1 /*
2 * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000
3 * The Regents of the University of California. All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
16 * written permission.
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
20 *
21 * Support for splitting captures into multiple files with a maximum
22 * file size:
23 *
24 * Copyright (c) 2001
25 * Seth Webster <swebster@sst.ll.mit.edu>
26 */
27
28 /*
29 * tcpdump - dump traffic on a network
30 *
31 * First written in 1987 by Van Jacobson, Lawrence Berkeley Laboratory.
32 * Mercilessly hacked and occasionally improved since then via the
33 * combined efforts of Van, Steve McCanne and Craig Leres of LBL.
34 */
35
36 #ifdef HAVE_CONFIG_H
37 #include <config.h>
38 #endif
39
40 /*
41 * Some older versions of Mac OS X may ship pcap.h from libpcap 0.6 with a
42 * libpcap based on 0.8. That means it has pcap_findalldevs() but the
43 * header doesn't define pcap_if_t, meaning that we can't actually *use*
44 * pcap_findalldevs().
45 */
46 #ifdef HAVE_PCAP_FINDALLDEVS
47 #ifndef HAVE_PCAP_IF_T
48 #undef HAVE_PCAP_FINDALLDEVS
49 #endif
50 #endif
51
52 #include "netdissect-stdinc.h"
53
54 /*
55 * This must appear after including netdissect-stdinc.h, so that _U_ is
56 * defined.
57 */
58 #ifndef lint
59 static const char copyright[] _U_ =
60 "@(#) Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000\n\
61 The Regents of the University of California. All rights reserved.\n";
62 #endif
63
64 #include <sys/stat.h>
65
66 #ifdef HAVE_FCNTL_H
67 #include <fcntl.h>
68 #endif
69
70 #ifdef HAVE_LIBCRYPTO
71 #include <openssl/crypto.h>
72 #endif
73
74 #ifdef HAVE_GETOPT_LONG
75 #include <getopt.h>
76 #else
77 #include "missing/getopt_long.h"
78 #endif
79 /* Capsicum-specific code requires macros from <net/bpf.h>, which will fail
80 * to compile if <pcap.h> has already been included; including the headers
81 * in the opposite order works fine.
82 */
83 #ifdef HAVE_CAPSICUM
84 #include <sys/capsicum.h>
85 #include <sys/ioccom.h>
86 #include <net/bpf.h>
87 #include <libgen.h>
88 #ifdef HAVE_CASPER
89 #include <libcasper.h>
90 #include <casper/cap_dns.h>
91 #include <sys/nv.h>
92 #endif /* HAVE_CASPER */
93 #endif /* HAVE_CAPSICUM */
94 #ifdef HAVE_PCAP_OPEN
95 /*
96 * We found pcap_open() in the capture library, so we'll be using
97 * the remote capture APIs; define PCAP_REMOTE before we include pcap.h,
98 * so we get those APIs declared, and the types and #defines that they
99 * use defined.
100 *
101 * WinPcap's headers require that PCAP_REMOTE be defined in order to get
102 * remote-capture APIs declared and types and #defines that they use
103 * defined.
104 *
105 * (Versions of libpcap with those APIs, and thus Npcap, which is based on
106 * those versions of libpcap, don't require it.)
107 */
108 #define HAVE_REMOTE
109 #endif
110 #include <pcap.h>
111 #include <signal.h>
112 #include <stdio.h>
113 #include <stdarg.h>
114 #include <stdlib.h>
115 #include <string.h>
116 #include <limits.h>
117 #ifdef _WIN32
118 #include <windows.h>
119 #else
120 #include <sys/time.h>
121 #include <sys/wait.h>
122 #include <sys/resource.h>
123 #include <pwd.h>
124 #include <grp.h>
125 #endif /* _WIN32 */
126
127 /*
128 * Pathname separator.
129 * Use this in pathnames, but do *not* use it in URLs.
130 */
131 #ifdef _WIN32
132 #define PATH_SEPARATOR '\\'
133 #else
134 #define PATH_SEPARATOR '/'
135 #endif
136
137 /* capabilities convenience library */
138 /* If a code depends on HAVE_LIBCAP_NG, it depends also on HAVE_CAP_NG_H.
139 * If HAVE_CAP_NG_H is not defined, undefine HAVE_LIBCAP_NG.
140 * Thus, the later tests are done only on HAVE_LIBCAP_NG.
141 */
142 #ifdef HAVE_LIBCAP_NG
143 #ifdef HAVE_CAP_NG_H
144 #include <cap-ng.h>
145 #else
146 #undef HAVE_LIBCAP_NG
147 #endif /* HAVE_CAP_NG_H */
148 #endif /* HAVE_LIBCAP_NG */
149
150 #ifdef __FreeBSD__
151 #include <sys/sysctl.h>
152 #endif /* __FreeBSD__ */
153
154 #include "netdissect-stdinc.h"
155 #include "netdissect.h"
156 #include "interface.h"
157 #include "addrtoname.h"
158 #include "machdep.h"
159 #include "pcap-missing.h"
160 #include "ascii_strcasecmp.h"
161
162 #include "print.h"
163
164 #include "fptype.h"
165
166 #ifndef PATH_MAX
167 #define PATH_MAX 1024
168 #endif
169
170 #if defined(SIGINFO)
171 #define SIGNAL_REQ_INFO SIGINFO
172 #elif defined(SIGUSR1)
173 #define SIGNAL_REQ_INFO SIGUSR1
174 #endif
175
176 #if defined(HAVE_PCAP_DUMP_FLUSH) && defined(SIGUSR2)
177 #define SIGNAL_FLUSH_PCAP SIGUSR2
178 #endif
179
180 #if defined(HAVE_PCAP_CREATE) || defined(_WIN32)
181 static int Bflag; /* buffer size */
182 #endif
183 #ifdef HAVE_PCAP_DUMP_FTELL64
184 static int64_t Cflag; /* rotate dump files after this many bytes */
185 #else
186 static long Cflag; /* rotate dump files after this many bytes */
187 #endif
188 static int Cflag_count; /* Keep track of which file number we're writing */
189 #ifdef HAVE_PCAP_FINDALLDEVS
190 static int Dflag; /* list available devices and exit */
191 #endif
192 #ifdef HAVE_PCAP_FINDALLDEVS_EX
193 static char *remote_interfaces_source; /* list available devices from this source and exit */
194 #endif
195
196 /*
197 * This is exported because, in some versions of libpcap, if libpcap
198 * is built with optimizer debugging code (which is *NOT* the default
199 * configuration!), the library *imports*(!) a variable named dflag,
200 * under the expectation that tcpdump is exporting it, to govern
201 * how much debugging information to print when optimizing
202 * the generated BPF code.
203 *
204 * This is a horrible hack; newer versions of libpcap don't import
205 * dflag but, instead, *if* built with optimizer debugging code,
206 * *export* a routine to set that flag.
207 */
208 extern int dflag;
209 int dflag; /* print filter code */
210 static int Gflag; /* rotate dump files after this many seconds */
211 static int Gflag_count; /* number of files created with Gflag rotation */
212 static time_t Gflag_time; /* The last time_t the dump file was rotated. */
213 static int Lflag; /* list available data link types and exit */
214 static int Iflag; /* rfmon (monitor) mode */
215 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE
216 static int Jflag; /* list available time stamp types */
217 static int jflag = -1; /* packet time stamp source */
218 #endif
219 static int lflag; /* line-buffered output */
220 static int pflag; /* don't go promiscuous */
221 #ifdef HAVE_PCAP_SETDIRECTION
222 static int Qflag = -1; /* restrict captured packet by send/receive direction */
223 #endif
224 #ifdef HAVE_PCAP_DUMP_FLUSH
225 static int Uflag; /* "unbuffered" output of dump files */
226 #endif
227 static int Wflag; /* recycle output files after this number of files */
228 static int WflagChars;
229 static char *zflag = NULL; /* compress each savefile using a specified command (like gzip or bzip2) */
230 static int timeout = 1000; /* default timeout = 1000 ms = 1 s */
231 #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE
232 static int immediate_mode;
233 #endif
234 static int count_mode;
235
236 static int infodelay;
237 static int infoprint;
238
239 char *program_name;
240
241 #ifdef HAVE_CASPER
242 cap_channel_t *capdns;
243 #endif
244
245 /* Forwards */
246 static NORETURN void error(FORMAT_STRING(const char *), ...) PRINTFLIKE(1, 2);
247 static void warning(FORMAT_STRING(const char *), ...) PRINTFLIKE(1, 2);
248 static NORETURN void exit_tcpdump(int);
249 static void (*setsignal (int sig, void (*func)(int)))(int);
250 static void cleanup(int);
251 static void child_cleanup(int);
252 static void print_version(FILE *);
253 static void print_usage(FILE *);
254 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE
255 static NORETURN void show_tstamp_types_and_exit(pcap_t *, const char *device);
256 #endif
257 static NORETURN void show_dlts_and_exit(pcap_t *, const char *device);
258 #ifdef HAVE_PCAP_FINDALLDEVS
259 static NORETURN void show_devices_and_exit(void);
260 #endif
261 #ifdef HAVE_PCAP_FINDALLDEVS_EX
262 static NORETURN void show_remote_devices_and_exit(void);
263 #endif
264
265 static void print_packet(u_char *, const struct pcap_pkthdr *, const u_char *);
266 static void dump_packet_and_trunc(u_char *, const struct pcap_pkthdr *, const u_char *);
267 static void dump_packet(u_char *, const struct pcap_pkthdr *, const u_char *);
268 static void droproot(const char *, const char *);
269
270 #ifdef SIGNAL_REQ_INFO
271 static void requestinfo(int);
272 #endif
273
274 #ifdef SIGNAL_FLUSH_PCAP
275 static void flushpcap(int);
276 #endif
277
278 #ifdef _WIN32
279 static HANDLE timer_handle = INVALID_HANDLE_VALUE;
280 static void CALLBACK verbose_stats_dump(PVOID param, BOOLEAN timer_fired);
281 #else /* _WIN32 */
282 static void verbose_stats_dump(int sig);
283 #endif /* _WIN32 */
284
285 static void info(int);
286 static u_int packets_captured;
287
288 #ifdef HAVE_PCAP_FINDALLDEVS
289 static const struct tok status_flags[] = {
290 #ifdef PCAP_IF_UP
291 { PCAP_IF_UP, "Up" },
292 #endif
293 #ifdef PCAP_IF_RUNNING
294 { PCAP_IF_RUNNING, "Running" },
295 #endif
296 { PCAP_IF_LOOPBACK, "Loopback" },
297 #ifdef PCAP_IF_WIRELESS
298 { PCAP_IF_WIRELESS, "Wireless" },
299 #endif
300 { 0, NULL }
301 };
302 #endif
303
304 static pcap_t *pd;
305 static pcap_dumper_t *pdd = NULL;
306
307 static int supports_monitor_mode;
308
309 extern int optind;
310 extern int opterr;
311 extern char *optarg;
312
313 struct dump_info {
314 char *WFileName;
315 char *CurrentFileName;
316 pcap_t *pd;
317 pcap_dumper_t *pdd;
318 netdissect_options *ndo;
319 #ifdef HAVE_CAPSICUM
320 int dirfd;
321 #endif
322 };
323
324 #if defined(HAVE_PCAP_SET_PARSER_DEBUG)
325 /*
326 * We have pcap_set_parser_debug() in libpcap; declare it (it's not declared
327 * by any libpcap header, because it's a special hack, only available if
328 * libpcap was configured to include it, and only intended for use by
329 * libpcap developers trying to debug the parser for filter expressions).
330 */
331 #ifdef _WIN32
332 __declspec(dllimport)
333 #else /* _WIN32 */
334 extern
335 #endif /* _WIN32 */
336 void pcap_set_parser_debug(int);
337 #elif defined(HAVE_PCAP_DEBUG) || defined(HAVE_YYDEBUG)
338 /*
339 * We don't have pcap_set_parser_debug() in libpcap, but we do have
340 * pcap_debug or yydebug. Make a local version of pcap_set_parser_debug()
341 * to set the flag, and define HAVE_PCAP_SET_PARSER_DEBUG.
342 */
343 static void
pcap_set_parser_debug(int value)344 pcap_set_parser_debug(int value)
345 {
346 #ifdef HAVE_PCAP_DEBUG
347 extern int pcap_debug;
348
349 pcap_debug = value;
350 #else /* HAVE_PCAP_DEBUG */
351 extern int yydebug;
352
353 yydebug = value;
354 #endif /* HAVE_PCAP_DEBUG */
355 }
356
357 #define HAVE_PCAP_SET_PARSER_DEBUG
358 #endif
359
360 #if defined(HAVE_PCAP_SET_OPTIMIZER_DEBUG)
361 /*
362 * We have pcap_set_optimizer_debug() in libpcap; declare it (it's not declared
363 * by any libpcap header, because it's a special hack, only available if
364 * libpcap was configured to include it, and only intended for use by
365 * libpcap developers trying to debug the optimizer for filter expressions).
366 */
367 #ifdef _WIN32
368 __declspec(dllimport)
369 #else /* _WIN32 */
370 extern
371 #endif /* _WIN32 */
372 void pcap_set_optimizer_debug(int);
373 #endif
374
375 /* VARARGS */
376 static void
error(const char * fmt,...)377 error(const char *fmt, ...)
378 {
379 va_list ap;
380
381 (void)fprintf(stderr, "%s: ", program_name);
382 va_start(ap, fmt);
383 (void)vfprintf(stderr, fmt, ap);
384 va_end(ap);
385 if (*fmt) {
386 fmt += strlen(fmt);
387 if (fmt[-1] != '\n')
388 (void)fputc('\n', stderr);
389 }
390 exit_tcpdump(S_ERR_HOST_PROGRAM);
391 /* NOTREACHED */
392 }
393
394 /* VARARGS */
395 static void
warning(const char * fmt,...)396 warning(const char *fmt, ...)
