1 /* 2 * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000 3 * The Regents of the University of California. All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that: (1) source code distributions 7 * retain the above copyright notice and this paragraph in its entirety, (2) 8 * distributions including binary code include the above copyright notice and 9 * this paragraph in its entirety in the documentation or other materials 10 * provided with the distribution, and (3) all advertising materials mentioning 11 * features or use of this software display the following acknowledgement: 12 * ``This product includes software developed by the University of California, 13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of 14 * the University nor the names of its contributors may be used to endorse 15 * or promote products derived from this software without specific prior 16 * written permission. 17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED 18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF 19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. 20 * 21 * Support for splitting captures into multiple files with a maximum 22 * file size: 23 * 24 * Copyright (c) 2001 25 * Seth Webster <swebster@sst.ll.mit.edu> 26 */ 27 28 /* 29 * tcpdump - dump traffic on a network 30 * 31 * First written in 1987 by Van Jacobson, Lawrence Berkeley Laboratory. 32 * Mercilessly hacked and occasionally improved since then via the 33 * combined efforts of Van, Steve McCanne and Craig Leres of LBL. 34 */ 35 36 #ifdef HAVE_CONFIG_H 37 #include <config.h> 38 #endif 39 40 /* 41 * Some older versions of Mac OS X may ship pcap.h from libpcap 0.6 with a 42 * libpcap based on 0.8. That means it has pcap_findalldevs() but the 43 * header doesn't define pcap_if_t, meaning that we can't actually *use* 44 * pcap_findalldevs(). 45 */ 46 #ifdef HAVE_PCAP_FINDALLDEVS 47 #ifndef HAVE_PCAP_IF_T 48 #undef HAVE_PCAP_FINDALLDEVS 49 #endif 50 #endif 51 52 #include "netdissect-stdinc.h" 53 54 /* 55 * This must appear after including netdissect-stdinc.h, so that _U_ is 56 * defined. 57 */ 58 #ifndef lint 59 static const char copyright[] _U_ = 60 "@(#) Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000\n\ 61 The Regents of the University of California. All rights reserved.\n"; 62 #endif 63 64 #include <sys/stat.h> 65 66 #ifdef HAVE_FCNTL_H 67 #include <fcntl.h> 68 #endif 69 70 #ifdef HAVE_LIBCRYPTO 71 #include <openssl/crypto.h> 72 #endif 73 74 #ifdef HAVE_GETOPT_LONG 75 #include <getopt.h> 76 #else 77 #include "missing/getopt_long.h" 78 #endif 79 /* Capsicum-specific code requires macros from <net/bpf.h>, which will fail 80 * to compile if <pcap.h> has already been included; including the headers 81 * in the opposite order works fine. 82 */ 83 #ifdef HAVE_CAPSICUM 84 #include <sys/capsicum.h> 85 #include <sys/ioccom.h> 86 #include <net/bpf.h> 87 #include <libgen.h> 88 #ifdef HAVE_CASPER 89 #include <libcasper.h> 90 #include <casper/cap_dns.h> 91 #include <sys/nv.h> 92 #endif /* HAVE_CASPER */ 93 #endif /* HAVE_CAPSICUM */ 94 #ifdef HAVE_PCAP_OPEN 95 /* 96 * We found pcap_open() in the capture library, so we'll be using 97 * the remote capture APIs; define PCAP_REMOTE before we include pcap.h, 98 * so we get those APIs declared, and the types and #defines that they 99 * use defined. 100 * 101 * WinPcap's headers require that PCAP_REMOTE be defined in order to get 102 * remote-capture APIs declared and types and #defines that they use 103 * defined. 104 * 105 * (Versions of libpcap with those APIs, and thus Npcap, which is based on 106 * those versions of libpcap, don't require it.) 107 */ 108 #define HAVE_REMOTE 109 #endif 110 #include <pcap.h> 111 #include <signal.h> 112 #include <stdio.h> 113 #include <stdarg.h> 114 #include <stdlib.h> 115 #include <string.h> 116 #include <limits.h> 117 #ifdef _WIN32 118 #include <windows.h> 119 #else 120 #include <sys/time.h> 121 #include <sys/wait.h> 122 #include <sys/resource.h> 123 #include <pwd.h> 124 #include <grp.h> 125 #endif /* _WIN32 */ 126 127 /* 128 * Pathname separator. 129 * Use this in pathnames, but do *not* use it in URLs. 130 */ 131 #ifdef _WIN32 132 #define PATH_SEPARATOR '\\' 133 #else 134 #define PATH_SEPARATOR '/' 135 #endif 136 137 /* capabilities convenience library */ 138 /* If a code depends on HAVE_LIBCAP_NG, it depends also on HAVE_CAP_NG_H. 139 * If HAVE_CAP_NG_H is not defined, undefine HAVE_LIBCAP_NG. 140 * Thus, the later tests are done only on HAVE_LIBCAP_NG. 141 */ 142 #ifdef HAVE_LIBCAP_NG 143 #ifdef HAVE_CAP_NG_H 144 #include <cap-ng.h> 145 #else 146 #undef HAVE_LIBCAP_NG 147 #endif /* HAVE_CAP_NG_H */ 148 #endif /* HAVE_LIBCAP_NG */ 149 150 #ifdef __FreeBSD__ 151 #include <sys/sysctl.h> 152 #endif /* __FreeBSD__ */ 153 154 #include "netdissect-stdinc.h" 155 #include "netdissect.h" 156 #include "interface.h" 157 #include "addrtoname.h" 158 #include "machdep.h" 159 #include "pcap-missing.h" 160 #include "ascii_strcasecmp.h" 161 162 #include "print.h" 163 164 #include "fptype.h" 165 166 #ifndef PATH_MAX 167 #define PATH_MAX 1024 168 #endif 169 170 #if defined(SIGINFO) 171 #define SIGNAL_REQ_INFO SIGINFO 172 #elif defined(SIGUSR1) 173 #define SIGNAL_REQ_INFO SIGUSR1 174 #endif 175 176 #if defined(HAVE_PCAP_DUMP_FLUSH) && defined(SIGUSR2) 177 #define SIGNAL_FLUSH_PCAP SIGUSR2 178 #endif 179 180 #if defined(HAVE_PCAP_CREATE) || defined(_WIN32) 181 static int Bflag; /* buffer size */ 182 #endif 183 #ifdef HAVE_PCAP_DUMP_FTELL64 184 static int64_t Cflag; /* rotate dump files after this many bytes */ 185 #else 186 static long Cflag; /* rotate dump files after this many bytes */ 187 #endif 188 static int Cflag_count; /* Keep track of which file number we're writing */ 189 #ifdef HAVE_PCAP_FINDALLDEVS 190 static int Dflag; /* list available devices and exit */ 191 #endif 192 #ifdef HAVE_PCAP_FINDALLDEVS_EX 193 static char *remote_interfaces_source; /* list available devices from this source and exit */ 194 #endif 195 196 /* 197 * This is exported because, in some versions of libpcap, if libpcap 198 * is built with optimizer debugging code (which is *NOT* the default 199 * configuration!), the library *imports*(!) a variable named dflag, 200 * under the expectation that tcpdump is exporting it, to govern 201 * how much debugging information to print when optimizing 202 * the generated BPF code. 203 * 204 * This is a horrible hack; newer versions of libpcap don't import 205 * dflag but, instead, *if* built with optimizer debugging code, 206 * *export* a routine to set that flag. 207 */ 208 extern int dflag; 209 int dflag; /* print filter code */ 210 static int Gflag; /* rotate dump files after this many seconds */ 211 static int Gflag_count; /* number of files created with Gflag rotation */ 212 static time_t Gflag_time; /* The last time_t the dump file was rotated. */ 213 static int Lflag; /* list available data link types and exit */ 214 static int Iflag; /* rfmon (monitor) mode */ 215 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE 