s: Can't set immediate mode: %s", 1651 device, 1652 pcap_statustostr(status)); 1653 } 1654 #endif 1655 /* 1656 * Is this an interface that supports monitor mode? 1657 */ 1658 if (pcap_can_set_rfmon(pd) == 1) 1659 supports_monitor_mode = 1; 1660 else 1661 supports_monitor_mode = 0; 1662 status = pcap_set_snaplen(pd, snaplen); 1663 if (status != 0) 1664 error("%s: Can't set snapshot length: %s", 1665 device, pcap_statustostr(status)); 1666 status = pcap_set_promisc(pd, !pflag); 1667 if (status != 0) 1668 error("%s: Can't set promiscuous mode: %s", 1669 device, pcap_statustostr(status)); 1670 if (Iflag) { 1671 status = pcap_set_rfmon(pd, 1); 1672 if (status != 0) 1673 error("%s: Can't set monitor mode: %s", 1674 device, pcap_statustostr(status)); 1675 } 1676 status = pcap_set_timeout(pd, 1000); 1677 if (status != 0) 1678 error("%s: pcap_set_timeout failed: %s", 1679 device, pcap_statustostr(status)); 1680 if (Bflag != 0) { 1681 status = pcap_set_buffer_size(pd, Bflag); 1682 if (status != 0) 1683 error("%s: Can't set buffer size: %s", 1684 device, pcap_statustostr(status)); 1685 } 1686 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE 1687 if (jflag != -1) { 1688 status = pcap_set_tstamp_type(pd, jflag); 1689 if (status < 0) 1690 error("%s: Can't set time stamp type: %s", 1691 device, pcap_statustostr(status)); 1692 } 1693 #endif 1694 status = pcap_activate(pd); 1695 if (status < 0) { 1696 /* 1697 * pcap_activate() failed. 1698 */ 1699 cp = pcap_geterr(pd); 1700 if (status == PCAP_ERROR) 1701 error("%s", cp); 1702 else if ((status == PCAP_ERROR_NO_SUCH_DEVICE || 1703 status == PCAP_ERROR_PERM_DENIED) && 1704 *cp != '\0') 1705 error("%s: %s\n(%s)", device, 1706 pcap_statustostr(status), cp); 1707 else 1708 error("%s: %s", device, 1709 pcap_statustostr(status)); 1710 } else if (status > 0) { 1711 /* 1712 * pcap_activate() succeeded, but it's warning us 1713 * of a problem it had. 1714 */ 1715 cp = pcap_geterr(pd); 1716 if (status == PCAP_WARNING) 1717 warning("%s", cp); 1718 else if (status == PCAP_WARNING_PROMISC_NOTSUP && 1719 *cp != '\0') 1720 warning("%s: %s\n(%s)", device, 1721 pcap_statustostr(status), cp); 1722 else 1723 warning("%s: %s", device, 1724 pcap_statustostr(status)); 1725 } 1726 #ifdef HAVE_PCAP_SETDIRECTION 1727 if (Qflag != -1) { 1728 status = pcap_setdirection(pd, Qflag); 1729 if (status != 0) 1730 error("%s: pcap_setdirection() failed: %s", 1731 device, pcap_geterr(pd)); 1732 } 1733 #endif /* HAVE_PCAP_SETDIRECTION */ 1734 #else 1735 *ebuf = '\0'; 1736 pd = pcap_open_live(device, snaplen, !pflag, 1000, ebuf); 1737 if (pd == NULL) 1738 error("%s", ebuf); 1739 else if (*ebuf) 1740 warning("%s", ebuf); 1741 #endif /* HAVE_PCAP_CREATE */ 1742 /* 1743 * Let user own process after socket has been opened. 1744 */ 1745 #ifndef WIN32 1746 if (setgid(getgid()) != 0 || setuid(getuid()) != 0) 1747 fprintf(stderr, "Warning: setgid/setuid failed !\n"); 1748 #endif /* WIN32 */ 1749 #if !defined(HAVE_PCAP_CREATE) && defined(WIN32) 1750 if(Bflag != 0) 1751 if(pcap_setbuff(pd, Bflag)==-1){ 1752 error("%s", pcap_geterr(pd)); 1753 } 1754 #endif /* !defined(HAVE_PCAP_CREATE) && defined(WIN32) */ 1755 if (Lflag) 1756 show_dlts_and_exit(device, pd); 1757 if (gndo->ndo_dlt >= 0) { 1758 #ifdef HAVE_PCAP_SET_DATALINK 1759 if (pcap_set_datalink(pd, gndo->ndo_dlt) < 0) 1760 error("%s", pcap_geterr(pd)); 1761 #else 1762 /* 1763 * We don't actually support changing the 1764 * data link type, so we only let them 1765 * set it to what it already is. 1766 */ 1767 if (gndo->ndo_dlt != pcap_datalink(pd)) { 1768 error("%s is not one of the DLTs supported by this device\n", 1769 gndo->ndo_dltname); 1770 } 1771 #endif 1772 (void)fprintf(stderr, "%s: data link type %s\n", 1773 program_name, gndo->ndo_dltname); 1774 (void)fflush(stderr); 1775 } 1776 i = pcap_snapshot(pd); 1777 if (snaplen < i) { 1778 warning("snaplen raised from %d to %d", snaplen, i); 1779 snaplen = i; 1780 } 1781 if(fflag != 0) { 1782 if (pcap_lookupnet(device, &localnet, &netmask, ebuf) < 0) { 1783 warning("foreign (-f) flag used but: %s", ebuf); 1784 } 1785 } 1786 1787 } 1788 if (infile) 1789 cmdbuf = read_infile(infile); 1790 else 1791 cmdbuf = copy_argv(&argv[optind]); 1792 1793 if (pcap_compile(pd, &fcode, cmdbuf, Oflag, netmask) < 0) 1794 error("%s", pcap_geterr(pd)); 1795 if (dflag) { 1796 bpf_dump(&fcode, dflag); 1797 pcap_close(pd); 1798 free(cmdbuf); 1799 exit(0); 1800 } 1801 init_addrtoname(gndo, localnet, netmask); 1802 init_checksum(); 1803 1804 #ifndef WIN32 1805 (void)setsignal(SIGPIPE, cleanup); 1806 (void)setsignal(SIGTERM, cleanup); 1807 (void)setsignal(SIGINT, cleanup); 1808 #endif /* WIN32 */ 1809 #if defined(HAVE_FORK) || defined(HAVE_VFORK) 1810 (void)setsignal(SIGCHLD, child_cleanup); 1811 #endif 1812 /* Cooperate with nohup(1) */ 1813 #ifndef WIN32 1814 if ((oldhandler = setsignal(SIGHUP, cleanup)) != SIG_DFL) 1815 (void)setsignal(SIGHUP, oldhandler); 1816 #endif /* WIN32 */ 1817 1818 #ifndef WIN32 1819 /* 1820 * If a user name was specified with "-Z", attempt to switch to 1821 * that user's UID. This would probably be used with sudo, 1822 * to allow tcpdump to be run in a special restricted 1823 * account (if you just want to allow users to open capture 1824 * devices, and can't just give users that permission, 1825 * you'd make tcpdump set-UID or set-GID). 1826 * 1827 * Tcpdump doesn't necessarily write only to one savefile; 1828 * the general only way to allow a -Z instance to write to 1829 * savefiles as the user under whose UID it's run, rather 1830 * than as the user specified with -Z, would thus be to switch 1831 * to the original user ID before opening a capture file and 1832 * then switch back to the -Z user ID after opening the savefile. 1833 * Switching to the -Z user ID only after opening the first 1834 * savefile doesn't handle the general case. 1835 */ 1836 1837 if (getuid() == 0 || geteuid() == 0) { 1838 #ifdef HAVE_LIBCAP_NG 1839 /* Initialize capng */ 1840 capng_clear(CAPNG_SELECT_BOTH); 1841 if (username) { 1842 capng_updatev( 1843 CAPNG_ADD, 1844 CAPNG_PERMITTED | CAPNG_EFFECTIVE, 1845 CAP_SETUID, 1846 CAP_SETGID, 1847 -1); 1848 } 1849 1850 if (WFileName) { 1851 capng_update( 1852 CAPNG_ADD, 1853 CAPNG_PERMITTED | CAPNG_EFFECTIVE, 1854 CAP_DAC_OVERRIDE 1855 ); 1856 } 1857 capng_apply(CAPNG_SELECT_BOTH); 1858 #endif /* HAVE_LIBCAP_NG */ 1859 if (username || chroot_dir) { 1860 #ifndef HAVE_LIBCAP_NG 1861 if (!WFileName) 1862 #endif 1863 droproot(username, chroot_dir); 1864 } 1865 } 1866 #endif /* WIN32 */ 1867 1868 if (pcap_setfilter(pd, &fcode) < 0) 1869 error("%s", pcap_geterr(pd)); 1870 #ifdef HAVE_CAPSICUM 1871 if (RFileName == NULL && VFileName == NULL) { 1872 static const unsigned long cmds[] = { BIOCGSTATS }; 1873 1874 cap_rights_init(&rights, CAP_IOCTL, CAP_READ); 1875 if (cap_rights_limit(pcap_fileno(pd), &rights) < 0 && 1876 errno != ENOSYS) { 1877 error("unable to limit pcap descriptor"); 1878 } 1879 if (cap_ioctls_limit(pcap_fileno(pd), cmds, 1880 sizeof(cmds) / sizeof(cmds[0])) < 0 && errno != ENOSYS) { 1881 error("unable to limit ioctls on pcap descriptor"); 1882 } 1883 } 1884 #endif 1885 if (WFileName) { 1886 pcap_dumper_t *p; 1887 /* Do not exceed the default PATH_MAX for files. */ 1888 dumpinfo.CurrentFileName = (char *)malloc(PATH_MAX + 1); 1889 1890 if (dumpinfo.CurrentFileName == NULL) 1891 error("malloc of dumpinfo.CurrentFileName"); 1892 1893 /* We do not need numbering for dumpfiles if Cflag isn't set. */ 1894 if (Cflag != 0) 1895 MakeFilename(dumpinfo.CurrentFileName, WFileName, 0, WflagChars); 1896 else 1897 MakeFilename(dumpinfo.CurrentFileName, WFileName, 0, 0); 1898 1899 p = pcap_dump_open(pd, dumpinfo.CurrentFileName); 1900 #ifdef HAVE_LIBCAP_NG 1901 /* Give up CAP_DAC_OVERRIDE capability. 1902 * Only allow it to be restored if the -C or -G flag have been 1903 * set since we may need to create more files later on. 1904 */ 1905 capng_update( 1906 CAPNG_DROP, 1907 (Cflag || Gflag ? 