1 /*
2 * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000
3 * The Regents of the University of California. All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
16 * written permission.
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
20 *
21 * Support for splitting captures into multiple files with a maximum
22 * file size:
23 *
24 * Copyright (c) 2001
25 * Seth Webster <swebster@sst.ll.mit.edu>
26 */
27
28 #include <sys/cdefs.h>
29 #ifndef lint
30 static const char copyright[] _U_ =
31 "@(#) Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000\n\
32 The Regents of the University of California. All rights reserved.\n";
33 __RCSID("$NetBSD: tcpdump.c,v 1.12 2015/09/17 14:03:10 nonaka Exp $");
34 #endif
35
36 /*
37 * tcpdump - monitor tcp/ip traffic on an ethernet.
38 *
39 * First written in 1987 by Van Jacobson, Lawrence Berkeley Laboratory.
40 * Mercilessly hacked and occasionally improved since then via the
41 * combined efforts of Van, Steve McCanne and Craig Leres of LBL.
42 */
43
44 #ifdef HAVE_CONFIG_H
45 #include "config.h"
46 #endif
47
48 /*
49 * Mac OS X may ship pcap.h from libpcap 0.6 with a libpcap based on
50 * 0.8. That means it has pcap_findalldevs() but the header doesn't
51 * define pcap_if_t, meaning that we can't actually *use* pcap_findalldevs().
52 */
53 #ifdef HAVE_PCAP_FINDALLDEVS
54 #ifndef HAVE_PCAP_IF_T
55 #undef HAVE_PCAP_FINDALLDEVS
56 #endif
57 #endif
58
59 #include <tcpdump-stdinc.h>
60
61 #ifdef WIN32
62 #include "w32_fzs.h"
63 extern int strcasecmp (const char *__s1, const char *__s2);
64 extern int SIZE_BUF;
65 #define off_t long
66 #define uint UINT
67 #endif /* WIN32 */
68
69 #ifdef USE_LIBSMI
70 #include <smi.h>
71 #endif
72
73 #ifdef HAVE_LIBCRYPTO
74 #include <openssl/crypto.h>
75 #endif
76
77 #ifdef HAVE_GETOPT_LONG
78 #include <getopt.h>
79 #else
80 #include "getopt_long.h"
81 #endif
82 /* Capsicum-specific code requires macros from <net/bpf.h>, which will fail
83 * to compile if <pcap.h> has already been included; including the headers
84 * in the opposite order works fine.
85 */
86 #ifdef HAVE_CAPSICUM
87 #include <sys/capability.h>
88 #include <sys/ioccom.h>
89 #include <net/bpf.h>
90 #include <fcntl.h>
91 #include <libgen.h>
92 #endif /* HAVE_CAPSICUM */
93 #include <pcap.h>
94 #include <signal.h>
95 #include <stdio.h>
96 #include <stdlib.h>
97 #include <string.h>
98 #include <limits.h>
99 #include <resolv.h>
100 #ifndef WIN32
101 #include <sys/wait.h>
102 #include <sys/resource.h>
103 #include <pwd.h>
104 #include <grp.h>
105 #endif /* WIN32 */
106
107 /* capabilities convenience library */
108 /* If a code depends on HAVE_LIBCAP_NG, it depends also on HAVE_CAP_NG_H.
109 * If HAVE_CAP_NG_H is not defined, undefine HAVE_LIBCAP_NG.
110 * Thus, the later tests are done only on HAVE_LIBCAP_NG.
111 */
112 #ifdef HAVE_LIBCAP_NG
113 #ifdef HAVE_CAP_NG_H
114 #include <cap-ng.h>
115 #else
116 #undef HAVE_LIBCAP_NG
117 #endif /* HAVE_CAP_NG_H */
118 #endif /* HAVE_LIBCAP_NG */
119
120 #include "netdissect.h"
121 #include "interface.h"
122 #include "addrtoname.h"
123 #include "machdep.h"
124 #include "setsignal.h"
125 #include "gmt2local.h"
126 #include "pcap-missing.h"
127
128 #ifndef PATH_MAX
129 #define PATH_MAX 1024
130 #endif
131
132 #ifdef SIGINFO
133 #define SIGNAL_REQ_INFO SIGINFO
134 #elif SIGUSR1
135 #define SIGNAL_REQ_INFO SIGUSR1
136 #endif
137
138 netdissect_options Gndo;
139 netdissect_options *gndo = &Gndo;
140
141 static int Dflag; /* list available devices and exit */
142 static int dflag; /* print filter code */
143 static int Lflag; /* list available data link types and exit */
144 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE
145 static int Jflag; /* list available time stamp types */
146 #endif
147 #ifdef HAVE_PCAP_SETDIRECTION
148 int Qflag = -1; /* restrict captured packet by send/receive direction */
149 #endif
150 static char *zflag = NULL; /* compress each savefile using a specified command (like gzip or bzip2) */
151
152 static int infodelay;
153 static int infoprint;
154
155 char *program_name;
156
157 int32_t thiszone; /* seconds offset from gmt to local time */
158
159 /* Forwards */
160 static RETSIGTYPE cleanup(int);
161 static RETSIGTYPE child_cleanup(int);
162 static void print_version(void);
163 static void print_usage(void);
164 static void show_dlts_and_exit(const char *device, pcap_t *pd) __attribute__((noreturn));
165
166 static void print_packet(u_char *, const struct pcap_pkthdr *, const u_char *);
167 static void ndo_default_print(netdissect_options *, const u_char *, u_int);
168 static void dump_packet_and_trunc(u_char *, const struct pcap_pkthdr *, const u_char *);
169 static void dump_packet(u_char *, const struct pcap_pkthdr *, const u_char *);
170 static void droproot(const char *, const char *);
171 static void ndo_error(netdissect_options *ndo, const char *fmt, ...)
172 __attribute__((noreturn))
173 #ifdef __ATTRIBUTE___FORMAT_OK
174 __attribute__((format (printf, 2, 3)))
175 #endif /* __ATTRIBUTE___FORMAT_OK */
176 ;
177 static void ndo_warning(netdissect_options *ndo, const char *fmt, ...)
178 #ifdef __ATTRIBUTE___FORMAT_OK
179 __attribute__((format (printf, 2, 3)))
180 #endif /* __ATTRIBUTE___FORMAT_OK */
181 ;
182
183 #ifdef SIGNAL_REQ_INFO
184 RETSIGTYPE requestinfo(int);
185 #endif
186
187 #if defined(USE_WIN32_MM_TIMER)
188 #include <MMsystem.h>
189 static UINT timer_id;
190 static void CALLBACK verbose_stats_dump(UINT, UINT, DWORD_PTR, DWORD_PTR, DWORD_PTR);
191 #elif defined(HAVE_ALARM)
192 static void verbose_stats_dump(int sig);
193 #endif
194
195 static void info(int);
196 static u_int packets_captured;
197
198 struct printer {
199 if_printer f;
200 int type;
201 };
202
203
204 struct ndo_printer {
205 if_ndo_printer f;
206 int type;
207 };
208
209
210 static const struct printer printers[] = {
211 { NULL, 0 },
212 };
213
214 static const struct ndo_printer ndo_printers[] = {
215 { ether_if_print, DLT_EN10MB },
216 #ifdef DLT_IPNET
217 { ipnet_if_print, DLT_IPNET },
218 #endif
219 #ifdef DLT_IEEE802_15_4
220 { ieee802_15_4_if_print, DLT_IEEE802_15_4 },
221 #endif
222 #ifdef DLT_IEEE802_15_4_NOFCS
223 { ieee802_15_4_if_print, DLT_IEEE802_15_4_NOFCS },
224 #endif
225 #ifdef DLT_PPI
226 { ppi_if_print, DLT_PPI },
227 #endif
228 #ifdef DLT_NETANALYZER
229 { netanalyzer_if_print, DLT_NETANALYZER },
230 #endif
231 #ifdef DLT_NETANALYZER_TRANSPARENT
232 { netanalyzer_transparent_if_print, DLT_NETANALYZER_TRANSPARENT },
233 #endif
234 #if defined(DLT_NFLOG) && defined(HAVE_PCAP_NFLOG_H)
235 { nflog_if_print, DLT_NFLOG},
236 #endif
237 #ifdef DLT_CIP
238 { cip_if_print, DLT_CIP },
239 #endif
240 #ifdef DLT_ATM_CLIP
241 { cip_if_print, DLT_ATM_CLIP },
242 #endif
243 #ifdef DLT_IP_OVER_FC
244 { ipfc_if_print, DLT_IP_OVER_FC },
245 #endif
246 { null_if_print, DLT_NULL },
247 #ifdef DLT_LOOP
248 { null_if_print, DLT_LOOP },
249 #endif
250 #ifdef DLT_APPLE_IP_OVER_IEEE1394
251 { ap1394_if_print, DLT_APPLE_IP_OVER_IEEE1394 },
252 #endif
253 #if defined(DLT_BLUETOOTH_HCI_H4_WITH_PHDR) && defined(HAVE_PCAP_BLUETOOTH_H)
254 { bt_if_print, DLT_BLUETOOTH_HCI_H4_WITH_PHDR},
255 #endif
256 #ifdef DLT_LANE8023
257 { lane_if_print, DLT_LANE8023 },
258 #endif
259 { arcnet_if_print, DLT_ARCNET },
260 #ifdef DLT_ARCNET_LINUX
261 { arcnet_linux_if_print, DLT_ARCNET_LINUX },
262 #endif
263 { raw_if_print, DLT_RAW },
264 #ifdef DLT_IPV4
265 { raw_if_print, DLT_IPV4 },
266 #endif
267 #ifdef DLT_IPV6
268 { raw_if_print, DLT_IPV6 },
269 #endif
270 #ifdef HAVE_PCAP_USB_H
271 #ifdef DLT_USB_LINUX
272 { usb_linux_48_byte_print, DLT_USB_LINUX},
273 #endif /* DLT_USB_LINUX */
274 #ifdef DLT_USB_LINUX_MMAPPED
275 { usb_linux_64_byte_print, DLT_USB_LINUX_MMAPPED},
276 #endif /* DLT_USB_LINUX_MMAPPED */
277 #endif /* HAVE_PCAP_USB_H */
278 #ifdef DLT_SYMANTEC_FIREWALL
279 { symantec_if_print, DLT_SYMANTEC_FIREWALL },
280 #endif
281 #ifdef DLT_C_HDLC
282 { chdlc_if_print, DLT_C_HDLC },
283 #endif
284 #ifdef DLT_HDLC
285 { chdlc_if_print, DLT_HDLC },
286 #endif
287 #ifdef DLT_PPP_ETHER
288 { pppoe_if_print, DLT_PPP_ETHER },
289 #endif
290 #if defined(DLT_PFLOG) && defined(HAVE_NET_PFVAR_H)
291 { pflog_if_print, DLT_PFLOG },
292 #endif
293 { token_if_print, DLT_IEEE802 },
294 { fddi_if_print, DLT_FDDI },
295 #ifdef DLT_LINUX_SLL
296 { sll_if_print, DLT_LINUX_SLL },
297 #endif
298 #ifdef DLT_FR
299 { fr_if_print, DLT_FR },
300 #endif
301 #ifdef DLT_FRELAY
302 { fr_if_print, DLT_FRELAY },
303 #endif
304 #ifdef DLT_MFR
305 { mfr_if_print, DLT_MFR },
306 #endif
307 { atm_if_print, DLT_ATM_RFC1483 },
308 #ifdef DLT_SUNATM
309 { sunatm_if_print, DLT_SUNATM },
310 #endif
311 #ifdef DLT_ENC
312 { enc_if_print, DLT_ENC },
313 #endif
314 { sl_if_print, DLT_SLIP },
315 #ifdef DLT_SLIP_BSDOS
316 { sl_bsdos_if_print, DLT_SLIP_BSDOS },
317 #endif
318 #ifdef DLT_LTALK
319 { ltalk_if_print, DLT_LTALK },
320 #endif
321 #ifdef DLT_JUNIPER_ATM1
322 { juniper_atm1_print, DLT_JUNIPER_ATM1 },
323 #endif
324 #ifdef DLT_JUNIPER_ATM2
325 { juniper_atm2_print, DLT_JUNIPER_ATM2 },
326 #endif
327 #ifdef DLT_JUNIPER_MFR
328 { juniper_mfr_print, DLT_JUNIPER_MFR },
329 #endif
330 #ifdef DLT_JUNIPER_MLFR
331 { juniper_mlfr_print, DLT_JUNIPER_MLFR },
332 #endif
333 #ifdef DLT_JUNIPER_MLPPP
334 { juniper_mlppp_print, DLT_JUNIPER_MLPPP },
335 #endif
336 #ifdef DLT_JUNIPER_PPPOE
337 { juniper_pppoe_print, DLT_JUNIPER_PPPOE },
338 #endif
339 #ifdef DLT_JUNIPER_PPPOE_ATM
340 { juniper_pppoe_atm_print, DLT_JUNIPER_PPPOE_ATM },
341 #endif
342 #ifdef DLT_JUNIPER_GGSN
343 { juniper_ggsn_print, DLT_JUNIPER_GGSN },
344 #endif
345 #ifdef DLT_JUNIPER_ES
346 { juniper_es_print, DLT_JUNIPER_ES },
347 #endif
348 #ifdef DLT_JUNIPER_MONITOR
349 { juniper_monitor_print, DLT_JUNIPER_MONITOR },
350 #endif
351 #ifdef DLT_JUNIPER_SERVICES
352 { juniper_services_print, DLT_JUNIPER_SERVICES },
353 #endif
354 #ifdef DLT_JUNIPER_ETHER
355 { juniper_ether_print, DLT_JUNIPER_ETHER },
356 #endif
357 #ifdef DLT_JUNIPER_PPP
358 { juniper_ppp_print, DLT_JUNIPER_PPP },
359 #endif
360 #ifdef DLT_JUNIPER_FRELAY
361 { juniper_frelay_print, DLT_JUNIPER_FRELAY },
362 #endif
363 #ifdef DLT_JUNIPER_CHDLC
364 { juniper_chdlc_print, DLT_JUNIPER_CHDLC },
365 #endif
366 #ifdef DLT_PKTAP
367 { pktap_if_print, DLT_PKTAP },
368 #endif
369 #ifdef DLT_IEEE802_11_RADIO
370 { ieee802_11_radio_if_print, DLT_IEEE802_11_RADIO },
371 #endif
372 #ifdef DLT_IEEE802_11
373 { ieee802_11_if_print, DLT_IEEE802_11},
374 #endif
375 #ifdef DLT_IEEE802_11_RADIO_AVS
376 { ieee802_11_radio_avs_if_print, DLT_IEEE802_11_RADIO_AVS },
377 #endif
378 #ifdef DLT_PRISM_HEADER
379 { prism_if_print, DLT_PRISM_HEADER },
380 #endif
381 { ppp_if_print, DLT_PPP },
382 #ifdef DLT_PPP_WITHDIRECTION
383 { ppp_if_print, DLT_PPP_WITHDIRECTION },
384 #endif
385 #ifdef DLT_PPP_BSDOS
386 { ppp_bsdos_if_print, DLT_PPP_BSDOS },
387 #endif
388 #ifdef DLT_PPP_SERIAL
389 { ppp_hdlc_if_print, DLT_PPP_SERIAL },
390 #endif
391 #ifdef DLT_PFSYNC
392 { pfsync_if_print, DLT_PFSYNC },
393 #endif
394 { NULL, 0 },
395 };
396
397 static const struct tok status_flags[] = {
398 #ifdef PCAP_IF_UP
399 { PCAP_IF_UP, "Up" },
400 #endif
401 #ifdef PCAP_IF_RUNNING
402 { PCAP_IF_RUNNING, "Running" },
403 #endif
404 { PCAP_IF_LOOPBACK, "Loopback" },
405 { 0, NULL }
406 };
407
408 if_printer
lookup_printer(int type)409 lookup_printer(int type)
410 {
411 const struct printer *p;
412
413 for (p = printers; p->f; ++p)
414 if (type == p->type)
415 return p->f;
416
417 return NULL;
418 /* NOTREACHED */
419 }
420
421 if_ndo_printer
lookup_ndo_printer(int type)422 lookup_ndo_printer(int type)
423 {
424 const struct ndo_printer *p;
425
426 for (p = ndo_printers; p->f; ++p)
427 if (type == p->type)
428 return p->f;
429
430 #if defined(DLT_USER2) && defined(DLT_PKTAP)
431 /*
432 * Apple incorrectly chose to use DLT_USER2 for their PKTAP
433 * header.