216 static int Jflag; /* list available time stamp types */ 217 static int jflag = -1; /* packet time stamp source */ 218 #endif 219 static int lflag; /* line-buffered output */ 220 static int pflag; /* don't go promiscuous */ 221 #ifdef HAVE_PCAP_SETDIRECTION 222 static int Qflag = -1; /* restrict captured packet by send/receive direction */ 223 #endif 224 #ifdef HAVE_PCAP_DUMP_FLUSH 225 static int Uflag; /* "unbuffered" output of dump files */ 226 #endif 227 static int Wflag; /* recycle output files after this number of files */ 228 static int WflagChars; 229 static char *zflag = NULL; /* compress each savefile using a specified command (like gzip or bzip2) */ 230 static int timeout = 1000; /* default timeout = 1000 ms = 1 s */ 231 #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE 232 static int immediate_mode; 233 #endif 234 static int count_mode; 235 236 static int infodelay; 237 static int infoprint; 238 239 char *program_name; 240 241 #ifdef HAVE_CASPER 242 cap_channel_t *capdns; 243 #endif 244 245 /* Forwards */ 246 static NORETURN void error(FORMAT_STRING(const char *), ...) PRINTFLIKE(1, 2); 247 static void warning(FORMAT_STRING(const char *), ...) PRINTFLIKE(1, 2); 248 static NORETURN void exit_tcpdump(int); 249 static void (*setsignal (int sig, void (*func)(int)))(int); 250 static void cleanup(int); 251 static void child_cleanup(int); 252 static void print_version(FILE *); 253 static void print_usage(FILE *); 254 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE 255 static NORETURN void show_tstamp_types_and_exit(pcap_t *, const char *device); 256 #endif 257 static NORETURN void show_dlts_and_exit(pcap_t *, const char *device); 258 #ifdef HAVE_PCAP_FINDALLDEVS 259 static NORETURN void show_devices_and_exit(void); 260 #endif 261 #ifdef HAVE_PCAP_FINDALLDEVS_EX 262 static NORETURN void show_remote_devices_and_exit(void); 263 #endif 264 265 static void print_packet(u_char *, const struct pcap_pkthdr *, const u_char *); 266 static void dump_packet_and_trunc(u_char *, const struct pcap_pkthdr *, const u_char *); 267 static void dump_packet(u_char *, const struct pcap_pkthdr *, const u_char *); 268 static void droproot(const char *, const char *); 269 270 #ifdef SIGNAL_REQ_INFO 271 static void requestinfo(int); 272 #endif 273 274 #ifdef SIGNAL_FLUSH_PCAP 275 static void flushpcap(int); 276 #endif 277 278 #ifdef _WIN32 279 static HANDLE timer_handle = INVALID_HANDLE_VALUE; 280 static void CALLBACK verbose_stats_dump(PVOID param, BOOLEAN timer_fired); 281 #else /* _WIN32 */ 282 static void verbose_stats_dump(int sig); 283 #endif /* _WIN32 */ 284 285 static void info(int); 286 static u_int packets_captured; 287 288 #ifdef HAVE_PCAP_FINDALLDEVS 289 static const struct tok status_flags[] = { 290 #ifdef PCAP_IF_UP 291 { PCAP_IF_UP, "Up" }, 292 #endif 293 #ifdef PCAP_IF_RUNNING 294 { PCAP_IF_RUNNING, "Running" }, 295 #endif 296 { PCAP_IF_LOOPBACK, "Loopback" }, 297 #ifdef PCAP_IF_WIRELESS 298 { PCAP_IF_WIRELESS, "Wireless" }, 299 #endif 300 { 0, NULL } 301 }; 302 #endif 303 304 static pcap_t *pd; 305 static pcap_dumper_t *pdd = NULL; 306 307 static int supports_monitor_mode; 308 309 extern int optind; 310 extern int opterr; 311 extern char *optarg; 312 313 struct dump_info { 314 char *WFileName; 315 char *CurrentFileName; 316 pcap_t *pd; 317 pcap_dumper_t *pdd; 318 netdissect_options *ndo; 319 #ifdef HAVE_CAPSICUM 320 int dirfd; 321 #endif 322 }; 323 324 #if defined(HAVE_PCAP_SET_PARSER_DEBUG) 325 /* 326 * We have pcap_set_parser_debug() in libpcap; declare it (it's not declared 327 * by any libpcap header, because it's a special hack, only available if 328 * libpcap was configured to include it, and only intended for use by 329 * libpcap developers trying to debug the parser for filter expressions). 330 */ 331 #ifdef _WIN32 332 __declspec(dllimport) 333 #else /* _WIN32 */ 334 extern 335 #endif /* _WIN32 */ 336 void pcap_set_parser_debug(int); 337 #elif defined(HAVE_PCAP_DEBUG) || defined(HAVE_YYDEBUG) 338 /* 339 * We don't have pcap_set_parser_debug() in libpcap, but we do have 340 * pcap_debug or yydebug. Make a local version of pcap_set_parser_debug() 341 * to set the flag, and define HAVE_PCAP_SET_PARSER_DEBUG. 342 */ 343 static void 344 pcap_set_parser_debug(int value) 345 { 346 #ifdef HAVE_PCAP_DEBUG 347 extern int pcap_debug; 348 349 pcap_debug = value; 350 #else /* HAVE_PCAP_DEBUG */ 351 extern int yydebug; 352 353 yydebug = value; 354 #endif /* HAVE_PCAP_DEBUG */ 355 } 356 357 #define HAVE_PCAP_SET_PARSER_DEBUG 358 #endif 359 360 #if defined(HAVE_PCAP_SET_OPTIMIZER_DEBUG) 361 /* 362 * We have pcap_set_optimizer_debug() in libpcap; declare it (it's not declared 363 * by any libpcap header, because it's a special hack, only available if 364 * libpcap was configured to include it, and only intended for use by 365 * libpcap developers trying to debug the optimizer for filter expressions). 366 */ 367 #ifdef _WIN32 368 __declspec(dllimport) 369 #else /* _WIN32 */ 370 extern 371 #endif /* _WIN32 */ 372 void pcap_set_optimizer_debug(int); 373 #endif 374 375 /* VARARGS */ 376 static void 377 error(const char *fmt, ...) 378 { 379 va_list ap; 380 381 (void)fprintf(stderr, "%s: ", program_name); 382 va_start(ap, fmt); 383 (void)vfprintf(stderr, fmt, ap); 384 va_end(ap); 385 if (*fmt) { 386 fmt += strlen(fmt); 387 if (fmt[-1] != '\n') 388 (void)fputc('\n', stderr); 389 } 390 exit_tcpdump(S_ERR_HOST_PROGRAM); 391 /* NOTREACHED */ 392 } 393 394 /* VARARGS */ 395 static void 396 warning(const char *fmt, ...) 397 { 398 va_list ap; 399 400 (void)fprintf(stderr, "%s: WARNING: ", program_name); 401 va_start(ap, fmt); 402 (void)vfprintf(stderr, fmt, ap); 403 va_end(ap); 404 if (*fmt) { 405 fmt += strlen(fmt); 406 if (fmt[-1] != '\n') 407 (void)fputc('\n', stderr); 408 } 409 } 410 411 static void 412 exit_tcpdump(int status) 413 { 414 nd_cleanup(); 415 exit(status); 416 } 417 418 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE 419 static void 420 show_tstamp_types_and_exit(pcap_t *pc, const char *device) 421 { 422 int n_tstamp_types; 423 int *tstamp_types = 0; 424 const char *tstamp_type_name; 425 int i; 426 427 n_tstamp_types = pcap_list_tstamp_types(pc, &tstamp_types); 428 if (n_tstamp_types < 0) 429 error("%s", pcap_geterr(pc)); 430 431 if (n_tstamp_types == 0) { 432 fprintf(stderr, "Time stamp type cannot be set for %s\n", 433 device); 434 exit_tcpdump(S_SUCCESS); 435 } 436 fprintf(stderr, "Time stamp types for %s (use option -j to set):\n", 437 device); 438 for (i = 0; i < n_tstamp_types; i++) { 439 tstamp_type_name = pcap_tstamp_type_val_to_name(tstamp_types[i]); 440 if (tstamp_type_name != NULL) { 441 (void) fprintf(stderr, " %s (%s)\n", tstamp_type_name, 442 pcap_tstamp_type_val_to_description(tstamp_types[i])); 443 } else { 444 (void) fprintf(stderr, " %d\n", tstamp_types[i]); 445 } 446 } 447 pcap_free_tstamp_types(tstamp_types); 448 exit_tcpdump(S_SUCCESS); 449 } 450 #endif 451 452 static void 453 show_dlts_and_exit(pcap_t *pc, const char *device) 454 { 455 int n_dlts, i; 456 int *dlts = 0; 457 const char *dlt_name; 458 459 n_dlts = pcap_list_datalinks(pc, &dlts); 460 if (n_dlts < 0) 461 error("%s", pcap_geterr(pc)); 462 else if (n_dlts == 0 || !dlts) 463 error("No data link types."); 464 465 /* 466 * If the interface is known to support monitor mode, indicate 467 * whether these are the data link types available when not in 468 * monitor mode, if -I wasn't specified, or when in monitor mode, 469 * when -I was specified (the link-layer types available in 470 * monitor mode might be different from the ones available when 471 * not in monitor mode). 