0 : CAPNG_PERMITTED) 1908 | CAPNG_EFFECTIVE, 1909 CAP_DAC_OVERRIDE 1910 ); 1911 capng_apply(CAPNG_SELECT_BOTH); 1912 #endif /* HAVE_LIBCAP_NG */ 1913 if (p == NULL) 1914 error("%s", pcap_geterr(pd)); 1915 #ifdef HAVE_CAPSICUM 1916 set_dumper_capsicum_rights(p); 1917 #endif 1918 if (Cflag != 0 || Gflag != 0) { 1919 #ifdef HAVE_CAPSICUM 1920 dumpinfo.WFileName = strdup(basename(WFileName)); 1921 dumpinfo.dirfd = open(dirname(WFileName), 1922 O_DIRECTORY | O_RDONLY); 1923 if (dumpinfo.dirfd < 0) { 1924 error("unable to open directory %s", 1925 dirname(WFileName)); 1926 } 1927 cap_rights_init(&rights, CAP_CREATE, CAP_FCNTL, 1928 CAP_FTRUNCATE, CAP_LOOKUP, CAP_SEEK, CAP_WRITE); 1929 if (cap_rights_limit(dumpinfo.dirfd, &rights) < 0 && 1930 errno != ENOSYS) { 1931 error("unable to limit directory rights"); 1932 } 1933 if (cap_fcntls_limit(dumpinfo.dirfd, CAP_FCNTL_GETFL) < 0 && 1934 errno != ENOSYS) { 1935 error("unable to limit dump descriptor fcntls"); 1936 } 1937 #else /* !HAVE_CAPSICUM */ 1938 dumpinfo.WFileName = WFileName; 1939 #endif 1940 callback = dump_packet_and_trunc; 1941 dumpinfo.pd = pd; 1942 dumpinfo.p = p; 1943 pcap_userdata = (u_char *)&dumpinfo; 1944 } else { 1945 callback = dump_packet; 1946 pcap_userdata = (u_char *)p; 1947 } 1948 #ifdef HAVE_PCAP_DUMP_FLUSH 1949 if (Uflag) 1950 pcap_dump_flush(p); 1951 #endif 1952 } else { 1953 type = pcap_datalink(pd); 1954 printinfo = get_print_info(type); 1955 callback = print_packet; 1956 pcap_userdata = (u_char *)&printinfo; 1957 } 1958 1959 #ifdef SIGNAL_REQ_INFO 1960 /* 1961 * We can't get statistics when reading from a file rather 1962 * than capturing from a device. 1963 */ 1964 if (RFileName == NULL) 1965 (void)setsignal(SIGNAL_REQ_INFO, requestinfo); 1966 #endif 1967 1968 if (vflag > 0 && WFileName) { 1969 /* 1970 * When capturing to a file, "-v" means tcpdump should, 1971 * every 10 secodns, "v"erbosely report the number of 1972 * packets captured. 1973 */ 1974 #ifdef USE_WIN32_MM_TIMER 1975 /* call verbose_stats_dump() each 1000 +/-100msec */ 1976 timer_id = timeSetEvent(1000, 100, verbose_stats_dump, 0, TIME_PERIODIC); 1977 setvbuf(stderr, NULL, _IONBF, 0); 1978 #elif defined(HAVE_ALARM) 1979 (void)setsignal(SIGALRM, verbose_stats_dump); 1980 alarm(1); 1981 #endif 1982 } 1983 1984 #ifndef WIN32 1985 if (RFileName == NULL) { 1986 /* 1987 * Live capture (if -V was specified, we set RFileName 1988 * to a file from the -V file). Print a message to 1989 * the standard error on UN*X. 1990 */ 1991 if (!vflag && !WFileName) { 1992 (void)fprintf(stderr, 1993 "%s: verbose output suppressed, use -v or -vv for full protocol decode\n", 1994 program_name); 1995 } else 1996 (void)fprintf(stderr, "%s: ", program_name); 1997 dlt = pcap_datalink(pd); 1998 dlt_name = pcap_datalink_val_to_name(dlt); 1999 if (dlt_name == NULL) { 2000 (void)fprintf(stderr, "listening on %s, link-type %u, capture size %u bytes\n", 2001 device, dlt, snaplen); 2002 } else { 2003 (void)fprintf(stderr, "listening on %s, link-type %s (%s), capture size %u bytes\n", 2004 device, dlt_name, 2005 pcap_datalink_val_to_description(dlt), snaplen); 2006 } 2007 (void)fflush(stderr); 2008 } 2009 2010 /* 2011 * If a user name was specified with "-Z", attempt to switch to 2012 * that user's UID. This would probably be used with sudo, 2013 * to allow tcpdump to be run in a special restricted 2014 * account (if you just want to allow users to open capture 2015 * devices, and can't just give users that permission, 2016 * you'd make tcpdump set-UID or set-GID). 2017 * 2018 * Tcpdump doesn't necessarily write only to one savefile; 2019 * the general only way to allow a -Z instance to write to 2020 * savefiles as the user under whose UID it's run, rather 2021 * than as the user specified with -Z, would thus be to switch 2022 * to the original user ID before opening a capture file and 2023 * then switch back to the -Z user ID after opening the savefile. 2024 * Switching to the -Z user ID only after opening the first 2025 * savefile doesn't handle the general case. 2026 */ 2027 if (getuid() == 0 || geteuid() == 0) { 2028 if (username || chroot_dir) 2029 droproot(username, chroot_dir); 2030 } 2031 #endif /* WIN32 */ 2032 2033 #ifdef HAVE_CAPSICUM 2034 cansandbox = (nflag && VFileName == NULL && zflag == NULL); 2035 if (cansandbox && cap_enter() < 0 && errno != ENOSYS) 2036 error("unable to enter the capability mode"); 2037 if (cap_sandboxed()) 2038 fprintf(stderr, "capability mode sandbox enabled\n"); 2039 #endif /* HAVE_CAPSICUM */ 2040 2041 do { 2042 status = pcap_loop(pd, cnt, callback, pcap_userdata); 2043 if (WFileName == NULL) { 2044 /* 2045 * We're printing packets. Flush the printed output, 2046 * so it doesn't get intermingled with error output. 