434 *
435 * We map DLT_PKTAP, whether it's DLT_USER2 as it is on Darwin-
436 * based OSes or the same value as LINKTYPE_PKTAP as it is on
437 * other OSes, to LINKTYPE_PKTAP, so files written with
438 * this version of libpcap for a DLT_PKTAP capture have a link-
439 * layer header type of LINKTYPE_PKTAP.
440 *
441 * However, files written on OS X Mavericks for a DLT_PKTAP
442 * capture have a link-layer header type of LINKTYPE_USER2.
443 * If we don't have a printer for DLT_USER2, and type is
444 * DLT_USER2, we look up the printer for DLT_PKTAP and use
445 * that.
446 */
447 if (type == DLT_USER2) {
448 for (p = ndo_printers; p->f; ++p)
449 if (DLT_PKTAP == p->type)
450 return p->f;
451 }
452 #endif
453
454 return NULL;
455 /* NOTREACHED */
456 }
457
458 static pcap_t *pd;
459
460 static int supports_monitor_mode;
461
462 extern int optind;
463 extern int opterr;
464 extern char *optarg;
465
466 struct print_info {
467 netdissect_options *ndo;
468 union {
469 if_printer printer;
470 if_ndo_printer ndo_printer;
471 } p;
472 int ndo_type;
473 };
474
475 struct dump_info {
476 char *WFileName;
477 char *CurrentFileName;
478 pcap_t *pd;
479 pcap_dumper_t *p;
480 #ifdef HAVE_CAPSICUM
481 int dirfd;
482 #endif
483 };
484
485 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE
486 static void
show_tstamp_types_and_exit(const char * device,pcap_t * pd)487 show_tstamp_types_and_exit(const char *device, pcap_t *pd)
488 {
489 int n_tstamp_types;
490 int *tstamp_types = 0;
491 const char *tstamp_type_name;
492 int i;
493
494 n_tstamp_types = pcap_list_tstamp_types(pd, &tstamp_types);
495 if (n_tstamp_types < 0)
496 error("%s", pcap_geterr(pd));
497
498 if (n_tstamp_types == 0) {
499 fprintf(stderr, "Time stamp type cannot be set for %s\n",
500 device);
501 exit(0);
502 }
503 fprintf(stderr, "Time stamp types for %s (use option -j to set):\n",
504 device);
505 for (i = 0; i < n_tstamp_types; i++) {
506 tstamp_type_name = pcap_tstamp_type_val_to_name(tstamp_types[i]);
507 if (tstamp_type_name != NULL) {
508 (void) fprintf(stderr, " %s (%s)\n", tstamp_type_name,
509 pcap_tstamp_type_val_to_description(tstamp_types[i]));
510 } else {
511 (void) fprintf(stderr, " %d\n", tstamp_types[i]);
512 }
513 }
514 pcap_free_tstamp_types(tstamp_types);
515 exit(0);
516 }
517 #endif
518
519 static void
show_dlts_and_exit(const char * device,pcap_t * pd)520 show_dlts_and_exit(const char *device, pcap_t *pd)
521 {
522 int n_dlts;
523 int *dlts = 0;
524 const char *dlt_name;
525
526 n_dlts = pcap_list_datalinks(pd, &dlts);
527 if (n_dlts < 0)
528 error("%s", pcap_geterr(pd));
529 else if (n_dlts == 0 || !dlts)
530 error("No data link types.");
531
532 /*
533 * If the interface is known to support monitor mode, indicate
534 * whether these are the data link types available when not in
535 * monitor mode, if -I wasn't specified, or when in monitor mode,
536 * when -I was specified (the link-layer types available in
537 * monitor mode might be different from the ones available when
538 * not in monitor mode).
539 */
540 if (supports_monitor_mode)
541 (void) fprintf(stderr, "Data link types for %s %s (use option -y to set):\n",
542 device,
543 Iflag ? "when in monitor mode" : "when not in monitor mode");
544 else
545 (void) fprintf(stderr, "Data link types for %s (use option -y to set):\n",
546 device);
547
548 while (--n_dlts >= 0) {
549 dlt_name = pcap_datalink_val_to_name(dlts[n_dlts]);
550 if (dlt_name != NULL) {
551 (void) fprintf(stderr, " %s (%s)", dlt_name,
552 pcap_datalink_val_to_description(dlts[n_dlts]));
553
554 /*
555 * OK, does tcpdump handle that type?
556 */
557 if (lookup_printer(dlts[n_dlts]) == NULL
558 && lookup_ndo_printer(dlts[n_dlts]) == NULL)
559 (void) fprintf(stderr, " (printing not supported)");
560 fprintf(stderr, "\n");
561 } else {
562 (void) fprintf(stderr, " DLT %d (printing not supported)\n",
563 dlts[n_dlts]);
564 }
565 }
566 #ifdef HAVE_PCAP_FREE_DATALINKS
567 pcap_free_datalinks(dlts);
568 #endif
569 exit(0);
570 }
571
572 #ifdef HAVE_PCAP_FINDALLDEVS
573 static void
show_devices_and_exit(void)574 show_devices_and_exit (void)
575 {
576 pcap_if_t *devpointer;
577 char ebuf[PCAP_ERRBUF_SIZE];
578 int i;
579
580 if (pcap_findalldevs(&devpointer, ebuf) < 0)
581 error("%s", ebuf);
582 else {
583 for (i = 0; devpointer != NULL; i++) {
584 printf("%d.%s", i+1, devpointer->name);
585 if (devpointer->description != NULL)
586 printf(" (%s)", devpointer->description);
587 if (devpointer->flags != 0)
588 printf(" [%s]", bittok2str(status_flags, "none", devpointer->flags));
589 printf("\n");
590 devpointer = devpointer->next;
591 }
592 }
593 exit(0);
594 }
595 #endif /* HAVE_PCAP_FINDALLDEVS */
596
597 /*
598 * Short options.
599 *
600 * Note that there we use all letters for short options except for g, k,
601 * o, and P, and those are used by other versions of tcpdump, and we should
602 * only use them for the same purposes that the other versions of tcpdump
603 * use them:
604 *
605 * OS X tcpdump uses -g to force non--v output for IP to be on one
606 * line, making it more "g"repable;
607 *
608 * OS X tcpdump uses -k tospecify that packet comments in pcap-ng files
609 * should be printed;
610 *
611 * OpenBSD tcpdump uses -o to indicate that OS fingerprinting should be done
612 * for hosts sending TCP SYN packets;
613 *
614 * OS X tcpdump uses -P to indicate that -w should write pcap-ng rather
615 * than pcap files.
616 *
617 * OS X tcpdump also uses -Q to specify expressions that match packet
618 * metadata, including but not limited to the packet direction.
619 * The expression syntax is different from a simple "in|out|inout",
620 * and those expressions aren't accepted by OS X tcpdump, but the
621 * equivalents would be "in" = "dir=in", "out" = "dir=out", and
622 * "inout" = "dir=in or dir=out", and the parser could conceivably
623 * special-case "in", "out", and "inout" as expressions for backwards
624 * compatibility, so all is not (yet) lost.
625 */
626
627 /*
628 * Set up flags that might or might not be supported depending on the
629 * version of libpcap we're using.
630 */
631 #if defined(HAVE_PCAP_CREATE) || defined(WIN32)
632 #define B_FLAG "B:"
633 #define B_FLAG_USAGE " [ -B size ]"
634 #else /* defined(HAVE_PCAP_CREATE) || defined(WIN32) */
635 #define B_FLAG
636 #define B_FLAG_USAGE
637 #endif /* defined(HAVE_PCAP_CREATE) || defined(WIN32) */
638
639 #ifdef HAVE_PCAP_CREATE
640 #define I_FLAG "I"
641 #else /* HAVE_PCAP_CREATE */
642 #define I_FLAG
643 #endif /* HAVE_PCAP_CREATE */
644
645 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE
646 #define j_FLAG "j:"
647 #define j_FLAG_USAGE " [ -j tstamptype ]"
648 #define J_FLAG "J"
649 #else /* PCAP_ERROR_TSTAMP_TYPE_NOTSUP */
650 #define j_FLAG
651 #define j_FLAG_USAGE
652 #define J_FLAG
653 #endif /* PCAP_ERROR_TSTAMP_TYPE_NOTSUP */
654
655 #ifdef HAVE_PCAP_FINDALLDEVS
656 #define D_FLAG "D"
657 #else
658 #define D_FLAG
659 #endif
660
661 #ifdef HAVE_PCAP_DUMP_FLUSH
662 #define U_FLAG "U"
663 #else
664 #define U_FLAG
665 #endif
666
667 #ifdef HAVE_PCAP_SETDIRECTION
668 #define Q_FLAG "Q:"
669 #else
670 #define Q_FLAG
671 #endif
672
673 #define SHORTOPTS "aAb" B_FLAG "c:C:d" D_FLAG "eE:fF:G:hHi:" I_FLAG j_FLAG J_FLAG "KlLm:M:nNOpq" Q_FLAG "r:Rs:StT:u" U_FLAG "vV:w:W:xXy:Yz:Z:#"
674
675 /*
676 * Long options.
677 *
678 * We do not currently have long options corresponding to all short
679 * options; we should probably pick appropriate option names for them.
680 *
681 * However, the short options where the number of times the option is
682 * specified matters, such as -v and -d and -t, should probably not
683 * just map to a long option, as saying
684 *
685 * tcpdump --verbose --verbose
686 *
687 * doesn't make sense; it should be --verbosity={N} or something such
688 * as that.
