1 /* 2 * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000 3 * The Regents of the University of California. All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that: (1) source code distributions 7 * retain the above copyright notice and this paragraph in its entirety, (2) 8 * distributions including binary code include the above copyright notice and 9 * this paragraph in its entirety in the documentation or other materials 10 * provided with the distribution, and (3) all advertising materials mentioning 11 * features or use of this software display the following acknowledgement: 12 * ``This product includes software developed by the University of California, 13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of 14 * the University nor the names of its contributors may be used to endorse 15 * or promote products derived from this software without specific prior 16 * written permission. 17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED 18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF 19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 20 * 21 * Support for splitting captures into multiple files with a maximum 22 * file size: 23 * 24 * Copyright (c) 2001 25 * Seth Webster <swebster (at) sst.ll.mit.edu> 26 */ 27 28 #ifndef lint 29 static const char copyright[] _U_ = 30 "@(#) Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000\n\ 31 The Regents of the University of California. All rights reserved.\n"; 32 #endif 33 34 /* 35 * tcpdump - dump traffic on a network 36 * 37 * First written in 1987 by Van Jacobson, Lawrence Berkeley Laboratory. 38 * Mercilessly hacked and occasionally improved since then via the 39 * combined efforts of Van, Steve McCanne and Craig Leres of LBL. 40 */ 41 42 #ifdef HAVE_CONFIG_H 43 #include "config.h" 44 #endif 45 46 /* 47 * Mac OS X may ship pcap.h from libpcap 0.6 with a libpcap based on 48 * 0.8. That means it has pcap_findalldevs() but the header doesn't 49 * define pcap_if_t, meaning that we can't actually *use* pcap_findalldevs(). 50 */ 51 #ifdef HAVE_PCAP_FINDALLDEVS 52 #ifndef HAVE_PCAP_IF_T 53 #undef HAVE_PCAP_FINDALLDEVS 54 #endif 55 #endif 56 57 #include <netdissect-stdinc.h> 58 59 #include <sys/stat.h> 60 61 #ifdef HAVE_FCNTL_H 62 #include <fcntl.h> 63 #endif 64 65 #ifdef HAVE_LIBCRYPTO 66 #include <openssl/crypto.h> 67 #endif 68 69 #ifdef HAVE_GETOPT_LONG 70 #include <getopt.h> 71 #else 72 #include "getopt_long.h" 73 #endif 74 /* Capsicum-specific code requires macros from <net/bpf.h>, which will fail 75 * to compile if <pcap.h> has already been included; including the headers 76 * in the opposite order works fine. 77 */ 78 #ifdef HAVE_CAPSICUM 79 #include <sys/capability.h> 80 #include <sys/ioccom.h> 81 #include <net/bpf.h> 82 #include <libgen.h> 83 #endif /* HAVE_CAPSICUM */ 84 #include <pcap.h> 85 #include <signal.h> 86 #include <stdio.h> 87 #include <stdarg.h> 88 #include <stdlib.h> 89 #include <string.h> 90 #include <limits.h> 91 #ifndef _WIN32 92 #include <sys/wait.h> 93 #include <sys/resource.h> 94 #include <pwd.h> 95 #include <grp.h> 96 #endif /* _WIN32 */ 97 98 /* capabilities convenience library */ 99 /* If a code depends on HAVE_LIBCAP_NG, it depends also on HAVE_CAP_NG_H. 100 * If HAVE_CAP_NG_H is not defined, undefine HAVE_LIBCAP_NG. 101 * Thus, the later tests are done only on HAVE_LIBCAP_NG. 102 */ 103 #ifdef HAVE_LIBCAP_NG 104 #ifdef HAVE_CAP_NG_H 105 #include <cap-ng.h> 106 #else 107 #undef HAVE_LIBCAP_NG 108 #endif /* HAVE_CAP_NG_H */ 109 #endif /* HAVE_LIBCAP_NG */ 110 111 #include "netdissect.h" 112 #include "interface.h" 113 #include "addrtoname.h" 114 #include "machdep.h" 115 #include "setsignal.h" 116 #include "gmt2local.h" 117 #include "pcap-missing.h" 118 #include "ascii_strcasecmp.h" 119 120 #include "print.h" 121 122 #ifndef PATH_MAX 123 #define PATH_MAX 1024 124 #endif 125 126 #ifdef SIGINFO 127 #define SIGNAL_REQ_INFO SIGINFO 128 #elif SIGUSR1 129 #define SIGNAL_REQ_INFO SIGUSR1 130 #endif 131 132 static int Bflag; /* buffer size */ 133 static int Cflag; /* rotate dump files after this many bytes */ 134 static int Cflag_count; /* Keep track of which file number we're writing */ 135 static int Dflag; /* list available devices and exit */ 136 /* 137 * This is exported because, in some versions of libpcap, if libpcap 138 * is built with optimizer debugging code (which is *NOT* the default 139 * configuration!), the library *imports*(!) a variable named dflag, 140 * under the expectation that tcpdump is exporting it, to govern 141 * how much debugging information to print when optimizing 142 * the generated BPF code. 143 * 144 * This is a horrible hack; newer versions of libpcap don't import 145 * dflag but, instead, *if* built with optimizer debugging code, 146 * *export* a routine to set that flag. 147 */ 148 int dflag; /* print filter code */ 149 static int Gflag; /* rotate dump files after this many seconds */ 150 static int Gflag_count; /* number of files created with Gflag rotation */ 151 static time_t Gflag_time; /* The last time_t the dump file was rotated. */ 152 static int Lflag; /* list available data link types and exit */ 153 static int Iflag; /* rfmon (monitor) mode */ 154 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE 155 static int Jflag; /* list available time stamp types */ 156 #endif 157 static int jflag = -1; /* packet time stamp source */ 158 static int pflag; /* don't go promiscuous */ 159 #ifdef HAVE_PCAP_SETDIRECTION 160 static int Qflag = -1; /* restrict captured packet by send/receive direction */ 161 #endif 162 static int Uflag; /* "unbuffered" output of dump files */ 163 static int Wflag; /* recycle output files after this number of files */ 164 static int WflagChars; 165 static char *zflag = NULL; /* compress each savefile using a specified command (like gzip or bzip2) */ 166 static int immediate_mode; 167 168 static int infodelay; 169 static int infoprint; 170 171 char *program_name; 172 173 /* Forwards */ 174 static void error(const char *, ...) 175 __attribute__((noreturn)) 176 #ifdef __ATTRIBUTE___FORMAT_OK 177 __attribute__((format (printf, 1, 2))) 178 #endif /* __ATTRIBUTE___FORMAT_OK */ 179 ; 180 static void warning(const char *, ...) 181 #ifdef __ATTRIBUTE___FORMAT_OK 182 __attribute__((format (printf, 1, 2))) 183 #endif /* __ATTRIBUTE___FORMAT_OK */ 184 ; 185 static void exit_tcpdump(int) __attribute__((noreturn)); 186 static RETSIGTYPE cleanup(int); 187 static RETSIGTYPE child_cleanup(int); 188 static void print_version(void); 189 static void print_usage(void); 190 static void show_tstamp_types_and_exit(pcap_t *, const char *device) __attribute__((noreturn)); 191 static void show_dlts_and_exit(pcap_t *, const char *device) __attribute__((noreturn)); 192 #ifdef HAVE_PCAP_FINDALLDEVS 193 static void show_devices_and_exit (void) __attribute__((noreturn)); 194 #endif 195 196 static void print_packet(u_char *, const struct pcap_pkthdr *, const u_char *); 197 static void dump_packet_and_trunc(u_char *, const struct pcap_pkthdr *, const u_char *); 198 static void dump_packet(u_char *, const struct pcap_pkthdr *, const u_char *); 199 static void droproot(const char *, const char *); 200 201 #ifdef SIGNAL_REQ_INFO 202 RETSIGTYPE requestinfo(int); 203 #endif 204 205 #if defined(USE_WIN32_MM_TIMER) 206 #include <MMsystem.h> 207 static UINT timer_id; 208 static void CALLBACK verbose_stats_dump(UINT, UINT, DWORD_PTR, DWORD_PTR, DWORD_PTR); 209 #elif defined(HAVE_ALARM) 210 static void verbose_stats_dump(int sig); 211 #endif 212 213 static void info(int); 214 static u_int packets_captured; 215 216 #ifdef HAVE_PCAP_FINDALLDEVS 217 static const struct tok status_flags[] = { 218 #ifdef PCAP_IF_UP 219 { PCAP_IF_UP, "Up" }, 220 #endif 221 #ifdef PCAP_IF_RUNNING 222 { PCAP_IF_RUNNING, "Running" }, 223 #endif 224 { PCAP_IF_LOOPBACK, "Loopback" }, 225 { 0, NULL } 226 }; 227 #endif 228 229 static pcap_t *pd; 230 231 static int supports_monitor_mode; 232 233 extern int optind; 234 extern int opterr; 235 extern char *optarg; 236 237 struct dump_info { 238 char *WFileName; 239 char *CurrentFileName; 240 pcap_t *pd; 241 pcap_dumper_t *p; 242 #ifdef HAVE_CAPSICUM 243 int dirfd; 244 #endif 245 }; 246 247 #if defined(HAVE_PCAP_SET_PARSER_DEBUG) 248 /* 249 * We have pcap_set_parser_debug() in libpcap; declare it (it's not declared 250 * by any libpcap header, because it's a special hack, only available if 251 * libpcap was configured to include it, and only intended for use by 252 * libpcap developers trying to debug the parser for filter expressions). 253 */ 254 #ifdef _WIN32 255 __declspec(dllimport) 256 #else /* _WIN32 */ 257 extern 258 #endif /* _WIN32 */ 259 void pcap_set_parser_debug(int); 260 #elif defined(HAVE_PCAP_DEBUG) || defined(HAVE_YYDEBUG) 261 /* 262 * We don't have pcap_set_parser_debug() in libpcap, but we do have 263 * pcap_debug or yydebug. Make a local version of pcap_set_parser_debug() 264 * to set the flag, and define HAVE_PCAP_SET_PARSER_DEBUG. 265 */ 266 static void 267 pcap_set_parser_debug(int value) 268 { 269 #ifdef HAVE_PCAP_DEBUG 270 extern int pcap_debug; 271 272 pcap_debug = value; 273 #else /* HAVE_PCAP_DEBUG */ 274 extern int yydebug; 275 276 yydebug = value; 277 #endif /* HAVE_PCAP_DEBUG */ 278 } 279 280 #define HAVE_PCAP_SET_PARSER_DEBUG 281 #endif 282 283 #if defined(HAVE_PCAP_SET_OPTIMIZER_DEBUG) 284 /* 285 * We have pcap_set_optimizer_debug() in libpcap; declare it (it's not declared 286 * by any libpcap header, because it's a special hack, only available if 287 * libpcap was configured to include it, and only intended for use by 288 * libpcap developers trying to debug the optimizer for filter expressions). 