2047 */ 2048 if (status == -2) { 2049 /* 2050 * We got interrupted, so perhaps we didn't 2051 * manage to finish a line we were printing. 2052 * Print an extra newline, just in case. 2053 */ 2054 putchar('\n'); 2055 } 2056 (void)fflush(stdout); 2057 } 2058 if (status == -2) { 2059 /* 2060 * We got interrupted. If we are reading multiple 2061 * files (via -V) set these so that we stop. 2062 */ 2063 VFileName = NULL; 2064 ret = NULL; 2065 } 2066 if (status == -1) { 2067 /* 2068 * Error. Report it. 2069 */ 2070 (void)fprintf(stderr, "%s: pcap_loop: %s\n", 2071 program_name, pcap_geterr(pd)); 2072 } 2073 if (RFileName == NULL) { 2074 /* 2075 * We're doing a live capture. Report the capture 2076 * statistics. 2077 */ 2078 info(1); 2079 } 2080 pcap_close(pd); 2081 if (VFileName != NULL) { 2082 ret = get_next_file(VFile, VFileLine); 2083 if (ret) { 2084 RFileName = VFileLine; 2085 pd = pcap_open_offline(RFileName, ebuf); 2086 if (pd == NULL) 2087 error("%s", ebuf); 2088 #ifdef HAVE_CAPSICUM 2089 cap_rights_init(&rights, CAP_READ); 2090 if (cap_rights_limit(fileno(pcap_file(pd)), 2091 &rights) < 0 && errno != ENOSYS) { 2092 error("unable to limit pcap descriptor"); 2093 } 2094 #endif 2095 new_dlt = pcap_datalink(pd); 2096 if (WFileName && new_dlt != dlt) 2097 error("%s: new dlt does not match original", RFileName); 2098 printinfo = get_print_info(new_dlt); 2099 dlt_name = pcap_datalink_val_to_name(new_dlt); 2100 if (dlt_name == NULL) { 2101 fprintf(stderr, "reading from file %s, link-type %u\n", 2102 RFileName, new_dlt); 2103 } else { 2104 fprintf(stderr, 2105 "reading from file %s, link-type %s (%s)\n", 2106 RFileName, dlt_name, 2107 pcap_datalink_val_to_description(new_dlt)); 2108 } 2109 if (pcap_compile(pd, &fcode, cmdbuf, Oflag, netmask) < 0) 2110 error("%s", pcap_geterr(pd)); 2111 if (pcap_setfilter(pd, &fcode) < 0) 2112 error("%s", pcap_geterr(pd)); 2113 } 2114 } 2115 } 2116 while (ret != NULL); 2117 2118 free(cmdbuf); 2119 exit(status == -1 ? 1 : 0); 2120 } 2121 2122 /* make a clean exit on interrupts */ 2123 static RETSIGTYPE 2124 cleanup(int signo _U_) 2125 { 2126 #ifdef USE_WIN32_MM_TIMER 2127 if (timer_id) 2128 timeKillEvent(timer_id); 2129 timer_id = 0; 2130 #elif defined(HAVE_ALARM) 2131 alarm(0); 2132 #endif 2133 2134 #ifdef HAVE_PCAP_BREAKLOOP 2135 /* 2136 * We have "pcap_breakloop()"; use it, so that we do as little 2137 * as possible in the signal handler (it's probably not safe 2138 * to do anything with standard I/O streams in a signal handler - 2139 * the ANSI C standard doesn't say it is). 2140 */ 2141 pcap_breakloop(pd); 2142 #else 2143 /* 2144 * We don't have "pcap_breakloop()"; this isn't safe, but 2145 * it's the best we can do. Print the summary if we're 2146 * not reading from a savefile - i.e., if we're doing a 2147 * live capture - and exit. 2148 */ 2149 if (pd != NULL && pcap_file(pd) == NULL) { 2150 /* 2151 * We got interrupted, so perhaps we didn't 2152 * manage to finish a line we were printing. 2153 * Print an extra newline, just in case. 2154 */ 2155 putchar('\n'); 2156 (void)fflush(stdout); 2157 info(1); 2158 } 2159 exit(0); 2160 #endif 2161 } 2162 2163 /* 2164 On windows, we do not use a fork, so we do not care less about 2165 waiting a child processes to die 2166 */ 2167 #if defined(HAVE_FORK) || defined(HAVE_VFORK) 2168 static RETSIGTYPE 2169 child_cleanup(int signo _U_) 2170 { 2171 wait(NULL); 2172 } 2173 #endif /* HAVE_FORK && HAVE_VFORK */ 2174 2175 static void 2176 info(register int verbose) 2177 { 2178 struct pcap_stat stat; 2179 2180 /* 2181 * Older versions of libpcap didn't set ps_ifdrop on some 2182 * platforms; initialize it to 0 to handle that. 2183 */ 2184 stat.ps_ifdrop = 0; 2185 if (pcap_stats(pd, &stat) < 0) { 2186 (void)fprintf(stderr, "pcap_stats: %s\n", pcap_geterr(pd)); 2187 infoprint = 0; 2188 return; 2189 } 2190 2191 if (!verbose) 2192 fprintf(stderr, "%s: ", program_name); 2193 2194 (void)fprintf(stderr, "%u packet%s captured", packets_captured, 2195 PLURAL_SUFFIX(packets_captured)); 2196 if (!verbose) 2197 fputs(", ", stderr); 