472 */ 473 if (supports_monitor_mode) 474 (void) fprintf(stderr, "Data link types for %s %s (use option -y to set):\n", 475 device, 476 Iflag ? "when in monitor mode" : "when not in monitor mode"); 477 else 478 (void) fprintf(stderr, "Data link types for %s (use option -y to set):\n", 479 device); 480 481 for (i = 0; i < n_dlts; i++) { 482 dlt_name = pcap_datalink_val_to_name(dlts[i]); 483 if (dlt_name != NULL) { 484 (void) fprintf(stderr, " %s (%s)", dlt_name, 485 pcap_datalink_val_to_description(dlts[i])); 486 487 /* 488 * OK, does tcpdump handle that type? 489 */ 490 if (!has_printer(dlts[i])) 491 (void) fprintf(stderr, " (printing not supported)"); 492 fprintf(stderr, "\n"); 493 } else { 494 (void) fprintf(stderr, " DLT %d (printing not supported)\n", 495 dlts[i]); 496 } 497 } 498 #ifdef HAVE_PCAP_FREE_DATALINKS 499 pcap_free_datalinks(dlts); 500 #endif 501 exit_tcpdump(S_SUCCESS); 502 } 503 504 #ifdef HAVE_PCAP_FINDALLDEVS 505 static void 506 show_devices_and_exit(void) 507 { 508 pcap_if_t *dev, *devlist; 509 char ebuf[PCAP_ERRBUF_SIZE]; 510 int i; 511 512 if (pcap_findalldevs(&devlist, ebuf) < 0) 513 error("%s", ebuf); 514 for (i = 0, dev = devlist; dev != NULL; i++, dev = dev->next) { 515 printf("%d.%s", i+1, dev->name); 516 if (dev->description != NULL) 517 printf(" (%s)", dev->description); 518 if (dev->flags != 0) { 519 printf(" ["); 520 printf("%s", bittok2str(status_flags, "none", dev->flags)); 521 #ifdef PCAP_IF_WIRELESS 522 if (dev->flags & PCAP_IF_WIRELESS) { 523 switch (dev->flags & PCAP_IF_CONNECTION_STATUS) { 524 525 case PCAP_IF_CONNECTION_STATUS_UNKNOWN: 526 printf(", Association status unknown"); 527 break; 528 529 case PCAP_IF_CONNECTION_STATUS_CONNECTED: 530 printf(", Associated"); 531 break; 532 533 case PCAP_IF_CONNECTION_STATUS_DISCONNECTED: 534 printf(", Not associated"); 535 break; 536 537 case PCAP_IF_CONNECTION_STATUS_NOT_APPLICABLE: 538 break; 539 } 540 } else { 541 switch (dev->flags & PCAP_IF_CONNECTION_STATUS) { 542 543 case PCAP_IF_CONNECTION_STATUS_UNKNOWN: 544 printf(", Connection status unknown"); 545 break; 546 547 case PCAP_IF_CONNECTION_STATUS_CONNECTED: 548 printf(", Connected"); 549 break; 550 551 case PCAP_IF_CONNECTION_STATUS_DISCONNECTED: 552 printf(", Disconnected"); 553 break; 554 555 case PCAP_IF_CONNECTION_STATUS_NOT_APPLICABLE: 556 break; 557 } 558 } 559 #endif 560 printf("]"); 561 } 562 printf("\n"); 563 } 564 pcap_freealldevs(devlist); 565 exit_tcpdump(S_SUCCESS); 566 } 567 #endif /* HAVE_PCAP_FINDALLDEVS */ 568 569 #ifdef HAVE_PCAP_FINDALLDEVS_EX 570 static void 571 show_remote_devices_and_exit(void) 572 { 573 pcap_if_t *dev, *devlist; 574 char ebuf[PCAP_ERRBUF_SIZE]; 575 int i; 576 577 if (pcap_findalldevs_ex(remote_interfaces_source, NULL, &devlist, 578 ebuf) < 0) 579 error("%s", ebuf); 580 for (i = 0, dev = devlist; dev != NULL; i++, dev = dev->next) { 581 printf("%d.%s", i+1, dev->name); 582 if (dev->description != NULL) 583 printf(" (%s)", dev->description); 584 if (dev->flags != 0) 585 printf(" [%s]", bittok2str(status_flags, "none", dev->flags)); 586 printf("\n"); 587 } 588 pcap_freealldevs(devlist); 589 exit_tcpdump(S_SUCCESS); 590 } 591 #endif /* HAVE_PCAP_FINDALLDEVS */ 592 593 /* 594 * Short options. 595 * 596 * Note that there we use all letters for short options except for g, k, 597 * o, and P, and those are used by other versions of tcpdump, and we should 598 * only use them for the same purposes that the other versions of tcpdump 599 * use them: 600 * 601 * macOS tcpdump uses -g to force non--v output for IP to be on one 602 * line, making it more "g"repable; 603 * 604 * macOS tcpdump uses -k to specify that packet comments in pcapng files 605 * should be printed; 606 * 607 * OpenBSD tcpdump uses -o to indicate that OS fingerprinting should be done 608 * for hosts sending TCP SYN packets; 609 * 610 * macOS tcpdump uses -P to indicate that -w should write pcapng rather 611 * than pcap files. 612 * 613 * macOS tcpdump also uses -Q to specify expressions that match packet 614 * metadata, including but not limited to the packet direction. 615 * The expression syntax is different from a simple "in|out|inout", 616 * and those expressions aren't accepted by macOS tcpdump, but the 617 * equivalents would be "in" = "dir=in", "out" = "dir=out", and 618 * "inout" = "dir=in or dir=out", and the parser could conceivably 619 * special-case "in", "out", and "inout" as expressions for backwards 620 * compatibility, so all is not (yet) lost. 621 */ 622 623 /* 624 * Set up flags that might or might not be supported depending on the 625 * version of libpcap we're using. 626 */ 627 #if defined(HAVE_PCAP_CREATE) || defined(_WIN32) 628 #define B_FLAG "B:" 629 #define B_FLAG_USAGE " [ -B size ]" 630 #else /* defined(HAVE_PCAP_CREATE) || defined(_WIN32) */ 631 #define B_FLAG 632 #define B_FLAG_USAGE 633 #endif /* defined(HAVE_PCAP_CREATE) || defined(_WIN32) */ 634 635 #ifdef HAVE_PCAP_FINDALLDEVS 636 #define D_FLAG "D" 637 #else 638 #define D_FLAG 639 #endif 640 641 #ifdef HAVE_PCAP_CREATE 642 #define I_FLAG "I" 643 #else /* HAVE_PCAP_CREATE */ 644 #define I_FLAG 645 #endif /* HAVE_PCAP_CREATE */ 646 647 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE 648 #define j_FLAG "j:" 649 #define j_FLAG_USAGE " [ -j tstamptype ]" 650 #define J_FLAG "J" 651 #else /* PCAP_ERROR_TSTAMP_TYPE_NOTSUP */ 652 #define j_FLAG 653 #define j_FLAG_USAGE 654 #define J_FLAG 655 #endif /* PCAP_ERROR_TSTAMP_TYPE_NOTSUP */ 656 657 #ifdef USE_LIBSMI 658 #define m_FLAG_USAGE "[ -m module ] ..." 659 #endif 660 661 #ifdef HAVE_PCAP_SETDIRECTION 662 #define Q_FLAG "Q:" 663 #define Q_FLAG_USAGE " [ -Q in|out|inout ]" 664 #else 665 #define Q_FLAG 666 #define Q_FLAG_USAGE 667 #endif 668 669 #ifdef HAVE_PCAP_DUMP_FLUSH 670 #define U_FLAG "U" 671 #else 672 #define U_FLAG 673 #endif 674 675 #define SHORTOPTS "aAb" B_FLAG "c:C:d" D_FLAG "eE:fF:G:hHi:" I_FLAG j_FLAG J_FLAG "KlLm:M:nNOpq" Q_FLAG "r:s:StT:u" U_FLAG "vV:w:W:xXy:Yz:Z:#" 676 677 /* 678 * Long options. 679 * 680 * We do not currently have long options corresponding to all short 681 * options; we should probably pick appropriate option names for them. 682 * 683 * However, the short options where the number of times the option is 684 * specified matters, such as -v and -d and -t, should probably not 685 * just map to a long option, as saying 686 * 687 * tcpdump --verbose --verbose 688 * 689 * doesn't make sense; it should be --verbosity={N} or something such 690 * as that. 691 * 692 * For long options with no corresponding short options, we define values 693 * outside the range of ASCII graphic characters, make that the last 694 * component of the entry for the long option, and have a case for that 695 * option in the switch statement. 