397 {
398 va_list ap;
399
400 (void)fprintf(stderr, "%s: WARNING: ", program_name);
401 va_start(ap, fmt);
402 (void)vfprintf(stderr, fmt, ap);
403 va_end(ap);
404 if (*fmt) {
405 fmt += strlen(fmt);
406 if (fmt[-1] != '\n')
407 (void)fputc('\n', stderr);
408 }
409 }
410
411 static void
exit_tcpdump(int status)412 exit_tcpdump(int status)
413 {
414 nd_cleanup();
415 exit(status);
416 }
417
418 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE
419 static void
show_tstamp_types_and_exit(pcap_t * pc,const char * device)420 show_tstamp_types_and_exit(pcap_t *pc, const char *device)
421 {
422 int n_tstamp_types;
423 int *tstamp_types = 0;
424 const char *tstamp_type_name;
425 int i;
426
427 n_tstamp_types = pcap_list_tstamp_types(pc, &tstamp_types);
428 if (n_tstamp_types < 0)
429 error("%s", pcap_geterr(pc));
430
431 if (n_tstamp_types == 0) {
432 fprintf(stderr, "Time stamp type cannot be set for %s\n",
433 device);
434 exit_tcpdump(S_SUCCESS);
435 }
436 fprintf(stderr, "Time stamp types for %s (use option -j to set):\n",
437 device);
438 for (i = 0; i < n_tstamp_types; i++) {
439 tstamp_type_name = pcap_tstamp_type_val_to_name(tstamp_types[i]);
440 if (tstamp_type_name != NULL) {
441 (void) fprintf(stderr, " %s (%s)\n", tstamp_type_name,
442 pcap_tstamp_type_val_to_description(tstamp_types[i]));
443 } else {
444 (void) fprintf(stderr, " %d\n", tstamp_types[i]);
445 }
446 }
447 pcap_free_tstamp_types(tstamp_types);
448 exit_tcpdump(S_SUCCESS);
449 }
450 #endif
451
452 static void
show_dlts_and_exit(pcap_t * pc,const char * device)453 show_dlts_and_exit(pcap_t *pc, const char *device)
454 {
455 int n_dlts, i;
456 int *dlts = 0;
457 const char *dlt_name;
458
459 n_dlts = pcap_list_datalinks(pc, &dlts);
460 if (n_dlts < 0)
461 error("%s", pcap_geterr(pc));
462 else if (n_dlts == 0 || !dlts)
463 error("No data link types.");
464
465 /*
466 * If the interface is known to support monitor mode, indicate
467 * whether these are the data link types available when not in
468 * monitor mode, if -I wasn't specified, or when in monitor mode,
469 * when -I was specified (the link-layer types available in
470 * monitor mode might be different from the ones available when
471 * not in monitor mode).
472 */
473 if (supports_monitor_mode)
474 (void) fprintf(stderr, "Data link types for %s %s (use option -y to set):\n",
475 device,
476 Iflag ? "when in monitor mode" : "when not in monitor mode");
477 else
478 (void) fprintf(stderr, "Data link types for %s (use option -y to set):\n",
479 device);
480
481 for (i = 0; i < n_dlts; i++) {
482 dlt_name = pcap_datalink_val_to_name(dlts[i]);
483 if (dlt_name != NULL) {
484 (void) fprintf(stderr, " %s (%s)", dlt_name,
485 pcap_datalink_val_to_description(dlts[i]));
486
487 /*
488 * OK, does tcpdump handle that type?
489 */
490 if (!has_printer(dlts[i]))
491 (void) fprintf(stderr, " (printing not supported)");
492 fprintf(stderr, "\n");
493 } else {
494 (void) fprintf(stderr, " DLT %d (printing not supported)\n",
495 dlts[i]);
496 }
497 }
498 #ifdef HAVE_PCAP_FREE_DATALINKS
499 pcap_free_datalinks(dlts);
500 #endif
501 exit_tcpdump(S_SUCCESS);
502 }
503
504 #ifdef HAVE_PCAP_FINDALLDEVS
505 static void
show_devices_and_exit(void)506 show_devices_and_exit(void)
507 {
508 pcap_if_t *dev, *devlist;
509 char ebuf[PCAP_ERRBUF_SIZE];
510 int i;
511
512 if (pcap_findalldevs(&devlist, ebuf) < 0)
513 error("%s", ebuf);
514 for (i = 0, dev = devlist; dev != NULL; i++, dev = dev->next) {
515 printf("%d.%s", i+1, dev->name);
516 if (dev->description != NULL)
517 printf(" (%s)", dev->description);
518 if (dev->flags != 0) {
519 printf(" [");
520 printf("%s", bittok2str(status_flags, "none", dev->flags));
521 #ifdef PCAP_IF_WIRELESS
522 if (dev->flags & PCAP_IF_WIRELESS) {
523 switch (dev->flags & PCAP_IF_CONNECTION_STATUS) {
524
525 case PCAP_IF_CONNECTION_STATUS_UNKNOWN:
526 printf(", Association status unknown");
527 break;
528
529 case PCAP_IF_CONNECTION_STATUS_CONNECTED:
530 printf(", Associated");
531 break;
532
533 case PCAP_IF_CONNECTION_STATUS_DISCONNECTED:
534 printf(", Not associated");
535 break;
536
537 case PCAP_IF_CONNECTION_STATUS_NOT_APPLICABLE:
538 break;
539 }
540 } else {
541 switch (dev->flags & PCAP_IF_CONNECTION_STATUS) {
542
543 case PCAP_IF_CONNECTION_STATUS_UNKNOWN:
544 printf(", Connection status unknown");
545 break;
546
547 case PCAP_IF_CONNECTION_STATUS_CONNECTED:
548 printf(", Connected");
549 break;
550
551 case PCAP_IF_CONNECTION_STATUS_DISCONNECTED:
552 printf(", Disconnected");
553 break;
554
555 case PCAP_IF_CONNECTION_STATUS_NOT_APPLICABLE:
556 break;
557 }
558 }
559 #endif
560 printf("]");
561 }
562 printf("\n");
563 }
564 pcap_freealldevs(devlist);
565 exit_tcpdump(S_SUCCESS);
566 }
567 #endif /* HAVE_PCAP_FINDALLDEVS */
568
569 #ifdef HAVE_PCAP_FINDALLDEVS_EX
570 static void
show_remote_devices_and_exit(void)571 show_remote_devices_and_exit(void)
572 {
573 pcap_if_t *dev, *devlist;
574 char ebuf[PCAP_ERRBUF_SIZE];
575 int i;
576
577 if (pcap_findalldevs_ex(remote_interfaces_source, NULL, &devlist,
578 ebuf) < 0)
579 error("%s", ebuf);
580 for (i = 0, dev = devlist; dev != NULL; i++, dev = dev->next) {
581 printf("%d.%s", i+1, dev->name);
582 if (dev->description != NULL)
583 printf(" (%s)", dev->description);
584 if (dev->flags != 0)
585 printf(" [%s]", bittok2str(status_flags, "none", dev->flags));
586 printf("\n");
587 }
588 pcap_freealldevs(devlist);
589 exit_tcpdump(S_SUCCESS);
590 }
591 #endif /* HAVE_PCAP_FINDALLDEVS */
592
593 /*
594 * Short options.
595 *
596 * Note that there we use all letters for short options except for g, k,
597 * o, and P, and those are used by other versions of tcpdump, and we should
598 * only use them for the same purposes that the other versions of tcpdump
599 * use them:
600 *
601 * macOS tcpdump uses -g to force non--v output for IP to be on one
602 * line, making it more "g"repable;
603 *
604 * macOS tcpdump uses -k to specify that packet comments in pcapng files
605 * should be printed;
606 *
607 * OpenBSD tcpdump uses -o to indicate that OS fingerprinting should be done
608 * for hosts sending TCP SYN packets;
609 *
610 * macOS tcpdump uses -P to indicate that -w should write pcapng rather
611 * than pcap files.
612 *
613 * macOS tcpdump also uses -Q to specify expressions that match packet
614 * metadata, including but not limited to the packet direction.
615 * The expression syntax is different from a simple "in|out|inout",
616 * and those expressions aren't accepted by macOS tcpdump, but the
617 * equivalents would be "in" = "dir=in", "out" = "dir=out", and
618 * "inout" = "dir=in or dir=out", and the parser could conceivably
619 * special-case "in", "out", and "inout" as expressions for backwards
620 * compatibility, so all is not (yet) lost.
621 */
622
623 /*
624 * Set up flags that might or might not be supported depending on the
625 * version of libpcap we're using.
626 */
627 #if defined(HAVE_PCAP_CREATE) || defined(_WIN32)
628 #define B_FLAG "B:"
629 #define B_FLAG_USAGE " [ -B size ]"
630 #else /* defined(HAVE_PCAP_CREATE) || defined(_WIN32) */
631 #define B_FLAG
632 #define B_FLAG_USAGE
633 #endif /* defined(HAVE_PCAP_CREATE) || defined(_WIN32) */
634
635 #ifdef HAVE_PCAP_FINDALLDEVS
636 #define D_FLAG "D"
637 #else
638 #define D_FLAG
639 #endif
640
641 #ifdef HAVE_PCAP_CREATE
642 #define I_FLAG "I"
643 #else /* HAVE_PCAP_CREATE */
644 #define I_FLAG
645 #endif /* HAVE_PCAP_CREATE */
646
647 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE
648 #define j_FLAG "j:"
649 #define j_FLAG_USAGE " [ -j tstamptype ]"
650 #define J_FLAG "J"
651 #else /* PCAP_ERROR_TSTAMP_TYPE_NOTSUP */
652 #define j_FLAG
653 #define j_FLAG_USAGE
654 #define J_FLAG
655 #endif /* PCAP_ERROR_TSTAMP_TYPE_NOTSUP */
656
657 #ifdef USE_LIBSMI
658 #define m_FLAG_USAGE "[ -m module ] ..."
659 #endif
660
661 #ifdef HAVE_PCAP_SETDIRECTION
662 #define Q_FLAG "Q:"
663 #define Q_FLAG_USAGE " [ -Q in|out|inout ]"
664 #else
665 #define Q_FLAG
666 #define Q_FLAG_USAGE
667 #endif
668
669 #ifdef HAVE_PCAP_DUMP_FLUSH
670 #define U_FLAG "U"
671 #else
672 #define U_FLAG
673 #endif
674
675 #define SHORTOPTS "aAb" B_FLAG "c:C:d" D_FLAG "eE:fF:G:hHi:" I_FLAG j_FLAG J_FLAG "KlLm:M:nNOpq" Q_FLAG "r:s:StT:u" U_FLAG "vV:w:W:xXy:Yz:Z:#"
676
677 /*
678 * Long options.
679 *
680 * We do not currently have long options corresponding to all short
681 * options; we should probably pick appropriate option names for them.
682 *
683 * However, the short options where the number of times the option is
684 * specified matters, such as -v and -d and -t, should probably not
685 * just map to a long option, as saying
686 *
687 * tcpdump --verbose --verbose
688 *
689 * doesn't make sense; it should be --verbosity={N} or something such
690 * as that.
691 *
692 * For long options with no corresponding short options, we define values
693 * outside the range of ASCII graphic characters, make that the last
694 * component of the entry for the long option, and have a case for that
695 * option in the switch statement.
696 */
697 #define OPTION_VERSION 128
698 #define OPTION_TSTAMP_PRECISION 129
699 #define OPTION_IMMEDIATE_MODE 130
700 #define OPTION_PRINT 131
701 #define OPTION_LIST_REMOTE_INTERFACES 132
702 #define OPTION_TSTAMP_MICRO 133
703 #define OPTION_TSTAMP_NANO 134
704 #define OPTION_FP_TYPE 135
705 #define OPTION_COUNT 136
706
707 static const struct option longopts[] = {
708 #if defined(HAVE_PCAP_CREATE) || defined(_WIN32)
709 { "buffer-size", required_argument, NULL, 'B' },
710 #endif
711 { "list-interfaces", no_argument, NULL, 'D' },
712 #ifdef HAVE_PCAP_FINDALLDEVS_EX
713 { "list-remote-interfaces", required_argument, NULL, OPTION_LIST_REMOTE_INTERFACES },
714 #endif
715 { "help", no_argument, NULL, 'h' },
716 { "interface", required_argument, NULL, 'i' },
717 #ifdef HAVE_PCAP_CREATE
718 { "monitor-mode", no_argument, NULL, 'I' },
719 #endif
720 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE
721 { "time-stamp-type", required_argument, NULL, 'j' },
722 { "list-time-stamp-types", no_argument, NULL, 'J' },
723 #endif
724 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
725 { "micro", no_argument, NULL, OPTION_TSTAMP_MICRO},
726 { "nano", no_argument, NULL, OPTION_TSTAMP_NANO},
727 { "time-stamp-precision", required_argument, NULL, OPTION_TSTAMP_PRECISION},
728 #endif
729 { "dont-verify-checksums", no_argument, NULL, 'K' },
730 { "list-data-link-types", no_argument, NULL, 'L' },
731 { "no-optimize", no_argument, NULL, 'O' },
732 { "no-promiscuous-mode", no_argument, NULL, 'p' },
733 #ifdef HAVE_PCAP_SETDIRECTION
734 { "direction", required_argument, NULL, 'Q' },
735 #endif
736 { "snapshot-length", required_argument, NULL, 's' },
737 { "absolute-tcp-sequence-numbers", no_argument, NULL, 'S' },
738 #ifdef HAVE_PCAP_DUMP_FLUSH
739 { "packet-buffered", no_argument, NULL, 'U' },
740 #endif
741 { "linktype", required_argument, NULL, 'y' },
742 #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE
743 { "immediate-mode", no_argument, NULL, OPTION_IMMEDIATE_MODE },
744 #endif
745 #ifdef HAVE_PCAP_SET_PARSER_DEBUG
746 { "debug-filter-parser", no_argument, NULL, 'Y' },
747 #endif
748 { "relinquish-privileges", required_argument, NULL, 'Z' },
749 { "count", no_argument, NULL, OPTION_COUNT },
750 { "fp-type", no_argument, NULL, OPTION_FP_TYPE },
751 { "number", no_argument, NULL, '#' },
752 { "print", no_argument, NULL, OPTION_PRINT },
753 { "version", no_argument, NULL, OPTION_VERSION },
754 { NULL, 0, NULL, 0 }
755 };
756
757 #ifdef HAVE_PCAP_FINDALLDEVS_EX
758 #define LIST_REMOTE_INTERFACES_USAGE "[ --list-remote-interfaces remote-source ]"
759 #else
760 #define LIST_REMOTE_INTERFACES_USAGE
761 #endif
762
763 #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE
764 #define IMMEDIATE_MODE_USAGE " [ --immediate-mode ]"
765 #else
766 #define IMMEDIATE_MODE_USAGE ""
767 #endif
768
769 #ifndef _WIN32
770 /* Drop root privileges and chroot if necessary */
771 static void
droproot(const char * username,const char * chroot_dir)772 droproot(const char *username, const char *chroot_dir)
773 {
774 struct passwd *pw = NULL;
775
776 if (chroot_dir && !username)
777 error("Chroot without dropping root is insecure");
778
779 pw = getpwnam(username);
780 if (pw) {
781 if (chroot_dir) {
782 if (chroot(chroot_dir) != 0 || chdir ("/") != 0)
783 error("Couldn't chroot/chdir to '%.64s': %s",
784 chroot_dir, pcap_strerror(errno));
785 }
786 #ifdef HAVE_LIBCAP_NG
787 {
788 int ret = capng_change_id(pw->pw_uid, pw->pw_gid, CAPNG_NO_FLAG);
789 if (ret < 0)
790 error("capng_change_id(): return %d\n", ret);
791 else
792 fprintf(stderr, "dropped privs to %s\n", username);
793 }
794 #else
795 if (initgroups(pw->pw_name, pw->pw_gid) != 0 ||
796 setgid(pw->pw_gid) != 0 || setuid(pw->pw_uid) != 0)
797 error("Couldn't change to '%.32s' uid=%lu gid=%lu: %s",
798 username,
799 (unsigned long)pw->pw_uid,
800 (unsigned long)pw->pw_gid,
801 pcap_strerror(errno));
802 else {
803 fprintf(stderr, "dropped privs to %s\n", username);
804 }
805 #endif /* HAVE_LIBCAP_NG */
806 } else
807 error("Couldn't find user '%.32s'", username);
808 #ifdef HAVE_LIBCAP_NG
809 /* We don't need CAP_SETUID, CAP_SETGID and CAP_SYS_CHROOT any more. */
810 DIAG_OFF_CLANG(assign-enum)
811 capng_updatev(
812 CAPNG_DROP,
813 CAPNG_EFFECTIVE | CAPNG_PERMITTED,
814 CAP_SETUID,
815 CAP_SETGID,
816 CAP_SYS_CHROOT,
817 -1);
818 DIAG_ON_CLANG(assign-enum)
819 capng_apply(CAPNG_SELECT_BOTH);
820 #endif /* HAVE_LIBCAP_NG */
821
822 }
823 #endif /* _WIN32 */
824
825 static int
getWflagChars(int x)826 getWflagChars(int x)
827 {
828 int c = 0;
829
830 x -= 1;
831 while (x > 0) {
832 c += 1;
833 x /= 10;
834 }
835
836 return c;
837 }
838
839
840 static void
MakeFilename(char * buffer,char * orig_name,int cnt,int max_chars)841 MakeFilename(char *buffer, char *orig_name, int cnt, int max_chars)
842 {
843 char *filename = malloc(PATH_MAX + 1);
844 if (filename == NULL)
845 error("%s: malloc", __func__);
846
847 /* Process with strftime if Gflag is set. */
848 if (Gflag != 0) {
849 struct tm *local_tm;
850
851 /* Convert Gflag_time to a usable format */
852 if ((local_tm = localtime(&Gflag_time)) == NULL) {
853 error("%s: localtime", __func__);
854 }
855
856 /* There's no good way to detect an error in strftime since a return
857 * value of 0 isn't necessarily failure.