2198 else 2199 putc('\n', stderr); 2200 (void)fprintf(stderr, "%u packet%s received by filter", stat.ps_recv, 2201 PLURAL_SUFFIX(stat.ps_recv)); 2202 if (!verbose) 2203 fputs(", ", stderr); 2204 else 2205 putc('\n', stderr); 2206 (void)fprintf(stderr, "%u packet%s dropped by kernel", stat.ps_drop, 2207 PLURAL_SUFFIX(stat.ps_drop)); 2208 if (stat.ps_ifdrop != 0) { 2209 if (!verbose) 2210 fputs(", ", stderr); 2211 else 2212 putc('\n', stderr); 2213 (void)fprintf(stderr, "%u packet%s dropped by interface\n", 2214 stat.ps_ifdrop, PLURAL_SUFFIX(stat.ps_ifdrop)); 2215 } else 2216 putc('\n', stderr); 2217 infoprint = 0; 2218 } 2219 2220 #if defined(HAVE_FORK) || defined(HAVE_VFORK) 2221 static void 2222 compress_savefile(const char *filename) 2223 { 2224 # ifdef HAVE_FORK 2225 if (fork()) 2226 # else 2227 if (vfork()) 2228 # endif 2229 return; 2230 /* 2231 * Set to lowest priority so that this doesn't disturb the capture 2232 */ 2233 #ifdef NZERO 2234 setpriority(PRIO_PROCESS, 0, NZERO - 1); 2235 #else 2236 setpriority(PRIO_PROCESS, 0, 19); 2237 #endif 2238 if (execlp(zflag, zflag, filename, (char *)NULL) == -1) 2239 fprintf(stderr, 2240 "compress_savefile:execlp(%s, %s): %s\n", 2241 zflag, 2242 filename, 2243 strerror(errno)); 2244 # ifdef HAVE_FORK 2245 exit(1); 2246 # else 2247 _exit(1); 2248 # endif 2249 } 2250 #else /* HAVE_FORK && HAVE_VFORK */ 2251 static void 2252 compress_savefile(const char *filename) 2253 { 2254 fprintf(stderr, 2255 "compress_savefile failed. Functionality not implemented under your system\n"); 2256 } 2257 #endif /* HAVE_FORK && HAVE_VFORK */ 2258 2259 static void 2260 dump_packet_and_trunc(u_char *user, const struct pcap_pkthdr *h, const u_char *sp) 2261 { 2262 struct dump_info *dump_info; 2263 #ifdef HAVE_CAPSICUM 2264 cap_rights_t rights; 2265 #endif 2266 2267 ++packets_captured; 2268 2269 ++infodelay; 2270 2271 dump_info = (struct dump_info *)user; 2272 2273 /* 2274 * XXX - this won't force the file to rotate on the specified time 2275 * boundary, but it will rotate on the first packet received after the 2276 * specified Gflag number of seconds. Note: if a Gflag time boundary 2277 * and a Cflag size boundary coincide, the time rotation will occur 2278 * first thereby cancelling the Cflag boundary (since the file should 2279 * be 0). 2280 */ 2281 if (Gflag != 0) { 2282 /* Check if it is time to rotate */ 2283 time_t t; 2284 2285 /* Get the current time */ 2286 if ((t = time(NULL)) == (time_t)-1) { 2287 error("dump_and_trunc_packet: can't get current_time: %s", 2288 pcap_strerror(errno)); 2289 } 2290 2291 2292 /* If the time is greater than the specified window, rotate */ 2293 if (t - Gflag_time >= Gflag) { 2294 #ifdef HAVE_CAPSICUM 2295 FILE *fp; 2296 int fd; 2297 #endif 2298 2299 /* Update the Gflag_time */ 2300 Gflag_time = t; 2301 /* Update Gflag_count */ 2302 Gflag_count++; 2303 /* 2304 * Close the current file and open a new one. 2305 */ 2306 pcap_dump_close(dump_info->p); 2307 2308 /* 2309 * Compress the file we just closed, if the user asked for it 2310 */ 2311 if (zflag != NULL) 2312 compress_savefile(dump_info->CurrentFileName); 2313 2314 /* 2315 * Check to see if we've exceeded the Wflag (when 2316 * not using Cflag). 2317 */ 2318 if (Cflag == 0 && Wflag > 0 && Gflag_count >= Wflag) { 2319 (void)fprintf(stderr, "Maximum file limit reached: %d\n", 2320 Wflag); 2321 exit(0); 2322 /* NOTREACHED */ 2323 } 2324 if (dump_info->CurrentFileName != NULL) 2325 free(dump_info->CurrentFileName); 2326 /* Allocate space for max filename + \0. */ 2327 dump_info->CurrentFileName = (char *)malloc(PATH_MAX + 1); 2328 if (dump_info->CurrentFileName == NULL) 2329 error("dump_packet_and_trunc: malloc"); 2330 /* 2331 * Gflag was set otherwise we wouldn't be here. Reset the count 2332 * so multiple files would end with 1,2,3 in the filename. 