289 */ 290 #ifdef _WIN32 291 __declspec(dllimport) 292 #else /* _WIN32 */ 293 extern 294 #endif /* _WIN32 */ 295 void pcap_set_optimizer_debug(int); 296 #endif 297 298 /* VARARGS */ 299 static void 300 error(const char *fmt, ...) 301 { 302 va_list ap; 303 304 (void)fprintf(stderr, "%s: ", program_name); 305 va_start(ap, fmt); 306 (void)vfprintf(stderr, fmt, ap); 307 va_end(ap); 308 if (*fmt) { 309 fmt += strlen(fmt); 310 if (fmt[-1] != '\n') 311 (void)fputc('\n', stderr); 312 } 313 exit_tcpdump(1); 314 /* NOTREACHED */ 315 } 316 317 /* VARARGS */ 318 static void 319 warning(const char *fmt, ...) 320 { 321 va_list ap; 322 323 (void)fprintf(stderr, "%s: WARNING: ", program_name); 324 va_start(ap, fmt); 325 (void)vfprintf(stderr, fmt, ap); 326 va_end(ap); 327 if (*fmt) { 328 fmt += strlen(fmt); 329 if (fmt[-1] != '\n') 330 (void)fputc('\n', stderr); 331 } 332 } 333 334 static void 335 exit_tcpdump(int status) 336 { 337 nd_cleanup(); 338 exit(status); 339 } 340 341 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE 342 static void 343 show_tstamp_types_and_exit(pcap_t *pc, const char *device) 344 { 345 int n_tstamp_types; 346 int *tstamp_types = 0; 347 const char *tstamp_type_name; 348 int i; 349 350 n_tstamp_types = pcap_list_tstamp_types(pc, &tstamp_types); 351 if (n_tstamp_types < 0) 352 error("%s", pcap_geterr(pc)); 353 354 if (n_tstamp_types == 0) { 355 fprintf(stderr, "Time stamp type cannot be set for %s\n", 356 device); 357 exit_tcpdump(0); 358 } 359 fprintf(stderr, "Time stamp types for %s (use option -j to set):\n", 360 device); 361 for (i = 0; i < n_tstamp_types; i++) { 362 tstamp_type_name = pcap_tstamp_type_val_to_name(tstamp_types[i]); 363 if (tstamp_type_name != NULL) { 364 (void) fprintf(stderr, " %s (%s)\n", tstamp_type_name, 365 pcap_tstamp_type_val_to_description(tstamp_types[i])); 366 } else { 367 (void) fprintf(stderr, " %d\n", tstamp_types[i]); 368 } 369 } 370 pcap_free_tstamp_types(tstamp_types); 371 exit_tcpdump(0); 372 } 373 #endif 374 375 static void 376 show_dlts_and_exit(pcap_t *pc, const char *device) 377 { 378 int n_dlts, i; 379 int *dlts = 0; 380 const char *dlt_name; 381 382 n_dlts = pcap_list_datalinks(pc, &dlts); 383 if (n_dlts < 0) 384 error("%s", pcap_geterr(pc)); 385 else if (n_dlts == 0 || !dlts) 386 error("No data link types."); 387 388 /* 389 * If the interface is known to support monitor mode, indicate 390 * whether these are the data link types available when not in 391 * monitor mode, if -I wasn't specified, or when in monitor mode, 392 * when -I was specified (the link-layer types available in 393 * monitor mode might be different from the ones available when 394 * not in monitor mode). 395 */ 396 if (supports_monitor_mode) 397 (void) fprintf(stderr, "Data link types for %s %s (use option -y to set):\n", 398 device, 399 Iflag ? "when in monitor mode" : "when not in monitor mode"); 400 else 401 (void) fprintf(stderr, "Data link types for %s (use option -y to set):\n", 402 device); 403 404 for (i = 0; i < n_dlts; i++) { 405 dlt_name = pcap_datalink_val_to_name(dlts[i]); 406 if (dlt_name != NULL) { 407 (void) fprintf(stderr, " %s (%s)", dlt_name, 408 pcap_datalink_val_to_description(dlts[i])); 409 410 /* 411 * OK, does tcpdump handle that type? 412 */ 413 if (!has_printer(dlts[i])) 414 (void) fprintf(stderr, " (printing not supported)"); 415 fprintf(stderr, "\n"); 416 } else { 417 (void) fprintf(stderr, " DLT %d (printing not supported)\n", 418 dlts[i]); 419 } 420 } 421 #ifdef HAVE_PCAP_FREE_DATALINKS 422 pcap_free_datalinks(dlts); 423 #endif 424 exit_tcpdump(0); 425 } 426 427 #ifdef HAVE_PCAP_FINDALLDEVS 428 static void 429 show_devices_and_exit (void) 430 { 431 pcap_if_t *dev, *devlist; 432 char ebuf[PCAP_ERRBUF_SIZE]; 433 int i; 434 435 if (pcap_findalldevs(&devlist, ebuf) < 0) 436 error("%s", ebuf); 437 for (i = 0, dev = devlist; dev != NULL; i++, dev = dev->next) { 438 printf("%d.%s", i+1, dev->name); 439 if (dev->description != NULL) 440 printf(" (%s)", dev->description); 441 if (dev->flags != 0) 442 printf(" [%s]", bittok2str(status_flags, "none", dev->flags)); 443 printf("\n"); 444 } 445 pcap_freealldevs(devlist); 446 exit_tcpdump(0); 447 } 448 #endif /* HAVE_PCAP_FINDALLDEVS */ 449 450 /* 451 * Short options. 452 * 453 * Note that there we use all letters for short options except for g, k, 454 * o, and P, and those are used by other versions of tcpdump, and we should 455 * only use them for the same purposes that the other versions of tcpdump 456 * use them: 457 * 458 * OS X tcpdump uses -g to force non--v output for IP to be on one 459 * line, making it more "g"repable; 460 * 461 * OS X tcpdump uses -k to specify that packet comments in pcap-ng files 462 * should be printed; 463 * 464 * OpenBSD tcpdump uses -o to indicate that OS fingerprinting should be done 465 * for hosts sending TCP SYN packets; 466 * 467 * OS X tcpdump uses -P to indicate that -w should write pcap-ng rather 468 * than pcap files. 469 * 470 * OS X tcpdump also uses -Q to specify expressions that match packet 471 * metadata, including but not limited to the packet direction. 472 * The expression syntax is different from a simple "in|out|inout", 473 * and those expressions aren't accepted by OS X tcpdump, but the 474 * equivalents would be "in" = "dir=in", "out" = "dir=out", and 475 * "inout" = "dir=in or dir=out", and the parser could conceivably 476 * special-case "in", "out", and "inout" as expressions for backwards 477 * compatibility, so all is not (yet) lost. 478 */ 479 480 /* 481 * Set up flags that might or might not be supported depending on the 482 * version of libpcap we're using. 483 */ 484 #if defined(HAVE_PCAP_CREATE) || defined(_WIN32) 485 #define B_FLAG "B:" 486 #define B_FLAG_USAGE " [ -B size ]" 487 #else /* defined(HAVE_PCAP_CREATE) || defined(_WIN32) */ 488 #define B_FLAG 489 #define B_FLAG_USAGE 490 #endif /* defined(HAVE_PCAP_CREATE) || defined(_WIN32) */ 491 492 #ifdef HAVE_PCAP_CREATE 493 #define I_FLAG "I" 494 #else /* HAVE_PCAP_CREATE */ 495 #define I_FLAG 496 #endif /* HAVE_PCAP_CREATE */ 497 498 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE 499 #define j_FLAG "j:" 500 #define j_FLAG_USAGE " [ -j tstamptype ]" 501 #define J_FLAG "J" 502 #else /* PCAP_ERROR_TSTAMP_TYPE_NOTSUP */ 503 #define j_FLAG 504 #define j_FLAG_USAGE 505 #define J_FLAG 506 #endif /* PCAP_ERROR_TSTAMP_TYPE_NOTSUP */ 507 508 #ifdef HAVE_PCAP_FINDALLDEVS 509 #define D_FLAG "D" 510 #else 511 #define D_FLAG 512 #endif 513 514 #ifdef HAVE_PCAP_DUMP_FLUSH 515 #define U_FLAG "U" 516 #else 517 #define U_FLAG 518 #endif 519 520 #ifdef HAVE_PCAP_SETDIRECTION 521 #define Q_FLAG "Q:" 522 #else 523 #define Q_FLAG 524 #endif 525 526 #define SHORTOPTS "aAb" B_FLAG "c:C:d" D_FLAG "eE:fF:G:hHi:" I_FLAG j_FLAG J_FLAG "KlLm:M:nNOpq" Q_FLAG "r:s:StT:u" U_FLAG "vV:w:W:xXy:Yz:Z:#" 527 528 /* 529 * Long options. 530 * 531 * We do not currently have long options corresponding to all short 532 * options; we should probably pick appropriate option names for them. 533 * 534 * However, the short options where the number of times the option is 535 * specified matters, such as -v and -d and -t, should probably not 536 * just map to a long option, as saying 537 * 538 * tcpdump --verbose --verbose 539 * 540 * doesn't make sense; it should be --verbosity={N} or something such 541 * as that. 542 * 543 * For long options with no corresponding short options, we define values 544 * outside the range of ASCII graphic characters, make that the last 545 * component of the entry for the long option, and have a case for that 546 * option in the switch statement. 547 */ 548 #define OPTION_VERSION 128 549 #define OPTION_TSTAMP_PRECISION 129 550 #define OPTION_IMMEDIATE_MODE 130 551 552 static const struct option longopts[] = { 553 #if defined(HAVE_PCAP_CREATE) || defined(_WIN32) 554 { "buffer-size", required_argument, NULL, 'B' }, 555 #endif 556 { "list-interfaces", no_argument, NULL, 'D' }, 557 { "help", no_argument, NULL, 'h' }, 558 { "interface", required_argument, NULL, 'i' }, 559 #ifdef HAVE_PCAP_CREATE 560 { "monitor-mode", no_argument, NULL, 'I' }, 561 #endif 562 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE 563 { "time-stamp-type", required_argument, NULL, 'j' }, 564 { "list-time-stamp-types", no_argument, NULL, 'J' }, 565 #endif 566 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION 567 { "time-stamp-precision", required_argument, NULL, OPTION_TSTAMP_PRECISION}, 568 #endif 569 { "dont-verify-checksums", no_argument, NULL, 'K' }, 570 { "list-data-link-types", no_argument, NULL, 'L' }, 571 { "no-optimize", no_argument, NULL, 'O' }, 572 { "no-promiscuous-mode", no_argument, NULL, 'p' }, 573 #ifdef HAVE_PCAP_SETDIRECTION 574 { "direction", required_argument, NULL, 'Q' }, 575 #endif 576 { "snapshot-length", required_argument, NULL, 's' }, 577 { "absolute-tcp-sequence-numbers", no_argument, NULL, 'S' }, 578 #ifdef HAVE_PCAP_DUMP_FLUSH 579 { "packet-buffered", no_argument, NULL, 'U' }, 580 #endif 581 { "linktype", required_argument, NULL, 'y' }, 582 #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE 583 { "immediate-mode", no_argument, NULL, OPTION_IMMEDIATE_MODE }, 584 #endif 585 #ifdef HAVE_PCAP_SET_PARSER_DEBUG 586 { "debug-filter-parser", no_argument, NULL, 'Y' }, 587 #endif 588 { "relinquish-privileges", required_argument, NULL, 'Z' }, 589 { "number", no_argument, NULL, '#' }, 590 { "version", no_argument, NULL, OPTION_VERSION }, 591 { NULL, 0, NULL, 0 } 592 }; 593 594 #ifndef _WIN32 595 /* Drop root privileges and chroot if necessary */ 596 static void 597 droproot(const char *username, const char *chroot_dir) 598 { 