689 *
690 * For long options with no corresponding short options, we define values
691 * outside the range of ASCII graphic characters, make that the last
692 * component of the entry for the long option, and have a case for that
693 * option in the switch statement.
694 */
695 #define OPTION_VERSION 128
696 #define OPTION_TSTAMP_PRECISION 129
697 #define OPTION_IMMEDIATE_MODE 130
698
699 static const struct option longopts[] = {
700 #if defined(HAVE_PCAP_CREATE) || defined(WIN32)
701 { "buffer-size", required_argument, NULL, 'B' },
702 #endif
703 { "list-interfaces", no_argument, NULL, 'D' },
704 { "help", no_argument, NULL, 'h' },
705 { "interface", required_argument, NULL, 'i' },
706 #ifdef HAVE_PCAP_CREATE
707 { "monitor-mode", no_argument, NULL, 'I' },
708 #endif
709 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE
710 { "time-stamp-type", required_argument, NULL, 'j' },
711 { "list-time-stamp-types", no_argument, NULL, 'J' },
712 #endif
713 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
714 { "time-stamp-precision", required_argument, NULL, OPTION_TSTAMP_PRECISION},
715 #endif
716 { "dont-verify-checksums", no_argument, NULL, 'K' },
717 { "list-data-link-types", no_argument, NULL, 'L' },
718 { "no-optimize", no_argument, NULL, 'O' },
719 { "no-promiscuous-mode", no_argument, NULL, 'p' },
720 #ifdef HAVE_PCAP_SETDIRECTION
721 { "direction", required_argument, NULL, 'Q' },
722 #endif
723 { "snapshot-length", required_argument, NULL, 's' },
724 { "absolute-tcp-sequence-numbers", no_argument, NULL, 'S' },
725 #ifdef HAVE_PCAP_DUMP_FLUSH
726 { "packet-buffered", no_argument, NULL, 'U' },
727 #endif
728 { "linktype", required_argument, NULL, 'y' },
729 #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE
730 { "immediate-mode", no_argument, NULL, OPTION_IMMEDIATE_MODE },
731 #endif
732 #if defined(HAVE_PCAP_DEBUG) || defined(HAVE_YYDEBUG)
733 { "debug-filter-parser", no_argument, NULL, 'Y' },
734 #endif
735 { "relinquish-privileges", required_argument, NULL, 'Z' },
736 { "number", no_argument, NULL, '#' },
737 { "version", no_argument, NULL, OPTION_VERSION },
738 { NULL, 0, NULL, 0 }
739 };
740
741 #ifndef WIN32
742 /* Drop root privileges and chroot if necessary */
743 static void
droproot(const char * username,const char * chroot_dir)744 droproot(const char *username, const char *chroot_dir)
745 {
746 struct passwd *pw = NULL;
747
748 if (chroot_dir && !username) {
749 fprintf(stderr, "tcpdump: Chroot without dropping root is insecure\n");
750 exit(1);
751 }
752
753 pw = getpwnam(username);
754 if (pw) {
755 if (initgroups(pw->pw_name, pw->pw_gid) != 0) {
756 fprintf(stderr, "tcpdump: Couldn't initgroups to "
757 "'%.32s' gid=%lu: %s\n", pw->pw_name,
758 (unsigned long)pw->pw_gid,
759 pcap_strerror(errno));
760 exit(1);
761 }
762 if (chroot_dir) {
763 setprotoent(1);
764 res_init();
765 if (chroot(chroot_dir) != 0 || chdir ("/") != 0) {
766 fprintf(stderr, "tcpdump: Couldn't chroot/chdir to '%.64s': %s\n",
767 chroot_dir, pcap_strerror(errno));
768 exit(1);
769 }
770 }
771 #ifdef HAVE_LIBCAP_NG
772 int ret = capng_change_id(pw->pw_uid, pw->pw_gid, CAPNG_NO_FLAG);
773 if (ret < 0) {
774 fprintf(stderr, "error : ret %d\n", ret);
775 }
776 else {
777 // fprintf(stderr, "dropped privs to %s\n", username);
778 }
779 #else
780 if (initgroups(pw->pw_name, pw->pw_gid) != 0 ||
781 setgid(pw->pw_gid) != 0 || setuid(pw->pw_uid) != 0) {
782 fprintf(stderr, "tcpdump: Couldn't change to '%.32s' uid=%lu gid=%lu: %s\n",
783 username,
784 (unsigned long)pw->pw_uid,
785 (unsigned long)pw->pw_gid,
786 pcap_strerror(errno));
787 exit(1);
788 }
789 else {
790 // fprintf(stderr, "dropped privs to %s\n", username);
791 }
792 #endif /* HAVE_LIBCAP_NG */
793 }
794 else {
795 fprintf(stderr, "tcpdump: Couldn't find user '%.32s'\n",
796 username);
797 exit(1);
798 }
799 #ifdef HAVE_LIBCAP_NG
800 /* We don't need CAP_SETUID and CAP_SETGID any more. */
801 capng_updatev(
802 CAPNG_DROP,
803 CAPNG_EFFECTIVE | CAPNG_PERMITTED,
804 CAP_SETUID,
805 CAP_SETGID,
806 -1);
807 capng_apply(CAPNG_SELECT_BOTH);
808 #endif /* HAVE_LIBCAP_NG */
809
810 }
811 #endif /* WIN32 */
812
813 static int
getWflagChars(int x)814 getWflagChars(int x)
815 {
816 int c = 0;
817
818 x -= 1;
819 while (x > 0) {
820 c += 1;
821 x /= 10;
822 }
823
824 return c;
825 }
826
827
828 static void
MakeFilename(char * buffer,char * orig_name,int cnt,int max_chars)829 MakeFilename(char *buffer, char *orig_name, int cnt, int max_chars)
830 {
831 char *filename = malloc(PATH_MAX + 1);
832 if (filename == NULL)
833 error("Makefilename: malloc");
834
835 /* Process with strftime if Gflag is set. */
836 if (Gflag != 0) {
837 struct tm *local_tm;
838
839 /* Convert Gflag_time to a usable format */
840 if ((local_tm = localtime(&Gflag_time)) == NULL) {
841 error("MakeTimedFilename: localtime");
842 }
843
844 /* There's no good way to detect an error in strftime since a return
845 * value of 0 isn't necessarily failure.
846 */
847 strftime(filename, PATH_MAX, orig_name, local_tm);
848 } else {
849 strncpy(filename, orig_name, PATH_MAX);
850 }
851
852 if (cnt == 0 && max_chars == 0)
853 strncpy(buffer, filename, PATH_MAX + 1);
854 else
855 if (snprintf(buffer, PATH_MAX + 1, "%s%0*d", filename, max_chars, cnt) > PATH_MAX)
856 /* Report an error if the filename is too large */
857 error("too many output files or filename is too long (> %d)", PATH_MAX);
858 free(filename);
859 }
860
tcpdump_printf(netdissect_options * ndo _U_,const char * fmt,...)861 static int tcpdump_printf(netdissect_options *ndo _U_,
862 const char *fmt, ...)
863 {
864
865 va_list args;
866 int ret;
867
868 va_start(args, fmt);
869 ret=vfprintf(stdout, fmt, args);
870 va_end(args);
871
872 return ret;
873 }
874
875 static struct print_info
get_print_info(int type)876 get_print_info(int type)
877 {
878 struct print_info printinfo;
879
880 printinfo.ndo_type = 1;
881 printinfo.ndo = gndo;
882 printinfo.p.ndo_printer = lookup_ndo_printer(type);
883 if (printinfo.p.ndo_printer == NULL) {
884 printinfo.p.printer = lookup_printer(type);
885 printinfo.ndo_type = 0;
886 if (printinfo.p.printer == NULL) {
887 gndo->ndo_dltname = pcap_datalink_val_to_name(type);
888 if (gndo->ndo_dltname != NULL)
889 error("packet printing is not supported for link type %s: use -w",
890 gndo->ndo_dltname);
891 else
892 error("packet printing is not supported for link type %d: use -w", type);
893 }
894 }
895 return (printinfo);
896 }
897
898 static char *
get_next_file(FILE * VFile,char * ptr)899 get_next_file(FILE *VFile, char *ptr)
900 {
901 char *ret;
902
903 ret = fgets(ptr, PATH_MAX, VFile);
904 if (!ret)
905 return NULL;
906
907 if (ptr[strlen(ptr) - 1] == '\n')
908 ptr[strlen(ptr) - 1] = '\0';
909
910 return ret;
911 }
912
913 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
914 static int
tstamp_precision_from_string(const char * precision)915 tstamp_precision_from_string(const char *precision)
916 {
917 if (strncmp(precision, "nano", strlen("nano")) == 0)
918 return PCAP_TSTAMP_PRECISION_NANO;
919
920 if (strncmp(precision, "micro", strlen("micro")) == 0)
921 return PCAP_TSTAMP_PRECISION_MICRO;
922
923 return -EINVAL;
924 }
925
926 static const char *
tstamp_precision_to_string(int precision)927 tstamp_precision_to_string(int precision)
928 {
929 switch (precision) {
930
931 case PCAP_TSTAMP_PRECISION_MICRO:
932 return "micro";
933
934 case PCAP_TSTAMP_PRECISION_NANO:
935 return "nano";
936
937 default:
938 return "unknown";
939 }
940 }
941 #endif
942
943 #ifdef HAVE_CAPSICUM
944 /*
945 * Ensure that, on a dump file's descriptor, we have all the rights
946 * necessary to make the standard I/O library work with an fdopen()ed
947 * FILE * from that descriptor.
948 *
949 * A long time ago, in a galaxy far far away, AT&T decided that, instead
950 * of providing separate APIs for getting and setting the FD_ flags on a
951 * descriptor, getting and setting the O_ flags on a descriptor, and
952 * locking files, they'd throw them all into a kitchen-sink fcntl() call
953 * along the lines of ioctl(), the fact that ioctl() operations are
954 * largely specific to particular character devices but fcntl() operations
955 * are either generic to all descriptors or generic to all descriptors for
956 * regular files nonwithstanding.
957 *
958 * The Capsicum people decided that fine-grained control of descriptor
959 * operations was required, so that you need to grant permission for
960 * reading, writing, seeking, and fcntl-ing. The latter, courtesy of
961 * AT&T's decision, means that "fcntl-ing" isn't a thing, but a motley
962 * collection of things, so there are *individual* fcntls for which
963 * permission needs to be granted.
964 *
965 * The FreeBSD standard I/O people implemented some optimizations that
966 * requires that the standard I/O routines be able to determine whether
967 * the descriptor for the FILE * is open append-only or not; as that
968 * descriptor could have come from an open() rather than an fopen(),
969 * that requires that it be able to do an F_GETFL fcntl() to read
970 * the O_ flags.
971 *
972 * Tcpdump uses ftell() to determine how much data has been written
973 * to a file in order to, when used with -C, determine when it's time
974 * to rotate capture files. ftell() therefore needs to do an lseek()
975 * to find out the file offset and must, thanks to the aforementioned
976 * optimization, also know whether the descriptor is open append-only
977 * or not.
978 *
979 * The net result of all the above is that we need to grant CAP_SEEK,
980 * CAP_WRITE, and CAP_FCNTL with the CAP_FCNTL_GETFL subcapability.
981 *
982 * Perhaps this is the universe's way of saying that either
983 *
984 * 1) there needs to be an fopenat() call and a pcap_dump_openat() call
985 * using it, so that Capsicum-capable tcpdump wouldn't need to do
986 * an fdopen()
987 *
988 * or
989 *
990 * 2) there needs to be a cap_fdopen() call in the FreeBSD standard
991 * I/O library that knows what rights are needed by the standard
992 * I/O library, based on the open mode, and assigns them, perhaps
993 * with an additional argument indicating, for example, whether
994 * seeking should be allowed, so that tcpdump doesn't need to know
995 * what the standard I/O library happens to require this week.