2333 * The counting is handled with the -C flow after this. 2334 */ 2335 Cflag_count = 0; 2336 2337 /* 2338 * This is always the first file in the Cflag 2339 * rotation: e.g. 0 2340 * We also don't need numbering if Cflag is not set. 2341 */ 2342 if (Cflag != 0) 2343 MakeFilename(dump_info->CurrentFileName, dump_info->WFileName, 0, 2344 WflagChars); 2345 else 2346 MakeFilename(dump_info->CurrentFileName, dump_info->WFileName, 0, 0); 2347 2348 #ifdef HAVE_LIBCAP_NG 2349 capng_update(CAPNG_ADD, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE); 2350 capng_apply(CAPNG_SELECT_BOTH); 2351 #endif /* HAVE_LIBCAP_NG */ 2352 #ifdef HAVE_CAPSICUM 2353 fd = openat(dump_info->dirfd, 2354 dump_info->CurrentFileName, 2355 O_CREAT | O_WRONLY | O_TRUNC, 0644); 2356 if (fd < 0) { 2357 error("unable to open file %s", 2358 dump_info->CurrentFileName); 2359 } 2360 fp = fdopen(fd, "w"); 2361 if (fp == NULL) { 2362 error("unable to fdopen file %s", 2363 dump_info->CurrentFileName); 2364 } 2365 dump_info->p = pcap_dump_fopen(dump_info->pd, fp); 2366 #else /* !HAVE_CAPSICUM */ 2367 dump_info->p = pcap_dump_open(dump_info->pd, dump_info->CurrentFileName); 2368 #endif 2369 #ifdef HAVE_LIBCAP_NG 2370 capng_update(CAPNG_DROP, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE); 2371 capng_apply(CAPNG_SELECT_BOTH); 2372 #endif /* HAVE_LIBCAP_NG */ 2373 if (dump_info->p == NULL) 2374 error("%s", pcap_geterr(pd)); 2375 #ifdef HAVE_CAPSICUM 2376 set_dumper_capsicum_rights(dump_info->p); 2377 #endif 2378 } 2379 } 2380 2381 /* 2382 * XXX - this won't prevent capture files from getting 2383 * larger than Cflag - the last packet written to the 2384 * file could put it over Cflag. 2385 */ 2386 if (Cflag != 0) { 2387 long size = pcap_dump_ftell(dump_info->p); 2388 2389 if (size == -1) 2390 error("ftell fails on output file"); 2391 if (size > Cflag) { 2392 #ifdef HAVE_CAPSICUM 2393 FILE *fp; 2394 int fd; 2395 #endif 2396 2397 /* 2398 * Close the current file and open a new one. 2399 */ 2400 pcap_dump_close(dump_info->p); 2401 2402 /* 2403 * Compress the file we just closed, if the user 2404 * asked for it. 2405 */ 2406 if (zflag != NULL) 2407 compress_savefile(dump_info->CurrentFileName); 2408 2409 Cflag_count++; 2410 if (Wflag > 0) { 2411 if (Cflag_count >= Wflag) 2412 Cflag_count = 0; 2413 } 2414 if (dump_info->CurrentFileName != NULL) 2415 free(dump_info->CurrentFileName); 2416 dump_info->CurrentFileName = (char *)malloc(PATH_MAX + 1); 2417 if (dump_info->CurrentFileName == NULL) 2418 error("dump_packet_and_trunc: malloc"); 2419 MakeFilename(dump_info->CurrentFileName, dump_info->WFileName, Cflag_count, WflagChars); 2420 #ifdef HAVE_LIBCAP_NG 2421 capng_update(CAPNG_ADD, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE); 2422 capng_apply(CAPNG_SELECT_BOTH); 2423 #endif /* HAVE_LIBCAP_NG */ 2424 #ifdef HAVE_CAPSICUM 2425 fd = openat(dump_info->dirfd, dump_info->CurrentFileName, 2426 O_CREAT | O_WRONLY | O_TRUNC, 0644); 2427 if (fd < 0) { 2428 error("unable to open file %s", 2429 dump_info->CurrentFileName); 2430 } 2431 fp = fdopen(fd, "w"); 2432 if (fp == NULL) { 2433 error("unable to fdopen file %s", 2434 dump_info->CurrentFileName); 2435 } 2436 dump_info->p = pcap_dump_fopen(dump_info->pd, fp); 2437 #else /* !HAVE_CAPSICUM */ 2438 dump_info->p = pcap_dump_open(dump_info->pd, dump_info->CurrentFileName); 2439 #endif 2440 #ifdef HAVE_LIBCAP_NG 2441 capng_update(CAPNG_DROP, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE); 2442 capng_apply(CAPNG_SELECT_BOTH); 2443 #endif /* HAVE_LIBCAP_NG */ 2444 if (dump_info->p == NULL) 2445 error("%s", pcap_geterr(pd)); 2446 #ifdef HAVE_CAPSICUM 2447 set_dumper_capsicum_rights(dump_info->p); 2448 #endif 2449 } 2450 } 2451 2452 pcap_dump((u_char *)dump_info->p, h, sp); 2453 #ifdef HAVE_PCAP_DUMP_FLUSH 2454 if (Uflag) 2455 pcap_dump_flush(dump_info->p); 2456 #endif 2457 2458 --infodelay; 2459 if (infoprint) 2460 info(0); 2461 } 2462 2463 static void 2464 dump_packet(u_char *user, const struct pcap_pkthdr *h, const u_char *sp) 2465 { 2466 ++packets_captured; 2467 2468 ++infodelay; 2469 2470 pcap_dump(user, h, sp); 2471 #ifdef HAVE_PCAP_DUMP_FLUSH 2472 if (Uflag) 2473 pcap_dump_flush((pcap_dumper_t *)user); 2474 #endif 2475 2476 --infodelay; 2477 if (infoprint) 2478 info(0); 2479 } 2480 2481 static void 2482 print_packet(u_char *user, const struct pcap_pkthdr *h, const u_char *sp) 2483 { 2484 struct print_info *print_info; 2485 u_int hdrlen; 2486 netdissect_options *ndo; 2487 2488 ++packets_captured; 2489 2490 ++infodelay; 2491 2492 print_info = (struct print_info *)user; 2493 ndo = print_info->ndo; 2494 2495 if(ndo->ndo_packet_number) 2496 ND_PRINT((ndo, "%5u ", packets_captured)); 2497 2498 ts_print(ndo, &h->ts); 2499 2500 /* 2501 * Some printers want to check that they're not walking off the 2502 * end of the packet. 