696 */ 697 #define OPTION_VERSION 128 698 #define OPTION_TSTAMP_PRECISION 129 699 #define OPTION_IMMEDIATE_MODE 130 700 #define OPTION_PRINT 131 701 #define OPTION_LIST_REMOTE_INTERFACES 132 702 #define OPTION_TSTAMP_MICRO 133 703 #define OPTION_TSTAMP_NANO 134 704 #define OPTION_FP_TYPE 135 705 #define OPTION_COUNT 136 706 707 static const struct option longopts[] = { 708 #if defined(HAVE_PCAP_CREATE) || defined(_WIN32) 709 { "buffer-size", required_argument, NULL, 'B' }, 710 #endif 711 { "list-interfaces", no_argument, NULL, 'D' }, 712 #ifdef HAVE_PCAP_FINDALLDEVS_EX 713 { "list-remote-interfaces", required_argument, NULL, OPTION_LIST_REMOTE_INTERFACES }, 714 #endif 715 { "help", no_argument, NULL, 'h' }, 716 { "interface", required_argument, NULL, 'i' }, 717 #ifdef HAVE_PCAP_CREATE 718 { "monitor-mode", no_argument, NULL, 'I' }, 719 #endif 720 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE 721 { "time-stamp-type", required_argument, NULL, 'j' }, 722 { "list-time-stamp-types", no_argument, NULL, 'J' }, 723 #endif 724 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION 725 { "micro", no_argument, NULL, OPTION_TSTAMP_MICRO}, 726 { "nano", no_argument, NULL, OPTION_TSTAMP_NANO}, 727 { "time-stamp-precision", required_argument, NULL, OPTION_TSTAMP_PRECISION}, 728 #endif 729 { "dont-verify-checksums", no_argument, NULL, 'K' }, 730 { "list-data-link-types", no_argument, NULL, 'L' }, 731 { "no-optimize", no_argument, NULL, 'O' }, 732 { "no-promiscuous-mode", no_argument, NULL, 'p' }, 733 #ifdef HAVE_PCAP_SETDIRECTION 734 { "direction", required_argument, NULL, 'Q' }, 735 #endif 736 { "snapshot-length", required_argument, NULL, 's' }, 737 { "absolute-tcp-sequence-numbers", no_argument, NULL, 'S' }, 738 #ifdef HAVE_PCAP_DUMP_FLUSH 739 { "packet-buffered", no_argument, NULL, 'U' }, 740 #endif 741 { "linktype", required_argument, NULL, 'y' }, 742 #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE 743 { "immediate-mode", no_argument, NULL, OPTION_IMMEDIATE_MODE }, 744 #endif 745 #ifdef HAVE_PCAP_SET_PARSER_DEBUG 746 { "debug-filter-parser", no_argument, NULL, 'Y' }, 747 #endif 748 { "relinquish-privileges", required_argument, NULL, 'Z' }, 749 { "count", no_argument, NULL, OPTION_COUNT }, 750 { "fp-type", no_argument, NULL, OPTION_FP_TYPE }, 751 { "number", no_argument, NULL, '#' }, 752 { "print", no_argument, NULL, OPTION_PRINT }, 753 { "version", no_argument, NULL, OPTION_VERSION }, 754 { NULL, 0, NULL, 0 } 755 }; 756 757 #ifdef HAVE_PCAP_FINDALLDEVS_EX 758 #define LIST_REMOTE_INTERFACES_USAGE "[ --list-remote-interfaces remote-source ]" 759 #else 760 #define LIST_REMOTE_INTERFACES_USAGE 761 #endif 762 763 #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE 764 #define IMMEDIATE_MODE_USAGE " [ --immediate-mode ]" 765 #else 766 #define IMMEDIATE_MODE_USAGE "" 767 #endif 768 769 #ifndef _WIN32 770 /* Drop root privileges and chroot if necessary */ 771 static void 772 droproot(const char *username, const char *chroot_dir) 773 { 774 struct passwd *pw = NULL; 775 776 if (chroot_dir && !username) 777 error("Chroot without dropping root is insecure"); 778 779 pw = getpwnam(username); 780 if (pw) { 781 if (chroot_dir) { 782 if (chroot(chroot_dir) != 0 || chdir ("/") != 0) 783 error("Couldn't chroot/chdir to '%.64s': %s", 784 chroot_dir, pcap_strerror(errno)); 785 } 786 #ifdef HAVE_LIBCAP_NG 787 { 788 int ret = capng_change_id(pw->pw_uid, pw->pw_gid, CAPNG_NO_FLAG); 789 if (ret < 0) 790 error("capng_change_id(): return %d\n", ret); 791 else 792 fprintf(stderr, "dropped privs to %s\n", username); 793 } 794 #else 795 if (initgroups(pw->pw_name, pw->pw_gid) != 0 || 796 setgid(pw->pw_gid) != 0 || setuid(pw->pw_uid) != 0) 797 error("Couldn't change to '%.32s' uid=%lu gid=%lu: %s", 798 username, 799 (unsigned long)pw->pw_uid, 800 (unsigned long)pw->pw_gid, 801 pcap_strerror(errno)); 802 else { 803 fprintf(stderr, "dropped privs to %s\n", username); 804 } 805 #endif /* HAVE_LIBCAP_NG */ 806 } else 807 error("Couldn't find user '%.32s'", username); 808 #ifdef HAVE_LIBCAP_NG 809 /* We don't need CAP_SETUID, CAP_SETGID and CAP_SYS_CHROOT any more. */ 810 DIAG_OFF_CLANG(assign-enum) 811 capng_updatev( 812 CAPNG_DROP, 813 CAPNG_EFFECTIVE | CAPNG_PERMITTED, 814 CAP_SETUID, 815 CAP_SETGID, 816 CAP_SYS_CHROOT, 817 -1); 818 DIAG_ON_CLANG(assign-enum) 819 capng_apply(CAPNG_SELECT_BOTH); 820 #endif /* HAVE_LIBCAP_NG */ 821 822 } 823 #endif /* _WIN32 */ 824 825 static int 826 getWflagChars(int x) 827 { 828 int c = 0; 829 830 x -= 1; 831 while (x > 0) { 832 c += 1; 833 x /= 10; 834 } 835 836 return c; 837 } 838 839 840 static void 841 MakeFilename(char *buffer, char *orig_name, int cnt, int max_chars) 842 { 843 char *filename = malloc(PATH_MAX + 1); 844 if (filename == NULL) 845 error("%s: malloc", __func__); 846 847 /* Process with strftime if Gflag is set. */ 848 if (Gflag != 0) { 849 struct tm *local_tm; 850 851 /* Convert Gflag_time to a usable format */ 852 if ((local_tm = localtime(&Gflag_time)) == NULL) { 853 error("%s: localtime", __func__); 854 } 855 856 /* There's no good way to detect an error in strftime since a return 857 * value of 0 isn't necessarily failure. 858 */ 859 strftime(filename, PATH_MAX, orig_name, local_tm); 860 } else { 861 strncpy(filename, orig_name, PATH_MAX); 862 } 863 864 if (cnt == 0 && max_chars == 0) 865 strncpy(buffer, filename, PATH_MAX + 1); 866 else 867 if (snprintf(buffer, PATH_MAX + 1, "%s%0*d", filename, max_chars, cnt) > PATH_MAX) 868 /* Report an error if the filename is too large */ 869 error("too many output files or filename is too long (> %d)", PATH_MAX); 870 free(filename); 871 } 872 873 static char * 874 get_next_file(FILE *VFile, char *ptr) 875 { 876 char *ret; 877 size_t len; 878 879 ret = fgets(ptr, PATH_MAX, VFile); 880 if (!ret) 881 return NULL; 882 883 len = strlen (ptr); 884 if (len > 0 && ptr[len - 1] == '\n') 885 ptr[len - 1] = '\0'; 886 887 return ret; 888 } 889 890 #ifdef HAVE_CASPER 891 static cap_channel_t * 892 capdns_setup(void) 893 { 894 cap_channel_t *capcas, *capdnsloc; 895 const char *types[1]; 896 int families[2]; 897 898 capcas = cap_init(); 899 if (capcas == NULL) 900 error("unable to create casper process"); 901 capdnsloc = cap_service_open(capcas, "system.dns"); 902 /* Casper capability no longer needed. */ 903 cap_close(capcas); 904 if (capdnsloc == NULL) 905 error("unable to open system.dns service"); 906 /* Limit system.dns to reverse DNS lookups. */ 907 types[0] = "ADDR"; 908 if (cap_dns_type_limit(capdnsloc, types, 1) < 0) 909 error("unable to limit access to system.dns service"); 910 families[0] = AF_INET; 911 families[1] = AF_INET6; 912 if (cap_dns_family_limit(capdnsloc, families, 2) < 0) 913 error("unable to limit access to system.dns service"); 914 915 return (capdnsloc); 916 } 917 #endif /* HAVE_CASPER */ 918 919 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION 920 static int 921 tstamp_precision_from_string(const char *precision) 922 { 923 if (strncmp(precision, "nano", strlen("nano")) == 0) 924 return PCAP_TSTAMP_PRECISION_NANO; 925 926 if (strncmp(precision, "micro", strlen("micro")) == 0) 927 return PCAP_TSTAMP_PRECISION_MICRO; 928 929 return -EINVAL; 930 } 931 932 static const char * 933 tstamp_precision_to_string(int precision) 934 { 935 switch (precision) { 936 937 case PCAP_TSTAMP_PRECISION_MICRO: 938 return "micro"; 939 940 case PCAP_TSTAMP_PRECISION_NANO: 941 return "nano"; 942 943 default: 944 return "unknown"; 945 } 946 } 947 #endif 948 949 #ifdef HAVE_CAPSICUM 950 /* 951 * Ensure that, on a dump file's descriptor, we have all the rights 952 * necessary to make the standard I/O library work with an fdopen()ed 953 * FILE * from that descriptor. 