996 */
997 static void
set_dumper_capsicum_rights(pcap_dumper_t * p)998 set_dumper_capsicum_rights(pcap_dumper_t *p)
999 {
1000 int fd = fileno(pcap_dump_file(p));
1001 cap_rights_t rights;
1002
1003 cap_rights_init(&rights, CAP_SEEK, CAP_WRITE, CAP_FCNTL);
1004 if (cap_rights_limit(fd, &rights) < 0 && errno != ENOSYS) {
1005 error("unable to limit dump descriptor");
1006 }
1007 if (cap_fcntls_limit(fd, CAP_FCNTL_GETFL) < 0 && errno != ENOSYS) {
1008 error("unable to limit dump descriptor fcntls");
1009 }
1010 }
1011 #endif
1012
1013 int
main(int argc,char ** argv)1014 main(int argc, char **argv)
1015 {
1016 register int cnt, op, i;
1017 bpf_u_int32 localnet =0 , netmask = 0;
1018 register char *cp, *infile, *cmdbuf, *device, *RFileName, *VFileName, *WFileName;
1019 pcap_handler callback;
1020 int type;
1021 int dlt;
1022 int new_dlt;
1023 const char *dlt_name;
1024 struct bpf_program fcode;
1025 #ifndef WIN32
1026 RETSIGTYPE (*oldhandler)(int);
1027 #endif
1028 struct print_info printinfo;
1029 struct dump_info dumpinfo;
1030 u_char *pcap_userdata;
1031 char ebuf[PCAP_ERRBUF_SIZE];
1032 char VFileLine[PATH_MAX + 1];
1033 char *username = NULL;
1034 char *chroot_dir = NULL;
1035 char *ret = NULL;
1036 char *end;
1037 #ifdef HAVE_PCAP_FINDALLDEVS
1038 pcap_if_t *devpointer;
1039 int devnum;
1040 #endif
1041 int status;
1042 FILE *VFile;
1043 #ifdef HAVE_CAPSICUM
1044 cap_rights_t rights;
1045 int cansandbox;
1046 #endif /* HAVE_CAPSICUM */
1047
1048 #ifdef WIN32
1049 if(wsockinit() != 0) return 1;
1050 #endif /* WIN32 */
1051
1052 jflag=-1; /* not set */
1053 gndo->ndo_Oflag=1;
1054 gndo->ndo_Rflag=1;
1055 gndo->ndo_dlt=-1;
1056 gndo->ndo_default_print=ndo_default_print;
1057 gndo->ndo_printf=tcpdump_printf;
1058 gndo->ndo_error=ndo_error;
1059 gndo->ndo_warning=ndo_warning;
1060 gndo->ndo_snaplen = DEFAULT_SNAPLEN;
1061 gndo->ndo_immediate = 0;
1062
1063 cnt = -1;
1064 device = NULL;
1065 infile = NULL;
1066 RFileName = NULL;
1067 VFileName = NULL;
1068 VFile = NULL;
1069 WFileName = NULL;
1070 dlt = -1;
1071 if ((cp = strrchr(argv[0], '/')) != NULL)
1072 program_name = cp + 1;
1073 else
1074 program_name = argv[0];
1075
1076 /*
1077 * On platforms where the CPU doesn't support unaligned loads,
1078 * force unaligned accesses to abort with SIGBUS, rather than
1079 * being fixed up (slowly) by the OS kernel; on those platforms,
1080 * misaligned accesses are bugs, and we want tcpdump to crash so
1081 * that the bugs are reported.
1082 */
1083 if (abort_on_misalignment(ebuf, sizeof(ebuf)) < 0)
1084 error("%s", ebuf);
1085
1086 #ifdef USE_LIBSMI
1087 smiInit("tcpdump");
1088 #endif
1089
1090 while (
1091 (op = getopt_long(argc, argv, SHORTOPTS, longopts, NULL)) != -1)
1092 switch (op) {
1093
1094 case 'a':
1095 /* compatibility for old -a */
1096 break;
1097
1098 case 'A':
1099 ++Aflag;
1100 break;
1101
1102 case 'b':
1103 ++bflag;
1104 break;
1105
1106 #if defined(HAVE_PCAP_CREATE) || defined(WIN32)
1107 case 'B':
1108 Bflag = atoi(optarg)*1024;
1109 if (Bflag <= 0)
1110 error("invalid packet buffer size %s", optarg);
1111 break;
1112 #endif /* defined(HAVE_PCAP_CREATE) || defined(WIN32) */
1113
1114 case 'c':
1115 cnt = atoi(optarg);
1116 if (cnt <= 0)
1117 error("invalid packet count %s", optarg);
1118 break;
1119
1120 case 'C':
1121 Cflag = atoi(optarg) * 1000000;
1122 if (Cflag < 0)
1123 error("invalid file size %s", optarg);
1124 break;
1125
1126 case 'd':
1127 ++dflag;
1128 break;
1129
1130 case 'D':
1131 Dflag++;
1132 break;
1133
1134 case 'L':
1135 Lflag++;
1136 break;
1137
1138 case 'e':
1139 ++eflag;
1140 break;
1141
1142 case 'E':
1143 #ifndef HAVE_LIBCRYPTO
1144 warning("crypto code not compiled in");
1145 #endif
1146 gndo->ndo_espsecret = optarg;
1147 break;
1148
1149 case 'f':
1150 ++fflag;
1151 break;
1152
1153 case 'F':
1154 infile = optarg;
1155 break;
1156
1157 case 'G':
1158 Gflag = atoi(optarg);
1159 if (Gflag < 0)
1160 error("invalid number of seconds %s", optarg);
1161
1162 /* We will create one file initially. */
1163 Gflag_count = 0;
1164
1165 /* Grab the current time for rotation use. */
1166 if ((Gflag_time = time(NULL)) == (time_t)-1) {
1167 error("main: can't get current time: %s",
1168 pcap_strerror(errno));
1169 }
1170 break;
1171
1172 case 'h':
1173 print_usage();
1174 exit(0);
1175 break;
1176
1177 case 'H':
1178 ++Hflag;
1179 break;
1180
1181 case 'i':
1182 if (optarg[0] == '0' && optarg[1] == 0)
1183 error("Invalid adapter index");
1184
1185 #ifdef HAVE_PCAP_FINDALLDEVS
1186 /*
1187 * If the argument is a number, treat it as
1188 * an index into the list of adapters, as
1189 * printed by "tcpdump -D".
1190 *
1191 * This should be OK on UNIX systems, as interfaces
1192 * shouldn't have names that begin with digits.
1193 * It can be useful on Windows, where more than
1194 * one interface can have the same name.
1195 */
1196 devnum = strtol(optarg, &end, 10);
1197 if (optarg != end && *end == '\0') {
1198 if (devnum < 0)
1199 error("Invalid adapter index");
1200
1201 if (pcap_findalldevs(&devpointer, ebuf) < 0)
1202 error("%s", ebuf);
1203 else {
1204 /*
1205 * Look for the devnum-th entry
1206 * in the list of devices
1207 * (1-based).
1208 */
1209 for (i = 0;
1210 i < devnum-1 && devpointer != NULL;
1211 i++, devpointer = devpointer->next)
1212 ;
1213 if (devpointer == NULL)
1214 error("Invalid adapter index");
1215 }
1216 device = devpointer->name;
1217 break;
1218 }
1219 #endif /* HAVE_PCAP_FINDALLDEVS */
1220 device = optarg;
1221 break;
1222
1223 #ifdef HAVE_PCAP_CREATE
1224 case 'I':
1225 ++Iflag;
1226 break;
1227 #endif /* HAVE_PCAP_CREATE */
1228
1229 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE
1230 case 'j':
1231 jflag = pcap_tstamp_type_name_to_val(optarg);
1232 if (jflag < 0)
1233 error("invalid time stamp type %s", optarg);
1234 break;
1235
1236 case 'J':
1237 Jflag++;
1238 break;
1239 #endif
1240
1241 case 'l':
1242 #ifdef WIN32
1243 /*
1244 * _IOLBF is the same as _IOFBF in Microsoft's C
1245 * libraries; the only alternative they offer
1246 * is _IONBF.
1247 *
1248 * XXX - this should really be checking for MSVC++,
1249 * not WIN32, if, for example, MinGW has its own
1250 * C library that is more UNIX-compatible.
1251 */
1252 setvbuf(stdout, NULL, _IONBF, 0);
1253 #else /* WIN32 */
1254 #ifdef HAVE_SETLINEBUF
1255 setlinebuf(stdout);
1256 #else
1257 setvbuf(stdout, NULL, _IOLBF, 0);
1258 #endif
1259 #endif /* WIN32 */
1260 break;
1261
1262 case 'K':
1263 ++Kflag;
1264 break;
1265
1266 case 'm':
1267 #ifdef USE_LIBSMI
1268 if (smiLoadModule(optarg) == 0) {
1269 error("could not load MIB module %s", optarg);
1270 }
1271 sflag = 1;
1272 #else
1273 (void)fprintf(stderr, "%s: ignoring option `-m %s' ",
1274 program_name, optarg);
1275 (void)fprintf(stderr, "(no libsmi support)\n");
1276 #endif
1277 break;
1278
1279 case 'M':
1280 /* TCP-MD5 shared secret */
1281 #ifndef HAVE_LIBCRYPTO
1282 warning("crypto code not compiled in");
1283 #endif
1284 sigsecret = optarg;
1285 break;
1286
1287 case 'n':
1288 ++nflag;
1289 break;
1290
1291 case 'N':
1292 ++Nflag;
1293 break;
1294
1295 case 'O':
1296 Oflag = 0;
1297 break;
1298
1299 case 'p':
1300 ++pflag;
1301 break;
1302
1303 case 'q':
1304 ++qflag;
1305 ++suppress_default_print;
1306 break;
1307
1308 #ifdef HAVE_PCAP_SETDIRECTION
1309 case 'Q':
1310 if (strcasecmp(optarg, "in") == 0)
1311 Qflag = PCAP_D_IN;
1312 else if (strcasecmp(optarg, "out") == 0)
1313 Qflag = PCAP_D_OUT;
1314 else if (strcasecmp(optarg, "inout") == 0)
1315 Qflag = PCAP_D_INOUT;
1316 else
1317 error("unknown capture direction `%s'", optarg);
1318 break;
1319 #endif /* HAVE_PCAP_SETDIRECTION */
1320
1321 case 'r':
1322 RFileName = optarg;
1323 break;
1324
1325 case 'R':
1326 Rflag = 0;
1327 break;
1328
1329 case 's':
1330 snaplen = strtol(optarg, &end, 0);
1331 if (optarg == end || *end != '\0'
1332 || snaplen < 0 || snaplen > MAXIMUM_SNAPLEN)
1333 error("invalid snaplen %s", optarg);
1334 else if (snaplen == 0)
1335 snaplen = MAXIMUM_SNAPLEN;
1336 break;
1337
1338 case 'S':
1339 ++Sflag;
1340 break;
1341
1342 case 't':
1343 ++tflag;
1344 break;
1345
1346 case 'T':
1347 if (strcasecmp(optarg, "vat") == 0)
1348 packettype = PT_VAT;
1349 else if (strcasecmp(optarg, "wb") == 0)
1350 packettype = PT_WB;
1351 else if (strcasecmp(optarg, "rpc") == 0)
1352 packettype = PT_RPC;
1353 else if (strcasecmp(optarg, "rtp") == 0)
1354 packettype = PT_RTP;
1355 else if (strcasecmp(optarg, "rtcp") == 0)
1356 packettype = PT_RTCP;
1357 else if (strcasecmp(optarg, "snmp") == 0)
1358 packettype = PT_SNMP;
1359 else if (strcasecmp(optarg, "cnfp") == 0)
1360 packettype = PT_CNFP;
1361 else if (strcasecmp(optarg, "tftp") == 0)
1362 packettype = PT_TFTP;
1363 else if (strcasecmp(optarg, "aodv") == 0)
1364 packettype = PT_AODV;
1365 else if (strcasecmp(optarg, "carp") == 0)
1366 packettype = PT_CARP;
1367 else if (strcasecmp(optarg, "radius") == 0)
1368 packettype = PT_RADIUS;
1369 else if (strcasecmp(optarg, "zmtp1") == 0)
1370 packettype = PT_ZMTP1;
1371 else if (strcasecmp(optarg, "vxlan") == 0)
1372 packettype = PT_VXLAN;
1373 else if (strcasecmp(optarg, "pgm") == 0)
1374 packettype = PT_PGM;
1375 else if (strcasecmp(optarg, "pgm_zmtp1") == 0)
1376 packettype = PT_PGM_ZMTP1;
1377 else if (strcasecmp(optarg, "lmp") == 0)
1378 packettype = PT_LMP;
1379 else
1380 error("unknown packet type `%s'", optarg);
1381 break;
1382
1383 case 'u':
1384 ++uflag;
1385 break;
1386
1387 #ifdef HAVE_PCAP_DUMP_FLUSH
1388 case 'U':
1389 ++Uflag;
1390 break;
1391 #endif
1392
1393 case 'v':
1394 ++vflag;
1395 break;
1396
1397 case 'V':
1398 VFileName = optarg;
1399 break;
1400
1401 case 'w':
1402 WFileName = optarg;
1403 break;
1404
1405 case 'W':
1406 Wflag = atoi(optarg);
1407 if (Wflag < 0)
1408 error("invalid number of output files %s", optarg);
1409 WflagChars = getWflagChars(Wflag);
1410 break;
1411
1412 case 'x':
1413 ++xflag;
1414 ++suppress_default_print;
1415 break;
1416
1417 case 'X':
1418 ++Xflag;
1419 ++suppress_default_print;
1420 break;
1421
1422 case 'y':
1423 gndo->ndo_dltname = optarg;
1424 gndo->ndo_dlt =
1425 pcap_datalink_name_to_val(gndo->ndo_dltname);
1426 if (gndo->ndo_dlt < 0)
1427 error("invalid data link type %s", gndo->ndo_dltname);
1428 break;
1429
1430 #if defined(HAVE_PCAP_DEBUG) || defined(HAVE_YYDEBUG)
1431 case 'Y':
1432 {
1433 /* Undocumented flag */
1434 #ifdef HAVE_PCAP_DEBUG
1435 extern int pcap_debug;
1436 pcap_debug = 1;
1437 #else
1438 extern int yydebug;
1439 yydebug = 1;
1440 #endif
1441 }
1442 break;
1443 #endif
1444 case 'z':
1445 zflag = strdup(optarg);
1446 break;
1447
1448 case 'Z':
1449 username = strdup(optarg);
1450 break;
1451
1452 case '#':
1453 gndo->ndo_packet_number = 1;
1454 break;
1455
1456 case OPTION_VERSION:
1457 print_version();
1458 exit(0);
1459 break;
1460
1461 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
1462 case OPTION_TSTAMP_PRECISION:
1463 gndo->ndo_tstamp_precision = tstamp_precision_from_string(optarg);
1464 if (gndo->ndo_tstamp_precision < 0)
1465 error("unsupported time stamp precision");
1466 break;
1467 #endif
1468
1469 #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE
1470 case OPTION_IMMEDIATE_MODE:
1471 gndo->ndo_immediate = 1;
1472 break;
1473 #endif
1474
1475 default:
1476 print_usage();
1477 exit(1);
1478 /* NOTREACHED */
1479 }
1480
1481 #ifdef HAVE_PCAP_FINDALLDEVS
1482 if (Dflag)
1483 show_devices_and_exit();
1484 #endif
1485
1486 switch (tflag) {
1487
1488 case 0: /* Default */
1489 case 4: /* Default + Date*/
1490 thiszone = gmt2local(0);
1491 break;
1492
1493 case 1: /* No time stamp */
1494 case 2: /* Unix timeval style */
1495 case 3: /* Microseconds since previous packet */
1496 case 5: /* Microseconds since first packet */
1497 break;
1498
1499 default: /* Not supported */
1500 error("only -t, -tt, -ttt, -tttt and -ttttt are supported");
1501 break;
1502 }
1503
1504 if (fflag != 0 && (VFileName != NULL || RFileName != NULL))
1505 error("-f can not be used with -V or -r");
1506
1507 if (VFileName != NULL && RFileName != NULL)
1508 error("-V and -r are mutually exclusive.");
1509
1510 #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE
1511 /*
1512 * If we're printing dissected packets to the standard output
1513 * rather than saving raw packets to a file, and the standard
1514 * output is a terminal, use immediate mode, as the user's
1515 * probably expecting to see packets pop up immediately.