2503 * Rather than pass it all the way down, we set this member 2504 * of the netdissect_options structure. 2505 */ 2506 ndo->ndo_snapend = sp + h->caplen; 2507 2508 if(print_info->ndo_type) { 2509 hdrlen = (*print_info->p.ndo_printer)(print_info->ndo, h, sp); 2510 } else { 2511 hdrlen = (*print_info->p.printer)(h, sp); 2512 } 2513 2514 /* 2515 * Restore the original snapend, as a printer might have 2516 * changed it. 2517 */ 2518 ndo->ndo_snapend = sp + h->caplen; 2519 if (ndo->ndo_Xflag) { 2520 /* 2521 * Print the raw packet data in hex and ASCII. 2522 */ 2523 if (ndo->ndo_Xflag > 1) { 2524 /* 2525 * Include the link-layer header. 2526 */ 2527 hex_and_ascii_print(ndo, "\n\t", sp, h->caplen); 2528 } else { 2529 /* 2530 * Don't include the link-layer header - and if 2531 * we have nothing past the link-layer header, 2532 * print nothing. 2533 */ 2534 if (h->caplen > hdrlen) 2535 hex_and_ascii_print(ndo, "\n\t", sp + hdrlen, 2536 h->caplen - hdrlen); 2537 } 2538 } else if (ndo->ndo_xflag) { 2539 /* 2540 * Print the raw packet data in hex. 2541 */ 2542 if (ndo->ndo_xflag > 1) { 2543 /* 2544 * Include the link-layer header. 2545 */ 2546 hex_print(ndo, "\n\t", sp, h->caplen); 2547 } else { 2548 /* 2549 * Don't include the link-layer header - and if 2550 * we have nothing past the link-layer header, 2551 * print nothing. 2552 */ 2553 if (h->caplen > hdrlen) 2554 hex_print(ndo, "\n\t", sp + hdrlen, 2555 h->caplen - hdrlen); 2556 } 2557 } else if (ndo->ndo_Aflag) { 2558 /* 2559 * Print the raw packet data in ASCII. 2560 */ 2561 if (ndo->ndo_Aflag > 1) { 2562 /* 2563 * Include the link-layer header. 2564 */ 2565 ascii_print(ndo, sp, h->caplen); 2566 } else { 2567 /* 2568 * Don't include the link-layer header - and if 2569 * we have nothing past the link-layer header, 2570 * print nothing. 2571 */ 2572 if (h->caplen > hdrlen) 2573 ascii_print(ndo, sp + hdrlen, h->caplen - hdrlen); 2574 } 2575 } 2576 2577 putchar('\n'); 2578 2579 --infodelay; 2580 if (infoprint) 2581 info(0); 2582 } 2583 2584 #ifdef WIN32 2585 /* 2586 * XXX - there should really be libpcap calls to get the version 2587 * number as a string (the string would be generated from #defines 2588 * at run time, so that it's not generated from string constants 2589 * in the library, as, on many UNIX systems, those constants would 2590 * be statically linked into the application executable image, and 2591 * would thus reflect the version of libpcap on the system on 2592 * which the application was *linked*, not the system on which it's 2593 * *running*. 2594 * 2595 * That routine should be documented, unlike the "version[]" 2596 * string, so that UNIX vendors providing their own libpcaps 2597 * don't omit it (as a couple of vendors have...). 2598 * 2599 * Packet.dll should perhaps also export a routine to return the 2600 * version number of the Packet.dll code, to supply the 2601 * "Wpcap_version" information on Windows. 2602 */ 2603 char WDversion[]="current-git.tcpdump.org"; 2604 #if !defined(HAVE_GENERATED_VERSION) 2605 char version[]="current-git.tcpdump.org"; 2606 #endif 2607 char pcap_version[]="current-git.tcpdump.org"; 2608 char Wpcap_version[]="3.1"; 2609 #endif 2610 2611 /* 2612 * By default, print the specified data out in hex and ASCII. 2613 */ 2614 static void 2615 ndo_default_print(netdissect_options *ndo, const u_char *bp, u_int length) 2616 { 2617 hex_and_ascii_print(ndo, "\n\t", bp, length); /* pass on lf and indentation string */ 2618 } 2619 2620 void 2621 default_print(const u_char *bp, u_int length) 2622 { 2623 ndo_default_print(gndo, bp, length); 2624 } 2625 2626 #ifdef SIGNAL_REQ_INFO 2627 RETSIGTYPE requestinfo(int signo _U_) 2628 { 2629 if (infodelay) 2630 ++infoprint; 2631 else 2632 info(0); 2633 } 2634 #endif 2635 2636 /* 2637 * Called once each second in verbose mode while dumping to file 2638 */ 2639 #ifdef USE_WIN32_MM_TIMER 2640 void CALLBACK verbose_stats_dump (UINT timer_id _U_, UINT msg _U_, DWORD_PTR arg _U_, 2641 DWORD_PTR dw1 _U_, DWORD_PTR dw2 _U_) 2642 { 2643 struct pcap_stat stat; 2644 2645 if (infodelay == 0 && pcap_stats(pd, &stat) >= 0) 2646 fprintf(stderr, "Got %u\r", packets_captured); 2647 } 2648 #elif defined(HAVE_ALARM) 2649 static void verbose_stats_dump(int sig _U_) 2650 { 2651 struct pcap_stat stat; 2652 2653 if (infodelay == 0 && pcap_stats(pd, &stat) >= 0) 2654 fprintf(stderr, "Got %u\r", packets_captured); 2655 alarm(1); 2656 } 2657 #endif 2658 2659 USES_APPLE_DEPRECATED_API 2660 static void 2661 print_version(void) 2662 { 2663 extern char version[]; 2664 #ifndef HAVE_PCAP_LIB_VERSION 2665 #if defined(WIN32) || defined(HAVE_PCAP_VERSION) 2666 extern char pcap_version[]; 2667 #else /* defined(WIN32) || defined(HAVE_PCAP_VERSION) */ 2668 static char pcap_version[] = "unknown"; 2669 #endif /* defined(WIN32) || defined(HAVE_PCAP_VERSION) */ 2670 #endif /* HAVE_PCAP_LIB_VERSION */ 2671 2672 #ifdef HAVE_PCAP_LIB_VERSION 2673 #ifdef WIN32 2674 (void)fprintf(stderr, "%s version %s, based on tcpdump version %s\n", program_name, WDversion, version); 2675 #else /* WIN32 */ 2676 (void)fprintf(stderr, "%s version %s\n", program_name, version); 2677 #endif /* WIN32 */ 2678 (void)fprintf(stderr, "%s\n",pcap_lib_version()); 2679 #else /* HAVE_PCAP_LIB_VERSION */ 2680 #ifdef WIN32 2681 (void)fprintf(stderr, "%s version %s, based on tcpdump version %s\n", program_name, WDversion, version); 2682 (void)fprintf(stderr, "WinPcap version %s, based on libpcap version %s\n",Wpcap_version, pcap_version); 2683 #else /* WIN32 */ 2684 (void)fprintf(stderr, "%s version %s\n", program_name, version); 2685 (void)fprintf(stderr, "libpcap version %s\n", pcap_version); 2686 #endif /* WIN32 */ 2687 #endif /* HAVE_PCAP_LIB_VERSION */ 2688 2689 #if defined(HAVE_LIBCRYPTO) && defined(SSLEAY_VERSION) 2690 (void)fprintf (stderr, "%s\n", SSLeay_version(SSLEAY_VERSION)); 2691 #endif 2692 2693 #ifdef USE_LIBSMI 2694 (void)fprintf (stderr, "SMI-library: %s\n", smi_version_string); 2695 #endif 2696 } 2697 USES_APPLE_RST 2698 2699 static void 2700 print_usage(void) 2701 { 2702 print_version(); 2703 (void)fprintf(stderr, 2704 "Usage: %s [-aAbd" D_FLAG "efhH" I_FLAG J_FLAG "KlLnNOpqRStu" U_FLAG "vxX#]" B_FLAG_USAGE " [ -c count ]\n", program_name); 2705 (void)fprintf(stderr, 2706 "\t\t[ -C file_size ] [ -E algo:secret ] [ -F file ] [ -G seconds ]\n"); 2707 (void)fprintf(stderr, 2708 "\t\t[ -i interface ]" j_FLAG_USAGE " [ -M secret ] [ --number ]\n"); 2709 #ifdef HAVE_PCAP_SETDIRECTION 2710 (void)fprintf(stderr, 2711 "\t\t[ -Q in|out|inout ]\n"); 2712 #endif 2713 (void)fprintf(stderr, 2714 "\t\t[ -r file ] [ -s snaplen ] "); 2715 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION 2716 (void)fprintf(stderr, "[ --time-stamp-precision precision ]\n"); 2717 (void)fprintf(stderr, 2718 "\t\t"); 2719 #endif 2720 #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE 2721 (void)fprintf(stderr, "[ --immediate-mode ] "); 2722 #endif 2723 (void)fprintf(stderr, "[ -T type ] [ --version ] [ -V file ]\n"); 2724 (void)fprintf(stderr, 2725 "\t\t[ -w file ] [ -W filecount ] [ -y datalinktype ] [ -z command ]\n"); 2726 (void)fprintf(stderr, 2727 "\t\t[ -Z user ] [ expression ]\n"); 2728 } 2729 2730 2731 2732 /* VARARGS */ 2733 static void 2734 ndo_error(netdissect_options *ndo _U_, const char *fmt, ...) 2735 { 2736 va_list ap; 2737 2738 (void)fprintf(stderr, "%s: ", program_name); 2739 va_start(ap, fmt); 2740 (void)vfprintf(stderr, fmt, ap); 2741 va_end(ap); 2742 if (*fmt) { 2743 fmt += strlen(fmt); 2744 if (fmt[-1] != '\n') 2745 (void)fputc('\n', stderr); 2746 } 2747 exit(1); 2748 /* NOTREACHED */ 2749 } 2750 2751 /* VARARGS */ 2752 static void 2753 ndo_warning(netdissect_options *ndo _U_, const char *fmt, ...) 2754 { 2755 va_list ap; 2756 2757 (void)fprintf(stderr, "%s: WARNING: ", program_name); 2758 va_start(ap, fmt); 2759 (void)vfprintf(stderr, fmt, ap); 2760 va_end(ap); 2761 if (*fmt) { 2762 fmt += strlen(fmt); 2763 if (fmt[-1] != '\n') 2764 (void)fputc('\n', stderr); 2765 } 2766 } 2767 /* 2768 * Local Variables: 2769 * c-style: whitesmith 2770 * c-basic-offset: 8 2771 * End: 2772 */ 2773