858 */
859 strftime(filename, PATH_MAX, orig_name, local_tm);
860 } else {
861 strncpy(filename, orig_name, PATH_MAX);
862 }
863
864 if (cnt == 0 && max_chars == 0)
865 strncpy(buffer, filename, PATH_MAX + 1);
866 else
867 if (snprintf(buffer, PATH_MAX + 1, "%s%0*d", filename, max_chars, cnt) > PATH_MAX)
868 /* Report an error if the filename is too large */
869 error("too many output files or filename is too long (> %d)", PATH_MAX);
870 free(filename);
871 }
872
873 static char *
get_next_file(FILE * VFile,char * ptr)874 get_next_file(FILE *VFile, char *ptr)
875 {
876 char *ret;
877 size_t len;
878
879 ret = fgets(ptr, PATH_MAX, VFile);
880 if (!ret)
881 return NULL;
882
883 len = strlen (ptr);
884 if (len > 0 && ptr[len - 1] == '\n')
885 ptr[len - 1] = '\0';
886
887 return ret;
888 }
889
890 #ifdef HAVE_CASPER
891 static cap_channel_t *
capdns_setup(void)892 capdns_setup(void)
893 {
894 cap_channel_t *capcas, *capdnsloc;
895 const char *types[1];
896 int families[2];
897
898 capcas = cap_init();
899 if (capcas == NULL)
900 error("unable to create casper process");
901 capdnsloc = cap_service_open(capcas, "system.dns");
902 /* Casper capability no longer needed. */
903 cap_close(capcas);
904 if (capdnsloc == NULL)
905 error("unable to open system.dns service");
906 /* Limit system.dns to reverse DNS lookups. */
907 types[0] = "ADDR";
908 if (cap_dns_type_limit(capdnsloc, types, 1) < 0)
909 error("unable to limit access to system.dns service");
910 families[0] = AF_INET;
911 families[1] = AF_INET6;
912 if (cap_dns_family_limit(capdnsloc, families, 2) < 0)
913 error("unable to limit access to system.dns service");
914
915 return (capdnsloc);
916 }
917 #endif /* HAVE_CASPER */
918
919 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
920 static int
tstamp_precision_from_string(const char * precision)921 tstamp_precision_from_string(const char *precision)
922 {
923 if (strncmp(precision, "nano", strlen("nano")) == 0)
924 return PCAP_TSTAMP_PRECISION_NANO;
925
926 if (strncmp(precision, "micro", strlen("micro")) == 0)
927 return PCAP_TSTAMP_PRECISION_MICRO;
928
929 return -EINVAL;
930 }
931
932 static const char *
tstamp_precision_to_string(int precision)933 tstamp_precision_to_string(int precision)
934 {
935 switch (precision) {
936
937 case PCAP_TSTAMP_PRECISION_MICRO:
938 return "micro";
939
940 case PCAP_TSTAMP_PRECISION_NANO:
941 return "nano";
942
943 default:
944 return "unknown";
945 }
946 }
947 #endif
948
949 #ifdef HAVE_CAPSICUM
950 /*
951 * Ensure that, on a dump file's descriptor, we have all the rights
952 * necessary to make the standard I/O library work with an fdopen()ed
953 * FILE * from that descriptor.
954 *
955 * A long time ago in a galaxy far, far away, AT&T decided that, instead
956 * of providing separate APIs for getting and setting the FD_ flags on a
957 * descriptor, getting and setting the O_ flags on a descriptor, and
958 * locking files, they'd throw them all into a kitchen-sink fcntl() call
959 * along the lines of ioctl(), the fact that ioctl() operations are
960 * largely specific to particular character devices but fcntl() operations
961 * are either generic to all descriptors or generic to all descriptors for
962 * regular files nonwithstanding.
963 *
964 * The Capsicum people decided that fine-grained control of descriptor
965 * operations was required, so that you need to grant permission for
966 * reading, writing, seeking, and fcntl-ing. The latter, courtesy of
967 * AT&T's decision, means that "fcntl-ing" isn't a thing, but a motley
968 * collection of things, so there are *individual* fcntls for which
969 * permission needs to be granted.
970 *
971 * The FreeBSD standard I/O people implemented some optimizations that
972 * requires that the standard I/O routines be able to determine whether
973 * the descriptor for the FILE * is open append-only or not; as that
974 * descriptor could have come from an open() rather than an fopen(),
975 * that requires that it be able to do an F_GETFL fcntl() to read
976 * the O_ flags.
977 *
978 * Tcpdump uses ftell() to determine how much data has been written
979 * to a file in order to, when used with -C, determine when it's time
980 * to rotate capture files. ftell() therefore needs to do an lseek()
981 * to find out the file offset and must, thanks to the aforementioned
982 * optimization, also know whether the descriptor is open append-only
983 * or not.
984 *
985 * The net result of all the above is that we need to grant CAP_SEEK,
986 * CAP_WRITE, and CAP_FCNTL with the CAP_FCNTL_GETFL subcapability.
987 *
988 * Perhaps this is the universe's way of saying that either
989 *
990 * 1) there needs to be an fopenat() call and a pcap_dump_openat() call
991 * using it, so that Capsicum-capable tcpdump wouldn't need to do
992 * an fdopen()
993 *
994 * or
995 *
996 * 2) there needs to be a cap_fdopen() call in the FreeBSD standard
997 * I/O library that knows what rights are needed by the standard
998 * I/O library, based on the open mode, and assigns them, perhaps
999 * with an additional argument indicating, for example, whether
1000 * seeking should be allowed, so that tcpdump doesn't need to know
1001 * what the standard I/O library happens to require this week.
1002 */
1003 static void
set_dumper_capsicum_rights(pcap_dumper_t * p)1004 set_dumper_capsicum_rights(pcap_dumper_t *p)
1005 {
1006 int fd = fileno(pcap_dump_file(p));
1007 cap_rights_t rights;
1008
1009 cap_rights_init(&rights, CAP_SEEK, CAP_WRITE, CAP_FCNTL);
1010 if (cap_rights_limit(fd, &rights) < 0 && errno != ENOSYS) {
1011 error("unable to limit dump descriptor");
1012 }
1013 if (cap_fcntls_limit(fd, CAP_FCNTL_GETFL) < 0 && errno != ENOSYS) {
1014 error("unable to limit dump descriptor fcntls");
1015 }
1016 }
1017 #endif
1018
1019 /*
1020 * Copy arg vector into a new buffer, concatenating arguments with spaces.
1021 */
1022 static char *
copy_argv(char ** argv)1023 copy_argv(char **argv)
1024 {
1025 char **p;
1026 size_t len = 0;
1027 char *buf;
1028 char *src, *dst;
1029
1030 p = argv;
1031 if (*p == NULL)
1032 return 0;
1033
1034 while (*p)
1035 len += strlen(*p++) + 1;
1036
1037 buf = (char *)malloc(len);
1038 if (buf == NULL)
1039 error("%s: malloc", __func__);
1040
1041 p = argv;
1042 dst = buf;
1043 while ((src = *p++) != NULL) {
1044 while ((*dst++ = *src++) != '\0')
1045 ;
1046 dst[-1] = ' ';
1047 }
1048 dst[-1] = '\0';
1049
1050 return buf;
1051 }
1052
1053 /*
1054 * On Windows, we need to open the file in binary mode, so that
1055 * we get all the bytes specified by the size we get from "fstat()".
1056 * On UNIX, that's not necessary. O_BINARY is defined on Windows;
1057 * we define it as 0 if it's not defined, so it does nothing.
1058 */
1059 #ifndef O_BINARY
1060 #define O_BINARY 0
1061 #endif
1062
1063 static char *
read_infile(char * fname)1064 read_infile(char *fname)
1065 {
1066 int i, fd;
1067 ssize_t cc;
1068 char *cp;
1069 our_statb buf;
1070
1071 fd = open(fname, O_RDONLY|O_BINARY);
1072 if (fd < 0)
1073 error("can't open %s: %s", fname, pcap_strerror(errno));
1074
1075 if (our_fstat(fd, &buf) < 0)
1076 error("can't stat %s: %s", fname, pcap_strerror(errno));
1077
1078 /*
1079 * Reject files whose size doesn't fit into an int; a filter
1080 * *that* large will probably be too big.
1081 */
1082 if (buf.st_size > INT_MAX)
1083 error("%s is too large", fname);
1084
1085 cp = malloc((u_int)buf.st_size + 1);
1086 if (cp == NULL)
1087 error("malloc(%d) for %s: %s", (u_int)buf.st_size + 1,
1088 fname, pcap_strerror(errno));
1089 cc = read(fd, cp, (u_int)buf.st_size);
1090 if (cc < 0)
1091 error("read %s: %s", fname, pcap_strerror(errno));
1092 if (cc != buf.st_size)
1093 error("short read %s (%d != %d)", fname, (int) cc,
1094 (int)buf.st_size);
1095
1096 close(fd);
1097 /* replace "# comment" with spaces */
1098 for (i = 0; i < cc; i++) {
1099 if (cp[i] == '#')
1100 while (i < cc && cp[i] != '\n')
1101 cp[i++] = ' ';
1102 }
1103 cp[cc] = '\0';
1104 return (cp);
1105 }
1106
1107 #ifdef HAVE_PCAP_FINDALLDEVS
1108 static long
parse_interface_number(const char * device)1109 parse_interface_number(const char *device)
1110 {
1111 const char *p;
1112 long devnum;
1113 char *end;
1114
1115 /*
1116 * Search for a colon, terminating any scheme at the beginning
1117 * of the device.
1118 */
1119 p = strchr(device, ':');
1120 if (p != NULL) {
1121 /*
1122 * We found it. Is it followed by "//"?
1123 */
1124 p++; /* skip the : */
1125 if (strncmp(p, "//", 2) == 0) {
1126 /*
1127 * Yes. Search for the next /, at the end of the
1128 * authority part of the URL.
1129 */
1130 p += 2; /* skip the // */
1131 p = strchr(p, '/');
1132 if (p != NULL) {
1133 /*
1134 * OK, past the / is the path.
1135 */
1136 device = p + 1;
1137 }
1138 }
1139 }
1140 devnum = strtol(device, &end, 10);
1141 if (device != end && *end == '\0') {
1142 /*
1143 * It's all-numeric, but is it a valid number?
1144 */
1145 if (devnum <= 0) {
1146 /*
1147 * No, it's not an ordinal.
1148 */
1149 error("Invalid adapter index");
1150 }
1151 return (devnum);
1152 } else {
1153 /*
1154 * It's not all-numeric; return -1, so our caller
1155 * knows that.
1156 */
1157 return (-1);
1158 }
1159 }
1160
1161 static char *
find_interface_by_number(const char * url _U_,long devnum)1162 find_interface_by_number(const char *url
1163 #ifndef HAVE_PCAP_FINDALLDEVS_EX
1164 _U_
1165 #endif
1166 , long devnum)
1167 {
1168 pcap_if_t *dev, *devlist;
1169 long i;
1170 char ebuf[PCAP_ERRBUF_SIZE];
1171 char *device;
1172 #ifdef HAVE_PCAP_FINDALLDEVS_EX
1173 const char *endp;
1174 char *host_url;
1175 #endif
1176 int status;
1177
1178 #ifdef HAVE_PCAP_FINDALLDEVS_EX
1179 /*
1180 * Search for a colon, terminating any scheme at the beginning
1181 * of the URL.
1182 */
1183 endp = strchr(url, ':');
1184 if (endp != NULL) {
1185 /*
1186 * We found it. Is it followed by "//"?
1187 */
1188 endp++; /* skip the : */
1189 if (strncmp(endp, "//", 2) == 0) {
1190 /*
1191 * Yes. Search for the next /, at the end of the
1192 * authority part of the URL.
1193 */
1194 endp += 2; /* skip the // */
1195 endp = strchr(endp, '/');
1196 } else
1197 endp = NULL;
1198 }
1199 if (endp != NULL) {
1200 /*
1201 * OK, everything from device to endp is a URL to hand
1202 * to pcap_findalldevs_ex().
1203 */
1204 endp++; /* Include the trailing / in the URL; pcap_findalldevs_ex() requires it */
1205 host_url = malloc(endp - url + 1);
1206 if (host_url == NULL && (endp - url + 1) > 0)
1207 error("Invalid allocation for host");
1208
1209 memcpy(host_url, url, endp - url);
1210 host_url[endp - url] = '\0';
1211 status = pcap_findalldevs_ex(host_url, NULL, &devlist, ebuf);
1212 free(host_url);
1213 } else
1214 #endif
1215 status = pcap_findalldevs(&devlist, ebuf);
1216 if (status < 0)
1217 error("%s", ebuf);
1218 /*
1219 * Look for the devnum-th entry in the list of devices (1-based).
1220 */
1221 for (i = 0, dev = devlist; i < devnum-1 && dev != NULL;
1222 i++, dev = dev->next)
1223 ;
1224 if (dev == NULL)
1225 error("Invalid adapter index");
1226 device = strdup(dev->name);
1227 pcap_freealldevs(devlist);
1228 return (device);
1229 }
1230 #endif
1231
1232 #ifdef HAVE_PCAP_OPEN
1233 /*
1234 * Prefixes for rpcap URLs.