599 struct passwd *pw = NULL; 600 601 if (chroot_dir && !username) { 602 fprintf(stderr, "%s: Chroot without dropping root is insecure\n", 603 program_name); 604 exit_tcpdump(1); 605 } 606 607 pw = getpwnam(username); 608 if (pw) { 609 if (chroot_dir) { 610 if (chroot(chroot_dir) != 0 || chdir ("/") != 0) { 611 fprintf(stderr, "%s: Couldn't chroot/chdir to '%.64s': %s\n", 612 program_name, chroot_dir, pcap_strerror(errno)); 613 exit_tcpdump(1); 614 } 615 } 616 #ifdef HAVE_LIBCAP_NG 617 { 618 int ret = capng_change_id(pw->pw_uid, pw->pw_gid, CAPNG_NO_FLAG); 619 if (ret < 0) { 620 fprintf(stderr, "error : ret %d\n", ret); 621 } else { 622 fprintf(stderr, "dropped privs to %s\n", username); 623 } 624 } 625 #else 626 if (initgroups(pw->pw_name, pw->pw_gid) != 0 || 627 setgid(pw->pw_gid) != 0 || setuid(pw->pw_uid) != 0) { 628 fprintf(stderr, "%s: Couldn't change to '%.32s' uid=%lu gid=%lu: %s\n", 629 program_name, username, 630 (unsigned long)pw->pw_uid, 631 (unsigned long)pw->pw_gid, 632 pcap_strerror(errno)); 633 exit_tcpdump(1); 634 } 635 else { 636 fprintf(stderr, "dropped privs to %s\n", username); 637 } 638 #endif /* HAVE_LIBCAP_NG */ 639 } 640 else { 641 fprintf(stderr, "%s: Couldn't find user '%.32s'\n", 642 program_name, username); 643 exit_tcpdump(1); 644 } 645 #ifdef HAVE_LIBCAP_NG 646 /* We don't need CAP_SETUID, CAP_SETGID and CAP_SYS_CHROOT any more. */ 647 capng_updatev( 648 CAPNG_DROP, 649 CAPNG_EFFECTIVE | CAPNG_PERMITTED, 650 CAP_SETUID, 651 CAP_SETGID, 652 CAP_SYS_CHROOT, 653 -1); 654 capng_apply(CAPNG_SELECT_BOTH); 655 #endif /* HAVE_LIBCAP_NG */ 656 657 } 658 #endif /* _WIN32 */ 659 660 static int 661 getWflagChars(int x) 662 { 663 int c = 0; 664 665 x -= 1; 666 while (x > 0) { 667 c += 1; 668 x /= 10; 669 } 670 671 return c; 672 } 673 674 675 static void 676 MakeFilename(char *buffer, char *orig_name, int cnt, int max_chars) 677 { 678 char *filename = malloc(PATH_MAX + 1); 679 if (filename == NULL) 680 error("Makefilename: malloc"); 681 682 /* Process with strftime if Gflag is set. */ 683 if (Gflag != 0) { 684 struct tm *local_tm; 685 686 /* Convert Gflag_time to a usable format */ 687 if ((local_tm = localtime(&Gflag_time)) == NULL) { 688 error("MakeTimedFilename: localtime"); 689 } 690 691 /* There's no good way to detect an error in strftime since a return 692 * value of 0 isn't necessarily failure. 693 */ 694 strftime(filename, PATH_MAX, orig_name, local_tm); 695 } else { 696 strncpy(filename, orig_name, PATH_MAX); 697 } 698 699 if (cnt == 0 && max_chars == 0) 700 strncpy(buffer, filename, PATH_MAX + 1); 701 else 702 if (snprintf(buffer, PATH_MAX + 1, "%s%0*d", filename, max_chars, cnt) > PATH_MAX) 703 /* Report an error if the filename is too large */ 704 error("too many output files or filename is too long (> %d)", PATH_MAX); 705 free(filename); 706 } 707 708 static char * 709 get_next_file(FILE *VFile, char *ptr) 710 { 711 char *ret; 712 713 ret = fgets(ptr, PATH_MAX, VFile); 714 if (!ret) 715 return NULL; 716 717 if (ptr[strlen(ptr) - 1] == '\n') 718 ptr[strlen(ptr) - 1] = '\0'; 719 720 return ret; 721 } 722 723 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION 724 static int 725 tstamp_precision_from_string(const char *precision) 726 { 727 if (strncmp(precision, "nano", strlen("nano")) == 0) 728 return PCAP_TSTAMP_PRECISION_NANO; 729 730 if (strncmp(precision, "micro", strlen("micro")) == 0) 731 return PCAP_TSTAMP_PRECISION_MICRO; 732 733 return -EINVAL; 734 } 735 736 static const char * 737 tstamp_precision_to_string(int precision) 738 { 739 switch (precision) { 740 741 case PCAP_TSTAMP_PRECISION_MICRO: 742 return "micro"; 743 744 case PCAP_TSTAMP_PRECISION_NANO: 745 return "nano"; 746 747 default: 748 return "unknown"; 749 } 750 } 751 #endif 752 753 #ifdef HAVE_CAPSICUM 754 /* 755 * Ensure that, on a dump file's descriptor, we have all the rights 756 * necessary to make the standard I/O library work with an fdopen()ed 757 * FILE * from that descriptor. 758 * 759 * A long time ago, in a galaxy far far away, AT&T decided that, instead 760 * of providing separate APIs for getting and setting the FD_ flags on a 761 * descriptor, getting and setting the O_ flags on a descriptor, and 762 * locking files, they'd throw them all into a kitchen-sink fcntl() call 763 * along the lines of ioctl(), the fact that ioctl() operations are 764 * largely specific to particular character devices but fcntl() operations 765 * are either generic to all descriptors or generic to all descriptors for 766 * regular files nonwithstanding. 767 * 768 * The Capsicum people decided that fine-grained control of descriptor 769 * operations was required, so that you need to grant permission for 770 * reading, writing, seeking, and fcntl-ing. The latter, courtesy of 771 * AT&T's decision, means that "fcntl-ing" isn't a thing, but a motley 772 * collection of things, so there are *individual* fcntls for which 773 * permission needs to be granted. 774 * 775 * The FreeBSD standard I/O people implemented some optimizations that 776 * requires that the standard I/O routines be able to determine whether 777 * the descriptor for the FILE * is open append-only or not; as that 778 * descriptor could have come from an open() rather than an fopen(), 779 * that requires that it be able to do an F_GETFL fcntl() to read 780 * the O_ flags. 781 * 782 * Tcpdump uses ftell() to determine how much data has been written 783 * to a file in order to, when used with -C, determine when it's time 784 * to rotate capture files. ftell() therefore needs to do an lseek() 785 * to find out the file offset and must, thanks to the aforementioned 786 * optimization, also know whether the descriptor is open append-only 787 * or not. 788 * 789 * The net result of all the above is that we need to grant CAP_SEEK, 790 * CAP_WRITE, and CAP_FCNTL with the CAP_FCNTL_GETFL subcapability. 791 * 792 * Perhaps this is the universe's way of saying that either 793 * 794 * 1) there needs to be an fopenat() call and a pcap_dump_openat() call 795 * using it, so that Capsicum-capable tcpdump wouldn't need to do 796 * an fdopen() 797 * 798 * or 799 * 800 * 2) there needs to be a cap_fdopen() call in the FreeBSD standard 801 * I/O library that knows what rights are needed by the standard 802 * I/O library, based on the open mode, and assigns them, perhaps 803 * with an additional argument indicating, for example, whether 804 * seeking should be allowed, so that tcpdump doesn't need to know 805 * what the standard I/O library happens to require this week. 806 */ 807 static void 808 set_dumper_capsicum_rights(pcap_dumper_t *p) 809 { 810 int fd = fileno(pcap_dump_file(p)); 811 cap_rights_t rights; 812 813 cap_rights_init(&rights, CAP_SEEK, CAP_WRITE, CAP_FCNTL); 814 if (cap_rights_limit(fd, &rights) < 0 && errno != ENOSYS) { 815 error("unable to limit dump descriptor"); 816 } 817 if (cap_fcntls_limit(fd, CAP_FCNTL_GETFL) < 0 && errno != ENOSYS) { 818 error("unable to limit dump descriptor fcntls"); 819 } 820 } 821 #endif 822 823 /* 824 * Copy arg vector into a new buffer, concatenating arguments with spaces. 825 */ 826 static char * 827 copy_argv(register char **argv) 828 { 829 register char **p; 830 register u_int len = 0; 831 char *buf; 832 char *src, *dst; 833 834 p = argv; 835 if (*p == NULL) 836 return 0; 837 838 while (*p) 839 len += strlen(*p++) + 1; 840 841 buf = (char *)malloc(len); 842 if (buf == NULL) 843 error("copy_argv: malloc"); 844 845 p = argv; 846 dst = buf; 847 while ((src = *p++) != NULL) { 848 while ((*dst++ = *src++) != '\0') 849 ; 850 dst[-1] = ' '; 851 } 852 dst[-1] = '\0'; 853 854 return buf; 855 } 856 857 /* 858 * On Windows, we need to open the file in binary mode, so that 859 * we get all the bytes specified by the size we get from "fstat()". 860 * On UNIX, that's not necessary. O_BINARY is defined on Windows; 861 * we define it as 0 if it's not defined, so it does nothing. 862 */ 863 #ifndef O_BINARY 864 #define O_BINARY 0 865 #endif 866 867 static char * 868 read_infile(char *fname) 869 { 870 register int i, fd, cc; 871 register char *cp; 872 struct stat buf; 873 874 fd = open(fname, O_RDONLY|O_BINARY); 875 if (fd < 0) 876 error("can't open %s: %s", fname, pcap_strerror(errno)); 877 878 if (fstat(fd, &buf) < 0) 879 error("can't stat %s: %s", fname, pcap_strerror(errno)); 880 881 cp = malloc((u_int)buf.st_size + 1); 882 if (cp == NULL) 883 error("malloc(%d) for %s: %s", (u_int)buf.st_size + 1, 884 fname, pcap_strerror(errno)); 885 cc = read(fd, cp, (u_int)buf.st_size); 886 if (cc < 0) 887 error("read %s: %s", fname, pcap_strerror(errno)); 888 if (cc != buf.st_size) 889 error("short read %s (%d != %d)", fname, cc, (int)buf.st_size); 890 891 close(fd); 892 /* replace "# comment" with spaces */ 893 for (i = 0; i < cc; i++) { 894 if (cp[i] == '#') 895 while (i < cc && cp[i] != '\n') 896 cp[i++] = ' '; 897 } 898 cp[cc] = '\0'; 899 return (cp); 900 } 901 902 #ifdef HAVE_PCAP_FINDALLDEVS 903 static long 904 parse_interface_number(const char *device) 905 { 906 long devnum; 907 char *end; 908 909 devnum = strtol(device, &end, 10); 910 if (device != end && *end == '\0') { 911 /* 912 * It's all-numeric, but is it a valid number? 913 */ 914 if (devnum <= 0) { 915 /* 916 * No, it's not an ordinal. 917 */ 918 error("Invalid adapter index"); 919 } 920 return (devnum); 921 } else { 922 /* 923 * It's not all-numeric; return -1, so our caller 924 * knows that. 925 */ 926 return (-1); 927 } 928 } 929 930 static char * 931 find_interface_by_number(long devnum) 932 { 933 pcap_if_t *dev, *devlist; 934 long i; 935 char ebuf[PCAP_ERRBUF_SIZE]; 936 char *device; 937 938 if (pcap_findalldevs(&devlist, ebuf) < 0) 939 error("%s", ebuf); 940 /* 941 * Look for the devnum-th entry in the list of devices (1-based). 