1516 */
1517 if (WFileName == NULL && isatty(1))
1518 gndo->ndo_immediate = 1;
1519 #endif
1520
1521 #ifdef WITH_CHROOT
1522 /* if run as root, prepare for chrooting */
1523 if (getuid() == 0 || geteuid() == 0) {
1524 /* future extensibility for cmd-line arguments */
1525 if (!chroot_dir)
1526 chroot_dir = WITH_CHROOT;
1527 }
1528 #endif
1529
1530 #ifdef WITH_USER
1531 /* if run as root, prepare for dropping root privileges */
1532 if (getuid() == 0 || geteuid() == 0) {
1533 /* Run with '-Z root' to restore old behaviour */
1534 if (!username)
1535 username = WITH_USER;
1536 }
1537 #endif
1538
1539 if (RFileName != NULL || VFileName != NULL) {
1540 /*
1541 * If RFileName is non-null, it's the pathname of a
1542 * savefile to read. If VFileName is non-null, it's
1543 * the pathname of a file containing a list of pathnames
1544 * (one per line) of savefiles to read.
1545 *
1546 * In either case, we're reading a savefile, not doing
1547 * a live capture.
1548 */
1549 #ifndef WIN32
1550 /*
1551 * We don't need network access, so relinquish any set-UID
1552 * or set-GID privileges we have (if any).
1553 *
1554 * We do *not* want set-UID privileges when opening a
1555 * trace file, as that might let the user read other
1556 * people's trace files (especially if we're set-UID
1557 * root).
1558 */
1559 if (setgid(getgid()) != 0 || setuid(getuid()) != 0 )
1560 fprintf(stderr, "Warning: setgid/setuid failed !\n");
1561 #endif /* WIN32 */
1562 if (VFileName != NULL) {
1563 if (VFileName[0] == '-' && VFileName[1] == '\0')
1564 VFile = stdin;
1565 else
1566 VFile = fopen(VFileName, "r");
1567
1568 if (VFile == NULL)
1569 error("Unable to open file: %s\n", strerror(errno));
1570
1571 ret = get_next_file(VFile, VFileLine);
1572 if (!ret)
1573 error("Nothing in %s\n", VFileName);
1574 RFileName = VFileLine;
1575 }
1576
1577 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
1578 pd = pcap_open_offline_with_tstamp_precision(RFileName,
1579 gndo->ndo_tstamp_precision, ebuf);
1580 #else
1581 pd = pcap_open_offline(RFileName, ebuf);
1582 #endif
1583
1584 if (pd == NULL)
1585 error("%s", ebuf);
1586 #ifdef HAVE_CAPSICUM
1587 cap_rights_init(&rights, CAP_READ);
1588 if (cap_rights_limit(fileno(pcap_file(pd)), &rights) < 0 &&
1589 errno != ENOSYS) {
1590 error("unable to limit pcap descriptor");
1591 }
1592 #endif
1593 dlt = pcap_datalink(pd);
1594 dlt_name = pcap_datalink_val_to_name(dlt);
1595 if (dlt_name == NULL) {
1596 fprintf(stderr, "reading from file %s, link-type %u\n",
1597 RFileName, dlt);
1598 } else {
1599 fprintf(stderr,
1600 "reading from file %s, link-type %s (%s)\n",
1601 RFileName, dlt_name,
1602 pcap_datalink_val_to_description(dlt));
1603 }
1604 } else {
1605 /*
1606 * We're doing a live capture.
1607 */
1608 if (device == NULL) {
1609 device = pcap_lookupdev(ebuf);
1610 if (device == NULL)
1611 error("%s", ebuf);
1612 }
1613 #ifdef WIN32
1614 /*
1615 * Print a message to the standard error on Windows.
1616 * XXX - why do it here, with a different message?
1617 */
1618 if(strlen(device) == 1) /* we assume that an ASCII string is always longer than 1 char */
1619 { /* a Unicode string has a \0 as second byte (so strlen() is 1) */
1620 fprintf(stderr, "%s: listening on %ws\n", program_name, device);
1621 }
1622 else
1623 {
1624 fprintf(stderr, "%s: listening on %s\n", program_name, device);
1625 }
1626
1627 fflush(stderr);
1628 #endif /* WIN32 */
1629 #ifdef HAVE_PCAP_CREATE
1630 pd = pcap_create(device, ebuf);
1631 if (pd == NULL)
1632 error("%s", ebuf);
1633 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE
1634 if (Jflag)
1635 show_tstamp_types_and_exit(device, pd);
1636 #endif
1637 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
1638 status = pcap_set_tstamp_precision(pd, gndo->ndo_tstamp_precision);
1639 if (status != 0)
1640 error("%s: Can't set %ssecond time stamp precision: %s",
1641 device,
1642 tstamp_precision_to_string(gndo->ndo_tstamp_precision),
1643 pcap_statustostr(status));
1644 #endif
1645
1646 #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE
1647 if (gndo->ndo_immediate) {
1648 status = pcap_set_immediate_mode(pd, 1);
1649 if (status != 0)
1650 error("%s: Can't set immediate mode: %s",
1651 device,
1652 pcap_statustostr(status));
1653 }
1654 #endif
1655 /*
1656 * Is this an interface that supports monitor mode?
1657 */
1658 if (pcap_can_set_rfmon(pd) == 1)
1659 supports_monitor_mode = 1;
1660 else
1661 supports_monitor_mode = 0;
1662 status = pcap_set_snaplen(pd, snaplen);
1663 if (status != 0)
1664 error("%s: Can't set snapshot length: %s",
1665 device, pcap_statustostr(status));
1666 status = pcap_set_promisc(pd, !pflag);
1667 if (status != 0)
1668 error("%s: Can't set promiscuous mode: %s",
1669 device, pcap_statustostr(status));
1670 if (Iflag) {
1671 status = pcap_set_rfmon(pd, 1);
1672 if (status != 0)
1673 error("%s: Can't set monitor mode: %s",
1674 device, pcap_statustostr(status));
1675 }
1676 status = pcap_set_timeout(pd, 1000);
1677 if (status != 0)
1678 error("%s: pcap_set_timeout failed: %s",
1679 device, pcap_statustostr(status));
1680 if (Bflag != 0) {
1681 status = pcap_set_buffer_size(pd, Bflag);
1682 if (status != 0)
1683 error("%s: Can't set buffer size: %s",
1684 device, pcap_statustostr(status));
1685 }
1686 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE
1687 if (jflag != -1) {
1688 status = pcap_set_tstamp_type(pd, jflag);
1689 if (status < 0)
1690 error("%s: Can't set time stamp type: %s",
1691 device, pcap_statustostr(status));
1692 }
1693 #endif
1694 status = pcap_activate(pd);
1695 if (status < 0) {
1696 /*
1697 * pcap_activate() failed.
1698 */
1699 cp = pcap_geterr(pd);
1700 if (status == PCAP_ERROR)
1701 error("%s", cp);
1702 else if ((status == PCAP_ERROR_NO_SUCH_DEVICE ||
1703 status == PCAP_ERROR_PERM_DENIED) &&
1704 *cp != '\0')
1705 error("%s: %s\n(%s)", device,
1706 pcap_statustostr(status), cp);
1707 else
1708 error("%s: %s", device,
1709 pcap_statustostr(status));
1710 } else if (status > 0) {
1711 /*
1712 * pcap_activate() succeeded, but it's warning us
1713 * of a problem it had.
1714 */
1715 cp = pcap_geterr(pd);
1716 if (status == PCAP_WARNING)
1717 warning("%s", cp);
1718 else if (status == PCAP_WARNING_PROMISC_NOTSUP &&
1719 *cp != '\0')
1720 warning("%s: %s\n(%s)", device,
1721 pcap_statustostr(status), cp);
1722 else
1723 warning("%s: %s", device,
1724 pcap_statustostr(status));
1725 }
1726 #ifdef HAVE_PCAP_SETDIRECTION
1727 if (Qflag != -1) {
1728 status = pcap_setdirection(pd, Qflag);
1729 if (status != 0)
1730 error("%s: pcap_setdirection() failed: %s",
1731 device, pcap_geterr(pd));
1732 }
1733 #endif /* HAVE_PCAP_SETDIRECTION */
1734 #else
1735 *ebuf = '\0';
1736 pd = pcap_open_live(device, snaplen, !pflag, 1000, ebuf);
1737 if (pd == NULL)
1738 error("%s", ebuf);
1739 else if (*ebuf)
1740 warning("%s", ebuf);
1741 #endif /* HAVE_PCAP_CREATE */
1742 /*
1743 * Let user own process after socket has been opened.
1744 */
1745 #ifndef WIN32
1746 if (setgid(getgid()) != 0 || setuid(getuid()) != 0)
1747 fprintf(stderr, "Warning: setgid/setuid failed !\n");
1748 #endif /* WIN32 */
1749 #if !defined(HAVE_PCAP_CREATE) && defined(WIN32)
1750 if(Bflag != 0)
1751 if(pcap_setbuff(pd, Bflag)==-1){
1752 error("%s", pcap_geterr(pd));
1753 }
1754 #endif /* !defined(HAVE_PCAP_CREATE) && defined(WIN32) */
1755 if (Lflag)
1756 show_dlts_and_exit(device, pd);
1757 if (gndo->ndo_dlt >= 0) {
1758 #ifdef HAVE_PCAP_SET_DATALINK
1759 if (pcap_set_datalink(pd, gndo->ndo_dlt) < 0)
1760 error("%s", pcap_geterr(pd));
1761 #else
1762 /*
1763 * We don't actually support changing the
1764 * data link type, so we only let them
1765 * set it to what it already is.