1235 */
1236 static char rpcap_prefix[] = "rpcap://";
1237 static char rpcap_ssl_prefix[] = "rpcaps://";
1238 #endif
1239
1240 static pcap_t *
open_interface(const char * device,netdissect_options * ndo,char * ebuf)1241 open_interface(const char *device, netdissect_options *ndo, char *ebuf)
1242 {
1243 pcap_t *pc;
1244 #ifdef HAVE_PCAP_CREATE
1245 int status;
1246 char *cp;
1247 #endif
1248
1249 #ifdef HAVE_PCAP_OPEN
1250 /*
1251 * Is this an rpcap URL?
1252 */
1253 if (strncmp(device, rpcap_prefix, sizeof(rpcap_prefix) - 1) == 0 ||
1254 strncmp(device, rpcap_ssl_prefix, sizeof(rpcap_ssl_prefix) - 1) == 0) {
1255 /*
1256 * Yes. Open it with pcap_open().
1257 */
1258 *ebuf = '\0';
1259 pc = pcap_open(device, ndo->ndo_snaplen,
1260 pflag ? 0 : PCAP_OPENFLAG_PROMISCUOUS, timeout, NULL,
1261 ebuf);
1262 if (pc == NULL) {
1263 /*
1264 * If this failed with "No such device" or "The system
1265 * cannot find the device specified", that means
1266 * the interface doesn't exist; return NULL, so that
1267 * the caller can see whether the device name is
1268 * actually an interface index.
1269 */
1270 if (strstr(ebuf, "No such device") != NULL ||
1271 strstr(ebuf, "The system cannot find the device specified") != NULL)
1272 return (NULL);
1273 error("%s", ebuf);
1274 }
1275 if (*ebuf)
1276 warning("%s", ebuf);
1277 return (pc);
1278 }
1279 #endif /* HAVE_PCAP_OPEN */
1280
1281 #ifdef HAVE_PCAP_CREATE
1282 pc = pcap_create(device, ebuf);
1283 if (pc == NULL) {
1284 /*
1285 * If this failed with "No such device", that means
1286 * the interface doesn't exist; return NULL, so that
1287 * the caller can see whether the device name is
1288 * actually an interface index.
1289 */
1290 if (strstr(ebuf, "No such device") != NULL)
1291 return (NULL);
1292 error("%s", ebuf);
1293 }
1294 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE
1295 if (Jflag)
1296 show_tstamp_types_and_exit(pc, device);
1297 #endif
1298 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
1299 status = pcap_set_tstamp_precision(pc, ndo->ndo_tstamp_precision);
1300 if (status != 0)
1301 error("%s: Can't set %ssecond time stamp precision: %s",
1302 device,
1303 tstamp_precision_to_string(ndo->ndo_tstamp_precision),
1304 pcap_statustostr(status));
1305 #endif
1306
1307 #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE
1308 if (immediate_mode) {
1309 status = pcap_set_immediate_mode(pc, 1);
1310 if (status != 0)
1311 error("%s: Can't set immediate mode: %s",
1312 device, pcap_statustostr(status));
1313 }
1314 #endif
1315 /*
1316 * Is this an interface that supports monitor mode?
1317 */
1318 if (pcap_can_set_rfmon(pc) == 1)
1319 supports_monitor_mode = 1;
1320 else
1321 supports_monitor_mode = 0;
1322 if (ndo->ndo_snaplen != 0) {
1323 /*
1324 * A snapshot length was explicitly specified;
1325 * use it.
1326 */
1327 status = pcap_set_snaplen(pc, ndo->ndo_snaplen);
1328 if (status != 0)
1329 error("%s: Can't set snapshot length: %s",
1330 device, pcap_statustostr(status));
1331 }
1332 status = pcap_set_promisc(pc, !pflag);
1333 if (status != 0)
1334 error("%s: Can't set promiscuous mode: %s",
1335 device, pcap_statustostr(status));
1336 if (Iflag) {
1337 status = pcap_set_rfmon(pc, 1);
1338 if (status != 0)
1339 error("%s: Can't set monitor mode: %s",
1340 device, pcap_statustostr(status));
1341 }
1342 status = pcap_set_timeout(pc, timeout);
1343 if (status != 0)
1344 error("%s: pcap_set_timeout failed: %s",
1345 device, pcap_statustostr(status));
1346 if (Bflag != 0) {
1347 status = pcap_set_buffer_size(pc, Bflag);
1348 if (status != 0)
1349 error("%s: Can't set buffer size: %s",
1350 device, pcap_statustostr(status));
1351 }
1352 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE
1353 if (jflag != -1) {
1354 status = pcap_set_tstamp_type(pc, jflag);
1355 if (status < 0)
1356 error("%s: Can't set time stamp type: %s",
1357 device, pcap_statustostr(status));
1358 else if (status > 0)
1359 warning("When trying to set timestamp type '%s' on %s: %s",
1360 pcap_tstamp_type_val_to_name(jflag), device,
1361 pcap_statustostr(status));
1362 }
1363 #endif
1364 status = pcap_activate(pc);
1365 if (status < 0) {
1366 /*
1367 * pcap_activate() failed.
1368 */
1369 cp = pcap_geterr(pc);
1370 if (status == PCAP_ERROR)
1371 error("%s", cp);
1372 else if (status == PCAP_ERROR_NO_SUCH_DEVICE) {
1373 /*
1374 * Return an error for our caller to handle.
1375 */
1376 snprintf(ebuf, PCAP_ERRBUF_SIZE, "%s: %s\n(%s)",
1377 device, pcap_statustostr(status), cp);
1378 } else if (status == PCAP_ERROR_PERM_DENIED && *cp != '\0')
1379 error("%s: %s\n(%s)", device,
1380 pcap_statustostr(status), cp);
1381 #ifdef __FreeBSD__
1382 else if (status == PCAP_ERROR_RFMON_NOTSUP &&
1383 strncmp(device, "wlan", 4) == 0) {
1384 char parent[8], newdev[8];
1385 char sysctl[32];
1386 size_t s = sizeof(parent);
1387
1388 snprintf(sysctl, sizeof(sysctl),
1389 "net.wlan.%d.%%parent", atoi(device + 4));
1390 sysctlbyname(sysctl, parent, &s, NULL, 0);
1391 strlcpy(newdev, device, sizeof(newdev));
1392 /* Suggest a new wlan device. */
1393 /* FIXME: incrementing the index this way is not going to work well
1394 * when the index is 9 or greater but the only consequence in this
1395 * specific case would be an error message that looks a bit odd.
1396 */
1397 newdev[strlen(newdev)-1]++;
1398 error("%s is not a monitor mode VAP\n"
1399 "To create a new monitor mode VAP use:\n"
1400 " ifconfig %s create wlandev %s wlanmode monitor\n"
1401 "and use %s as the tcpdump interface",
1402 device, newdev, parent, newdev);
1403 }
1404 #endif
1405 else
1406 error("%s: %s", device,
1407 pcap_statustostr(status));
1408 pcap_close(pc);
1409 return (NULL);
1410 } else if (status > 0) {
1411 /*
1412 * pcap_activate() succeeded, but it's warning us
1413 * of a problem it had.
1414 */
1415 cp = pcap_geterr(pc);
1416 if (status == PCAP_WARNING)
1417 warning("%s", cp);
1418 else if (status == PCAP_WARNING_PROMISC_NOTSUP &&
1419 *cp != '\0')
1420 warning("%s: %s\n(%s)", device,
1421 pcap_statustostr(status), cp);
1422 else
1423 warning("%s: %s", device,
1424 pcap_statustostr(status));
1425 }
1426 #ifdef HAVE_PCAP_SETDIRECTION
1427 if (Qflag != -1) {
1428 status = pcap_setdirection(pc, Qflag);
1429 if (status != 0)
1430 error("%s: pcap_setdirection() failed: %s",
1431 device, pcap_geterr(pc));
1432 }
1433 #endif /* HAVE_PCAP_SETDIRECTION */
1434 #else /* HAVE_PCAP_CREATE */
1435 *ebuf = '\0';
1436 /*
1437 * If no snapshot length was specified, or a length of 0 was
1438 * specified, default to 256KB.
1439 */
1440 if (ndo->ndo_snaplen == 0)
1441 ndo->ndo_snaplen = MAXIMUM_SNAPLEN;
1442 pc = pcap_open_live(device, ndo->ndo_snaplen, !pflag, timeout, ebuf);
1443 if (pc == NULL) {
1444 /*
1445 * If this failed with "No such device", that means
1446 * the interface doesn't exist; return NULL, so that
1447 * the caller can see whether the device name is
1448 * actually an interface index.
1449 */
1450 if (strstr(ebuf, "No such device") != NULL)
1451 return (NULL);
1452 error("%s", ebuf);
1453 }
1454 if (*ebuf)
1455 warning("%s", ebuf);
1456 #endif /* HAVE_PCAP_CREATE */
1457
1458 return (pc);
1459 }
1460
1461 int
main(int argc,char ** argv)1462 main(int argc, char **argv)
1463 {
1464 int cnt, op, i;
1465 bpf_u_int32 localnet = 0, netmask = 0;
1466 char *cp, *infile, *cmdbuf, *device, *RFileName, *VFileName, *WFileName;
1467 char *endp;
1468 pcap_handler callback;
1469 int dlt;
1470 const char *dlt_name;
1471 struct bpf_program fcode;
1472 #ifndef _WIN32
1473 void (*oldhandler)(int);
1474 #endif
1475 struct dump_info dumpinfo;
1476 u_char *pcap_userdata;
1477 char ebuf[PCAP_ERRBUF_SIZE];
1478 char VFileLine[PATH_MAX + 1];
1479 const char *username = NULL;
1480 #ifndef _WIN32
1481 const char *chroot_dir = NULL;
1482 #endif
1483 char *ret = NULL;
1484 char *end;
1485 #ifdef HAVE_PCAP_FINDALLDEVS
1486 pcap_if_t *devlist;
1487 long devnum;
1488 #endif
1489 int status;
1490 FILE *VFile;
1491 #ifdef HAVE_CAPSICUM
1492 cap_rights_t rights;
1493 int cansandbox;
1494 #endif /* HAVE_CAPSICUM */
1495 int Oflag = 1; /* run filter code optimizer */
1496 int yflag_dlt = -1;
1497 const char *yflag_dlt_name = NULL;
1498 int print = 0;
1499
1500 netdissect_options Ndo;
1501 netdissect_options *ndo = &Ndo;
1502
1503 /*
1504 * Initialize the netdissect code.
1505 */
1506 if (nd_init(ebuf, sizeof(ebuf)) == -1)
1507 error("%s", ebuf);
1508
1509 memset(ndo, 0, sizeof(*ndo));
1510 ndo_set_function_pointers(ndo);
1511
1512 cnt = -1;
1513 device = NULL;
1514 infile = NULL;
1515 RFileName = NULL;
1516 VFileName = NULL;
1517 VFile = NULL;
1518 WFileName = NULL;
1519 dlt = -1;
1520 if ((cp = strrchr(argv[0], PATH_SEPARATOR)) != NULL)
1521 ndo->program_name = program_name = cp + 1;
1522 else
1523 ndo->program_name = program_name = argv[0];
1524
1525 #if defined(HAVE_PCAP_WSOCKINIT)
1526 if (pcap_wsockinit() != 0)
1527 error("Attempting to initialize Winsock failed");
1528 #elif defined(HAVE_WSOCKINIT)
1529 if (wsockinit() != 0)
1530 error("Attempting to initialize Winsock failed");
1531 #endif
1532
1533 /*
1534 * On platforms where the CPU doesn't support unaligned loads,
1535 * force unaligned accesses to abort with SIGBUS, rather than
1536 * being fixed up (slowly) by the OS kernel; on those platforms,
1537 * misaligned accesses are bugs, and we want tcpdump to crash so
1538 * that the bugs are reported.
1539 */
1540 if (abort_on_misalignment(ebuf, sizeof(ebuf)) < 0)
1541 error("%s", ebuf);
1542
1543 while (
1544 (op = getopt_long(argc, argv, SHORTOPTS, longopts, NULL)) != -1)
1545 switch (op) {
1546
1547 case 'a':
1548 /* compatibility for old -a */
1549 break;
1550
1551 case 'A':
1552 ++ndo->ndo_Aflag;
1553 break;
1554
1555 case 'b':
1556 ++ndo->ndo_bflag;
1557 break;
1558
1559 #if defined(HAVE_PCAP_CREATE) || defined(_WIN32)
1560 case 'B':
1561 Bflag = atoi(optarg)*1024;
1562 if (Bflag <= 0)
1563 error("invalid packet buffer size %s", optarg);
1564 break;
1565 #endif /* defined(HAVE_PCAP_CREATE) || defined(_WIN32) */
1566
1567 case 'c':
1568 cnt = atoi(optarg);
1569 if (cnt <= 0)
1570 error("invalid packet count %s", optarg);
1571 break;
1572
1573 case 'C':
1574 errno = 0;
1575 #ifdef HAVE_PCAP_DUMP_FTELL64
1576 Cflag = strtoint64_t(optarg, &endp, 10);
1577 #else
1578 Cflag = strtol(optarg, &endp, 10);
1579 #endif
1580 if (endp == optarg || *endp != '\0' || errno != 0
1581 || Cflag <= 0)
1582 error("invalid file size %s", optarg);
1583 /*
1584 * Will multiplying it by 1000000 overflow?
1585 */
1586 #ifdef HAVE_PCAP_DUMP_FTELL64
1587 if (Cflag > INT64_T_CONSTANT(0x7fffffffffffffff) / 1000000)
1588 #else
1589 if (Cflag > LONG_MAX / 1000000)
1590 #endif
1591 error("file size %s is too large", optarg);
1592 Cflag *= 1000000;
1593 break;
1594
1595 case 'd':
1596 ++dflag;
1597 break;
1598
1599 #ifdef HAVE_PCAP_FINDALLDEVS
1600 case 'D':
1601 Dflag++;
1602 break;
1603 #endif
1604
1605 #ifdef HAVE_PCAP_FINDALLDEVS_EX
1606 case OPTION_LIST_REMOTE_INTERFACES:
1607 remote_interfaces_source = optarg;
1608 break;
1609 #endif
1610
1611 case 'L':
1612 Lflag++;
1613 break;
1614
1615 case 'e':
1616 ++ndo->ndo_eflag;
1617 break;
1618
1619 case 'E':
1620 #ifndef HAVE_LIBCRYPTO
1621 warning("crypto code not compiled in");
1622 #endif
1623 ndo->ndo_espsecret = optarg;
1624 break;
1625
1626 case 'f':
1627 ++ndo->ndo_fflag;
1628 break;
1629
1630 case 'F':
1631 infile = optarg;
1632 break;
1633
1634 case 'G':
1635 Gflag = atoi(optarg);
1636 if (Gflag < 0)
1637 error("invalid number of seconds %s", optarg);
1638
1639 /* We will create one file initially. */
1640 Gflag_count = 0;
1641
1642 /* Grab the current time for rotation use. */
1643 if ((Gflag_time = time(NULL)) == (time_t)-1) {
1644 error("%s: can't get current time: %s",
1645 __func__, pcap_strerror(errno));
1646 }
1647 break;
1648
1649 case 'h':
1650 print_usage(stdout);
1651 exit_tcpdump(S_SUCCESS);
1652 break;
1653
1654 case 'H':
1655 ++ndo->ndo_Hflag;
1656 break;
1657
1658 case 'i':
1659 device = optarg;
1660 break;
1661
1662 #ifdef HAVE_PCAP_CREATE
1663 case 'I':
1664 ++Iflag;
1665 break;
1666 #endif /* HAVE_PCAP_CREATE */
1667
1668 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE
1669 case 'j':
1670 jflag = pcap_tstamp_type_name_to_val(optarg);
1671 if (jflag < 0)
1672 error("invalid time stamp type %s", optarg);
1673 break;
1674
1675 case 'J':
1676 Jflag++;
1677 break;
1678 #endif
1679
1680 case 'l':
1681 #ifdef _WIN32
1682 /*
1683 * _IOLBF is the same as _IOFBF in Microsoft's C
1684 * libraries; the only alternative they offer
1685 * is _IONBF.