954 * 955 * A long time ago in a galaxy far, far away, AT&T decided that, instead 956 * of providing separate APIs for getting and setting the FD_ flags on a 957 * descriptor, getting and setting the O_ flags on a descriptor, and 958 * locking files, they'd throw them all into a kitchen-sink fcntl() call 959 * along the lines of ioctl(), the fact that ioctl() operations are 960 * largely specific to particular character devices but fcntl() operations 961 * are either generic to all descriptors or generic to all descriptors for 962 * regular files nonwithstanding. 963 * 964 * The Capsicum people decided that fine-grained control of descriptor 965 * operations was required, so that you need to grant permission for 966 * reading, writing, seeking, and fcntl-ing. The latter, courtesy of 967 * AT&T's decision, means that "fcntl-ing" isn't a thing, but a motley 968 * collection of things, so there are *individual* fcntls for which 969 * permission needs to be granted. 970 * 971 * The FreeBSD standard I/O people implemented some optimizations that 972 * requires that the standard I/O routines be able to determine whether 973 * the descriptor for the FILE * is open append-only or not; as that 974 * descriptor could have come from an open() rather than an fopen(), 975 * that requires that it be able to do an F_GETFL fcntl() to read 976 * the O_ flags. 977 * 978 * Tcpdump uses ftell() to determine how much data has been written 979 * to a file in order to, when used with -C, determine when it's time 980 * to rotate capture files. ftell() therefore needs to do an lseek() 981 * to find out the file offset and must, thanks to the aforementioned 982 * optimization, also know whether the descriptor is open append-only 983 * or not. 984 * 985 * The net result of all the above is that we need to grant CAP_SEEK, 986 * CAP_WRITE, and CAP_FCNTL with the CAP_FCNTL_GETFL subcapability. 987 * 988 * Perhaps this is the universe's way of saying that either 989 * 990 * 1) there needs to be an fopenat() call and a pcap_dump_openat() call 991 * using it, so that Capsicum-capable tcpdump wouldn't need to do 992 * an fdopen() 993 * 994 * or 995 * 996 * 2) there needs to be a cap_fdopen() call in the FreeBSD standard 997 * I/O library that knows what rights are needed by the standard 998 * I/O library, based on the open mode, and assigns them, perhaps 999 * with an additional argument indicating, for example, whether 1000 * seeking should be allowed, so that tcpdump doesn't need to know 1001 * what the standard I/O library happens to require this week. 1002 */ 1003 static void 1004 set_dumper_capsicum_rights(pcap_dumper_t *p) 1005 { 1006 int fd = fileno(pcap_dump_file(p)); 1007 cap_rights_t rights; 1008 1009 cap_rights_init(&rights, CAP_SEEK, CAP_WRITE, CAP_FCNTL); 1010 if (cap_rights_limit(fd, &rights) < 0 && errno != ENOSYS) { 1011 error("unable to limit dump descriptor"); 1012 } 1013 if (cap_fcntls_limit(fd, CAP_FCNTL_GETFL) < 0 && errno != ENOSYS) { 1014 error("unable to limit dump descriptor fcntls"); 1015 } 1016 } 1017 #endif 1018 1019 /* 1020 * Copy arg vector into a new buffer, concatenating arguments with spaces. 1021 */ 1022 static char * 1023 copy_argv(char **argv) 1024 { 1025 char **p; 1026 size_t len = 0; 1027 char *buf; 1028 char *src, *dst; 1029 1030 p = argv; 1031 if (*p == NULL) 1032 return 0; 1033 1034 while (*p) 1035 len += strlen(*p++) + 1; 1036 1037 buf = (char *)malloc(len); 1038 if (buf == NULL) 1039 error("%s: malloc", __func__); 1040 1041 p = argv; 1042 dst = buf; 1043 while ((src = *p++) != NULL) { 1044 while ((*dst++ = *src++) != '\0') 1045 ; 1046 dst[-1] = ' '; 1047 } 1048 dst[-1] = '\0'; 1049 1050 return buf; 1051 } 1052 1053 /* 1054 * On Windows, we need to open the file in binary mode, so that 1055 * we get all the bytes specified by the size we get from "fstat()". 1056 * On UNIX, that's not necessary. O_BINARY is defined on Windows; 1057 * we define it as 0 if it's not defined, so it does nothing. 1058 */ 1059 #ifndef O_BINARY 1060 #define O_BINARY 0 1061 #endif 1062 1063 static char * 1064 read_infile(char *fname) 1065 { 1066 int i, fd; 1067 ssize_t cc; 1068 char *cp; 1069 our_statb buf; 1070 1071 fd = open(fname, O_RDONLY|O_BINARY); 1072 if (fd < 0) 1073 error("can't open %s: %s", fname, pcap_strerror(errno)); 1074 1075 if (our_fstat(fd, &buf) < 0) 1076 error("can't stat %s: %s", fname, pcap_strerror(errno)); 1077 1078 /* 1079 * Reject files whose size doesn't fit into an int; a filter 1080 * *that* large will probably be too big. 1081 */ 1082 if (buf.st_size > INT_MAX) 1083 error("%s is too large", fname); 1084 1085 cp = malloc((u_int)buf.st_size + 1); 1086 if (cp == NULL) 1087 error("malloc(%d) for %s: %s", (u_int)buf.st_size + 1, 1088 fname, pcap_strerror(errno)); 1089 cc = read(fd, cp, (u_int)buf.st_size); 1090 if (cc < 0) 1091 error("read %s: %s", fname, pcap_strerror(errno)); 1092 if (cc != buf.st_size) 1093 error("short read %s (%d != %d)", fname, (int) cc, 1094 (int)buf.st_size); 1095 1096 close(fd); 1097 /* replace "# comment" with spaces */ 1098 for (i = 0; i < cc; i++) { 1099 if (cp[i] == '#') 1100 while (i < cc && cp[i] != '\n') 1101 cp[i++] = ' '; 1102 } 1103 cp[cc] = '\0'; 1104 return (cp); 1105 } 1106 1107 #ifdef HAVE_PCAP_FINDALLDEVS 1108 static long 1109 parse_interface_number(const char *device) 1110 { 1111 const char *p; 1112 long devnum; 1113 char *end; 1114 1115 /* 1116 * Search for a colon, terminating any scheme at the beginning 1117 * of the device. 1118 */ 1119 p = strchr(device, ':'); 1120 if (p != NULL) { 1121 /* 1122 * We found it. Is it followed by "//"? 1123 */ 1124 p++; /* skip the : */ 1125 if (strncmp(p, "//", 2) == 0) { 1126 /* 1127 * Yes. Search for the next /, at the end of the 1128 * authority part of the URL. 1129 */ 1130 p += 2; /* skip the // */ 1131 p = strchr(p, '/'); 1132 if (p != NULL) { 1133 /* 1134 * OK, past the / is the path. 1135 */ 1136 device = p + 1; 1137 } 1138 } 1139 } 1140 devnum = strtol(device, &end, 10); 1141 if (device != end && *end == '\0') { 1142 /* 1143 * It's all-numeric, but is it a valid number? 