1766 */
1767 if (gndo->ndo_dlt != pcap_datalink(pd)) {
1768 error("%s is not one of the DLTs supported by this device\n",
1769 gndo->ndo_dltname);
1770 }
1771 #endif
1772 (void)fprintf(stderr, "%s: data link type %s\n",
1773 program_name, gndo->ndo_dltname);
1774 (void)fflush(stderr);
1775 }
1776 i = pcap_snapshot(pd);
1777 if (snaplen < i) {
1778 warning("snaplen raised from %d to %d", snaplen, i);
1779 snaplen = i;
1780 }
1781 if(fflag != 0) {
1782 if (pcap_lookupnet(device, &localnet, &netmask, ebuf) < 0) {
1783 warning("foreign (-f) flag used but: %s", ebuf);
1784 }
1785 }
1786
1787 }
1788 if (infile)
1789 cmdbuf = read_infile(infile);
1790 else
1791 cmdbuf = copy_argv(&argv[optind]);
1792
1793 if (pcap_compile(pd, &fcode, cmdbuf, Oflag, netmask) < 0)
1794 error("%s", pcap_geterr(pd));
1795 if (dflag) {
1796 bpf_dump(&fcode, dflag);
1797 pcap_close(pd);
1798 free(cmdbuf);
1799 exit(0);
1800 }
1801 init_addrtoname(gndo, localnet, netmask);
1802 init_checksum();
1803
1804 #ifndef WIN32
1805 (void)setsignal(SIGPIPE, cleanup);
1806 (void)setsignal(SIGTERM, cleanup);
1807 (void)setsignal(SIGINT, cleanup);
1808 #endif /* WIN32 */
1809 #if defined(HAVE_FORK) || defined(HAVE_VFORK)
1810 (void)setsignal(SIGCHLD, child_cleanup);
1811 #endif
1812 /* Cooperate with nohup(1) */
1813 #ifndef WIN32
1814 if ((oldhandler = setsignal(SIGHUP, cleanup)) != SIG_DFL)
1815 (void)setsignal(SIGHUP, oldhandler);
1816 #endif /* WIN32 */
1817
1818 #ifndef WIN32
1819 /*
1820 * If a user name was specified with "-Z", attempt to switch to
1821 * that user's UID. This would probably be used with sudo,
1822 * to allow tcpdump to be run in a special restricted
1823 * account (if you just want to allow users to open capture
1824 * devices, and can't just give users that permission,
1825 * you'd make tcpdump set-UID or set-GID).
1826 *
1827 * Tcpdump doesn't necessarily write only to one savefile;
1828 * the general only way to allow a -Z instance to write to
1829 * savefiles as the user under whose UID it's run, rather
1830 * than as the user specified with -Z, would thus be to switch
1831 * to the original user ID before opening a capture file and
1832 * then switch back to the -Z user ID after opening the savefile.
1833 * Switching to the -Z user ID only after opening the first
1834 * savefile doesn't handle the general case.
1835 */
1836
1837 if (getuid() == 0 || geteuid() == 0) {
1838 #ifdef HAVE_LIBCAP_NG
1839 /* Initialize capng */
1840 capng_clear(CAPNG_SELECT_BOTH);
1841 if (username) {
1842 capng_updatev(
1843 CAPNG_ADD,
1844 CAPNG_PERMITTED | CAPNG_EFFECTIVE,
1845 CAP_SETUID,
1846 CAP_SETGID,
1847 -1);
1848 }
1849
1850 if (WFileName) {
1851 capng_update(
1852 CAPNG_ADD,
1853 CAPNG_PERMITTED | CAPNG_EFFECTIVE,
1854 CAP_DAC_OVERRIDE
1855 );
1856 }
1857 capng_apply(CAPNG_SELECT_BOTH);
1858 #endif /* HAVE_LIBCAP_NG */
1859 if (username || chroot_dir) {
1860 #ifndef HAVE_LIBCAP_NG
1861 if (!WFileName)
1862 #endif
1863 droproot(username, chroot_dir);
1864 }
1865 }
1866 #endif /* WIN32 */
1867
1868 if (pcap_setfilter(pd, &fcode) < 0)
1869 error("%s", pcap_geterr(pd));
1870 #ifdef HAVE_CAPSICUM
1871 if (RFileName == NULL && VFileName == NULL) {
1872 static const unsigned long cmds[] = { BIOCGSTATS };
1873
1874 cap_rights_init(&rights, CAP_IOCTL, CAP_READ);
1875 if (cap_rights_limit(pcap_fileno(pd), &rights) < 0 &&
1876 errno != ENOSYS) {
1877 error("unable to limit pcap descriptor");
1878 }
1879 if (cap_ioctls_limit(pcap_fileno(pd), cmds,
1880 sizeof(cmds) / sizeof(cmds[0])) < 0 && errno != ENOSYS) {
1881 error("unable to limit ioctls on pcap descriptor");
1882 }
1883 }
1884 #endif
1885 if (WFileName) {
1886 pcap_dumper_t *p;
1887 /* Do not exceed the default PATH_MAX for files. */
1888 dumpinfo.CurrentFileName = (char *)malloc(PATH_MAX + 1);
1889
1890 if (dumpinfo.CurrentFileName == NULL)
1891 error("malloc of dumpinfo.CurrentFileName");
1892
1893 /* We do not need numbering for dumpfiles if Cflag isn't set. */
1894 if (Cflag != 0)
1895 MakeFilename(dumpinfo.CurrentFileName, WFileName, 0, WflagChars);
1896 else
1897 MakeFilename(dumpinfo.CurrentFileName, WFileName, 0, 0);
1898
1899 p = pcap_dump_open(pd, dumpinfo.CurrentFileName);
1900 #ifdef HAVE_LIBCAP_NG
1901 /* Give up CAP_DAC_OVERRIDE capability.
1902 * Only allow it to be restored if the -C or -G flag have been
1903 * set since we may need to create more files later on.
1904 */
1905 capng_update(
1906 CAPNG_DROP,
1907 (Cflag || Gflag ? 0 : CAPNG_PERMITTED)
1908 | CAPNG_EFFECTIVE,
1909 CAP_DAC_OVERRIDE
1910 );
1911 capng_apply(CAPNG_SELECT_BOTH);
1912 #endif /* HAVE_LIBCAP_NG */
1913 if (p == NULL)
1914 error("%s", pcap_geterr(pd));
1915 #ifdef HAVE_CAPSICUM
1916 set_dumper_capsicum_rights(p);
1917 #endif
1918 if (Cflag != 0 || Gflag != 0) {
1919 #ifdef HAVE_CAPSICUM
1920 dumpinfo.WFileName = strdup(basename(WFileName));
1921 dumpinfo.dirfd = open(dirname(WFileName),
1922 O_DIRECTORY | O_RDONLY);
1923 if (dumpinfo.dirfd < 0) {
1924 error("unable to open directory %s",
1925 dirname(WFileName));
1926 }
1927 cap_rights_init(&rights, CAP_CREATE, CAP_FCNTL,
1928 CAP_FTRUNCATE, CAP_LOOKUP, CAP_SEEK, CAP_WRITE);
1929 if (cap_rights_limit(dumpinfo.dirfd, &rights) < 0 &&
1930 errno != ENOSYS) {
1931 error("unable to limit directory rights");
1932 }
1933 if (cap_fcntls_limit(dumpinfo.dirfd, CAP_FCNTL_GETFL) < 0 &&
1934 errno != ENOSYS) {
1935 error("unable to limit dump descriptor fcntls");
1936 }
1937 #else /* !HAVE_CAPSICUM */
1938 dumpinfo.WFileName = WFileName;
1939 #endif
1940 callback = dump_packet_and_trunc;
1941 dumpinfo.pd = pd;
1942 dumpinfo.p = p;
1943 pcap_userdata = (u_char *)&dumpinfo;
1944 } else {
1945 callback = dump_packet;
1946 pcap_userdata = (u_char *)p;
1947 }
1948 #ifdef HAVE_PCAP_DUMP_FLUSH
1949 if (Uflag)
1950 pcap_dump_flush(p);
1951 #endif
1952 } else {
1953 type = pcap_datalink(pd);
1954 printinfo = get_print_info(type);
1955 callback = print_packet;
1956 pcap_userdata = (u_char *)&printinfo;
1957 }
1958
1959 #ifdef SIGNAL_REQ_INFO
1960 /*
1961 * We can't get statistics when reading from a file rather
1962 * than capturing from a device.
1963 */
1964 if (RFileName == NULL)
1965 (void)setsignal(SIGNAL_REQ_INFO, requestinfo);
1966 #endif
1967
1968 if (vflag > 0 && WFileName) {
1969 /*
1970 * When capturing to a file, "-v" means tcpdump should,
1971 * every 10 secodns, "v"erbosely report the number of
1972 * packets captured.
1973 */
1974 #ifdef USE_WIN32_MM_TIMER
1975 /* call verbose_stats_dump() each 1000 +/-100msec */
1976 timer_id = timeSetEvent(1000, 100, verbose_stats_dump, 0, TIME_PERIODIC);
1977 setvbuf(stderr, NULL, _IONBF, 0);
1978 #elif defined(HAVE_ALARM)
1979 (void)setsignal(SIGALRM, verbose_stats_dump);
1980 alarm(1);
1981 #endif
1982 }
1983
1984 #ifndef WIN32
1985 if (RFileName == NULL) {
1986 /*
1987 * Live capture (if -V was specified, we set RFileName
1988 * to a file from the -V file). Print a message to
1989 * the standard error on UN*X.
1990 */
1991 if (!vflag && !WFileName) {
1992 (void)fprintf(stderr,
1993 "%s: verbose output suppressed, use -v or -vv for full protocol decode\n",
1994 program_name);
1995 } else
1996 (void)fprintf(stderr, "%s: ", program_name);
1997 dlt = pcap_datalink(pd);
1998 dlt_name = pcap_datalink_val_to_name(dlt);
1999 if (dlt_name == NULL) {
2000 (void)fprintf(stderr, "listening on %s, link-type %u, capture size %u bytes\n",
2001 device, dlt, snaplen);
2002 } else {
2003 (void)fprintf(stderr, "listening on %s, link-type %s (%s), capture size %u bytes\n",
2004 device, dlt_name,
2005 pcap_datalink_val_to_description(dlt), snaplen);
2006 }
2007 (void)fflush(stderr);
2008 }
2009
2010 /*
2011 * If a user name was specified with "-Z", attempt to switch to
2012 * that user's UID. This would probably be used with sudo,
2013 * to allow tcpdump to be run in a special restricted
2014 * account (if you just want to allow users to open capture
2015 * devices, and can't just give users that permission,
2016 * you'd make tcpdump set-UID or set-GID).
2017 *
2018 * Tcpdump doesn't necessarily write only to one savefile;
2019 * the general only way to allow a -Z instance to write to
2020 * savefiles as the user under whose UID it's run, rather
2021 * than as the user specified with -Z, would thus be to switch
2022 * to the original user ID before opening a capture file and
2023 * then switch back to the -Z user ID after opening the savefile.
2024 * Switching to the -Z user ID only after opening the first
2025 * savefile doesn't handle the general case.
2026 */
2027 if (getuid() == 0 || geteuid() == 0) {
2028 if (username || chroot_dir)
2029 droproot(username, chroot_dir);
2030 }
2031 #endif /* WIN32 */
2032
2033 #ifdef HAVE_CAPSICUM
2034 cansandbox = (nflag && VFileName == NULL && zflag == NULL);
2035 if (cansandbox && cap_enter() < 0 && errno != ENOSYS)
2036 error("unable to enter the capability mode");
2037 if (cap_sandboxed())
2038 fprintf(stderr, "capability mode sandbox enabled\n");
2039 #endif /* HAVE_CAPSICUM */
2040
2041 do {
2042 status = pcap_loop(pd, cnt, callback, pcap_userdata);
2043 if (WFileName == NULL) {
2044 /*
2045 * We're printing packets. Flush the printed output,
2046 * so it doesn't get intermingled with error output.
2047 */
2048 if (status == -2) {
2049 /*
2050 * We got interrupted, so perhaps we didn't
2051 * manage to finish a line we were printing.
2052 * Print an extra newline, just in case.
2053 */
2054 putchar('\n');
2055 }
2056 (void)fflush(stdout);
2057 }
2058 if (status == -2) {
2059 /*
2060 * We got interrupted. If we are reading multiple
2061 * files (via -V) set these so that we stop.
2062 */
2063 VFileName = NULL;
2064 ret = NULL;
2065 }
2066 if (status == -1) {
2067 /*
2068 * Error. Report it.
2069 */
2070 (void)fprintf(stderr, "%s: pcap_loop: %s\n",
2071 program_name, pcap_geterr(pd));
2072 }
2073 if (RFileName == NULL) {
2074 /*
2075 * We're doing a live capture. Report the capture
2076 * statistics.