1686 *
1687 * XXX - this should really be checking for MSVC++,
1688 * not _WIN32, if, for example, MinGW has its own
1689 * C library that is more UNIX-compatible.
1690 */
1691 setvbuf(stdout, NULL, _IONBF, 0);
1692 #else /* _WIN32 */
1693 #ifdef HAVE_SETLINEBUF
1694 setlinebuf(stdout);
1695 #else
1696 setvbuf(stdout, NULL, _IOLBF, 0);
1697 #endif
1698 #endif /* _WIN32 */
1699 lflag = 1;
1700 break;
1701
1702 case 'K':
1703 ++ndo->ndo_Kflag;
1704 break;
1705
1706 case 'm':
1707 if (nd_have_smi_support()) {
1708 if (nd_load_smi_module(optarg, ebuf, sizeof(ebuf)) == -1)
1709 error("%s", ebuf);
1710 } else {
1711 (void)fprintf(stderr, "%s: ignoring option `-m %s' ",
1712 program_name, optarg);
1713 (void)fprintf(stderr, "(no libsmi support)\n");
1714 }
1715 break;
1716
1717 case 'M':
1718 /* TCP-MD5 shared secret */
1719 #ifndef HAVE_LIBCRYPTO
1720 warning("crypto code not compiled in");
1721 #endif
1722 ndo->ndo_sigsecret = optarg;
1723 break;
1724
1725 case 'n':
1726 ++ndo->ndo_nflag;
1727 break;
1728
1729 case 'N':
1730 ++ndo->ndo_Nflag;
1731 break;
1732
1733 case 'O':
1734 Oflag = 0;
1735 break;
1736
1737 case 'p':
1738 ++pflag;
1739 break;
1740
1741 case 'q':
1742 ++ndo->ndo_qflag;
1743 ++ndo->ndo_suppress_default_print;
1744 break;
1745
1746 #ifdef HAVE_PCAP_SETDIRECTION
1747 case 'Q':
1748 if (ascii_strcasecmp(optarg, "in") == 0)
1749 Qflag = PCAP_D_IN;
1750 else if (ascii_strcasecmp(optarg, "out") == 0)
1751 Qflag = PCAP_D_OUT;
1752 else if (ascii_strcasecmp(optarg, "inout") == 0)
1753 Qflag = PCAP_D_INOUT;
1754 else
1755 error("unknown capture direction `%s'", optarg);
1756 break;
1757 #endif /* HAVE_PCAP_SETDIRECTION */
1758
1759 case 'r':
1760 RFileName = optarg;
1761 break;
1762
1763 case 's':
1764 ndo->ndo_snaplen = (int)strtol(optarg, &end, 0);
1765 if (optarg == end || *end != '\0'
1766 || ndo->ndo_snaplen < 0 || ndo->ndo_snaplen > MAXIMUM_SNAPLEN)
1767 error("invalid snaplen %s (must be >= 0 and <= %d)",
1768 optarg, MAXIMUM_SNAPLEN);
1769 break;
1770
1771 case 'S':
1772 ++ndo->ndo_Sflag;
1773 break;
1774
1775 case 't':
1776 ++ndo->ndo_tflag;
1777 break;
1778
1779 case 'T':
1780 if (ascii_strcasecmp(optarg, "vat") == 0)
1781 ndo->ndo_packettype = PT_VAT;
1782 else if (ascii_strcasecmp(optarg, "wb") == 0)
1783 ndo->ndo_packettype = PT_WB;
1784 else if (ascii_strcasecmp(optarg, "rpc") == 0)
1785 ndo->ndo_packettype = PT_RPC;
1786 else if (ascii_strcasecmp(optarg, "rtp") == 0)
1787 ndo->ndo_packettype = PT_RTP;
1788 else if (ascii_strcasecmp(optarg, "rtcp") == 0)
1789 ndo->ndo_packettype = PT_RTCP;
1790 else if (ascii_strcasecmp(optarg, "snmp") == 0)
1791 ndo->ndo_packettype = PT_SNMP;
1792 else if (ascii_strcasecmp(optarg, "cnfp") == 0)
1793 ndo->ndo_packettype = PT_CNFP;
1794 else if (ascii_strcasecmp(optarg, "tftp") == 0)
1795 ndo->ndo_packettype = PT_TFTP;
1796 else if (ascii_strcasecmp(optarg, "aodv") == 0)
1797 ndo->ndo_packettype = PT_AODV;
1798 else if (ascii_strcasecmp(optarg, "carp") == 0)
1799 ndo->ndo_packettype = PT_CARP;
1800 else if (ascii_strcasecmp(optarg, "radius") == 0)
1801 ndo->ndo_packettype = PT_RADIUS;
1802 else if (ascii_strcasecmp(optarg, "zmtp1") == 0)
1803 ndo->ndo_packettype = PT_ZMTP1;
1804 else if (ascii_strcasecmp(optarg, "vxlan") == 0)
1805 ndo->ndo_packettype = PT_VXLAN;
1806 else if (ascii_strcasecmp(optarg, "pgm") == 0)
1807 ndo->ndo_packettype = PT_PGM;
1808 else if (ascii_strcasecmp(optarg, "pgm_zmtp1") == 0)
1809 ndo->ndo_packettype = PT_PGM_ZMTP1;
1810 else if (ascii_strcasecmp(optarg, "lmp") == 0)
1811 ndo->ndo_packettype = PT_LMP;
1812 else if (ascii_strcasecmp(optarg, "resp") == 0)
1813 ndo->ndo_packettype = PT_RESP;
1814 else if (ascii_strcasecmp(optarg, "ptp") == 0)
1815 ndo->ndo_packettype = PT_PTP;
1816 else if (ascii_strcasecmp(optarg, "someip") == 0)
1817 ndo->ndo_packettype = PT_SOMEIP;
1818 else if (ascii_strcasecmp(optarg, "domain") == 0)
1819 ndo->ndo_packettype = PT_DOMAIN;
1820 else
1821 error("unknown packet type `%s'", optarg);
1822 break;
1823
1824 case 'u':
1825 ++ndo->ndo_uflag;
1826 break;
1827
1828 #ifdef HAVE_PCAP_DUMP_FLUSH
1829 case 'U':
1830 ++Uflag;
1831 break;
1832 #endif
1833
1834 case 'v':
1835 ++ndo->ndo_vflag;
1836 break;
1837
1838 case 'V':
1839 VFileName = optarg;
1840 break;
1841
1842 case 'w':
1843 WFileName = optarg;
1844 break;
1845
1846 case 'W':
1847 Wflag = atoi(optarg);
1848 if (Wflag <= 0)
1849 error("invalid number of output files %s", optarg);
1850 WflagChars = getWflagChars(Wflag);
1851 break;
1852
1853 case 'x':
1854 ++ndo->ndo_xflag;
1855 ++ndo->ndo_suppress_default_print;
1856 break;
1857
1858 case 'X':
1859 ++ndo->ndo_Xflag;
1860 ++ndo->ndo_suppress_default_print;
1861 break;
1862
1863 case 'y':
1864 yflag_dlt_name = optarg;
1865 yflag_dlt =
1866 pcap_datalink_name_to_val(yflag_dlt_name);
1867 if (yflag_dlt < 0)
1868 error("invalid data link type %s", yflag_dlt_name);
1869 break;
1870
1871 #ifdef HAVE_PCAP_SET_PARSER_DEBUG
1872 case 'Y':
1873 {
1874 /* Undocumented flag */
1875 pcap_set_parser_debug(1);
1876 }
1877 break;
1878 #endif
1879 case 'z':
1880 zflag = optarg;
1881 break;
1882
1883 case 'Z':
1884 username = optarg;
1885 break;
1886
1887 case '#':
1888 ndo->ndo_packet_number = 1;
1889 break;
1890
1891 case OPTION_VERSION:
1892 print_version(stdout);
1893 exit_tcpdump(S_SUCCESS);
1894 break;
1895
1896 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
1897 case OPTION_TSTAMP_PRECISION:
1898 ndo->ndo_tstamp_precision = tstamp_precision_from_string(optarg);
1899 if (ndo->ndo_tstamp_precision < 0)
1900 error("unsupported time stamp precision");
1901 break;
1902 #endif
1903
1904 #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE
1905 case OPTION_IMMEDIATE_MODE:
1906 immediate_mode = 1;
1907 break;
1908 #endif
1909
1910 case OPTION_PRINT:
1911 print = 1;
1912 break;
1913
1914 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
1915 case OPTION_TSTAMP_MICRO:
1916 ndo->ndo_tstamp_precision = PCAP_TSTAMP_PRECISION_MICRO;
1917 break;
1918
1919 case OPTION_TSTAMP_NANO:
1920 ndo->ndo_tstamp_precision = PCAP_TSTAMP_PRECISION_NANO;
1921 break;
1922 #endif
1923
1924 case OPTION_FP_TYPE:
1925 /*
1926 * Print out the type of floating-point arithmetic
1927 * we're doing; it's probably IEEE, unless somebody
1928 * tries to run this on a VAX, but the precision
1929 * may differ (e.g., it might be 32-bit, 64-bit,
1930 * or 80-bit).
1931 */
1932 float_type_check(0x4e93312d);
1933 return 0;
1934
1935 case OPTION_COUNT:
1936 count_mode = 1;
1937 break;
1938
1939 default:
1940 print_usage(stderr);
1941 exit_tcpdump(S_ERR_HOST_PROGRAM);
1942 /* NOTREACHED */
1943 }
1944
1945 #ifdef HAVE_PCAP_FINDALLDEVS
1946 if (Dflag)
1947 show_devices_and_exit();
1948 #endif
1949 #ifdef HAVE_PCAP_FINDALLDEVS_EX
1950 if (remote_interfaces_source != NULL)
1951 show_remote_devices_and_exit();
1952 #endif
1953
1954 #if defined(DLT_LINUX_SLL2) && defined(HAVE_PCAP_SET_DATALINK)
1955 /* Set default linktype DLT_LINUX_SLL2 when capturing on the "any" device */
1956 if (device != NULL &&
1957 strncmp (device, "any", strlen("any")) == 0
1958 && yflag_dlt == -1)
1959 yflag_dlt = DLT_LINUX_SLL2;
1960 #endif
1961
1962 switch (ndo->ndo_tflag) {
1963
1964 case 0: /* Default */
1965 case 1: /* No time stamp */
1966 case 2: /* Unix timeval style */
1967 case 3: /* Microseconds/nanoseconds since previous packet */
1968 case 4: /* Date + Default */
1969 case 5: /* Microseconds/nanoseconds since first packet */
1970 break;
1971
1972 default: /* Not supported */
1973 error("only -t, -tt, -ttt, -tttt and -ttttt are supported");
1974 break;
1975 }
1976
1977 if (ndo->ndo_fflag != 0 && (VFileName != NULL || RFileName != NULL))
1978 error("-f can not be used with -V or -r");
1979
1980 if (VFileName != NULL && RFileName != NULL)
1981 error("-V and -r are mutually exclusive.");
1982
1983 /*
1984 * If we're printing dissected packets to the standard output,
1985 * and either the standard output is a terminal or we're doing
1986 * "line" buffering, set the capture timeout to .1 second rather
1987 * than 1 second, as the user's probably expecting to see packets
1988 * pop up immediately shortly after they arrive.
1989 *
1990 * XXX - would there be some value appropriate for all cases,
1991 * based on, say, the buffer size and packet input rate?
1992 */
1993 if ((WFileName == NULL || print) && (isatty(1) || lflag))
1994 timeout = 100;
1995
1996 #ifdef WITH_CHROOT
1997 /* if run as root, prepare for chrooting */
1998 if (getuid() == 0 || geteuid() == 0) {
1999 /* future extensibility for cmd-line arguments */
2000 if (!chroot_dir)
2001 chroot_dir = WITH_CHROOT;
2002 }
2003 #endif
2004
2005 #ifdef WITH_USER
2006 /* if run as root, prepare for dropping root privileges */
2007 if (getuid() == 0 || geteuid() == 0) {
2008 /* Run with '-Z root' to restore old behaviour */
2009 if (!username)
2010 username = WITH_USER;
2011 }
2012 #endif
2013
2014 if (RFileName != NULL || VFileName != NULL) {
2015 /*
2016 * If RFileName is non-null, it's the pathname of a
2017 * savefile to read. If VFileName is non-null, it's
2018 * the pathname of a file containing a list of pathnames
2019 * (one per line) of savefiles to read.
2020 *
2021 * In either case, we're reading a savefile, not doing
2022 * a live capture.
2023 */
2024 #ifndef _WIN32
2025 /*
2026 * We don't need network access, so relinquish any set-UID
2027 * or set-GID privileges we have (if any).
2028 *
2029 * We do *not* want set-UID privileges when opening a
2030 * trace file, as that might let the user read other
2031 * people's trace files (especially if we're set-UID
2032 * root).