942 */ 943 for (i = 0, dev = devlist; i < devnum-1 && dev != NULL; 944 i++, dev = dev->next) 945 ; 946 if (dev == NULL) 947 error("Invalid adapter index"); 948 device = strdup(dev->name); 949 pcap_freealldevs(devlist); 950 return (device); 951 } 952 #endif 953 954 static pcap_t * 955 open_interface(const char *device, netdissect_options *ndo, char *ebuf) 956 { 957 pcap_t *pc; 958 #ifdef HAVE_PCAP_CREATE 959 int status; 960 char *cp; 961 #endif 962 963 #ifdef HAVE_PCAP_CREATE 964 pc = pcap_create(device, ebuf); 965 if (pc == NULL) { 966 /* 967 * If this failed with "No such device", that means 968 * the interface doesn't exist; return NULL, so that 969 * the caller can see whether the device name is 970 * actually an interface index. 971 */ 972 if (strstr(ebuf, "No such device") != NULL) 973 return (NULL); 974 error("%s", ebuf); 975 } 976 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE 977 if (Jflag) 978 show_tstamp_types_and_exit(pc, device); 979 #endif 980 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION 981 status = pcap_set_tstamp_precision(pc, ndo->ndo_tstamp_precision); 982 if (status != 0) 983 error("%s: Can't set %ssecond time stamp precision: %s", 984 device, 985 tstamp_precision_to_string(ndo->ndo_tstamp_precision), 986 pcap_statustostr(status)); 987 #endif 988 989 #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE 990 if (immediate_mode) { 991 status = pcap_set_immediate_mode(pc, 1); 992 if (status != 0) 993 error("%s: Can't set immediate mode: %s", 994 device, 995 pcap_statustostr(status)); 996 } 997 #endif 998 /* 999 * Is this an interface that supports monitor mode? 1000 */ 1001 if (pcap_can_set_rfmon(pc) == 1) 1002 supports_monitor_mode = 1; 1003 else 1004 supports_monitor_mode = 0; 1005 status = pcap_set_snaplen(pc, ndo->ndo_snaplen); 1006 if (status != 0) 1007 error("%s: Can't set snapshot length: %s", 1008 device, pcap_statustostr(status)); 1009 status = pcap_set_promisc(pc, !pflag); 1010 if (status != 0) 1011 error("%s: Can't set promiscuous mode: %s", 1012 device, pcap_statustostr(status)); 1013 if (Iflag) { 1014 status = pcap_set_rfmon(pc, 1); 1015 if (status != 0) 1016 error("%s: Can't set monitor mode: %s", 1017 device, pcap_statustostr(status)); 1018 } 1019 status = pcap_set_timeout(pc, 1000); 1020 if (status != 0) 1021 error("%s: pcap_set_timeout failed: %s", 1022 device, pcap_statustostr(status)); 1023 if (Bflag != 0) { 1024 status = pcap_set_buffer_size(pc, Bflag); 1025 if (status != 0) 1026 error("%s: Can't set buffer size: %s", 1027 device, pcap_statustostr(status)); 1028 } 1029 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE 1030 if (jflag != -1) { 1031 status = pcap_set_tstamp_type(pc, jflag); 1032 if (status < 0) 1033 error("%s: Can't set time stamp type: %s", 1034 device, pcap_statustostr(status)); 1035 } 1036 #endif 1037 status = pcap_activate(pc); 1038 if (status < 0) { 1039 /* 1040 * pcap_activate() failed. 1041 */ 1042 cp = pcap_geterr(pc); 1043 if (status == PCAP_ERROR) 1044 error("%s", cp); 1045 else if (status == PCAP_ERROR_NO_SUCH_DEVICE) { 1046 /* 1047 * Return an error for our caller to handle. 1048 */ 1049 pcap_close(pc); 1050 snprintf(ebuf, PCAP_ERRBUF_SIZE, "%s: %s\n(%s)", 1051 device, pcap_statustostr(status), cp); 1052 return (NULL); 1053 } else if (status == PCAP_ERROR_PERM_DENIED && *cp != '\0') 1054 error("%s: %s\n(%s)", device, 1055 pcap_statustostr(status), cp); 1056 else 1057 error("%s: %s", device, 1058 pcap_statustostr(status)); 1059 } else if (status > 0) { 1060 /* 1061 * pcap_activate() succeeded, but it's warning us 1062 * of a problem it had. 1063 */ 1064 cp = pcap_geterr(pc); 1065 if (status == PCAP_WARNING) 1066 warning("%s", cp); 1067 else if (status == PCAP_WARNING_PROMISC_NOTSUP && 1068 *cp != '\0') 1069 warning("%s: %s\n(%s)", device, 1070 pcap_statustostr(status), cp); 1071 else 1072 warning("%s: %s", device, 1073 pcap_statustostr(status)); 1074 } 1075 #ifdef HAVE_PCAP_SETDIRECTION 1076 if (Qflag != -1) { 1077 status = pcap_setdirection(pc, Qflag); 1078 if (status != 0) 1079 error("%s: pcap_setdirection() failed: %s", 1080 device, pcap_geterr(pc)); 1081 } 1082 #endif /* HAVE_PCAP_SETDIRECTION */ 1083 #else /* HAVE_PCAP_CREATE */ 1084 *ebuf = '\0'; 1085 pc = pcap_open_live(device, ndo->ndo_snaplen, !pflag, 1000, ebuf); 1086 if (pc == NULL) { 1087 /* 1088 * If this failed with "No such device", that means 1089 * the interface doesn't exist; return NULL, so that 1090 * the caller can see whether the device name is 1091 * actually an interface index. 1092 */ 1093 if (strstr(ebuf, "No such device") != NULL) 1094 return (NULL); 1095 error("%s", ebuf); 1096 } 1097 if (*ebuf) 1098 warning("%s", ebuf); 1099 #endif /* HAVE_PCAP_CREATE */ 1100 1101 return (pc); 1102 } 1103 1104 int 1105 main(int argc, char **argv) 1106 { 1107 register int cnt, op, i; 1108 bpf_u_int32 localnet =0 , netmask = 0; 1109 int timezone_offset = 0; 1110 register char *cp, *infile, *cmdbuf, *device, *RFileName, *VFileName, *WFileName; 1111 pcap_handler callback; 1112 int dlt; 1113 const char *dlt_name; 1114 struct bpf_program fcode; 1115 #ifndef _WIN32 1116 RETSIGTYPE (*oldhandler)(int); 1117 #endif 1118 struct dump_info dumpinfo; 1119 u_char *pcap_userdata; 1120 char ebuf[PCAP_ERRBUF_SIZE]; 1121 char VFileLine[PATH_MAX + 1]; 1122 char *username = NULL; 1123 char *chroot_dir = NULL; 1124 char *ret = NULL; 1125 char *end; 1126 #ifdef HAVE_PCAP_FINDALLDEVS 1127 pcap_if_t *devlist; 1128 long devnum; 1129 #endif 1130 int status; 1131 FILE *VFile; 1132 #ifdef HAVE_CAPSICUM 1133 cap_rights_t rights; 1134 int cansandbox; 1135 #endif /* HAVE_CAPSICUM */ 1136 int Oflag = 1; /* run filter code optimizer */ 1137 int yflag_dlt = -1; 1138 const char *yflag_dlt_name = NULL; 1139 1140 netdissect_options Ndo; 1141 netdissect_options *ndo = &Ndo; 1142 1143 /* 1144 * Initialize the netdissect code. 1145 */ 1146 if (nd_init(ebuf, sizeof ebuf) == -1) 1147 error("%s", ebuf); 1148 1149 memset(ndo, 0, sizeof(*ndo)); 1150 ndo_set_function_pointers(ndo); 1151 ndo->ndo_snaplen = DEFAULT_SNAPLEN; 1152 1153 cnt = -1; 1154 device = NULL; 1155 infile = NULL; 1156 RFileName = NULL; 1157 VFileName = NULL; 1158 VFile = NULL; 1159 WFileName = NULL; 1160 dlt = -1; 1161 if ((cp = strrchr(argv[0], '/')) != NULL) 1162 ndo->program_name = program_name = cp + 1; 1163 else 1164 ndo->program_name = program_name = argv[0]; 1165 1166 #ifdef _WIN32 1167 if (pcap_wsockinit() != 0) 1168 error("Attempting to initialize Winsock failed"); 1169 #endif /* _WIN32 */ 1170 1171 /* 1172 * On platforms where the CPU doesn't support unaligned loads, 1173 * force unaligned accesses to abort with SIGBUS, rather than 1174 * being fixed up (slowly) by the OS kernel; on those platforms, 1175 * misaligned accesses are bugs, and we want tcpdump to crash so 1176 * that the bugs are reported. 1177 */ 1178 if (abort_on_misalignment(ebuf, sizeof(ebuf)) < 0) 1179 error("%s", ebuf); 1180 1181 while ( 1182 (op = getopt_long(argc, argv, SHORTOPTS, longopts, NULL)) != -1) 1183 switch (op) { 1184 1185 case 'a': 1186 /* compatibility for old -a */ 1187 break; 1188 1189 case 'A': 1190 ++ndo->ndo_Aflag; 1191 break; 1192 1193 case 'b': 1194 ++ndo->ndo_bflag; 1195 break; 1196 1197 #if defined(HAVE_PCAP_CREATE) || defined(_WIN32) 1198 case 'B': 1199 Bflag = atoi(optarg)*1024; 1200 if (Bflag <= 0) 1201 error("invalid packet buffer size %s", optarg); 1202 break; 1203 #endif /* defined(HAVE_PCAP_CREATE) || defined(_WIN32) */ 1204 1205 case 'c': 1206 cnt = atoi(optarg); 1207 if (cnt <= 0) 1208 error("invalid packet count %s", optarg); 1209 break; 1210 1211 case 'C': 1212 Cflag = atoi(optarg) * 1000000; 1213 if (Cflag <= 0) 1214 error("invalid file size %s", optarg); 1215 break; 1216 1217 case 'd': 1218 ++dflag; 1219 break; 1220 1221 case 'D': 1222 Dflag++; 1223 break; 1224 1225 case 'L': 1226 Lflag++; 1227 break; 1228 1229 case 'e': 1230 ++ndo->ndo_eflag; 1231 break; 1232 1233 case 'E': 1234 #ifndef HAVE_LIBCRYPTO 1235 warning("crypto code not compiled in"); 1236 #endif 1237 ndo->ndo_espsecret = optarg; 1238 break; 1239 1240 case 'f': 1241 ++ndo->ndo_fflag; 1242 break; 1243 1244 case 'F': 1245 infile = optarg; 1246 break; 1247 1248 case 'G': 1249 Gflag = atoi(optarg); 1250 if (Gflag < 0) 1251 error("invalid number of seconds %s", optarg); 1252 1253 /* We will create one file initially. */ 1254 Gflag_count = 0; 1255 1256 /* Grab the current time for rotation use. */ 1257 if ((Gflag_time = time(NULL)) == (time_t)-1) { 1258 error("main: can't get current time: %s", 1259 pcap_strerror(errno)); 1260 } 1261 break; 1262 1263 case 'h': 1264 print_usage(); 1265 exit_tcpdump(0); 1266 break; 1267 1268 case 'H': 1269 ++ndo->ndo_Hflag; 1270 break; 1271 1272 case 'i': 1273 device = optarg; 1274 break; 1275 1276 #ifdef HAVE_PCAP_CREATE 1277 case 'I': 1278 ++Iflag; 1279 break; 1280 #endif /* HAVE_PCAP_CREATE */ 1281 1282 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE 1283 case 'j': 1284 jflag = pcap_tstamp_type_name_to_val(optarg); 1285 if (jflag < 0) 1286 error("invalid time stamp type %s", optarg); 1287 break; 1288 1289 case 'J': 1290 Jflag++; 1291 break; 1292 #endif 1293 1294 case 'l': 1295 #ifdef _WIN32 1296 /* 1297 * _IOLBF is the same as _IOFBF in Microsoft's C 1298 * libraries; the only alternative they offer 1299 * is _IONBF. 1300 * 1301 * XXX - this should really be checking for MSVC++, 1302 * not _WIN32, if, for example, MinGW has its own 1303 * C library that is more UNIX-compatible. 