2077 */
2078 info(1);
2079 }
2080 pcap_close(pd);
2081 if (VFileName != NULL) {
2082 ret = get_next_file(VFile, VFileLine);
2083 if (ret) {
2084 RFileName = VFileLine;
2085 pd = pcap_open_offline(RFileName, ebuf);
2086 if (pd == NULL)
2087 error("%s", ebuf);
2088 #ifdef HAVE_CAPSICUM
2089 cap_rights_init(&rights, CAP_READ);
2090 if (cap_rights_limit(fileno(pcap_file(pd)),
2091 &rights) < 0 && errno != ENOSYS) {
2092 error("unable to limit pcap descriptor");
2093 }
2094 #endif
2095 new_dlt = pcap_datalink(pd);
2096 if (WFileName && new_dlt != dlt)
2097 error("%s: new dlt does not match original", RFileName);
2098 printinfo = get_print_info(new_dlt);
2099 dlt_name = pcap_datalink_val_to_name(new_dlt);
2100 if (dlt_name == NULL) {
2101 fprintf(stderr, "reading from file %s, link-type %u\n",
2102 RFileName, new_dlt);
2103 } else {
2104 fprintf(stderr,
2105 "reading from file %s, link-type %s (%s)\n",
2106 RFileName, dlt_name,
2107 pcap_datalink_val_to_description(new_dlt));
2108 }
2109 if (pcap_compile(pd, &fcode, cmdbuf, Oflag, netmask) < 0)
2110 error("%s", pcap_geterr(pd));
2111 if (pcap_setfilter(pd, &fcode) < 0)
2112 error("%s", pcap_geterr(pd));
2113 }
2114 }
2115 }
2116 while (ret != NULL);
2117
2118 free(cmdbuf);
2119 exit(status == -1 ? 1 : 0);
2120 }
2121
2122 /* make a clean exit on interrupts */
2123 static RETSIGTYPE
cleanup(int signo _U_)2124 cleanup(int signo _U_)
2125 {
2126 #ifdef USE_WIN32_MM_TIMER
2127 if (timer_id)
2128 timeKillEvent(timer_id);
2129 timer_id = 0;
2130 #elif defined(HAVE_ALARM)
2131 alarm(0);
2132 #endif
2133
2134 #ifdef HAVE_PCAP_BREAKLOOP
2135 /*
2136 * We have "pcap_breakloop()"; use it, so that we do as little
2137 * as possible in the signal handler (it's probably not safe
2138 * to do anything with standard I/O streams in a signal handler -
2139 * the ANSI C standard doesn't say it is).
2140 */
2141 pcap_breakloop(pd);
2142 #else
2143 /*
2144 * We don't have "pcap_breakloop()"; this isn't safe, but
2145 * it's the best we can do. Print the summary if we're
2146 * not reading from a savefile - i.e., if we're doing a
2147 * live capture - and exit.
2148 */
2149 if (pd != NULL && pcap_file(pd) == NULL) {
2150 /*
2151 * We got interrupted, so perhaps we didn't
2152 * manage to finish a line we were printing.
2153 * Print an extra newline, just in case.
2154 */
2155 putchar('\n');
2156 (void)fflush(stdout);
2157 info(1);
2158 }
2159 exit(0);
2160 #endif
2161 }
2162
2163 /*
2164 On windows, we do not use a fork, so we do not care less about
2165 waiting a child processes to die
2166 */
2167 #if defined(HAVE_FORK) || defined(HAVE_VFORK)
2168 static RETSIGTYPE
child_cleanup(int signo _U_)2169 child_cleanup(int signo _U_)
2170 {
2171 wait(NULL);
2172 }
2173 #endif /* HAVE_FORK && HAVE_VFORK */
2174
2175 static void
info(register int verbose)2176 info(register int verbose)
2177 {
2178 struct pcap_stat stat;
2179
2180 /*
2181 * Older versions of libpcap didn't set ps_ifdrop on some
2182 * platforms; initialize it to 0 to handle that.
2183 */
2184 stat.ps_ifdrop = 0;
2185 if (pcap_stats(pd, &stat) < 0) {
2186 (void)fprintf(stderr, "pcap_stats: %s\n", pcap_geterr(pd));
2187 infoprint = 0;
2188 return;
2189 }
2190
2191 if (!verbose)
2192 fprintf(stderr, "%s: ", program_name);
2193
2194 (void)fprintf(stderr, "%u packet%s captured", packets_captured,
2195 PLURAL_SUFFIX(packets_captured));
2196 if (!verbose)
2197 fputs(", ", stderr);
2198 else
2199 putc('\n', stderr);
2200 (void)fprintf(stderr, "%u packet%s received by filter", stat.ps_recv,
2201 PLURAL_SUFFIX(stat.ps_recv));
2202 if (!verbose)
2203 fputs(", ", stderr);
2204 else
2205 putc('\n', stderr);
2206 (void)fprintf(stderr, "%u packet%s dropped by kernel", stat.ps_drop,
2207 PLURAL_SUFFIX(stat.ps_drop));
2208 if (stat.ps_ifdrop != 0) {
2209 if (!verbose)
2210 fputs(", ", stderr);
2211 else
2212 putc('\n', stderr);
2213 (void)fprintf(stderr, "%u packet%s dropped by interface\n",
2214 stat.ps_ifdrop, PLURAL_SUFFIX(stat.ps_ifdrop));
2215 } else
2216 putc('\n', stderr);
2217 infoprint = 0;
2218 }
2219
2220 #if defined(HAVE_FORK) || defined(HAVE_VFORK)
2221 static void
compress_savefile(const char * filename)2222 compress_savefile(const char *filename)
2223 {
2224 # ifdef HAVE_FORK
2225 if (fork())
2226 # else
2227 if (vfork())
2228 # endif
2229 return;
2230 /*
2231 * Set to lowest priority so that this doesn't disturb the capture
2232 */
2233 #ifdef NZERO
2234 setpriority(PRIO_PROCESS, 0, NZERO - 1);
2235 #else
2236 setpriority(PRIO_PROCESS, 0, 19);
2237 #endif
2238 if (execlp(zflag, zflag, filename, (char *)NULL) == -1)
2239 fprintf(stderr,
2240 "compress_savefile:execlp(%s, %s): %s\n",
2241 zflag,
2242 filename,
2243 strerror(errno));
2244 # ifdef HAVE_FORK
2245 exit(1);
2246 # else
2247 _exit(1);
2248 # endif
2249 }
2250 #else /* HAVE_FORK && HAVE_VFORK */
2251 static void
compress_savefile(const char * filename)2252 compress_savefile(const char *filename)
2253 {
2254 fprintf(stderr,
2255 "compress_savefile failed. Functionality not implemented under your system\n");
2256 }
2257 #endif /* HAVE_FORK && HAVE_VFORK */
2258
2259 static void
dump_packet_and_trunc(u_char * user,const struct pcap_pkthdr * h,const u_char * sp)2260 dump_packet_and_trunc(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
2261 {
2262 struct dump_info *dump_info;
2263 #ifdef HAVE_CAPSICUM
2264 cap_rights_t rights;
2265 #endif
2266
2267 ++packets_captured;
2268
2269 ++infodelay;
2270
2271 dump_info = (struct dump_info *)user;
2272
2273 /*
2274 * XXX - this won't force the file to rotate on the specified time
2275 * boundary, but it will rotate on the first packet received after the
2276 * specified Gflag number of seconds. Note: if a Gflag time boundary
2277 * and a Cflag size boundary coincide, the time rotation will occur
2278 * first thereby cancelling the Cflag boundary (since the file should
2279 * be 0).
2280 */
2281 if (Gflag != 0) {
2282 /* Check if it is time to rotate */
2283 time_t t;
2284
2285 /* Get the current time */
2286 if ((t = time(NULL)) == (time_t)-1) {
2287 error("dump_and_trunc_packet: can't get current_time: %s",
2288 pcap_strerror(errno));
2289 }
2290
2291
2292 /* If the time is greater than the specified window, rotate */
2293 if (t - Gflag_time >= Gflag) {
2294 #ifdef HAVE_CAPSICUM
2295 FILE *fp;
2296 int fd;
2297 #endif
2298
2299 /* Update the Gflag_time */
2300 Gflag_time = t;
2301 /* Update Gflag_count */
2302 Gflag_count++;
2303 /*
2304 * Close the current file and open a new one.
2305 */
2306 pcap_dump_close(dump_info->p);
2307
2308 /*
2309 * Compress the file we just closed, if the user asked for it
2310 */
2311 if (zflag != NULL)
2312 compress_savefile(dump_info->CurrentFileName);
2313
2314 /*
2315 * Check to see if we've exceeded the Wflag (when
2316 * not using Cflag).
2317 */
2318 if (Cflag == 0 && Wflag > 0 && Gflag_count >= Wflag) {
2319 (void)fprintf(stderr, "Maximum file limit reached: %d\n",
2320 Wflag);
2321 exit(0);
2322 /* NOTREACHED */
2323 }
2324 if (dump_info->CurrentFileName != NULL)
2325 free(dump_info->CurrentFileName);
2326 /* Allocate space for max filename + \0. */
2327 dump_info->CurrentFileName = (char *)malloc(PATH_MAX + 1);
2328 if (dump_info->CurrentFileName == NULL)
2329 error("dump_packet_and_trunc: malloc");
2330 /*
2331 * Gflag was set otherwise we wouldn't be here. Reset the count
2332 * so multiple files would end with 1,2,3 in the filename.
2333 * The counting is handled with the -C flow after this.
2334 */
2335 Cflag_count = 0;
2336
2337 /*
2338 * This is always the first file in the Cflag
2339 * rotation: e.g. 0
2340 * We also don't need numbering if Cflag is not set.
2341 */
2342 if (Cflag != 0)
2343 MakeFilename(dump_info->CurrentFileName, dump_info->WFileName, 0,
2344 WflagChars);
2345 else
2346 MakeFilename(dump_info->CurrentFileName, dump_info->WFileName, 0, 0);
2347
2348 #ifdef HAVE_LIBCAP_NG
2349 capng_update(CAPNG_ADD, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE);
2350 capng_apply(CAPNG_SELECT_BOTH);
2351 #endif /* HAVE_LIBCAP_NG */
2352 #ifdef HAVE_CAPSICUM
2353 fd = openat(dump_info->dirfd,
2354 dump_info->CurrentFileName,
2355 O_CREAT | O_WRONLY | O_TRUNC, 0644);
2356 if (fd < 0) {
2357 error("unable to open file %s",
2358 dump_info->CurrentFileName);
2359 }
2360 fp = fdopen(fd, "w");
2361 if (fp == NULL) {
2362 error("unable to fdopen file %s",
2363 dump_info->CurrentFileName);
2364 }
2365 dump_info->p = pcap_dump_fopen(dump_info->pd, fp);
2366 #else /* !HAVE_CAPSICUM */
2367 dump_info->p = pcap_dump_open(dump_info->pd, dump_info->CurrentFileName);
2368 #endif
2369 #ifdef HAVE_LIBCAP_NG
2370 capng_update(CAPNG_DROP, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE);
2371 capng_apply(CAPNG_SELECT_BOTH);
2372 #endif /* HAVE_LIBCAP_NG */
2373 if (dump_info->p == NULL)
2374 error("%s", pcap_geterr(pd));
2375 #ifdef HAVE_CAPSICUM
2376 set_dumper_capsicum_rights(dump_info->p);
2377 #endif
2378 }
2379 }
2380
2381 /*
2382 * XXX - this won't prevent capture files from getting
2383 * larger than Cflag - the last packet written to the
2384 * file could put it over Cflag.
2385 */
2386 if (Cflag != 0) {
2387 long size = pcap_dump_ftell(dump_info->p);
2388
2389 if (size == -1)
2390 error("ftell fails on output file");
2391 if (size > Cflag) {
2392 #ifdef HAVE_CAPSICUM
2393 FILE *fp;
2394 int fd;
2395 #endif
2396
2397 /*
2398 * Close the current file and open a new one.
2399 */
2400 pcap_dump_close(dump_info->p);
2401
2402 /*
2403 * Compress the file we just closed, if the user
2404 * asked for it.