2033 */
2034 if (setgid(getgid()) != 0 || setuid(getuid()) != 0 )
2035 fprintf(stderr, "Warning: setgid/setuid failed !\n");
2036 #endif /* _WIN32 */
2037 if (VFileName != NULL) {
2038 if (VFileName[0] == '-' && VFileName[1] == '\0')
2039 VFile = stdin;
2040 else
2041 VFile = fopen(VFileName, "r");
2042
2043 if (VFile == NULL)
2044 error("Unable to open file: %s\n", pcap_strerror(errno));
2045
2046 ret = get_next_file(VFile, VFileLine);
2047 if (!ret)
2048 error("Nothing in %s\n", VFileName);
2049 RFileName = VFileLine;
2050 }
2051
2052 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
2053 pd = pcap_open_offline_with_tstamp_precision(RFileName,
2054 ndo->ndo_tstamp_precision, ebuf);
2055 #else
2056 pd = pcap_open_offline(RFileName, ebuf);
2057 #endif
2058
2059 if (pd == NULL)
2060 error("%s", ebuf);
2061 #ifdef HAVE_CAPSICUM
2062 cap_rights_init(&rights, CAP_READ);
2063 if (cap_rights_limit(fileno(pcap_file(pd)), &rights) < 0 &&
2064 errno != ENOSYS) {
2065 error("unable to limit pcap descriptor");
2066 }
2067 #endif
2068 dlt = pcap_datalink(pd);
2069 dlt_name = pcap_datalink_val_to_name(dlt);
2070 fprintf(stderr, "reading from file %s", RFileName);
2071 if (dlt_name == NULL) {
2072 fprintf(stderr, ", link-type %u", dlt);
2073 } else {
2074 fprintf(stderr, ", link-type %s (%s)", dlt_name,
2075 pcap_datalink_val_to_description(dlt));
2076 }
2077 fprintf(stderr, ", snapshot length %d\n", pcap_snapshot(pd));
2078 #ifdef DLT_LINUX_SLL2
2079 if (dlt == DLT_LINUX_SLL2)
2080 fprintf(stderr, "Warning: interface names might be incorrect\n");
2081 #endif
2082 } else if (dflag && !device) {
2083 int dump_dlt = DLT_EN10MB;
2084 /*
2085 * We're dumping the compiled code without an explicit
2086 * device specification. (If a device is specified, we
2087 * definitely want to open it to use the DLT of that device.)
2088 * Either default to DLT_EN10MB with a warning, or use
2089 * the user-specified value if supplied.
2090 */
2091 /*
2092 * If no snapshot length was specified, or a length of 0 was
2093 * specified, default to 256KB.
2094 */
2095 if (ndo->ndo_snaplen == 0)
2096 ndo->ndo_snaplen = MAXIMUM_SNAPLEN;
2097 /*
2098 * If a DLT was specified with the -y flag, use that instead.
2099 */
2100 if (yflag_dlt != -1)
2101 dump_dlt = yflag_dlt;
2102 else
2103 fprintf(stderr, "Warning: assuming Ethernet\n");
2104 pd = pcap_open_dead(dump_dlt, ndo->ndo_snaplen);
2105 } else {
2106 /*
2107 * We're doing a live capture.
2108 */
2109 if (device == NULL) {
2110 /*
2111 * No interface was specified. Pick one.
2112 */
2113 #ifdef HAVE_PCAP_FINDALLDEVS
2114 /*
2115 * Find the list of interfaces, and pick
2116 * the first interface.
2117 */
2118 if (pcap_findalldevs(&devlist, ebuf) == -1)
2119 error("%s", ebuf);
2120 if (devlist == NULL)
2121 error("no interfaces available for capture");
2122 device = strdup(devlist->name);
2123 pcap_freealldevs(devlist);
2124 #else /* HAVE_PCAP_FINDALLDEVS */
2125 /*
2126 * Use whatever interface pcap_lookupdev()
2127 * chooses.
2128 */
2129 device = pcap_lookupdev(ebuf);
2130 if (device == NULL)
2131 error("%s", ebuf);
2132 #endif
2133 }
2134
2135 /*
2136 * Try to open the interface with the specified name.
2137 */
2138 pd = open_interface(device, ndo, ebuf);
2139 if (pd == NULL) {
2140 /*
2141 * That failed. If we can get a list of
2142 * interfaces, and the interface name
2143 * is purely numeric, try to use it as
2144 * a 1-based index in the list of
2145 * interfaces.
2146 */
2147 #ifdef HAVE_PCAP_FINDALLDEVS
2148 devnum = parse_interface_number(device);
2149 if (devnum == -1) {
2150 /*
2151 * It's not a number; just report
2152 * the open error and fail.
2153 */
2154 error("%s", ebuf);
2155 }
2156
2157 /*
2158 * OK, it's a number; try to find the
2159 * interface with that index, and try
2160 * to open it.
2161 *
2162 * find_interface_by_number() exits if it
2163 * couldn't be found.
2164 */
2165 device = find_interface_by_number(device, devnum);
2166 pd = open_interface(device, ndo, ebuf);
2167 if (pd == NULL)
2168 error("%s", ebuf);
2169 #else /* HAVE_PCAP_FINDALLDEVS */
2170 /*
2171 * We can't get a list of interfaces; just
2172 * fail.
2173 */
2174 error("%s", ebuf);
2175 #endif /* HAVE_PCAP_FINDALLDEVS */
2176 }
2177
2178 /*
2179 * Let user own process after capture device has
2180 * been opened.
2181 */
2182 #ifndef _WIN32
2183 if (setgid(getgid()) != 0 || setuid(getuid()) != 0)
2184 fprintf(stderr, "Warning: setgid/setuid failed !\n");
2185 #endif /* _WIN32 */
2186 #if !defined(HAVE_PCAP_CREATE) && defined(_WIN32)
2187 if(Bflag != 0)
2188 if(pcap_setbuff(pd, Bflag)==-1){
2189 error("%s", pcap_geterr(pd));
2190 }
2191 #endif /* !defined(HAVE_PCAP_CREATE) && defined(_WIN32) */
2192 if (Lflag)
2193 show_dlts_and_exit(pd, device);
2194 if (yflag_dlt >= 0) {
2195 #ifdef HAVE_PCAP_SET_DATALINK
2196 if (pcap_set_datalink(pd, yflag_dlt) < 0)
2197 error("%s", pcap_geterr(pd));
2198 #else
2199 /*
2200 * We don't actually support changing the
2201 * data link type, so we only let them
2202 * set it to what it already is.
2203 */
2204 if (yflag_dlt != pcap_datalink(pd)) {
2205 error("%s is not one of the DLTs supported by this device\n",
2206 yflag_dlt_name);
2207 }
2208 #endif
2209 (void)fprintf(stderr, "%s: data link type %s\n",
2210 program_name,
2211 pcap_datalink_val_to_name(yflag_dlt));
2212 (void)fflush(stderr);
2213 }
2214 i = pcap_snapshot(pd);
2215 if (ndo->ndo_snaplen < i) {
2216 if (ndo->ndo_snaplen != 0)
2217 warning("snaplen raised from %d to %d", ndo->ndo_snaplen, i);
2218 ndo->ndo_snaplen = i;
2219 } else if (ndo->ndo_snaplen > i) {
2220 warning("snaplen lowered from %d to %d", ndo->ndo_snaplen, i);
2221 ndo->ndo_snaplen = i;
2222 }
2223 if(ndo->ndo_fflag != 0) {
2224 if (pcap_lookupnet(device, &localnet, &netmask, ebuf) < 0) {
2225 warning("foreign (-f) flag used but: %s", ebuf);
2226 }
2227 }
2228
2229 }
2230 if (infile)
2231 cmdbuf = read_infile(infile);
2232 else
2233 cmdbuf = copy_argv(&argv[optind]);
2234
2235 #ifdef HAVE_PCAP_SET_OPTIMIZER_DEBUG
2236 pcap_set_optimizer_debug(dflag);
2237 #endif
2238 if (pcap_compile(pd, &fcode, cmdbuf, Oflag, netmask) < 0)
2239 error("%s", pcap_geterr(pd));
2240 if (dflag) {
2241 bpf_dump(&fcode, dflag);
2242 pcap_close(pd);
2243 free(cmdbuf);
2244 pcap_freecode(&fcode);
2245 exit_tcpdump(S_SUCCESS);
2246 }
2247
2248 #ifdef HAVE_CASPER
2249 if (!ndo->ndo_nflag)
2250 capdns = capdns_setup();
2251 #endif /* HAVE_CASPER */
2252
2253 init_print(ndo, localnet, netmask);
2254
2255 #ifndef _WIN32
2256 (void)setsignal(SIGPIPE, cleanup);
2257 (void)setsignal(SIGTERM, cleanup);
2258 #endif /* _WIN32 */
2259 (void)setsignal(SIGINT, cleanup);
2260 #if defined(HAVE_FORK) || defined(HAVE_VFORK)
2261 (void)setsignal(SIGCHLD, child_cleanup);
2262 #endif
2263 /* Cooperate with nohup(1) */
2264 #ifndef _WIN32
2265 if ((oldhandler = setsignal(SIGHUP, cleanup)) != SIG_DFL)
2266 (void)setsignal(SIGHUP, oldhandler);
2267 #endif /* _WIN32 */
2268
2269 #ifndef _WIN32
2270 /*
2271 * If a user name was specified with "-Z", attempt to switch to
2272 * that user's UID. This would probably be used with sudo,
2273 * to allow tcpdump to be run in a special restricted
2274 * account (if you just want to allow users to open capture
2275 * devices, and can't just give users that permission,
2276 * you'd make tcpdump set-UID or set-GID).
2277 *
2278 * Tcpdump doesn't necessarily write only to one savefile;
2279 * the general only way to allow a -Z instance to write to
2280 * savefiles as the user under whose UID it's run, rather
2281 * than as the user specified with -Z, would thus be to switch
2282 * to the original user ID before opening a capture file and
2283 * then switch back to the -Z user ID after opening the savefile.
2284 * Switching to the -Z user ID only after opening the first
2285 * savefile doesn't handle the general case.
2286 */
2287
2288 if (getuid() == 0 || geteuid() == 0) {
2289 #ifdef HAVE_LIBCAP_NG
2290 /* Initialize capng */
2291 capng_clear(CAPNG_SELECT_BOTH);
2292 if (username) {
2293 DIAG_OFF_CLANG(assign-enum)
2294 capng_updatev(
2295 CAPNG_ADD,
2296 CAPNG_PERMITTED | CAPNG_EFFECTIVE,
2297 CAP_SETUID,
2298 CAP_SETGID,
2299 -1);
2300 DIAG_ON_CLANG(assign-enum)
2301 }
2302 if (chroot_dir) {
2303 DIAG_OFF_CLANG(assign-enum)
2304 capng_update(
2305 CAPNG_ADD,
2306 CAPNG_PERMITTED | CAPNG_EFFECTIVE,
2307 CAP_SYS_CHROOT
2308 );
2309 DIAG_ON_CLANG(assign-enum)
2310 }
2311
2312 if (WFileName) {
2313 DIAG_OFF_CLANG(assign-enum)
2314 capng_update(
2315 CAPNG_ADD,
2316 CAPNG_PERMITTED | CAPNG_EFFECTIVE,
2317 CAP_DAC_OVERRIDE
2318 );
2319 DIAG_ON_CLANG(assign-enum)
2320 }
2321 capng_apply(CAPNG_SELECT_BOTH);
2322 #endif /* HAVE_LIBCAP_NG */
2323 if (username || chroot_dir)
2324 droproot(username, chroot_dir);
2325
2326 }
2327 #endif /* _WIN32 */
2328
2329 if (pcap_setfilter(pd, &fcode) < 0)
2330 error("%s", pcap_geterr(pd));
2331 #ifdef HAVE_CAPSICUM
2332 if (RFileName == NULL && VFileName == NULL && pcap_fileno(pd) != -1) {
2333 static const unsigned long cmds[] = { BIOCGSTATS, BIOCROTZBUF };
2334
2335 /*
2336 * The various libpcap devices use a combination of
2337 * read (bpf), ioctl (bpf, netmap), poll (netmap)
2338 * so we add the relevant access rights.
2339 */
2340 cap_rights_init(&rights, CAP_IOCTL, CAP_READ, CAP_EVENT);
2341 if (cap_rights_limit(pcap_fileno(pd), &rights) < 0 &&
2342 errno != ENOSYS) {
2343 error("unable to limit pcap descriptor");
2344 }
2345 if (cap_ioctls_limit(pcap_fileno(pd), cmds,
2346 sizeof(cmds) / sizeof(cmds[0])) < 0 && errno != ENOSYS) {
2347 error("unable to limit ioctls on pcap descriptor");
2348 }
2349 }
2350 #endif
2351 if (WFileName) {
2352 /* Do not exceed the default PATH_MAX for files. */
2353 dumpinfo.CurrentFileName = (char *)malloc(PATH_MAX + 1);
2354
2355 if (dumpinfo.CurrentFileName == NULL)
2356 error("malloc of dumpinfo.CurrentFileName");
2357
2358 /* We do not need numbering for dumpfiles if Cflag isn't set. */
2359 if (Cflag != 0)
2360 MakeFilename(dumpinfo.CurrentFileName, WFileName, 0, WflagChars);
2361 else
2362 MakeFilename(dumpinfo.CurrentFileName, WFileName, 0, 0);
2363
2364 pdd = pcap_dump_open(pd, dumpinfo.CurrentFileName);
2365 #ifdef HAVE_LIBCAP_NG
2366 /* Give up CAP_DAC_OVERRIDE capability.
2367 * Only allow it to be restored if the -C or -G flag have been
2368 * set since we may need to create more files later on.
2369 */
2370 capng_update(
2371 CAPNG_DROP,
2372 (Cflag || Gflag ? 0 : CAPNG_PERMITTED)
2373 | CAPNG_EFFECTIVE,
2374 CAP_DAC_OVERRIDE
2375 );
2376 capng_apply(CAPNG_SELECT_BOTH);
2377 #endif /* HAVE_LIBCAP_NG */
2378 if (pdd == NULL)
2379 error("%s", pcap_geterr(pd));
2380 #ifdef HAVE_CAPSICUM
2381 set_dumper_capsicum_rights(pdd);
2382 #endif
2383 if (Cflag != 0 || Gflag != 0) {
2384 #ifdef HAVE_CAPSICUM
2385 dumpinfo.WFileName = strdup(basename(WFileName));
2386 if (dumpinfo.WFileName == NULL) {
2387 error("Unable to allocate memory for file %s",
2388 WFileName);
2389 }
2390 dumpinfo.dirfd = open(dirname(WFileName),
2391 O_DIRECTORY | O_RDONLY);
2392 if (dumpinfo.dirfd < 0) {
2393 error("unable to open directory %s",
2394 dirname(WFileName));
2395 }
2396 cap_rights_init(&rights, CAP_CREATE, CAP_FCNTL,
2397 CAP_FTRUNCATE, CAP_LOOKUP, CAP_SEEK, CAP_WRITE);
2398 if (cap_rights_limit(dumpinfo.dirfd, &rights) < 0 &&
2399 errno != ENOSYS) {
2400 error("unable to limit directory rights");
2401 }
2402 if (cap_fcntls_limit(dumpinfo.dirfd, CAP_FCNTL_GETFL) < 0 &&
2403 errno != ENOSYS) {
2404 error("unable to limit dump descriptor fcntls");
2405 }
2406 #else /* !HAVE_CAPSICUM */
2407 dumpinfo.WFileName = WFileName;
2408 #endif
2409 callback = dump_packet_and_trunc;
2410 dumpinfo.pd = pd;
2411 dumpinfo.pdd = pdd;
2412 pcap_userdata = (u_char *)&dumpinfo;
2413 } else {
2414 callback = dump_packet;
2415 dumpinfo.WFileName = WFileName;
2416 dumpinfo.pd = pd;
2417 dumpinfo.pdd = pdd;
2418 pcap_userdata = (u_char *)&dumpinfo;
2419 }
2420 if (print) {
2421 dlt = pcap_datalink(pd);
2422 ndo->ndo_if_printer = get_if_printer(dlt);
2423 dumpinfo.ndo = ndo;
2424 } else
2425 dumpinfo.ndo = NULL;
2426
2427 #ifdef HAVE_PCAP_DUMP_FLUSH
2428 if (Uflag)
2429 pcap_dump_flush(pdd);
2430 #endif
2431 } else {
2432 dlt = pcap_datalink(pd);
2433 ndo->ndo_if_printer = get_if_printer(dlt);
2434 callback = print_packet;
2435 pcap_userdata = (u_char *)ndo;
2436 }
2437
2438 #ifdef SIGNAL_REQ_INFO
2439 /*
2440 * We can't get statistics when reading from a file rather
2441 * than capturing from a device.