1304 */ 1305 setvbuf(stdout, NULL, _IONBF, 0); 1306 #else /* _WIN32 */ 1307 #ifdef HAVE_SETLINEBUF 1308 setlinebuf(stdout); 1309 #else 1310 setvbuf(stdout, NULL, _IOLBF, 0); 1311 #endif 1312 #endif /* _WIN32 */ 1313 break; 1314 1315 case 'K': 1316 ++ndo->ndo_Kflag; 1317 break; 1318 1319 case 'm': 1320 if (nd_have_smi_support()) { 1321 if (nd_load_smi_module(optarg, ebuf, sizeof ebuf) == -1) 1322 error("%s", ebuf); 1323 } else { 1324 (void)fprintf(stderr, "%s: ignoring option `-m %s' ", 1325 program_name, optarg); 1326 (void)fprintf(stderr, "(no libsmi support)\n"); 1327 } 1328 break; 1329 1330 case 'M': 1331 /* TCP-MD5 shared secret */ 1332 #ifndef HAVE_LIBCRYPTO 1333 warning("crypto code not compiled in"); 1334 #endif 1335 ndo->ndo_sigsecret = optarg; 1336 break; 1337 1338 case 'n': 1339 ++ndo->ndo_nflag; 1340 break; 1341 1342 case 'N': 1343 ++ndo->ndo_Nflag; 1344 break; 1345 1346 case 'O': 1347 Oflag = 0; 1348 break; 1349 1350 case 'p': 1351 ++pflag; 1352 break; 1353 1354 case 'q': 1355 ++ndo->ndo_qflag; 1356 ++ndo->ndo_suppress_default_print; 1357 break; 1358 1359 #ifdef HAVE_PCAP_SETDIRECTION 1360 case 'Q': 1361 if (ascii_strcasecmp(optarg, "in") == 0) 1362 Qflag = PCAP_D_IN; 1363 else if (ascii_strcasecmp(optarg, "out") == 0) 1364 Qflag = PCAP_D_OUT; 1365 else if (ascii_strcasecmp(optarg, "inout") == 0) 1366 Qflag = PCAP_D_INOUT; 1367 else 1368 error("unknown capture direction `%s'", optarg); 1369 break; 1370 #endif /* HAVE_PCAP_SETDIRECTION */ 1371 1372 case 'r': 1373 RFileName = optarg; 1374 break; 1375 1376 case 's': 1377 ndo->ndo_snaplen = strtol(optarg, &end, 0); 1378 if (optarg == end || *end != '\0' 1379 || ndo->ndo_snaplen < 0 || ndo->ndo_snaplen > MAXIMUM_SNAPLEN) 1380 error("invalid snaplen %s", optarg); 1381 else if (ndo->ndo_snaplen == 0) 1382 ndo->ndo_snaplen = MAXIMUM_SNAPLEN; 1383 break; 1384 1385 case 'S': 1386 ++ndo->ndo_Sflag; 1387 break; 1388 1389 case 't': 1390 ++ndo->ndo_tflag; 1391 break; 1392 1393 case 'T': 1394 if (ascii_strcasecmp(optarg, "vat") == 0) 1395 ndo->ndo_packettype = PT_VAT; 1396 else if (ascii_strcasecmp(optarg, "wb") == 0) 1397 ndo->ndo_packettype = PT_WB; 1398 else if (ascii_strcasecmp(optarg, "rpc") == 0) 1399 ndo->ndo_packettype = PT_RPC; 1400 else if (ascii_strcasecmp(optarg, "rtp") == 0) 1401 ndo->ndo_packettype = PT_RTP; 1402 else if (ascii_strcasecmp(optarg, "rtcp") == 0) 1403 ndo->ndo_packettype = PT_RTCP; 1404 else if (ascii_strcasecmp(optarg, "snmp") == 0) 1405 ndo->ndo_packettype = PT_SNMP; 1406 else if (ascii_strcasecmp(optarg, "cnfp") == 0) 1407 ndo->ndo_packettype = PT_CNFP; 1408 else if (ascii_strcasecmp(optarg, "tftp") == 0) 1409 ndo->ndo_packettype = PT_TFTP; 1410 else if (ascii_strcasecmp(optarg, "aodv") == 0) 1411 ndo->ndo_packettype = PT_AODV; 1412 else if (ascii_strcasecmp(optarg, "carp") == 0) 1413 ndo->ndo_packettype = PT_CARP; 1414 else if (ascii_strcasecmp(optarg, "radius") == 0) 1415 ndo->ndo_packettype = PT_RADIUS; 1416 else if (ascii_strcasecmp(optarg, "zmtp1") == 0) 1417 ndo->ndo_packettype = PT_ZMTP1; 1418 else if (ascii_strcasecmp(optarg, "vxlan") == 0) 1419 ndo->ndo_packettype = PT_VXLAN; 1420 else if (ascii_strcasecmp(optarg, "pgm") == 0) 1421 ndo->ndo_packettype = PT_PGM; 1422 else if (ascii_strcasecmp(optarg, "pgm_zmtp1") == 0) 1423 ndo->ndo_packettype = PT_PGM_ZMTP1; 1424 else if (ascii_strcasecmp(optarg, "lmp") == 0) 1425 ndo->ndo_packettype = PT_LMP; 1426 else if (ascii_strcasecmp(optarg, "resp") == 0) 1427 ndo->ndo_packettype = PT_RESP; 1428 else 1429 error("unknown packet type `%s'", optarg); 1430 break; 1431 1432 case 'u': 1433 ++ndo->ndo_uflag; 1434 break; 1435 1436 #ifdef HAVE_PCAP_DUMP_FLUSH 1437 case 'U': 1438 ++Uflag; 1439 break; 1440 #endif 1441 1442 case 'v': 1443 ++ndo->ndo_vflag; 1444 break; 1445 1446 case 'V': 1447 VFileName = optarg; 1448 break; 1449 1450 case 'w': 1451 WFileName = optarg; 1452 break; 1453 1454 case 'W': 1455 Wflag = atoi(optarg); 1456 if (Wflag <= 0) 1457 error("invalid number of output files %s", optarg); 1458 WflagChars = getWflagChars(Wflag); 1459 break; 1460 1461 case 'x': 1462 ++ndo->ndo_xflag; 1463 ++ndo->ndo_suppress_default_print; 1464 break; 1465 1466 case 'X': 1467 ++ndo->ndo_Xflag; 1468 ++ndo->ndo_suppress_default_print; 1469 break; 1470 1471 case 'y': 1472 yflag_dlt_name = optarg; 1473 yflag_dlt = 1474 pcap_datalink_name_to_val(yflag_dlt_name); 1475 if (yflag_dlt < 0) 1476 error("invalid data link type %s", yflag_dlt_name); 1477 break; 1478 1479 #ifdef HAVE_PCAP_SET_PARSER_DEBUG 1480 case 'Y': 1481 { 1482 /* Undocumented flag */ 1483 pcap_set_parser_debug(1); 1484 } 1485 break; 1486 #endif 1487 case 'z': 1488 zflag = optarg; 1489 break; 1490 1491 case 'Z': 1492 username = optarg; 1493 break; 1494 1495 case '#': 1496 ndo->ndo_packet_number = 1; 1497 break; 1498 1499 case OPTION_VERSION: 1500 print_version(); 1501 exit_tcpdump(0); 1502 break; 1503 1504 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION 1505 case OPTION_TSTAMP_PRECISION: 1506 ndo->ndo_tstamp_precision = tstamp_precision_from_string(optarg); 1507 if (ndo->ndo_tstamp_precision < 0) 1508 error("unsupported time stamp precision"); 1509 break; 1510 #endif 1511 1512 #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE 1513 case OPTION_IMMEDIATE_MODE: 1514 immediate_mode = 1; 1515 break; 1516 #endif 1517 1518 default: 1519 print_usage(); 1520 exit_tcpdump(1); 1521 /* NOTREACHED */ 1522 } 1523 1524 #ifdef HAVE_PCAP_FINDALLDEVS 1525 if (Dflag) 1526 show_devices_and_exit(); 1527 #endif 1528 1529 switch (ndo->ndo_tflag) { 1530 1531 case 0: /* Default */ 1532 case 4: /* Default + Date*/ 1533 timezone_offset = gmt2local(0); 1534 break; 1535 1536 case 1: /* No time stamp */ 1537 case 2: /* Unix timeval style */ 1538 case 3: /* Microseconds since previous packet */ 1539 case 5: /* Microseconds since first packet */ 1540 break; 1541 1542 default: /* Not supported */ 1543 error("only -t, -tt, -ttt, -tttt and -ttttt are supported"); 1544 break; 1545 } 1546 1547 if (ndo->ndo_fflag != 0 && (VFileName != NULL || RFileName != NULL)) 1548 error("-f can not be used with -V or -r"); 1549 1550 if (VFileName != NULL && RFileName != NULL) 1551 error("-V and -r are mutually exclusive."); 1552 1553 #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE 1554 /* 1555 * If we're printing dissected packets to the standard output 1556 * rather than saving raw packets to a file, and the standard 1557 * output is a terminal, use immediate mode, as the user's 1558 * probably expecting to see packets pop up immediately. 1559 */ 1560 if (WFileName == NULL && isatty(1)) 1561 immediate_mode = 1; 1562 #endif 1563 1564 #ifdef WITH_CHROOT 1565 /* if run as root, prepare for chrooting */ 1566 if (getuid() == 0 || geteuid() == 0) { 1567 /* future extensibility for cmd-line arguments */ 1568 if (!chroot_dir) 1569 chroot_dir = WITH_CHROOT; 1570 } 1571 #endif 1572 1573 #ifdef WITH_USER 1574 /* if run as root, prepare for dropping root privileges */ 1575 if (getuid() == 0 || geteuid() == 0) { 1576 /* Run with '-Z root' to restore old behaviour */ 1577 if (!username) 1578 username = WITH_USER; 1579 } 1580 #endif 1581 1582 if (RFileName != NULL || VFileName != NULL) { 1583 /* 1584 * If RFileName is non-null, it's the pathname of a 1585 * savefile to read. If VFileName is non-null, it's 1586 * the pathname of a file containing a list of pathnames 1587 * (one per line) of savefiles to read. 1588 * 1589 * In either case, we're reading a savefile, not doing 1590 * a live capture. 1591 */ 1592 #ifndef _WIN32 1593 /* 1594 * We don't need network access, so relinquish any set-UID 1595 * or set-GID privileges we have (if any). 1596 * 1597 * We do *not* want set-UID privileges when opening a 1598 * trace file, as that might let the user read other 1599 * people's trace files (especially if we're set-UID 1600 * root). 1601 */ 1602 if (setgid(getgid()) != 0 || setuid(getuid()) != 0 ) 1603 fprintf(stderr, "Warning: setgid/setuid failed !\n"); 1604 #endif /* _WIN32 */ 1605 if (VFileName != NULL) { 1606 if (VFileName[0] == '-' && VFileName[1] == '\0') 1607 VFile = stdin; 1608 else 1609 VFile = fopen(VFileName, "r"); 1610 1611 if (VFile == NULL) 1612 error("Unable to open file: %s\n", pcap_strerror(errno)); 1613 1614 ret = get_next_file(VFile, VFileLine); 1615 if (!ret) 1616 error("Nothing in %s\n", VFileName); 1617 RFileName = VFileLine; 1618 } 1619 1620 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION 1621 pd = pcap_open_offline_with_tstamp_precision(RFileName, 1622 ndo->ndo_tstamp_precision, ebuf); 1623 #else 1624 pd = pcap_open_offline(RFileName, ebuf); 1625 #endif 1626 1627 if (pd == NULL) 1628 error("%s", ebuf); 1629 #ifdef HAVE_CAPSICUM 1630 cap_rights_init(&rights, CAP_READ); 1631 if (cap_rights_limit(fileno(pcap_file(pd)), &rights) < 0 && 1632 errno != ENOSYS) { 1633 error("unable to limit pcap descriptor"); 1634 } 1635 #endif 1636 dlt = pcap_datalink(pd); 1637 dlt_name = pcap_datalink_val_to_name(dlt); 1638 if (dlt_name == NULL) { 1639 fprintf(stderr, "reading from file %s, link-type %u\n", 1640 RFileName, dlt); 1641 } else { 1642 fprintf(stderr, 1643 "reading from file %s, link-type %s (%s)\n", 1644 RFileName, dlt_name, 1645 pcap_datalink_val_to_description(dlt)); 1646 } 1647 } else { 1648 /* 1649 * We're doing a live capture. 1650 */ 1651 if (device == NULL) { 1652 /* 1653 * No interface was specified. Pick one. 1654 */ 1655 #ifdef HAVE_PCAP_FINDALLDEVS 1656 /* 1657 * Find the list of interfaces, and pick 1658 * the first interface. 1659 */ 1660 if (pcap_findalldevs(&devlist, ebuf) >= 0 && 1661 devlist != NULL) { 1662 device = strdup(devlist->name); 1663 pcap_freealldevs(devlist); 1664 } 1665 #else /* HAVE_PCAP_FINDALLDEVS */ 1666 /* 1667 * Use whatever interface pcap_lookupdev() 1668 * chooses. 