1144 */ 1145 if (devnum <= 0) { 1146 /* 1147 * No, it's not an ordinal. 1148 */ 1149 error("Invalid adapter index"); 1150 } 1151 return (devnum); 1152 } else { 1153 /* 1154 * It's not all-numeric; return -1, so our caller 1155 * knows that. 1156 */ 1157 return (-1); 1158 } 1159 } 1160 1161 static char * 1162 find_interface_by_number(const char *url 1163 #ifndef HAVE_PCAP_FINDALLDEVS_EX 1164 _U_ 1165 #endif 1166 , long devnum) 1167 { 1168 pcap_if_t *dev, *devlist; 1169 long i; 1170 char ebuf[PCAP_ERRBUF_SIZE]; 1171 char *device; 1172 #ifdef HAVE_PCAP_FINDALLDEVS_EX 1173 const char *endp; 1174 char *host_url; 1175 #endif 1176 int status; 1177 1178 #ifdef HAVE_PCAP_FINDALLDEVS_EX 1179 /* 1180 * Search for a colon, terminating any scheme at the beginning 1181 * of the URL. 1182 */ 1183 endp = strchr(url, ':'); 1184 if (endp != NULL) { 1185 /* 1186 * We found it. Is it followed by "//"? 1187 */ 1188 endp++; /* skip the : */ 1189 if (strncmp(endp, "//", 2) == 0) { 1190 /* 1191 * Yes. Search for the next /, at the end of the 1192 * authority part of the URL. 1193 */ 1194 endp += 2; /* skip the // */ 1195 endp = strchr(endp, '/'); 1196 } else 1197 endp = NULL; 1198 } 1199 if (endp != NULL) { 1200 /* 1201 * OK, everything from device to endp is a URL to hand 1202 * to pcap_findalldevs_ex(). 1203 */ 1204 endp++; /* Include the trailing / in the URL; pcap_findalldevs_ex() requires it */ 1205 host_url = malloc(endp - url + 1); 1206 if (host_url == NULL && (endp - url + 1) > 0) 1207 error("Invalid allocation for host"); 1208 1209 memcpy(host_url, url, endp - url); 1210 host_url[endp - url] = '\0'; 1211 status = pcap_findalldevs_ex(host_url, NULL, &devlist, ebuf); 1212 free(host_url); 1213 } else 1214 #endif 1215 status = pcap_findalldevs(&devlist, ebuf); 1216 if (status < 0) 1217 error("%s", ebuf); 1218 /* 1219 * Look for the devnum-th entry in the list of devices (1-based). 1220 */ 1221 for (i = 0, dev = devlist; i < devnum-1 && dev != NULL; 1222 i++, dev = dev->next) 1223 ; 1224 if (dev == NULL) 1225 error("Invalid adapter index"); 1226 device = strdup(dev->name); 1227 pcap_freealldevs(devlist); 1228 return (device); 1229 } 1230 #endif 1231 1232 #ifdef HAVE_PCAP_OPEN 1233 /* 1234 * Prefixes for rpcap URLs. 1235 */ 1236 static char rpcap_prefix[] = "rpcap://"; 1237 static char rpcap_ssl_prefix[] = "rpcaps://"; 1238 #endif 1239 1240 static pcap_t * 1241 open_interface(const char *device, netdissect_options *ndo, char *ebuf) 1242 { 1243 pcap_t *pc; 1244 #ifdef HAVE_PCAP_CREATE 1245 int status; 1246 char *cp; 1247 #endif 1248 1249 #ifdef HAVE_PCAP_OPEN 1250 /* 1251 * Is this an rpcap URL? 1252 */ 1253 if (strncmp(device, rpcap_prefix, sizeof(rpcap_prefix) - 1) == 0 || 1254 strncmp(device, rpcap_ssl_prefix, sizeof(rpcap_ssl_prefix) - 1) == 0) { 1255 /* 1256 * Yes. Open it with pcap_open(). 1257 */ 1258 *ebuf = '\0'; 1259 pc = pcap_open(device, ndo->ndo_snaplen, 1260 pflag ? 0 : PCAP_OPENFLAG_PROMISCUOUS, timeout, NULL, 1261 ebuf); 1262 if (pc == NULL) { 1263 /* 1264 * If this failed with "No such device" or "The system 1265 * cannot find the device specified", that means 1266 * the interface doesn't exist; return NULL, so that 1267 * the caller can see whether the device name is 1268 * actually an interface index. 1269 */ 1270 if (strstr(ebuf, "No such device") != NULL || 1271 strstr(ebuf, "The system cannot find the device specified") != NULL) 1272 return (NULL); 1273 error("%s", ebuf); 1274 } 1275 if (*ebuf) 1276 warning("%s", ebuf); 1277 return (pc); 1278 } 1279 #endif /* HAVE_PCAP_OPEN */ 1280 1281 #ifdef HAVE_PCAP_CREATE 1282 pc = pcap_create(device, ebuf); 1283 if (pc == NULL) { 1284 /* 1285 * If this failed with "No such device", that means 1286 * the interface doesn't exist; return NULL, so that 1287 * the caller can see whether the device name is 1288 * actually an interface index. 1289 */ 1290 if (strstr(ebuf, "No such device") != NULL) 1291 return (NULL); 1292 error("%s", ebuf); 1293 } 1294 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE 1295 if (Jflag) 1296 show_tstamp_types_and_exit(pc, device); 1297 #endif 1298 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION 1299 status = pcap_set_tstamp_precision(pc, ndo->ndo_tstamp_precision); 1300 if (status != 0) 1301 error("%s: Can't set %ssecond time stamp precision: %s", 1302 device, 1303 tstamp_precision_to_string(ndo->ndo_tstamp_precision), 1304 pcap_statustostr(status)); 1305 #endif 1306 1307 #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE 1308 if (immediate_mode) { 1309 status = pcap_set_immediate_mode(pc, 1); 1310 if (status != 0) 1311 error("%s: Can't set immediate mode: %s", 1312 device, pcap_statustostr(status)); 1313 } 1314 #endif 1315 /* 1316 * Is this an interface that supports monitor mode? 1317 */ 1318 if (pcap_can_set_rfmon(pc) == 1) 1319 supports_monitor_mode = 1; 1320 else 1321 supports_monitor_mode = 0; 1322 if (ndo->ndo_snaplen != 0) { 1323 /* 1324 * A snapshot length was explicitly specified; 1325 * use it. 1326 */ 1327 status = pcap_set_snaplen(pc, ndo->ndo_snaplen); 1328 if (status != 0) 1329 error("%s: Can't set snapshot length: %s", 1330 device, pcap_statustostr(status)); 1331 } 1332 status = pcap_set_promisc(pc, !pflag); 1333 if (status != 0) 1334 error("%s: Can't set promiscuous mode: %s", 1335 device, pcap_statustostr(status)); 1336 if (Iflag) { 1337 status = pcap_set_rfmon(pc, 1); 1338 if (status != 0) 1339 error("%s: Can't set monitor mode: %s", 1340 device, pcap_statustostr(status)); 1341 } 1342 status = pcap_set_timeout(pc, timeout); 1343 if (status != 0) 1344 error("%s: pcap_set_timeout failed: %s", 1345 device, pcap_statustostr(status)); 1346 if (Bflag != 0) { 1347 status = pcap_set_buffer_size(pc, Bflag); 1348 if (status != 0) 1349 error("%s: Can't set buffer size: %s", 1350 device, pcap_statustostr(status)); 1351 } 1352 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE 1353 if (jflag != -1) { 1354 status = pcap_set_tstamp_type(pc, jflag); 1355 if (status < 0) 1356 error("%s: Can't set time stamp type: %s", 1357 device, pcap_statustostr(status)); 1358 else if (status > 0) 1359 warning("When trying to set timestamp type '%s' on %s: %s", 1360 pcap_tstamp_type_val_to_name(jflag), device, 1361 pcap_statustostr(status)); 1362 } 1363 #endif 1364 status = pcap_activate(pc); 1365 if (status < 0) { 1366 /* 1367 * pcap_activate() failed. 1368 */ 1369 cp = pcap_geterr(pc); 1370 if (status == PCAP_ERROR) 1371 error("%s", cp); 1372 else if (status == PCAP_ERROR_NO_SUCH_DEVICE) { 1373 /* 1374 * Return an error for our caller to handle. 1375 */ 1376 snprintf(ebuf, PCAP_ERRBUF_SIZE, "%s: %s\n(%s)", 1377 device, pcap_statustostr(status), cp); 1378 } else if (status == PCAP_ERROR_PERM_DENIED && *cp != '\0') 1379 error("%s: %s\n(%s)", device, 1380 pcap_statustostr(status), cp); 1381 #ifdef __FreeBSD__ 1382 else if (status == PCAP_ERROR_RFMON_NOTSUP && 1383 strncmp(device, "wlan", 4) == 0) { 1384 char parent[8], newdev[8]; 1385 char sysctl[32]; 1386 size_t s = sizeof(parent); 1387 1388 snprintf(sysctl, sizeof(sysctl), 1389 "net.wlan.