2442 */
2443 if (RFileName == NULL)
2444 (void)setsignal(SIGNAL_REQ_INFO, requestinfo);
2445 #endif
2446 #ifdef SIGNAL_FLUSH_PCAP
2447 (void)setsignal(SIGNAL_FLUSH_PCAP, flushpcap);
2448 #endif
2449
2450 if (ndo->ndo_vflag > 0 && WFileName && RFileName == NULL && !print) {
2451 /*
2452 * When capturing to a file, if "--print" wasn't specified,
2453 *"-v" means tcpdump should, once per second,
2454 * "v"erbosely report the number of packets captured.
2455 * Except when reading from a file, because -r, -w and -v
2456 * together used to make a corner case, in which pcap_loop()
2457 * errored due to EINTR (see GH #155 for details).
2458 */
2459 #ifdef _WIN32
2460 /*
2461 * https://blogs.msdn.microsoft.com/oldnewthing/20151230-00/?p=92741
2462 *
2463 * suggests that this dates back to W2K.
2464 *
2465 * I don't know what a "long wait" is, but we'll assume
2466 * that printing the stats could be a "long wait".
2467 */
2468 CreateTimerQueueTimer(&timer_handle, NULL,
2469 verbose_stats_dump, NULL, 1000, 1000,
2470 WT_EXECUTEDEFAULT|WT_EXECUTELONGFUNCTION);
2471 setvbuf(stderr, NULL, _IONBF, 0);
2472 #else /* _WIN32 */
2473 /*
2474 * Assume this is UN*X, and that it has setitimer(); that
2475 * dates back to UNIX 95.
2476 */
2477 struct itimerval timer;
2478 (void)setsignal(SIGALRM, verbose_stats_dump);
2479 timer.it_interval.tv_sec = 1;
2480 timer.it_interval.tv_usec = 0;
2481 timer.it_value.tv_sec = 1;
2482 timer.it_value.tv_usec = 1;
2483 setitimer(ITIMER_REAL, &timer, NULL);
2484 #endif /* _WIN32 */
2485 }
2486
2487 if (RFileName == NULL) {
2488 /*
2489 * Live capture (if -V was specified, we set RFileName
2490 * to a file from the -V file). Print a message to
2491 * the standard error on UN*X.
2492 */
2493 if (!ndo->ndo_vflag && !WFileName) {
2494 (void)fprintf(stderr,
2495 "%s: verbose output suppressed, use -v[v]... for full protocol decode\n",
2496 program_name);
2497 } else
2498 (void)fprintf(stderr, "%s: ", program_name);
2499 dlt = pcap_datalink(pd);
2500 dlt_name = pcap_datalink_val_to_name(dlt);
2501 (void)fprintf(stderr, "listening on %s", device);
2502 if (dlt_name == NULL) {
2503 (void)fprintf(stderr, ", link-type %u", dlt);
2504 } else {
2505 (void)fprintf(stderr, ", link-type %s (%s)", dlt_name,
2506 pcap_datalink_val_to_description(dlt));
2507 }
2508 (void)fprintf(stderr, ", snapshot length %d bytes\n", ndo->ndo_snaplen);
2509 (void)fflush(stderr);
2510 }
2511
2512 #ifdef HAVE_CAPSICUM
2513 cansandbox = (VFileName == NULL && zflag == NULL);
2514 #ifdef HAVE_CASPER
2515 cansandbox = (cansandbox && (ndo->ndo_nflag || capdns != NULL));
2516 #else
2517 cansandbox = (cansandbox && ndo->ndo_nflag);
2518 #endif /* HAVE_CASPER */
2519 if (cansandbox && cap_enter() < 0 && errno != ENOSYS)
2520 error("unable to enter the capability mode");
2521 #endif /* HAVE_CAPSICUM */
2522
2523 do {
2524 status = pcap_loop(pd, cnt, callback, pcap_userdata);
2525 if (WFileName == NULL) {
2526 /*
2527 * We're printing packets. Flush the printed output,
2528 * so it doesn't get intermingled with error output.
2529 */
2530 if (status == -2) {
2531 /*
2532 * We got interrupted, so perhaps we didn't
2533 * manage to finish a line we were printing.
2534 * Print an extra newline, just in case.
2535 */
2536 putchar('\n');
2537 }
2538 (void)fflush(stdout);
2539 }
2540 if (status == -2) {
2541 /*
2542 * We got interrupted. If we are reading multiple
2543 * files (via -V) set these so that we stop.
2544 */
2545 VFileName = NULL;
2546 ret = NULL;
2547 }
2548 if (status == -1) {
2549 /*
2550 * Error. Report it.
2551 */
2552 (void)fprintf(stderr, "%s: pcap_loop: %s\n",
2553 program_name, pcap_geterr(pd));
2554 }
2555 if (RFileName == NULL) {
2556 /*
2557 * We're doing a live capture. Report the capture
2558 * statistics.
2559 */
2560 info(1);
2561 }
2562 pcap_close(pd);
2563 if (VFileName != NULL) {
2564 ret = get_next_file(VFile, VFileLine);
2565 if (ret) {
2566 int new_dlt;
2567
2568 RFileName = VFileLine;
2569 pd = pcap_open_offline(RFileName, ebuf);
2570 if (pd == NULL)
2571 error("%s", ebuf);
2572 #ifdef HAVE_CAPSICUM
2573 cap_rights_init(&rights, CAP_READ);
2574 if (cap_rights_limit(fileno(pcap_file(pd)),
2575 &rights) < 0 && errno != ENOSYS) {
2576 error("unable to limit pcap descriptor");
2577 }
2578 #endif
2579 new_dlt = pcap_datalink(pd);
2580 if (new_dlt != dlt) {
2581 /*
2582 * The new file has a different
2583 * link-layer header type from the
2584 * previous one.
2585 */
2586 if (WFileName != NULL) {
2587 /*
2588 * We're writing raw packets
2589 * that match the filter to
2590 * a pcap file. pcap files
2591 * don't support multiple
2592 * different link-layer
2593 * header types, so we fail
2594 * here.
2595 */
2596 error("%s: new dlt does not match original", RFileName);
2597 }
2598
2599 /*
2600 * We're printing the decoded packets;
2601 * switch to the new DLT.
2602 *
2603 * To do that, we need to change
2604 * the printer, change the DLT name,
2605 * and recompile the filter with
2606 * the new DLT.
2607 */
2608 dlt = new_dlt;
2609 ndo->ndo_if_printer = get_if_printer(dlt);
2610 if (pcap_compile(pd, &fcode, cmdbuf, Oflag, netmask) < 0)
2611 error("%s", pcap_geterr(pd));
2612 }
2613
2614 /*
2615 * Set the filter on the new file.
2616 */
2617 if (pcap_setfilter(pd, &fcode) < 0)
2618 error("%s", pcap_geterr(pd));
2619
2620 /*
2621 * Report the new file.
2622 */
2623 dlt_name = pcap_datalink_val_to_name(dlt);
2624 fprintf(stderr, "reading from file %s", RFileName);
2625 if (dlt_name == NULL) {
2626 fprintf(stderr, ", link-type %u", dlt);
2627 } else {
2628 fprintf(stderr, ", link-type %s (%s)",
2629 dlt_name,
2630 pcap_datalink_val_to_description(dlt));
2631 }
2632 fprintf(stderr, ", snapshot length %d\n", pcap_snapshot(pd));
2633 }
2634 }
2635 }
2636 while (ret != NULL);
2637
2638 if (count_mode && RFileName != NULL)
2639 fprintf(stdout, "%u packet%s\n", packets_captured,
2640 PLURAL_SUFFIX(packets_captured));
2641
2642 free(cmdbuf);
2643 pcap_freecode(&fcode);
2644 exit_tcpdump(status == -1 ? 1 : 0);
2645 }
2646
2647 /*
2648 * Catch a signal.
2649 */
2650 static void
setsignal(int sig,void (* func)(int))2651 (*setsignal (int sig, void (*func)(int)))(int)
2652 {
2653 #ifdef _WIN32
2654 return (signal(sig, func));
2655 #else
2656 struct sigaction old, new;
2657
2658 memset(&new, 0, sizeof(new));
2659 new.sa_handler = func;
2660 if (sig == SIGCHLD)
2661 new.sa_flags = SA_RESTART;
2662 if (sigaction(sig, &new, &old) < 0)
2663 return (SIG_ERR);
2664 return (old.sa_handler);
2665 #endif
2666 }
2667
2668 /* make a clean exit on interrupts */
2669 static void
cleanup(int signo _U_)2670 cleanup(int signo _U_)
2671 {
2672 #ifdef _WIN32
2673 if (timer_handle != INVALID_HANDLE_VALUE) {
2674 DeleteTimerQueueTimer(NULL, timer_handle, NULL);
2675 CloseHandle(timer_handle);
2676 timer_handle = INVALID_HANDLE_VALUE;
2677 }
2678 #else /* _WIN32 */
2679 struct itimerval timer;
2680
2681 timer.it_interval.tv_sec = 0;
2682 timer.it_interval.tv_usec = 0;
2683 timer.it_value.tv_sec = 0;
2684 timer.it_value.tv_usec = 0;
2685 setitimer(ITIMER_REAL, &timer, NULL);
2686 #endif /* _WIN32 */
2687
2688 #ifdef HAVE_PCAP_BREAKLOOP
2689 /*
2690 * We have "pcap_breakloop()"; use it, so that we do as little
2691 * as possible in the signal handler (it's probably not safe
2692 * to do anything with standard I/O streams in a signal handler -
2693 * the ANSI C standard doesn't say it is).
2694 */
2695 pcap_breakloop(pd);
2696 #else
2697 /*
2698 * We don't have "pcap_breakloop()"; this isn't safe, but
2699 * it's the best we can do. Print the summary if we're
2700 * not reading from a savefile - i.e., if we're doing a
2701 * live capture - and exit.
2702 */
2703 if (pd != NULL && pcap_file(pd) == NULL) {
2704 /*
2705 * We got interrupted, so perhaps we didn't
2706 * manage to finish a line we were printing.
2707 * Print an extra newline, just in case.
2708 */
2709 putchar('\n');
2710 (void)fflush(stdout);
2711 info(1);
2712 }
2713 exit_tcpdump(S_SUCCESS);
2714 #endif
2715 }
2716
2717 /*
2718 On windows, we do not use a fork, so we do not care less about
2719 waiting a child processes to die
2720 */
2721 #if defined(HAVE_FORK) || defined(HAVE_VFORK)
2722 static void
child_cleanup(int signo _U_)2723 child_cleanup(int signo _U_)
2724 {
2725 wait(NULL);
2726 }
2727 #endif /* HAVE_FORK && HAVE_VFORK */
2728
2729 static void
info(int verbose)2730 info(int verbose)
2731 {
2732 struct pcap_stat stats;
2733
2734 /*
2735 * Older versions of libpcap didn't set ps_ifdrop on some
2736 * platforms; initialize it to 0 to handle that.
2737 */
2738 stats.ps_ifdrop = 0;
2739 if (pcap_stats(pd, &stats) < 0) {
2740 (void)fprintf(stderr, "pcap_stats: %s\n", pcap_geterr(pd));
2741 infoprint = 0;
2742 return;
2743 }
2744
2745 if (!verbose)
2746 fprintf(stderr, "%s: ", program_name);
2747
2748 (void)fprintf(stderr, "%u packet%s captured", packets_captured,
2749 PLURAL_SUFFIX(packets_captured));
2750 if (!verbose)
2751 fputs(", ", stderr);
2752 else
2753 putc('\n', stderr);
2754 (void)fprintf(stderr, "%u packet%s received by filter", stats.ps_recv,
2755 PLURAL_SUFFIX(stats.ps_recv));
2756 if (!verbose)
2757 fputs(", ", stderr);
2758 else
2759 putc('\n', stderr);
2760 (void)fprintf(stderr, "%u packet%s dropped by kernel", stats.ps_drop,
2761 PLURAL_SUFFIX(stats.ps_drop));
2762 if (stats.ps_ifdrop != 0) {
2763 if (!verbose)
2764 fputs(", ", stderr);
2765 else
2766 putc('\n', stderr);
2767 (void)fprintf(stderr, "%u packet%s dropped by interface\n",
2768 stats.ps_ifdrop, PLURAL_SUFFIX(stats.ps_ifdrop));
2769 } else
2770 putc('\n', stderr);
2771 infoprint = 0;
2772 }
2773
2774 #if defined(HAVE_FORK) || defined(HAVE_VFORK)
2775 #ifdef HAVE_FORK
2776 #define fork_subprocess() fork()
2777 #else
2778 #define fork_subprocess() vfork()
2779 #endif
2780 static void
compress_savefile(const char * filename)2781 compress_savefile(const char *filename)
2782 {
2783 pid_t child;
2784
2785 child = fork_subprocess();
2786 if (child == -1) {
2787 fprintf(stderr,
2788 "compress_savefile: fork failed: %s\n",
2789 pcap_strerror(errno));
2790 return;
2791 }
2792 if (child != 0) {
2793 /* Parent process. */
2794 return;
2795 }
2796
2797 /*
2798 * Child process.
2799 * Set to lowest priority so that this doesn't disturb the capture.
2800 */
2801 #ifdef NZERO
2802 setpriority(PRIO_PROCESS, 0, NZERO - 1);
2803 #else
2804 setpriority(PRIO_PROCESS, 0, 19);
2805 #endif
2806 if (execlp(zflag, zflag, filename, (char *)NULL) == -1)
2807 fprintf(stderr,
2808 "compress_savefile: execlp(%s, %s) failed: %s\n",
2809 zflag,
2810 filename,
2811 pcap_strerror(errno));
2812 #ifdef HAVE_FORK
2813 exit(S_ERR_HOST_PROGRAM);
2814 #else
2815 _exit(S_ERR_HOST_PROGRAM);
2816 #endif
2817 }
2818 #else /* HAVE_FORK && HAVE_VFORK */
2819 static void
compress_savefile(const char * filename)2820 compress_savefile(const char *filename)
2821 {
2822 fprintf(stderr,
2823 "compress_savefile failed. Functionality not implemented under your system\n");
2824 }
2825 #endif /* HAVE_FORK && HAVE_VFORK */
2826
2827 static void
dump_packet_and_trunc(u_char * user,const struct pcap_pkthdr * h,const u_char * sp)2828 dump_packet_and_trunc(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
2829 {
2830 struct dump_info *dump_info;
2831
2832 ++packets_captured;
2833
2834 ++infodelay;
2835
2836 dump_info = (struct dump_info *)user;
2837
2838 /*
2839 * XXX - this won't force the file to rotate on the specified time
2840 * boundary, but it will rotate on the first packet received after the
2841 * specified Gflag number of seconds. Note: if a Gflag time boundary
2842 * and a Cflag size boundary coincide, the time rotation will occur
2843 * first thereby cancelling the Cflag boundary (since the file should
2844 * be 0).