1669 */ 1670 device = pcap_lookupdev(ebuf); 1671 #endif 1672 if (device == NULL) 1673 error("%s", ebuf); 1674 } 1675 1676 /* 1677 * Try to open the interface with the specified name. 1678 */ 1679 pd = open_interface(device, ndo, ebuf); 1680 if (pd == NULL) { 1681 /* 1682 * That failed. If we can get a list of 1683 * interfaces, and the interface name 1684 * is purely numeric, try to use it as 1685 * a 1-based index in the list of 1686 * interfaces. 1687 */ 1688 #ifdef HAVE_PCAP_FINDALLDEVS 1689 devnum = parse_interface_number(device); 1690 if (devnum == -1) { 1691 /* 1692 * It's not a number; just report 1693 * the open error and fail. 1694 */ 1695 error("%s", ebuf); 1696 } 1697 1698 /* 1699 * OK, it's a number; try to find the 1700 * interface with that index, and try 1701 * to open it. 1702 * 1703 * find_interface_by_number() exits if it 1704 * couldn't be found. 1705 */ 1706 device = find_interface_by_number(devnum); 1707 pd = open_interface(device, ndo, ebuf); 1708 if (pd == NULL) 1709 error("%s", ebuf); 1710 #else /* HAVE_PCAP_FINDALLDEVS */ 1711 /* 1712 * We can't get a list of interfaces; just 1713 * fail. 1714 */ 1715 error("%s", ebuf); 1716 #endif /* HAVE_PCAP_FINDALLDEVS */ 1717 } 1718 1719 /* 1720 * Let user own process after socket has been opened. 1721 */ 1722 #ifndef _WIN32 1723 if (setgid(getgid()) != 0 || setuid(getuid()) != 0) 1724 fprintf(stderr, "Warning: setgid/setuid failed !\n"); 1725 #endif /* _WIN32 */ 1726 #if !defined(HAVE_PCAP_CREATE) && defined(_WIN32) 1727 if(Bflag != 0) 1728 if(pcap_setbuff(pd, Bflag)==-1){ 1729 error("%s", pcap_geterr(pd)); 1730 } 1731 #endif /* !defined(HAVE_PCAP_CREATE) && defined(_WIN32) */ 1732 if (Lflag) 1733 show_dlts_and_exit(pd, device); 1734 if (yflag_dlt >= 0) { 1735 #ifdef HAVE_PCAP_SET_DATALINK 1736 if (pcap_set_datalink(pd, yflag_dlt) < 0) 1737 error("%s", pcap_geterr(pd)); 1738 #else 1739 /* 1740 * We don't actually support changing the 1741 * data link type, so we only let them 1742 * set it to what it already is. 1743 */ 1744 if (yflag_dlt != pcap_datalink(pd)) { 1745 error("%s is not one of the DLTs supported by this device\n", 1746 yflag_dlt_name); 1747 } 1748 #endif 1749 (void)fprintf(stderr, "%s: data link type %s\n", 1750 program_name, yflag_dlt_name); 1751 (void)fflush(stderr); 1752 } 1753 i = pcap_snapshot(pd); 1754 if (ndo->ndo_snaplen < i) { 1755 warning("snaplen raised from %d to %d", ndo->ndo_snaplen, i); 1756 ndo->ndo_snaplen = i; 1757 } 1758 if(ndo->ndo_fflag != 0) { 1759 if (pcap_lookupnet(device, &localnet, &netmask, ebuf) < 0) { 1760 warning("foreign (-f) flag used but: %s", ebuf); 1761 } 1762 } 1763 1764 } 1765 if (infile) 1766 cmdbuf = read_infile(infile); 1767 else 1768 cmdbuf = copy_argv(&argv[optind]); 1769 1770 #ifdef HAVE_PCAP_SET_OPTIMIZER_DEBUG 1771 pcap_set_optimizer_debug(dflag); 1772 #endif 1773 if (pcap_compile(pd, &fcode, cmdbuf, Oflag, netmask) < 0) 1774 error("%s", pcap_geterr(pd)); 1775 if (dflag) { 1776 bpf_dump(&fcode, dflag); 1777 pcap_close(pd); 1778 free(cmdbuf); 1779 pcap_freecode(&fcode); 1780 exit_tcpdump(0); 1781 } 1782 init_print(ndo, localnet, netmask, timezone_offset); 1783 1784 #ifndef _WIN32 1785 (void)setsignal(SIGPIPE, cleanup); 1786 (void)setsignal(SIGTERM, cleanup); 1787 (void)setsignal(SIGINT, cleanup); 1788 #endif /* _WIN32 */ 1789 #if defined(HAVE_FORK) || defined(HAVE_VFORK) 1790 (void)setsignal(SIGCHLD, child_cleanup); 1791 #endif 1792 /* Cooperate with nohup(1) */ 1793 #ifndef _WIN32 1794 if ((oldhandler = setsignal(SIGHUP, cleanup)) != SIG_DFL) 1795 (void)setsignal(SIGHUP, oldhandler); 1796 #endif /* _WIN32 */ 1797 1798 #ifndef _WIN32 1799 /* 1800 * If a user name was specified with "-Z", attempt to switch to 1801 * that user's UID. This would probably be used with sudo, 1802 * to allow tcpdump to be run in a special restricted 1803 * account (if you just want to allow users to open capture 1804 * devices, and can't just give users that permission, 1805 * you'd make tcpdump set-UID or set-GID). 1806 * 1807 * Tcpdump doesn't necessarily write only to one savefile; 1808 * the general only way to allow a -Z instance to write to 1809 * savefiles as the user under whose UID it's run, rather 1810 * than as the user specified with -Z, would thus be to switch 1811 * to the original user ID before opening a capture file and 1812 * then switch back to the -Z user ID after opening the savefile. 1813 * Switching to the -Z user ID only after opening the first 1814 * savefile doesn't handle the general case. 1815 */ 1816 1817 if (getuid() == 0 || geteuid() == 0) { 1818 #ifdef HAVE_LIBCAP_NG 1819 /* Initialize capng */ 1820 capng_clear(CAPNG_SELECT_BOTH); 1821 if (username) { 1822 capng_updatev( 1823 CAPNG_ADD, 1824 CAPNG_PERMITTED | CAPNG_EFFECTIVE, 1825 CAP_SETUID, 1826 CAP_SETGID, 1827 -1); 1828 } 1829 if (chroot_dir) { 1830 capng_update( 1831 CAPNG_ADD, 1832 CAPNG_PERMITTED | CAPNG_EFFECTIVE, 1833 CAP_SYS_CHROOT 1834 ); 1835 } 1836 1837 if (WFileName) { 1838 capng_update( 1839 CAPNG_ADD, 1840 CAPNG_PERMITTED | CAPNG_EFFECTIVE, 1841 CAP_DAC_OVERRIDE 1842 ); 1843 } 1844 capng_apply(CAPNG_SELECT_BOTH); 1845 #endif /* HAVE_LIBCAP_NG */ 1846 if (username || chroot_dir) 1847 droproot(username, chroot_dir); 1848 1849 } 1850 #endif /* _WIN32 */ 1851 1852 if (pcap_setfilter(pd, &fcode) < 0) 1853 error("%s", pcap_geterr(pd)); 1854 #ifdef HAVE_CAPSICUM 1855 if (RFileName == NULL && VFileName == NULL) { 1856 static const unsigned long cmds[] = { BIOCGSTATS, BIOCROTZBUF }; 1857 1858 cap_rights_init(&rights, CAP_IOCTL, CAP_READ); 1859 if (cap_rights_limit(pcap_fileno(pd), &rights) < 0 && 1860 errno != ENOSYS) { 1861 error("unable to limit pcap descriptor"); 1862 } 1863 if (cap_ioctls_limit(pcap_fileno(pd), cmds, 1864 sizeof(cmds) / sizeof(cmds[0])) < 0 && errno != ENOSYS) { 1865 error("unable to limit ioctls on pcap descriptor"); 1866 } 1867 } 1868 #endif 1869 if (WFileName) { 1870 pcap_dumper_t *p; 1871 /* Do not exceed the default PATH_MAX for files. */ 1872 dumpinfo.CurrentFileName = (char *)malloc(PATH_MAX + 1); 1873 1874 if (dumpinfo.CurrentFileName == NULL) 1875 error("malloc of dumpinfo.CurrentFileName"); 1876 1877 /* We do not need numbering for dumpfiles if Cflag isn't set. */ 1878 if (Cflag != 0) 1879 MakeFilename(dumpinfo.CurrentFileName, WFileName, 0, WflagChars); 1880 else 1881 MakeFilename(dumpinfo.CurrentFileName, WFileName, 0, 0); 1882 1883 p = pcap_dump_open(pd, dumpinfo.CurrentFileName); 1884 #ifdef HAVE_LIBCAP_NG 1885 /* Give up CAP_DAC_OVERRIDE capability. 1886 * Only allow it to be restored if the -C or -G flag have been 1887 * set since we may need to create more files later on. 1888 */ 1889 capng_update( 1890 CAPNG_DROP, 1891 (Cflag || Gflag ? 0 : CAPNG_PERMITTED) 1892 | CAPNG_EFFECTIVE, 1893 CAP_DAC_OVERRIDE 1894 ); 1895 capng_apply(CAPNG_SELECT_BOTH); 1896 #endif /* HAVE_LIBCAP_NG */ 1897 if (p == NULL) 1898 error("%s", pcap_geterr(pd)); 1899 #ifdef HAVE_CAPSICUM 1900 set_dumper_capsicum_rights(p); 1901 #endif 1902 if (Cflag != 0 || Gflag != 0) { 1903 #ifdef HAVE_CAPSICUM 1904 dumpinfo.WFileName = strdup(basename(WFileName)); 1905 if (dumpinfo.WFileName == NULL) { 1906 error("Unable to allocate memory for file %s", 1907 WFileName); 1908 } 1909 dumpinfo.dirfd = open(dirname(WFileName), 1910 O_DIRECTORY | O_RDONLY); 1911 if (dumpinfo.dirfd < 0) { 1912 error("unable to open directory %s", 1913 dirname(WFileName)); 1914 } 1915 cap_rights_init(&rights, CAP_CREATE, CAP_FCNTL, 1916 CAP_FTRUNCATE, CAP_LOOKUP, CAP_SEEK, CAP_WRITE); 1917 if (cap_rights_limit(dumpinfo.dirfd, &rights) < 0 && 1918 errno != ENOSYS) { 1919 error("unable to limit directory rights"); 1920 } 1921 if (cap_fcntls_limit(dumpinfo.dirfd, CAP_FCNTL_GETFL) < 0 && 1922 errno != ENOSYS) { 1923 error("unable to limit dump descriptor fcntls"); 1924 } 1925 #else /* !HAVE_CAPSICUM */ 1926 dumpinfo.WFileName = WFileName; 1927 #endif 1928 callback = dump_packet_and_trunc; 1929 dumpinfo.pd = pd; 1930 dumpinfo.p = p; 1931 pcap_userdata = (u_char *)&dumpinfo; 1932 } else { 1933 callback = dump_packet; 1934 pcap_userdata = (u_char *)p; 1935 } 1936 #ifdef HAVE_PCAP_DUMP_FLUSH 1937 if (Uflag) 1938 pcap_dump_flush(p); 1939 #endif 1940 } else { 1941 dlt = pcap_datalink(pd); 1942 ndo->ndo_if_printer = get_if_printer(ndo, dlt); 1943 callback = print_packet; 1944 pcap_userdata = (u_char *)ndo; 1945 } 1946 1947 #ifdef SIGNAL_REQ_INFO 1948 /* 1949 * We can't get statistics when reading from a file rather 1950 * than capturing from a device. 1951 */ 1952 if (RFileName == NULL) 1953 (void)setsignal(SIGNAL_REQ_INFO, requestinfo); 1954 #endif 1955 1956 if (ndo->ndo_vflag > 0 && WFileName) { 1957 /* 1958 * When capturing to a file, "-v" means tcpdump should, 1959 * every 10 seconds, "v"erbosely report the number of 1960 * packets captured. 