2405 */
2406 if (zflag != NULL)
2407 compress_savefile(dump_info->CurrentFileName);
2408
2409 Cflag_count++;
2410 if (Wflag > 0) {
2411 if (Cflag_count >= Wflag)
2412 Cflag_count = 0;
2413 }
2414 if (dump_info->CurrentFileName != NULL)
2415 free(dump_info->CurrentFileName);
2416 dump_info->CurrentFileName = (char *)malloc(PATH_MAX + 1);
2417 if (dump_info->CurrentFileName == NULL)
2418 error("dump_packet_and_trunc: malloc");
2419 MakeFilename(dump_info->CurrentFileName, dump_info->WFileName, Cflag_count, WflagChars);
2420 #ifdef HAVE_LIBCAP_NG
2421 capng_update(CAPNG_ADD, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE);
2422 capng_apply(CAPNG_SELECT_BOTH);
2423 #endif /* HAVE_LIBCAP_NG */
2424 #ifdef HAVE_CAPSICUM
2425 fd = openat(dump_info->dirfd, dump_info->CurrentFileName,
2426 O_CREAT | O_WRONLY | O_TRUNC, 0644);
2427 if (fd < 0) {
2428 error("unable to open file %s",
2429 dump_info->CurrentFileName);
2430 }
2431 fp = fdopen(fd, "w");
2432 if (fp == NULL) {
2433 error("unable to fdopen file %s",
2434 dump_info->CurrentFileName);
2435 }
2436 dump_info->p = pcap_dump_fopen(dump_info->pd, fp);
2437 #else /* !HAVE_CAPSICUM */
2438 dump_info->p = pcap_dump_open(dump_info->pd, dump_info->CurrentFileName);
2439 #endif
2440 #ifdef HAVE_LIBCAP_NG
2441 capng_update(CAPNG_DROP, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE);
2442 capng_apply(CAPNG_SELECT_BOTH);
2443 #endif /* HAVE_LIBCAP_NG */
2444 if (dump_info->p == NULL)
2445 error("%s", pcap_geterr(pd));
2446 #ifdef HAVE_CAPSICUM
2447 set_dumper_capsicum_rights(dump_info->p);
2448 #endif
2449 }
2450 }
2451
2452 pcap_dump((u_char *)dump_info->p, h, sp);
2453 #ifdef HAVE_PCAP_DUMP_FLUSH
2454 if (Uflag)
2455 pcap_dump_flush(dump_info->p);
2456 #endif
2457
2458 --infodelay;
2459 if (infoprint)
2460 info(0);
2461 }
2462
2463 static void
dump_packet(u_char * user,const struct pcap_pkthdr * h,const u_char * sp)2464 dump_packet(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
2465 {
2466 ++packets_captured;
2467
2468 ++infodelay;
2469
2470 pcap_dump(user, h, sp);
2471 #ifdef HAVE_PCAP_DUMP_FLUSH
2472 if (Uflag)
2473 pcap_dump_flush((pcap_dumper_t *)user);
2474 #endif
2475
2476 --infodelay;
2477 if (infoprint)
2478 info(0);
2479 }
2480
2481 static void
print_packet(u_char * user,const struct pcap_pkthdr * h,const u_char * sp)2482 print_packet(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
2483 {
2484 struct print_info *print_info;
2485 u_int hdrlen;
2486 netdissect_options *ndo;
2487
2488 ++packets_captured;
2489
2490 ++infodelay;
2491
2492 print_info = (struct print_info *)user;
2493 ndo = print_info->ndo;
2494
2495 if(ndo->ndo_packet_number)
2496 ND_PRINT((ndo, "%5u ", packets_captured));
2497
2498 ts_print(ndo, &h->ts);
2499
2500 /*
2501 * Some printers want to check that they're not walking off the
2502 * end of the packet.
2503 * Rather than pass it all the way down, we set this member
2504 * of the netdissect_options structure.
2505 */
2506 ndo->ndo_snapend = sp + h->caplen;
2507
2508 if(print_info->ndo_type) {
2509 hdrlen = (*print_info->p.ndo_printer)(print_info->ndo, h, sp);
2510 } else {
2511 hdrlen = (*print_info->p.printer)(h, sp);
2512 }
2513
2514 /*
2515 * Restore the original snapend, as a printer might have
2516 * changed it.
2517 */
2518 ndo->ndo_snapend = sp + h->caplen;
2519 if (ndo->ndo_Xflag) {
2520 /*
2521 * Print the raw packet data in hex and ASCII.
2522 */
2523 if (ndo->ndo_Xflag > 1) {
2524 /*
2525 * Include the link-layer header.
2526 */
2527 hex_and_ascii_print(ndo, "\n\t", sp, h->caplen);
2528 } else {
2529 /*
2530 * Don't include the link-layer header - and if
2531 * we have nothing past the link-layer header,
2532 * print nothing.
2533 */
2534 if (h->caplen > hdrlen)
2535 hex_and_ascii_print(ndo, "\n\t", sp + hdrlen,
2536 h->caplen - hdrlen);
2537 }
2538 } else if (ndo->ndo_xflag) {
2539 /*
2540 * Print the raw packet data in hex.
2541 */
2542 if (ndo->ndo_xflag > 1) {
2543 /*
2544 * Include the link-layer header.
2545 */
2546 hex_print(ndo, "\n\t", sp, h->caplen);
2547 } else {
2548 /*
2549 * Don't include the link-layer header - and if
2550 * we have nothing past the link-layer header,
2551 * print nothing.
2552 */
2553 if (h->caplen > hdrlen)
2554 hex_print(ndo, "\n\t", sp + hdrlen,
2555 h->caplen - hdrlen);
2556 }
2557 } else if (ndo->ndo_Aflag) {
2558 /*
2559 * Print the raw packet data in ASCII.
2560 */
2561 if (ndo->ndo_Aflag > 1) {
2562 /*
2563 * Include the link-layer header.
2564 */
2565 ascii_print(ndo, sp, h->caplen);
2566 } else {
2567 /*
2568 * Don't include the link-layer header - and if
2569 * we have nothing past the link-layer header,
2570 * print nothing.
2571 */
2572 if (h->caplen > hdrlen)
2573 ascii_print(ndo, sp + hdrlen, h->caplen - hdrlen);
2574 }
2575 }
2576
2577 putchar('\n');
2578
2579 --infodelay;
2580 if (infoprint)
2581 info(0);
2582 }
2583
2584 #ifdef WIN32
2585 /*
2586 * XXX - there should really be libpcap calls to get the version
2587 * number as a string (the string would be generated from #defines
2588 * at run time, so that it's not generated from string constants
2589 * in the library, as, on many UNIX systems, those constants would
2590 * be statically linked into the application executable image, and
2591 * would thus reflect the version of libpcap on the system on
2592 * which the application was *linked*, not the system on which it's
2593 * *running*.
2594 *
2595 * That routine should be documented, unlike the "version[]"
2596 * string, so that UNIX vendors providing their own libpcaps
2597 * don't omit it (as a couple of vendors have...).
2598 *
2599 * Packet.dll should perhaps also export a routine to return the
2600 * version number of the Packet.dll code, to supply the
2601 * "Wpcap_version" information on Windows.
2602 */
2603 char WDversion[]="current-git.tcpdump.org";
2604 #if !defined(HAVE_GENERATED_VERSION)
2605 char version[]="current-git.tcpdump.org";
2606 #endif
2607 char pcap_version[]="current-git.tcpdump.org";
2608 char Wpcap_version[]="3.1";
2609 #endif
2610
2611 /*
2612 * By default, print the specified data out in hex and ASCII.
2613 */
2614 static void
ndo_default_print(netdissect_options * ndo,const u_char * bp,u_int length)2615 ndo_default_print(netdissect_options *ndo, const u_char *bp, u_int length)
2616 {
2617 hex_and_ascii_print(ndo, "\n\t", bp, length); /* pass on lf and indentation string */
2618 }
2619
2620 void
default_print(const u_char * bp,u_int length)2621 default_print(const u_char *bp, u_int length)
2622 {
2623 ndo_default_print(gndo, bp, length);
2624 }
2625
2626 #ifdef SIGNAL_REQ_INFO
requestinfo(int signo _U_)2627 RETSIGTYPE requestinfo(int signo _U_)
2628 {
2629 if (infodelay)
2630 ++infoprint;
2631 else
2632 info(0);
2633 }
2634 #endif
2635
2636 /*
2637 * Called once each second in verbose mode while dumping to file
2638 */
2639 #ifdef USE_WIN32_MM_TIMER
verbose_stats_dump(UINT timer_id _U_,UINT msg _U_,DWORD_PTR arg _U_,DWORD_PTR dw1 _U_,DWORD_PTR dw2 _U_)2640 void CALLBACK verbose_stats_dump (UINT timer_id _U_, UINT msg _U_, DWORD_PTR arg _U_,
2641 DWORD_PTR dw1 _U_, DWORD_PTR dw2 _U_)
2642 {
2643 struct pcap_stat stat;
2644
2645 if (infodelay == 0 && pcap_stats(pd, &stat) >= 0)
2646 fprintf(stderr, "Got %u\r", packets_captured);
2647 }
2648 #elif defined(HAVE_ALARM)
verbose_stats_dump(int sig _U_)2649 static void verbose_stats_dump(int sig _U_)
2650 {
2651 struct pcap_stat stat;
2652
2653 if (infodelay == 0 && pcap_stats(pd, &stat) >= 0)
2654 fprintf(stderr, "Got %u\r", packets_captured);
2655 alarm(1);
2656 }
2657 #endif
2658
2659 USES_APPLE_DEPRECATED_API
2660 static void
print_version(void)2661 print_version(void)
2662 {
2663 extern char version[];
2664 #ifndef HAVE_PCAP_LIB_VERSION
2665 #if defined(WIN32) || defined(HAVE_PCAP_VERSION)
2666 extern char pcap_version[];
2667 #else /* defined(WIN32) || defined(HAVE_PCAP_VERSION) */
2668 static char pcap_version[] = "unknown";
2669 #endif /* defined(WIN32) || defined(HAVE_PCAP_VERSION) */
2670 #endif /* HAVE_PCAP_LIB_VERSION */
2671
2672 #ifdef HAVE_PCAP_LIB_VERSION
2673 #ifdef WIN32
2674 (void)fprintf(stderr, "%s version %s, based on tcpdump version %s\n", program_name, WDversion, version);
2675 #else /* WIN32 */
2676 (void)fprintf(stderr, "%s version %s\n", program_name, version);
2677 #endif /* WIN32 */
2678 (void)fprintf(stderr, "%s\n",pcap_lib_version());
2679 #else /* HAVE_PCAP_LIB_VERSION */
2680 #ifdef WIN32
2681 (void)fprintf(stderr, "%s version %s, based on tcpdump version %s\n", program_name, WDversion, version);
2682 (void)fprintf(stderr, "WinPcap version %s, based on libpcap version %s\n",Wpcap_version, pcap_version);
2683 #else /* WIN32 */
2684 (void)fprintf(stderr, "%s version %s\n", program_name, version);
2685 (void)fprintf(stderr, "libpcap version %s\n", pcap_version);
2686 #endif /* WIN32 */
2687 #endif /* HAVE_PCAP_LIB_VERSION */
2688
2689 #if defined(HAVE_LIBCRYPTO) && defined(SSLEAY_VERSION)
2690 (void)fprintf (stderr, "%s\n", SSLeay_version(SSLEAY_VERSION));
2691 #endif
2692
2693 #ifdef USE_LIBSMI
2694 (void)fprintf (stderr, "SMI-library: %s\n", smi_version_string);
2695 #endif
2696 }
2697 USES_APPLE_RST
2698
2699 static void
print_usage(void)2700 print_usage(void)
2701 {
2702 print_version();
2703 (void)fprintf(stderr,
2704 "Usage: %s [-aAbd" D_FLAG "efhH" I_FLAG J_FLAG "KlLnNOpqRStu" U_FLAG "vxX#]" B_FLAG_USAGE " [ -c count ]\n", program_name);
2705 (void)fprintf(stderr,
2706 "\t\t[ -C file_size ] [ -E algo:secret ] [ -F file ] [ -G seconds ]\n");
2707 (void)fprintf(stderr,
2708 "\t\t[ -i interface ]" j_FLAG_USAGE " [ -M secret ] [ --number ]\n");
2709 #ifdef HAVE_PCAP_SETDIRECTION
2710 (void)fprintf(stderr,
2711 "\t\t[ -Q in|out|inout ]\n");
2712 #endif
2713 (void)fprintf(stderr,
2714 "\t\t[ -r file ] [ -s snaplen ] ");
2715 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
2716 (void)fprintf(stderr, "[ --time-stamp-precision precision ]\n");
2717 (void)fprintf(stderr,
2718 "\t\t");
2719 #endif
2720 #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE
2721 (void)fprintf(stderr, "[ --immediate-mode ] ");
2722 #endif
2723 (void)fprintf(stderr, "[ -T type ] [ --version ] [ -V file ]\n");
2724 (void)fprintf(stderr,
2725 "\t\t[ -w file ] [ -W filecount ] [ -y datalinktype ] [ -z command ]\n");
2726 (void)fprintf(stderr,
2727 "\t\t[ -Z user ] [ expression ]\n");
2728 }
2729
2730
2731
2732 /* VARARGS */
2733 static void
ndo_error(netdissect_options * ndo _U_,const char * fmt,...)2734 ndo_error(netdissect_options *ndo _U_, const char *fmt, ...)
2735 {
2736 va_list ap;
2737
2738 (void)fprintf(stderr, "%s: ", program_name);
2739 va_start(ap, fmt);
2740 (void)vfprintf(stderr, fmt, ap);
2741 va_end(ap);
2742 if (*fmt) {
2743 fmt += strlen(fmt);
2744 if (fmt[-1] != '\n')
2745 (void)fputc('\n', stderr);
2746 }
2747 exit(1);
2748 /* NOTREACHED */
2749 }
2750
2751 /* VARARGS */
2752 static void
ndo_warning(netdissect_options * ndo _U_,const char * fmt,...)2753 ndo_warning(netdissect_options *ndo _U_, const char *fmt, ...)
2754 {
2755 va_list ap;
2756
2757 (void)fprintf(stderr, "%s: WARNING: ", program_name);
2758 va_start(ap, fmt);
2759 (void)vfprintf(stderr, fmt, ap);
2760 va_end(ap);
2761 if (*fmt) {
2762 fmt += strlen(fmt);
2763 if (fmt[-1] != '\n')
2764 (void)fputc('\n', stderr);
2765 }
2766 }
2767 /*
2768 * Local Variables:
2769 * c-style: whitesmith
2770 * c-basic-offset: 8
2771 * End:
2772 */
2773