%d.%%parent", atoi(device + 4)); 1390 sysctlbyname(sysctl, parent, &s, NULL, 0); 1391 strlcpy(newdev, device, sizeof(newdev)); 1392 /* Suggest a new wlan device. */ 1393 /* FIXME: incrementing the index this way is not going to work well 1394 * when the index is 9 or greater but the only consequence in this 1395 * specific case would be an error message that looks a bit odd. 1396 */ 1397 newdev[strlen(newdev)-1]++; 1398 error("%s is not a monitor mode VAP\n" 1399 "To create a new monitor mode VAP use:\n" 1400 " ifconfig %s create wlandev %s wlanmode monitor\n" 1401 "and use %s as the tcpdump interface", 1402 device, newdev, parent, newdev); 1403 } 1404 #endif 1405 else 1406 error("%s: %s", device, 1407 pcap_statustostr(status)); 1408 pcap_close(pc); 1409 return (NULL); 1410 } else if (status > 0) { 1411 /* 1412 * pcap_activate() succeeded, but it's warning us 1413 * of a problem it had. 1414 */ 1415 cp = pcap_geterr(pc); 1416 if (status == PCAP_WARNING) 1417 warning("%s", cp); 1418 else if (status == PCAP_WARNING_PROMISC_NOTSUP && 1419 *cp != '\0') 1420 warning("%s: %s\n(%s)", device, 1421 pcap_statustostr(status), cp); 1422 else 1423 warning("%s: %s", device, 1424 pcap_statustostr(status)); 1425 } 1426 #ifdef HAVE_PCAP_SETDIRECTION 1427 if (Qflag != -1) { 1428 status = pcap_setdirection(pc, Qflag); 1429 if (status != 0) 1430 error("%s: pcap_setdirection() failed: %s", 1431 device, pcap_geterr(pc)); 1432 } 1433 #endif /* HAVE_PCAP_SETDIRECTION */ 1434 #else /* HAVE_PCAP_CREATE */ 1435 *ebuf = '\0'; 1436 /* 1437 * If no snapshot length was specified, or a length of 0 was 1438 * specified, default to 256KB. 1439 */ 1440 if (ndo->ndo_snaplen == 0) 1441 ndo->ndo_snaplen = MAXIMUM_SNAPLEN; 1442 pc = pcap_open_live(device, ndo->ndo_snaplen, !pflag, timeout, ebuf); 1443 if (pc == NULL) { 1444 /* 1445 * If this failed with "No such device", that means 1446 * the interface doesn't exist; return NULL, so that 1447 * the caller can see whether the device name is 1448 * actually an interface index. 1449 */ 1450 if (strstr(ebuf, "No such device") != NULL) 1451 return (NULL); 1452 error("%s", ebuf); 1453 } 1454 if (*ebuf) 1455 warning("%s", ebuf); 1456 #endif /* HAVE_PCAP_CREATE */ 1457 1458 return (pc); 1459 } 1460 1461 int 1462 main(int argc, char **argv) 1463 { 1464 int cnt, op, i; 1465 bpf_u_int32 localnet = 0, netmask = 0; 1466 char *cp, *infile, *cmdbuf, *device, *RFileName, *VFileName, *WFileName; 1467 char *endp; 1468 pcap_handler callback; 1469 int dlt; 1470 const char *dlt_name; 1471 struct bpf_program fcode; 1472 #ifndef _WIN32 1473 void (*oldhandler)(int); 1474 #endif 1475 struct dump_info dumpinfo; 1476 u_char *pcap_userdata; 1477 char ebuf[PCAP_ERRBUF_SIZE]; 1478 char VFileLine[PATH_MAX + 1]; 1479 const char *username = NULL; 1480 #ifndef _WIN32 1481 const char *chroot_dir = NULL; 1482 #endif 1483 char *ret = NULL; 1484 char *end; 1485 #ifdef HAVE_PCAP_FINDALLDEVS 1486 pcap_if_t *devlist; 1487 long devnum; 1488 #endif 1489 int status; 1490 FILE *VFile; 1491 #ifdef HAVE_CAPSICUM 1492 cap_rights_t rights; 1493 int cansandbox; 1494 #endif /* HAVE_CAPSICUM */ 1495 int Oflag = 1; /* run filter code optimizer */ 1496 int yflag_dlt = -1; 1497 const char *yflag_dlt_name = NULL; 1498 int print = 0; 1499 1500 netdissect_options Ndo; 1501 netdissect_options *ndo = &Ndo; 1502 1503 /* 1504 * Initialize the netdissect code. 1505 */ 1506 if (nd_init(ebuf, sizeof(ebuf)) == -1) 1507 error("%s", ebuf); 1508 1509 memset(ndo, 0, sizeof(*ndo)); 1510 ndo_set_function_pointers(ndo); 1511 1512 cnt = -1; 1513 device = NULL; 1514 infile = NULL; 1515 RFileName = NULL; 1516 VFileName = NULL; 1517 VFile = NULL; 1518 WFileName = NULL; 1519 dlt = -1; 1520 if ((cp = strrchr(argv[0], PATH_SEPARATOR)) != NULL) 1521 ndo->program_name = program_name = cp + 1; 1522 else 1523 ndo->program_name = program_name = argv[0]; 1524 1525 #if defined(HAVE_PCAP_WSOCKINIT) 1526 if (pcap_wsockinit() != 0) 1527 error("Attempting to initialize Winsock failed"); 1528 #elif defined(HAVE_WSOCKINIT) 1529 if (wsockinit() != 0) 1530 error("Attempting to initialize Winsock failed"); 1531 #endif 1532 1533 /* 1534 * On platforms where the CPU doesn't support unaligned loads, 1535 * force unaligned accesses to abort with SIGBUS, rather than 1536 * being fixed up (slowly) by the OS kernel; on those platforms, 1537 * misaligned accesses are bugs, and we want tcpdump to crash so 1538 * that the bugs are reported. 1539 */ 1540 if (abort_on_misalignment(ebuf, sizeof(ebuf)) < 0) 1541 error("%s", ebuf); 1542 1543 while ( 1544 (op = getopt_long(argc, argv, SHORTOPTS, longopts, NULL)) != -1) 1545 switch (op) { 1546 1547 case 'a': 1548 /* compatibility for old -a */ 1549 break; 1550 1551 case 'A': 1552 ++ndo->ndo_Aflag; 1553 break; 1554 1555 case 'b': 1556 ++ndo->ndo_bflag; 1557 break; 1558 1559 #if defined(HAVE_PCAP_CREATE) || defined(_WIN32) 1560 case 'B': 1561 Bflag = atoi(optarg)*1024; 1562 if (Bflag <= 0) 1563 error("invalid packet buffer size %s", optarg); 1564 break; 1565 #endif /* defined(HAVE_PCAP_CREATE) || defined(_WIN32) */ 1566 1567 case 'c': 1568 cnt = atoi(optarg); 1569 if (cnt <= 0) 1570 error("invalid packet count %s", optarg); 1571 break; 1572 1573 case 'C': 1574 errno = 0; 1575 #ifdef HAVE_PCAP_DUMP_FTELL64 1576 Cflag = strtoint64_t(optarg, &endp, 10); 1577 #else 1578 Cflag = strtol(optarg, &endp, 10); 1579 #endif 1580 if (endp == optarg || *endp != '\0' || errno != 0 1581 || Cflag <= 0) 1582 error("invalid file size %s", optarg); 1583 /* 1584 * Will multiplying it by 1000000 overflow? 1585 */ 1586 #ifdef HAVE_PCAP_DUMP_FTELL64 1587 if (Cflag > INT64_T_CONSTANT(0x7fffffffffffffff) / 1000000) 1588 #else 1589 if (Cflag > LONG_MAX / 1000000) 1590 #endif 1591 error("file size %s is too large", optarg); 1592 Cflag *= 1000000; 1593 break; 1594 1595 case 'd': 1596 ++dflag; 1597 break; 1598 1599 #ifdef HAVE_PCAP_FINDALLDEVS 1600 case 'D': 1601 Dflag++; 1602 break; 1603 #endif 1604 1605 #ifdef HAVE_PCAP_FINDALLDEVS_EX 1606 case OPTION_LIST_REMOTE_INTERFACES: 1607 remote_interfaces_source = optarg; 1608 break; 1609 #endif 1610 1611 case 'L': 1612 Lflag++; 1613 break; 1614 1615 case 'e': 1616 ++ndo->ndo_eflag; 1617 break; 1618 1619 case 'E': 1620 #ifndef HAVE_LIBCRYPTO 1621 warning("crypto code not compiled in"); 1622 #endif 1623 ndo->ndo_espsecret = optarg; 1624 break; 1625 1626 case 'f': 1627 ++ndo->ndo_fflag; 1628 break; 1629 1630 case 'F': 1631 infile = optarg; 1632 break; 1633 1634 case 'G': 1635 Gflag = atoi(optarg); 1636 if (Gflag < 0) 1637 error("invalid number of seconds %s", optarg); 1638 1639 /* We will create one file initially. */ 1640 Gflag_count = 0; 1641 1642 /* Grab the current time for rotation use. */ 1643 if ((Gflag_time = time(NULL)) == (time_t)-1) { 1644 error("%s: can't get current time: %s", 1645 __func__, pcap_strerror(errno)); 1646 } 1647 break; 1648 1649 case 'h': 1650 print_usage(stdout); 1651 exit_tcpdump(S_SUCCESS); 1652 break; 1653 1654 case 'H': 1655 ++ndo->ndo_Hflag; 1656 break; 1657 1658 case 'i': 1659 device = optarg; 1660 break; 1661 1662 #ifdef HAVE_PCAP_CREATE 1663 case 'I': 1664 ++Iflag; 1665 break; 1666 #endif /* HAVE_PCAP_CREATE */ 1667 1668 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE 1669 case 'j': 1670 jflag = pcap_tstamp_type_name_to_val(optarg); 1671 if (jflag < 0) 1672 error("invalid time stamp type %s", optarg); 1673 break; 1674 1675 case 'J': 1676 Jflag++; 1677 break; 1678 #endif 1679 1680 case 'l': 1681 #ifdef _WIN32 1682 /* 1683 * _IOLBF is the same as _IOFBF in Microsoft's C 1684 * libraries; the only alternative they offer 1685 * is _IONBF. 