1961 */ 1962 #ifdef USE_WIN32_MM_TIMER 1963 /* call verbose_stats_dump() each 1000 +/-100msec */ 1964 timer_id = timeSetEvent(1000, 100, verbose_stats_dump, 0, TIME_PERIODIC); 1965 setvbuf(stderr, NULL, _IONBF, 0); 1966 #elif defined(HAVE_ALARM) 1967 (void)setsignal(SIGALRM, verbose_stats_dump); 1968 alarm(1); 1969 #endif 1970 } 1971 1972 if (RFileName == NULL) { 1973 /* 1974 * Live capture (if -V was specified, we set RFileName 1975 * to a file from the -V file). Print a message to 1976 * the standard error on UN*X. 1977 */ 1978 if (!ndo->ndo_vflag && !WFileName) { 1979 (void)fprintf(stderr, 1980 "%s: verbose output suppressed, use -v or -vv for full protocol decode\n", 1981 program_name); 1982 } else 1983 (void)fprintf(stderr, "%s: ", program_name); 1984 dlt = pcap_datalink(pd); 1985 dlt_name = pcap_datalink_val_to_name(dlt); 1986 if (dlt_name == NULL) { 1987 (void)fprintf(stderr, "listening on %s, link-type %u, capture size %u bytes\n", 1988 device, dlt, ndo->ndo_snaplen); 1989 } else { 1990 (void)fprintf(stderr, "listening on %s, link-type %s (%s), capture size %u bytes\n", 1991 device, dlt_name, 1992 pcap_datalink_val_to_description(dlt), ndo->ndo_snaplen); 1993 } 1994 (void)fflush(stderr); 1995 } 1996 1997 #ifdef HAVE_CAPSICUM 1998 cansandbox = (ndo->ndo_nflag && VFileName == NULL && zflag == NULL); 1999 if (cansandbox && cap_enter() < 0 && errno != ENOSYS) 2000 error("unable to enter the capability mode"); 2001 #endif /* HAVE_CAPSICUM */ 2002 2003 do { 2004 status = pcap_loop(pd, cnt, callback, pcap_userdata); 2005 if (WFileName == NULL) { 2006 /* 2007 * We're printing packets. Flush the printed output, 2008 * so it doesn't get intermingled with error output. 2009 */ 2010 if (status == -2) { 2011 /* 2012 * We got interrupted, so perhaps we didn't 2013 * manage to finish a line we were printing. 2014 * Print an extra newline, just in case. 2015 */ 2016 putchar('\n'); 2017 } 2018 (void)fflush(stdout); 2019 } 2020 if (status == -2) { 2021 /* 2022 * We got interrupted. If we are reading multiple 2023 * files (via -V) set these so that we stop. 2024 */ 2025 VFileName = NULL; 2026 ret = NULL; 2027 } 2028 if (status == -1) { 2029 /* 2030 * Error. Report it. 2031 */ 2032 (void)fprintf(stderr, "%s: pcap_loop: %s\n", 2033 program_name, pcap_geterr(pd)); 2034 } 2035 if (RFileName == NULL) { 2036 /* 2037 * We're doing a live capture. Report the capture 2038 * statistics. 2039 */ 2040 info(1); 2041 } 2042 pcap_close(pd); 2043 if (VFileName != NULL) { 2044 ret = get_next_file(VFile, VFileLine); 2045 if (ret) { 2046 int new_dlt; 2047 2048 RFileName = VFileLine; 2049 pd = pcap_open_offline(RFileName, ebuf); 2050 if (pd == NULL) 2051 error("%s", ebuf); 2052 #ifdef HAVE_CAPSICUM 2053 cap_rights_init(&rights, CAP_READ); 2054 if (cap_rights_limit(fileno(pcap_file(pd)), 2055 &rights) < 0 && errno != ENOSYS) { 2056 error("unable to limit pcap descriptor"); 2057 } 2058 #endif 2059 new_dlt = pcap_datalink(pd); 2060 if (new_dlt != dlt) { 2061 /* 2062 * The new file has a different 2063 * link-layer header type from the 2064 * previous one. 2065 */ 2066 if (WFileName != NULL) { 2067 /* 2068 * We're writing raw packets 2069 * that match the filter to 2070 * a pcap file. pcap files 2071 * don't support multiple 2072 * different link-layer 2073 * header types, so we fail 2074 * here. 2075 */ 2076 error("%s: new dlt does not match original", RFileName); 2077 } 2078 2079 /* 2080 * We're printing the decoded packets; 2081 * switch to the new DLT. 2082 * 2083 * To do that, we need to change 2084 * the printer, change the DLT name, 2085 * and recompile the filter with 2086 * the new DLT. 2087 */ 2088 dlt = new_dlt; 2089 ndo->ndo_if_printer = get_if_printer(ndo, dlt); 2090 if (pcap_compile(pd, &fcode, cmdbuf, Oflag, netmask) < 0) 2091 error("%s", pcap_geterr(pd)); 2092 } 2093 2094 /* 2095 * Set the filter on the new file. 2096 */ 2097 if (pcap_setfilter(pd, &fcode) < 0) 2098 error("%s", pcap_geterr(pd)); 2099 2100 /* 2101 * Report the new file. 2102 */ 2103 dlt_name = pcap_datalink_val_to_name(dlt); 2104 if (dlt_name == NULL) { 2105 fprintf(stderr, "reading from file %s, link-type %u\n", 2106 RFileName, dlt); 2107 } else { 2108 fprintf(stderr, 2109 "reading from file %s, link-type %s (%s)\n", 2110 RFileName, dlt_name, 2111 pcap_datalink_val_to_description(dlt)); 2112 } 2113 } 2114 } 2115 } 2116 while (ret != NULL); 2117 2118 free(cmdbuf); 2119 pcap_freecode(&fcode); 2120 exit_tcpdump(status == -1 ? 1 : 0); 2121 } 2122 2123 /* make a clean exit on interrupts */ 2124 static RETSIGTYPE 2125 cleanup(int signo _U_) 2126 { 2127 #ifdef USE_WIN32_MM_TIMER 2128 if (timer_id) 2129 timeKillEvent(timer_id); 2130 timer_id = 0; 2131 #elif defined(HAVE_ALARM) 2132 alarm(0); 2133 #endif 2134 2135 #ifdef HAVE_PCAP_BREAKLOOP 2136 /* 2137 * We have "pcap_breakloop()"; use it, so that we do as little 2138 * as possible in the signal handler (it's probably not safe 2139 * to do anything with standard I/O streams in a signal handler - 2140 * the ANSI C standard doesn't say it is). 2141 */ 2142 pcap_breakloop(pd); 2143 #else 2144 /* 2145 * We don't have "pcap_breakloop()"; this isn't safe, but 2146 * it's the best we can do. Print the summary if we're 2147 * not reading from a savefile - i.e., if we're doing a 2148 * live capture - and exit. 2149 */ 2150 if (pd != NULL && pcap_file(pd) == NULL) { 2151 /* 2152 * We got interrupted, so perhaps we didn't 2153 * manage to finish a line we were printing. 2154 * Print an extra newline, just in case. 2155 */ 2156 putchar('\n'); 2157 (void)fflush(stdout); 2158 info(1); 2159 } 2160 exit_tcpdump(0); 2161 #endif 2162 } 2163 2164 /* 2165 On windows, we do not use a fork, so we do not care less about 2166 waiting a child processes to die 2167 */ 2168 #if defined(HAVE_FORK) || defined(HAVE_VFORK) 2169 static RETSIGTYPE 2170 child_cleanup(int signo _U_) 2171 { 2172 wait(NULL); 2173 } 2174 #endif /* HAVE_FORK && HAVE_VFORK */ 2175 2176 static void 2177 info(register int verbose) 2178 { 2179 struct pcap_stat stats; 2180 2181 /* 2182 * Older versions of libpcap didn't set ps_ifdrop on some 2183 * platforms; initialize it to 0 to handle that. 2184 */ 2185 stats.ps_ifdrop = 0; 2186 if (pcap_stats(pd, &stats) < 0) { 2187 (void)fprintf(stderr, "pcap_stats: %s\n", pcap_geterr(pd)); 2188 infoprint = 0; 2189 return; 2190 } 2191 2192 if (!verbose) 2193 fprintf(stderr, "%s: ", program_name); 2194 2195 (void)fprintf(stderr, "%u packet%s captured", packets_captured, 2196 PLURAL_SUFFIX(packets_captured)); 2197 if (!verbose) 2198 fputs(", ", stderr); 2199 else 2200 putc('\n', stderr); 2201 (void)fprintf(stderr, "%u packet%s received by filter", stats.ps_recv, 2202 PLURAL_SUFFIX(stats.ps_recv)); 2203 if (!verbose) 2204 fputs(", ", stderr); 2205 else 2206 putc('\n', stderr); 2207 (void)fprintf(stderr, "%u packet%s dropped by kernel", stats.ps_drop, 2208 PLURAL_SUFFIX(stats.ps_drop)); 2209 if (stats.ps_ifdrop != 0) { 2210 if (!verbose) 2211 fputs(", ", stderr); 2212 else 2213 putc('\n', stderr); 2214 (void)fprintf(stderr, "%u packet%s dropped by interface\n", 2215 stats.ps_ifdrop, PLURAL_SUFFIX(stats.ps_ifdrop)); 2216 } else 2217 putc('\n', stderr); 2218 infoprint = 0; 2219 } 2220 2221 #if defined(HAVE_FORK) || defined(HAVE_VFORK) 2222 #ifdef HAVE_FORK 2223 #define fork_subprocess() fork() 2224 #else 2225 #define fork_subprocess() vfork() 2226 #endif 2227 static void 2228 compress_savefile(const char *filename) 2229 { 2230 pid_t child; 2231 2232 child = fork_subprocess(); 2233 if (child == -1) { 2234 fprintf(stderr, 2235 "compress_savefile: fork failed: %s\n", 2236 pcap_strerror(errno)); 2237 return; 2238 } 2239 if (child != 0) { 2240 /* Parent process. */ 2241 return; 2242 } 2243 2244 /* 2245 * Child process. 2246 * Set to lowest priority so that this doesn't disturb the capture. 2247 */ 2248 #ifdef NZERO 2249 setpriority(PRIO_PROCESS, 0, NZERO - 1); 2250 #else 2251 setpriority(PRIO_PROCESS, 0, 19); 2252 #endif 2253 if (execlp(zflag, zflag, filename, (char *)NULL) == -1) 2254 fprintf(stderr, 2255 "compress_savefile: execlp(%s, %s) failed: %s\n", 2256 zflag, 2257 filename, 2258 pcap_strerror(errno)); 2259 #ifdef HAVE_FORK 2260 exit(1); 2261 #else 2262 _exit(1); 2263 #endif 2264 } 2265 #else /* HAVE_FORK && HAVE_VFORK */ 2266 static void 2267 compress_savefile(const char *filename) 2268 { 2269 fprintf(stderr, 2270 "compress_savefile failed. Functionality not implemented under your system\n"); 2271 } 2272 #endif /* HAVE_FORK && HAVE_VFORK */ 2273 2274 static void 2275 dump_packet_and_trunc(u_char *user, const struct pcap_pkthdr *h, const u_char *sp) 2276 { 2277 struct dump_info *dump_info; 2278 2279 ++packets_captured; 2280 2281 ++infodelay; 2282 2283 dump_info = (struct dump_info *)user; 2284 2285 /* 2286 * XXX - this won't force the file to rotate on the specified time 2287 * boundary, but it will rotate on the first packet received after the 2288 * specified Gflag number of seconds. Note: if a Gflag time boundary 2289 * and a Cflag size boundary coincide, the time rotation will occur 2290 * first thereby cancelling the Cflag boundary (since the file should 2291 * be 0). 2292 */ 2293 if (Gflag != 0) { 2294 /* Check if it is time to rotate */ 2295 time_t t; 2296 2297 /* Get the current time */ 2298 if ((t = time(NULL)) == (time_t)-1) { 2299 error("dump_and_trunc_packet: can't get current_time: %s", 2300 pcap_strerror(errno)); 2301 } 2302 2303 2304 /* If the time is greater than the specified window, rotate */ 2305 if (t - Gflag_time >= Gflag) { 2306 #ifdef HAVE_CAPSICUM 2307 FILE *fp; 2308 int fd; 2309 #endif 2310 2311 /* Update the Gflag_time */ 2312 Gflag_time = t; 2313 /* Update Gflag_count */ 2314 Gflag_count++; 2315 /* 2316 * Close the current file and open a new one. 2317 */ 2318 pcap_dump_close(dump_info->p); 2319 2320 /* 2321 * Compress the file we just closed, if the user asked for it 2322 */ 2323 if (zflag != NULL) 2324 compress_savefile(dump_info->CurrentFileName); 2325 2326 /* 2327 * Check to see if we've exceeded the Wflag (when 2328 * not using Cflag). 2329 */ 2330 if (Cflag == 0 && Wflag > 0 && Gflag_count >= Wflag) { 2331 (void)fprintf(stderr, "Maximum file limit reached: %d\n", 2332 Wflag); 2333 info(1); 2334 exit_tcpdump(0); 2335 /* NOTREACHED */ 2336 } 2337 if (dump_info->CurrentFileName != NULL) 2338 free(dump_info->CurrentFileName); 2339 /* Allocate space for max filename + \0. */ 2340 dump_info->CurrentFileName = (char *)malloc(PATH_MAX + 1); 2341 if (dump_info->CurrentFileName == NULL) 2342 error("dump_packet_and_trunc: malloc"); 2343 /* 2344 * Gflag was set otherwise we wouldn't be here. Reset the count 2345 * so multiple files would end with 1,2,3 in the filename. 