2845 */
2846 if (Gflag != 0) {
2847 /* Check if it is time to rotate */
2848 time_t t;
2849
2850 /* Get the current time */
2851 if ((t = time(NULL)) == (time_t)-1) {
2852 error("%s: can't get current_time: %s",
2853 __func__, pcap_strerror(errno));
2854 }
2855
2856
2857 /* If the time is greater than the specified window, rotate */
2858 if (t - Gflag_time >= Gflag) {
2859 #ifdef HAVE_CAPSICUM
2860 FILE *fp;
2861 int fd;
2862 #endif
2863
2864 /* Update the Gflag_time */
2865 Gflag_time = t;
2866 /* Update Gflag_count */
2867 Gflag_count++;
2868 /*
2869 * Close the current file and open a new one.
2870 */
2871 pcap_dump_close(dump_info->pdd);
2872
2873 /*
2874 * Compress the file we just closed, if the user asked for it
2875 */
2876 if (zflag != NULL)
2877 compress_savefile(dump_info->CurrentFileName);
2878
2879 /*
2880 * Check to see if we've exceeded the Wflag (when
2881 * not using Cflag).
2882 */
2883 if (Cflag == 0 && Wflag > 0 && Gflag_count >= Wflag) {
2884 (void)fprintf(stderr, "Maximum file limit reached: %d\n",
2885 Wflag);
2886 info(1);
2887 exit_tcpdump(S_SUCCESS);
2888 /* NOTREACHED */
2889 }
2890 if (dump_info->CurrentFileName != NULL)
2891 free(dump_info->CurrentFileName);
2892 /* Allocate space for max filename + \0. */
2893 dump_info->CurrentFileName = (char *)malloc(PATH_MAX + 1);
2894 if (dump_info->CurrentFileName == NULL)
2895 error("dump_packet_and_trunc: malloc");
2896 /*
2897 * Gflag was set otherwise we wouldn't be here. Reset the count
2898 * so multiple files would end with 1,2,3 in the filename.
2899 * The counting is handled with the -C flow after this.
2900 */
2901 Cflag_count = 0;
2902
2903 /*
2904 * This is always the first file in the Cflag
2905 * rotation: e.g. 0
2906 * We also don't need numbering if Cflag is not set.
2907 */
2908 if (Cflag != 0)
2909 MakeFilename(dump_info->CurrentFileName, dump_info->WFileName, 0,
2910 WflagChars);
2911 else
2912 MakeFilename(dump_info->CurrentFileName, dump_info->WFileName, 0, 0);
2913
2914 #ifdef HAVE_LIBCAP_NG
2915 capng_update(CAPNG_ADD, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE);
2916 capng_apply(CAPNG_SELECT_BOTH);
2917 #endif /* HAVE_LIBCAP_NG */
2918 #ifdef HAVE_CAPSICUM
2919 fd = openat(dump_info->dirfd,
2920 dump_info->CurrentFileName,
2921 O_CREAT | O_WRONLY | O_TRUNC, 0644);
2922 if (fd < 0) {
2923 error("unable to open file %s",
2924 dump_info->CurrentFileName);
2925 }
2926 fp = fdopen(fd, "w");
2927 if (fp == NULL) {
2928 error("unable to fdopen file %s",
2929 dump_info->CurrentFileName);
2930 }
2931 dump_info->pdd = pcap_dump_fopen(dump_info->pd, fp);
2932 #else /* !HAVE_CAPSICUM */
2933 dump_info->pdd = pcap_dump_open(dump_info->pd, dump_info->CurrentFileName);
2934 #endif
2935 #ifdef HAVE_LIBCAP_NG
2936 capng_update(CAPNG_DROP, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE);
2937 capng_apply(CAPNG_SELECT_BOTH);
2938 #endif /* HAVE_LIBCAP_NG */
2939 if (dump_info->pdd == NULL)
2940 error("%s", pcap_geterr(pd));
2941 #ifdef HAVE_CAPSICUM
2942 set_dumper_capsicum_rights(dump_info->pdd);
2943 #endif
2944 }
2945 }
2946
2947 /*
2948 * XXX - this won't prevent capture files from getting
2949 * larger than Cflag - the last packet written to the
2950 * file could put it over Cflag.
2951 */
2952 if (Cflag != 0) {
2953 #ifdef HAVE_PCAP_DUMP_FTELL64
2954 int64_t size = pcap_dump_ftell64(dump_info->pdd);
2955 #else
2956 /*
2957 * XXX - this only handles a Cflag value > 2^31-1 on
2958 * LP64 platforms; to handle ILP32 (32-bit UN*X and
2959 * Windows) or LLP64 (64-bit Windows) would require
2960 * a version of libpcap with pcap_dump_ftell64().
2961 */
2962 long size = pcap_dump_ftell(dump_info->pdd);
2963 #endif
2964
2965 if (size == -1)
2966 error("ftell fails on output file");
2967 if (size > Cflag) {
2968 #ifdef HAVE_CAPSICUM
2969 FILE *fp;
2970 int fd;
2971 #endif
2972
2973 /*
2974 * Close the current file and open a new one.
2975 */
2976 pcap_dump_close(dump_info->pdd);
2977
2978 /*
2979 * Compress the file we just closed, if the user
2980 * asked for it.
2981 */
2982 if (zflag != NULL)
2983 compress_savefile(dump_info->CurrentFileName);
2984
2985 Cflag_count++;
2986 if (Wflag > 0) {
2987 if (Cflag_count >= Wflag)
2988 Cflag_count = 0;
2989 }
2990 if (dump_info->CurrentFileName != NULL)
2991 free(dump_info->CurrentFileName);
2992 dump_info->CurrentFileName = (char *)malloc(PATH_MAX + 1);
2993 if (dump_info->CurrentFileName == NULL)
2994 error("%s: malloc", __func__);
2995 MakeFilename(dump_info->CurrentFileName, dump_info->WFileName, Cflag_count, WflagChars);
2996 #ifdef HAVE_LIBCAP_NG
2997 capng_update(CAPNG_ADD, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE);
2998 capng_apply(CAPNG_SELECT_BOTH);
2999 #endif /* HAVE_LIBCAP_NG */
3000 #ifdef HAVE_CAPSICUM
3001 fd = openat(dump_info->dirfd, dump_info->CurrentFileName,
3002 O_CREAT | O_WRONLY | O_TRUNC, 0644);
3003 if (fd < 0) {
3004 error("unable to open file %s",
3005 dump_info->CurrentFileName);
3006 }
3007 fp = fdopen(fd, "w");
3008 if (fp == NULL) {
3009 error("unable to fdopen file %s",
3010 dump_info->CurrentFileName);
3011 }
3012 dump_info->pdd = pcap_dump_fopen(dump_info->pd, fp);
3013 #else /* !HAVE_CAPSICUM */
3014 dump_info->pdd = pcap_dump_open(dump_info->pd, dump_info->CurrentFileName);
3015 #endif
3016 #ifdef HAVE_LIBCAP_NG
3017 capng_update(CAPNG_DROP, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE);
3018 capng_apply(CAPNG_SELECT_BOTH);
3019 #endif /* HAVE_LIBCAP_NG */
3020 if (dump_info->pdd == NULL)
3021 error("%s", pcap_geterr(pd));
3022 #ifdef HAVE_CAPSICUM
3023 set_dumper_capsicum_rights(dump_info->pdd);
3024 #endif
3025 }
3026 }
3027
3028 pcap_dump((u_char *)dump_info->pdd, h, sp);
3029 #ifdef HAVE_PCAP_DUMP_FLUSH
3030 if (Uflag)
3031 pcap_dump_flush(dump_info->pdd);
3032 #endif
3033
3034 if (dump_info->ndo != NULL)
3035 pretty_print_packet(dump_info->ndo, h, sp, packets_captured);
3036
3037 --infodelay;
3038 if (infoprint)
3039 info(0);
3040 }
3041
3042 static void
dump_packet(u_char * user,const struct pcap_pkthdr * h,const u_char * sp)3043 dump_packet(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
3044 {
3045 struct dump_info *dump_info;
3046
3047 ++packets_captured;
3048
3049 ++infodelay;
3050
3051 dump_info = (struct dump_info *)user;
3052
3053 pcap_dump((u_char *)dump_info->pdd, h, sp);
3054 #ifdef HAVE_PCAP_DUMP_FLUSH
3055 if (Uflag)
3056 pcap_dump_flush(dump_info->pdd);
3057 #endif
3058
3059 if (dump_info->ndo != NULL)
3060 pretty_print_packet(dump_info->ndo, h, sp, packets_captured);
3061
3062 --infodelay;
3063 if (infoprint)
3064 info(0);
3065 }
3066
3067 static void
print_packet(u_char * user,const struct pcap_pkthdr * h,const u_char * sp)3068 print_packet(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
3069 {
3070 ++packets_captured;
3071
3072 ++infodelay;
3073
3074 if (!count_mode)
3075 pretty_print_packet((netdissect_options *)user, h, sp, packets_captured);
3076
3077 --infodelay;
3078 if (infoprint)
3079 info(0);
3080 }
3081
3082 #ifdef SIGNAL_REQ_INFO
3083 static void
requestinfo(int signo _U_)3084 requestinfo(int signo _U_)
3085 {
3086 if (infodelay)
3087 ++infoprint;
3088 else
3089 info(0);
3090 }
3091 #endif
3092
3093 #ifdef SIGNAL_FLUSH_PCAP
3094 static void
flushpcap(int signo _U_)3095 flushpcap(int signo _U_)
3096 {
3097 if (pdd != NULL)
3098 pcap_dump_flush(pdd);
3099 }
3100 #endif
3101
3102 static void
print_packets_captured(void)3103 print_packets_captured (void)
3104 {
3105 static u_int prev_packets_captured, first = 1;
3106
3107 if (infodelay == 0 && (first || packets_captured != prev_packets_captured)) {
3108 fprintf(stderr, "Got %u\r", packets_captured);
3109 first = 0;
3110 prev_packets_captured = packets_captured;
3111 }
3112 }
3113
3114 /*
3115 * Called once each second in verbose mode while dumping to file
3116 */
3117 #ifdef _WIN32
verbose_stats_dump(PVOID param _U_,BOOLEAN timer_fired _U_)3118 static void CALLBACK verbose_stats_dump(PVOID param _U_,
3119 BOOLEAN timer_fired _U_)
3120 {
3121 print_packets_captured();
3122 }
3123 #else /* _WIN32 */
verbose_stats_dump(int sig _U_)3124 static void verbose_stats_dump(int sig _U_)
3125 {
3126 print_packets_captured();
3127 }
3128 #endif /* _WIN32 */
3129
3130 USES_APPLE_DEPRECATED_API
3131 static void
print_version(FILE * f)3132 print_version(FILE *f)
3133 {
3134 #ifndef HAVE_PCAP_LIB_VERSION
3135 #ifdef HAVE_PCAP_VERSION
3136 extern char pcap_version[];
3137 #else /* HAVE_PCAP_VERSION */
3138 static char pcap_version[] = "unknown";
3139 #endif /* HAVE_PCAP_VERSION */
3140 #endif /* HAVE_PCAP_LIB_VERSION */
3141 const char *smi_version_string;
3142
3143 (void)fprintf(f, "%s version " PACKAGE_VERSION "\n", program_name);
3144 #ifdef HAVE_PCAP_LIB_VERSION
3145 (void)fprintf(f, "%s\n", pcap_lib_version());
3146 #else /* HAVE_PCAP_LIB_VERSION */
3147 (void)fprintf(f, "libpcap version %s\n", pcap_version);
3148 #endif /* HAVE_PCAP_LIB_VERSION */
3149
3150 #if defined(HAVE_LIBCRYPTO) && defined(SSLEAY_VERSION)
3151 (void)fprintf (f, "%s\n", SSLeay_version(SSLEAY_VERSION));
3152 #endif
3153
3154 smi_version_string = nd_smi_version_string();
3155 if (smi_version_string != NULL)
3156 (void)fprintf (f, "SMI-library: %s\n", smi_version_string);
3157
3158 #if defined(__SANITIZE_ADDRESS__)
3159 (void)fprintf (f, "Compiled with AddressSanitizer/GCC.\n");
3160 #elif defined(__has_feature)
3161 # if __has_feature(address_sanitizer)
3162 (void)fprintf (f, "Compiled with AddressSanitizer/Clang.\n");
3163 # elif __has_feature(memory_sanitizer)
3164 (void)fprintf (f, "Compiled with MemorySanitizer/Clang.\n");
3165 # endif
3166 #endif /* __SANITIZE_ADDRESS__ or __has_feature */
3167 }
3168 USES_APPLE_RST
3169
3170 static void
print_usage(FILE * f)3171 print_usage(FILE *f)
3172 {
3173 print_version(f);
3174 (void)fprintf(f,
3175 "Usage: %s [-Abd" D_FLAG "efhH" I_FLAG J_FLAG "KlLnNOpqStu" U_FLAG "vxX#]" B_FLAG_USAGE " [ -c count ] [--count]\n", program_name);
3176 (void)fprintf(f,
3177 "\t\t[ -C file_size ] [ -E algo:secret ] [ -F file ] [ -G seconds ]\n");
3178 (void)fprintf(f,
3179 "\t\t[ -i interface ]" IMMEDIATE_MODE_USAGE j_FLAG_USAGE "\n");
3180 #ifdef HAVE_PCAP_FINDALLDEVS_EX
3181 (void)fprintf(f,
3182 "\t\t" LIST_REMOTE_INTERFACES_USAGE "\n");
3183 #endif
3184 #ifdef USE_LIBSMI
3185 (void)fprintf(f,
3186 "\t\t" m_FLAG_USAGE "\n");
3187 #endif
3188 (void)fprintf(f,
3189 "\t\t[ -M secret ] [ --number ] [ --print ]" Q_FLAG_USAGE "\n");
3190 (void)fprintf(f,
3191 "\t\t[ -r file ] [ -s snaplen ] [ -T type ] [ --version ]\n");
3192 (void)fprintf(f,
3193 "\t\t[ -V file ] [ -w file ] [ -W filecount ] [ -y datalinktype ]\n");
3194 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
3195 (void)fprintf(f,
3196 "\t\t[ --time-stamp-precision precision ] [ --micro ] [ --nano ]\n");
3197 #endif
3198 (void)fprintf(f,
3199 "\t\t[ -z postrotate-command ] [ -Z user ] [ expression ]\n");
3200 }
3201