2346 * The counting is handled with the -C flow after this. 2347 */ 2348 Cflag_count = 0; 2349 2350 /* 2351 * This is always the first file in the Cflag 2352 * rotation: e.g. 0 2353 * We also don't need numbering if Cflag is not set. 2354 */ 2355 if (Cflag != 0) 2356 MakeFilename(dump_info->CurrentFileName, dump_info->WFileName, 0, 2357 WflagChars); 2358 else 2359 MakeFilename(dump_info->CurrentFileName, dump_info->WFileName, 0, 0); 2360 2361 #ifdef HAVE_LIBCAP_NG 2362 capng_update(CAPNG_ADD, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE); 2363 capng_apply(CAPNG_SELECT_BOTH); 2364 #endif /* HAVE_LIBCAP_NG */ 2365 #ifdef HAVE_CAPSICUM 2366 fd = openat(dump_info->dirfd, 2367 dump_info->CurrentFileName, 2368 O_CREAT | O_WRONLY | O_TRUNC, 0644); 2369 if (fd < 0) { 2370 error("unable to open file %s", 2371 dump_info->CurrentFileName); 2372 } 2373 fp = fdopen(fd, "w"); 2374 if (fp == NULL) { 2375 error("unable to fdopen file %s", 2376 dump_info->CurrentFileName); 2377 } 2378 dump_info->p = pcap_dump_fopen(dump_info->pd, fp); 2379 #else /* !HAVE_CAPSICUM */ 2380 dump_info->p = pcap_dump_open(dump_info->pd, dump_info->CurrentFileName); 2381 #endif 2382 #ifdef HAVE_LIBCAP_NG 2383 capng_update(CAPNG_DROP, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE); 2384 capng_apply(CAPNG_SELECT_BOTH); 2385 #endif /* HAVE_LIBCAP_NG */ 2386 if (dump_info->p == NULL) 2387 error("%s", pcap_geterr(pd)); 2388 #ifdef HAVE_CAPSICUM 2389 set_dumper_capsicum_rights(dump_info->p); 2390 #endif 2391 } 2392 } 2393 2394 /* 2395 * XXX - this won't prevent capture files from getting 2396 * larger than Cflag - the last packet written to the 2397 * file could put it over Cflag. 2398 */ 2399 if (Cflag != 0) { 2400 long size = pcap_dump_ftell(dump_info->p); 2401 2402 if (size == -1) 2403 error("ftell fails on output file"); 2404 if (size > Cflag) { 2405 #ifdef HAVE_CAPSICUM 2406 FILE *fp; 2407 int fd; 2408 #endif 2409 2410 /* 2411 * Close the current file and open a new one. 2412 */ 2413 pcap_dump_close(dump_info->p); 2414 2415 /* 2416 * Compress the file we just closed, if the user 2417 * asked for it. 2418 */ 2419 if (zflag != NULL) 2420 compress_savefile(dump_info->CurrentFileName); 2421 2422 Cflag_count++; 2423 if (Wflag > 0) { 2424 if (Cflag_count >= Wflag) 2425 Cflag_count = 0; 2426 } 2427 if (dump_info->CurrentFileName != NULL) 2428 free(dump_info->CurrentFileName); 2429 dump_info->CurrentFileName = (char *)malloc(PATH_MAX + 1); 2430 if (dump_info->CurrentFileName == NULL) 2431 error("dump_packet_and_trunc: malloc"); 2432 MakeFilename(dump_info->CurrentFileName, dump_info->WFileName, Cflag_count, WflagChars); 2433 #ifdef HAVE_LIBCAP_NG 2434 capng_update(CAPNG_ADD, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE); 2435 capng_apply(CAPNG_SELECT_BOTH); 2436 #endif /* HAVE_LIBCAP_NG */ 2437 #ifdef HAVE_CAPSICUM 2438 fd = openat(dump_info->dirfd, dump_info->CurrentFileName, 2439 O_CREAT | O_WRONLY | O_TRUNC, 0644); 2440 if (fd < 0) { 2441 error("unable to open file %s", 2442 dump_info->CurrentFileName); 2443 } 2444 fp = fdopen(fd, "w"); 2445 if (fp == NULL) { 2446 error("unable to fdopen file %s", 2447 dump_info->CurrentFileName); 2448 } 2449 dump_info->p = pcap_dump_fopen(dump_info->pd, fp); 2450 #else /* !HAVE_CAPSICUM */ 2451 dump_info->p = pcap_dump_open(dump_info->pd, dump_info->CurrentFileName); 2452 #endif 2453 #ifdef HAVE_LIBCAP_NG 2454 capng_update(CAPNG_DROP, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE); 2455 capng_apply(CAPNG_SELECT_BOTH); 2456 #endif /* HAVE_LIBCAP_NG */ 2457 if (dump_info->p == NULL) 2458 error("%s", pcap_geterr(pd)); 2459 #ifdef HAVE_CAPSICUM 2460 set_dumper_capsicum_rights(dump_info->p); 2461 #endif 2462 } 2463 } 2464 2465 pcap_dump((u_char *)dump_info->p, h, sp); 2466 #ifdef HAVE_PCAP_DUMP_FLUSH 2467 if (Uflag) 2468 pcap_dump_flush(dump_info->p); 2469 #endif 2470 2471 --infodelay; 2472 if (infoprint) 2473 info(0); 2474 } 2475 2476 static void 2477 dump_packet(u_char *user, const struct pcap_pkthdr *h, const u_char *sp) 2478 { 2479 ++packets_captured; 2480 2481 ++infodelay; 2482 2483 pcap_dump(user, h, sp); 2484 #ifdef HAVE_PCAP_DUMP_FLUSH 2485 if (Uflag) 2486 pcap_dump_flush((pcap_dumper_t *)user); 2487 #endif 2488 2489 --infodelay; 2490 if (infoprint) 2491 info(0); 2492 } 2493 2494 static void 2495 print_packet(u_char *user, const struct pcap_pkthdr *h, const u_char *sp) 2496 { 2497 ++packets_captured; 2498 2499 ++infodelay; 2500 2501 pretty_print_packet((netdissect_options *)user, h, sp, packets_captured); 2502 2503 --infodelay; 2504 if (infoprint) 2505 info(0); 2506 } 2507 2508 #ifdef _WIN32 2509 /* 2510 * XXX - there should really be libpcap calls to get the version 2511 * number as a string (the string would be generated from #defines 2512 * at run time, so that it's not generated from string constants 2513 * in the library, as, on many UNIX systems, those constants would 2514 * be statically linked into the application executable image, and 2515 * would thus reflect the version of libpcap on the system on 2516 * which the application was *linked*, not the system on which it's 2517 * *running*. 2518 * 2519 * That routine should be documented, unlike the "version[]" 2520 * string, so that UNIX vendors providing their own libpcaps 2521 * don't omit it (as a couple of vendors have...). 2522 * 2523 * Packet.dll should perhaps also export a routine to return the 2524 * version number of the Packet.dll code, to supply the 2525 * "Wpcap_version" information on Windows. 2526 */ 2527 char WDversion[]="current-git.tcpdump.org"; 2528 #if !defined(HAVE_GENERATED_VERSION) 2529 char version[]="current-git.tcpdump.org"; 2530 #endif 2531 char pcap_version[]="current-git.tcpdump.org"; 2532 char Wpcap_version[]="3.1"; 2533 #endif 2534 2535 #ifdef SIGNAL_REQ_INFO 2536 RETSIGTYPE requestinfo(int signo _U_) 2537 { 2538 if (infodelay) 2539 ++infoprint; 2540 else 2541 info(0); 2542 } 2543 #endif 2544 2545 /* 2546 * Called once each second in verbose mode while dumping to file 2547 */ 2548 #ifdef USE_WIN32_MM_TIMER 2549 void CALLBACK verbose_stats_dump (UINT timer_id _U_, UINT msg _U_, DWORD_PTR arg _U_, 2550 DWORD_PTR dw1 _U_, DWORD_PTR dw2 _U_) 2551 { 2552 if (infodelay == 0) 2553 fprintf(stderr, "Got %u\r", packets_captured); 2554 } 2555 #elif defined(HAVE_ALARM) 2556 static void verbose_stats_dump(int sig _U_) 2557 { 2558 if (infodelay == 0) 2559 fprintf(stderr, "Got %u\r", packets_captured); 2560 alarm(1); 2561 } 2562 #endif 2563 2564 USES_APPLE_DEPRECATED_API 2565 static void 2566 print_version(void) 2567 { 2568 extern char version[]; 2569 #ifndef HAVE_PCAP_LIB_VERSION 2570 #if defined(_WIN32) || defined(HAVE_PCAP_VERSION) 2571 extern char pcap_version[]; 2572 #else /* defined(_WIN32) || defined(HAVE_PCAP_VERSION) */ 2573 static char pcap_version[] = "unknown"; 2574 #endif /* defined(_WIN32) || defined(HAVE_PCAP_VERSION) */ 2575 #endif /* HAVE_PCAP_LIB_VERSION */ 2576 const char *smi_version_string; 2577 2578 #ifdef HAVE_PCAP_LIB_VERSION 2579 #ifdef _WIN32 2580 (void)fprintf(stderr, "%s version %s, based on tcpdump version %s\n", program_name, WDversion, version); 2581 #else /* _WIN32 */ 2582 (void)fprintf(stderr, "%s version %s\n", program_name, version); 2583 #endif /* _WIN32 */ 2584 (void)fprintf(stderr, "%s\n",pcap_lib_version()); 2585 #else /* HAVE_PCAP_LIB_VERSION */ 2586 #ifdef _WIN32 2587 (void)fprintf(stderr, "%s version %s, based on tcpdump version %s\n", program_name, WDversion, version); 2588 (void)fprintf(stderr, "WinPcap version %s, based on libpcap version %s\n",Wpcap_version, pcap_version); 2589 #else /* _WIN32 */ 2590 (void)fprintf(stderr, "%s version %s\n", program_name, version); 2591 (void)fprintf(stderr, "libpcap version %s\n", pcap_version); 2592 #endif /* _WIN32 */ 2593 #endif /* HAVE_PCAP_LIB_VERSION */ 2594 2595 #if defined(HAVE_LIBCRYPTO) && defined(SSLEAY_VERSION) 2596 (void)fprintf (stderr, "%s\n", SSLeay_version(SSLEAY_VERSION)); 2597 #endif 2598 2599 smi_version_string = nd_smi_version_string(); 2600 if (smi_version_string != NULL) 2601 (void)fprintf (stderr, "SMI-library: %s\n", smi_version_string); 2602 } 2603 USES_APPLE_RST 2604 2605 static void 2606 print_usage(void) 2607 { 2608 print_version(); 2609 (void)fprintf(stderr, 2610 "Usage: %s [-aAbd" D_FLAG "efhH" I_FLAG J_FLAG "KlLnNOpqStu" U_FLAG "vxX#]" B_FLAG_USAGE " [ -c count ]\n", program_name); 2611 (void)fprintf(stderr, 2612 "\t\t[ -C file_size ] [ -E algo:secret ] [ -F file ] [ -G seconds ]\n"); 2613 (void)fprintf(stderr, 2614 "\t\t[ -i interface ]" j_FLAG_USAGE " [ -M secret ] [ --number ]\n"); 2615 #ifdef HAVE_PCAP_SETDIRECTION 2616 (void)fprintf(stderr, 2617 "\t\t[ -Q in|out|inout ]\n"); 2618 #endif 2619 (void)fprintf(stderr, 2620 "\t\t[ -r file ] [ -s snaplen ] "); 2621 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION 2622 (void)fprintf(stderr, "[ --time-stamp-precision precision ]\n"); 2623 (void)fprintf(stderr, 2624 "\t\t"); 2625 #endif 2626 #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE 2627 (void)fprintf(stderr, "[ --immediate-mode ] "); 2628 #endif 2629 (void)fprintf(stderr, "[ -T type ] [ --version ] [ -V file ]\n"); 2630 (void)fprintf(stderr, 2631 "\t\t[ -w file ] [ -W filecount ] [ -y datalinktype ] [ -z postrotate-command ]\n"); 2632 (void)fprintf(stderr, 2633 "\t\t[ -Z user ] [ expression ]\n"); 2634 } 2635 /* 2636 * Local Variables: 2637 * c-style: whitesmith 2638 * c-basic-offset: 8 2639 * End: 2640 */ 2641