1686 * 1687 * XXX - this should really be checking for MSVC++, 1688 * not _WIN32, if, for example, MinGW has its own 1689 * C library that is more UNIX-compatible. 1690 */ 1691 setvbuf(stdout, NULL, _IONBF, 0); 1692 #else /* _WIN32 */ 1693 #ifdef HAVE_SETLINEBUF 1694 setlinebuf(stdout); 1695 #else 1696 setvbuf(stdout, NULL, _IOLBF, 0); 1697 #endif 1698 #endif /* _WIN32 */ 1699 lflag = 1; 1700 break; 1701 1702 case 'K': 1703 ++ndo->ndo_Kflag; 1704 break; 1705 1706 case 'm': 1707 if (nd_have_smi_support()) { 1708 if (nd_load_smi_module(optarg, ebuf, sizeof(ebuf)) == -1) 1709 error("%s", ebuf); 1710 } else { 1711 (void)fprintf(stderr, "%s: ignoring option `-m %s' ", 1712 program_name, optarg); 1713 (void)fprintf(stderr, "(no libsmi support)\n"); 1714 } 1715 break; 1716 1717 case 'M': 1718 /* TCP-MD5 shared secret */ 1719 #ifndef HAVE_LIBCRYPTO 1720 warning("crypto code not compiled in"); 1721 #endif 1722 ndo->ndo_sigsecret = optarg; 1723 break; 1724 1725 case 'n': 1726 ++ndo->ndo_nflag; 1727 break; 1728 1729 case 'N': 1730 ++ndo->ndo_Nflag; 1731 break; 1732 1733 case 'O': 1734 Oflag = 0; 1735 break; 1736 1737 case 'p': 1738 ++pflag; 1739 break; 1740 1741 case 'q': 1742 ++ndo->ndo_qflag; 1743 ++ndo->ndo_suppress_default_print; 1744 break; 1745 1746 #ifdef HAVE_PCAP_SETDIRECTION 1747 case 'Q': 1748 if (ascii_strcasecmp(optarg, "in") == 0) 1749 Qflag = PCAP_D_IN; 1750 else if (ascii_strcasecmp(optarg, "out") == 0) 1751 Qflag = PCAP_D_OUT; 1752 else if (ascii_strcasecmp(optarg, "inout") == 0) 1753 Qflag = PCAP_D_INOUT; 1754 else 1755 error("unknown capture direction `%s'", optarg); 1756 break; 1757 #endif /* HAVE_PCAP_SETDIRECTION */ 1758 1759 case 'r': 1760 RFileName = optarg; 1761 break; 1762 1763 case 's': 1764 ndo->ndo_snaplen = (int)strtol(optarg, &end, 0); 1765 if (optarg == end || *end != '\0' 1766 || ndo->ndo_snaplen < 0 || ndo->ndo_snaplen > MAXIMUM_SNAPLEN) 1767 error("invalid snaplen %s (must be >= 0 and <= %d)", 1768 optarg, MAXIMUM_SNAPLEN); 1769 break; 1770 1771 case 'S': 1772 ++ndo->ndo_Sflag; 1773 break; 1774 1775 case 't': 1776 ++ndo->ndo_tflag; 1777 break; 1778 1779 case 'T': 1780 if (ascii_strcasecmp(optarg, "vat") == 0) 1781 ndo->ndo_packettype = PT_VAT; 1782 else if (ascii_strcasecmp(optarg, "wb") == 0) 1783 ndo->ndo_packettype = PT_WB; 1784 else if (ascii_strcasecmp(optarg, "rpc") == 0) 1785 ndo->ndo_packettype = PT_RPC; 1786 else if (ascii_strcasecmp(optarg, "rtp") == 0) 1787 ndo->ndo_packettype = PT_RTP; 1788 else if (ascii_strcasecmp(optarg, "rtcp") == 0) 1789 ndo->ndo_packettype = PT_RTCP; 1790 else if (ascii_strcasecmp(optarg, "snmp") == 0) 1791 ndo->ndo_packettype = PT_SNMP; 1792 else if (ascii_strcasecmp(optarg, "cnfp") == 0) 1793 ndo->ndo_packettype = PT_CNFP; 1794 else if (ascii_strcasecmp(optarg, "tftp") == 0) 1795 ndo->ndo_packettype = PT_TFTP; 1796 else if (ascii_strcasecmp(optarg, "aodv") == 0) 1797 ndo->ndo_packettype = PT_AODV; 1798 else if (ascii_strcasecmp(optarg, "carp") == 0) 1799 ndo->ndo_packettype = PT_CARP; 1800 else if (ascii_strcasecmp(optarg, "radius") == 0) 1801 ndo->ndo_packettype = PT_RADIUS; 1802 else if (ascii_strcasecmp(optarg, "zmtp1") == 0) 1803 ndo->ndo_packettype = PT_ZMTP1; 1804 else if (ascii_strcasecmp(optarg, "vxlan") == 0) 1805 ndo->ndo_packettype = PT_VXLAN; 1806 else if (ascii_strcasecmp(optarg, "pgm") == 0) 1807 ndo->ndo_packettype = PT_PGM; 1808 else if (ascii_strcasecmp(optarg, "pgm_zmtp1") == 0) 1809 ndo->ndo_packettype = PT_PGM_ZMTP1; 1810 else if (ascii_strcasecmp(optarg, "lmp") == 0) 1811 ndo->ndo_packettype = PT_LMP; 1812 else if (ascii_strcasecmp(optarg, "resp") == 0) 1813 ndo->ndo_packettype = PT_RESP; 1814 else if (ascii_strcasecmp(optarg, "ptp") == 0) 1815 ndo->ndo_packettype = PT_PTP; 1816 else if (ascii_strcasecmp(optarg, "someip") == 0) 1817 ndo->ndo_packettype = PT_SOMEIP; 1818 else if (ascii_strcasecmp(optarg, "domain") == 0) 1819 ndo->ndo_packettype = PT_DOMAIN; 1820 else 1821 error("unknown packet type `%s'", optarg); 1822 break; 1823 1824 case 'u': 1825 ++ndo->ndo_uflag; 1826 break; 1827 1828 #ifdef HAVE_PCAP_DUMP_FLUSH 1829 case 'U': 1830 ++Uflag; 1831 break; 1832 #endif 1833 1834 case 'v': 1835 ++ndo->ndo_vflag; 1836 break; 1837 1838 case 'V': 1839 VFileName = optarg; 1840 break; 1841 1842 case 'w': 1843 WFileName = optarg; 1844 break; 1845 1846 case 'W': 1847 Wflag = atoi(optarg); 1848 if (Wflag <= 0) 1849 error("invalid number of output files %s", optarg); 1850 WflagChars = getWflagChars(Wflag); 1851 break; 1852 1853 case 'x': 1854 ++ndo->ndo_xflag; 1855 ++ndo->ndo_suppress_default_print; 1856 break; 1857 1858 case 'X': 1859 ++ndo->ndo_Xflag; 1860 ++ndo->ndo_suppress_default_print; 1861 break; 1862 1863 case 'y': 1864 yflag_dlt_name = optarg; 1865 yflag_dlt = 1866 pcap_datalink_name_to_val(yflag_dlt_name); 1867 if (yflag_dlt < 0) 1868 error("invalid data link type %s", yflag_dlt_name); 1869 break; 1870 1871 #ifdef HAVE_PCAP_SET_PARSER_DEBUG 1872 case 'Y': 1873 { 1874 /* Undocumented flag */ 1875 pcap_set_parser_debug(1); 1876 } 1877 break; 1878 #endif 1879 case 'z': 1880 zflag = optarg; 1881 break; 1882 1883 case 'Z': 1884 username = optarg; 1885 break; 1886 1887 case '#': 1888 ndo->ndo_packet_number = 1; 1889 break; 1890 1891 case OPTION_VERSION: 1892 print_version(stdout); 1893 exit_tcpdump(S_SUCCESS); 1894 break; 1895 1896 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION 1897 case OPTION_TSTAMP_PRECISION: 1898 ndo->ndo_tstamp_precision = tstamp_precision_from_string(optarg); 1899 if (ndo->ndo_tstamp_precision < 0) 1900 error("unsupported time stamp precision"); 1901 break; 1902 #endif 1903 1904 #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE 1905 case OPTION_IMMEDIATE_MODE: 1906 immediate_mode = 1; 1907 break; 1908 #endif 1909 1910 case OPTION_PRINT: 1911 print = 1; 1912 break; 1913 1914 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION 1915 case OPTION_TSTAMP_MICRO: 1916 ndo->ndo_tstamp_precision = PCAP_TSTAMP_PRECISION_MICRO; 1917 break; 1918 1919 case OPTION_TSTAMP_NANO: 1920 ndo->ndo_tstamp_precision = PCAP_TSTAMP_PRECISION_NANO; 1921 break; 1922 #endif 1923 1924 case OPTION_FP_TYPE: 1925 /* 1926 * Print out the type of floating-point arithmetic 1927 * we're doing; it's probably IEEE, unless somebody 1928 * tries to run this on a VAX, but the precision 1929 * may differ (e.g., it might be 32-bit, 64-bit, 1930 * or 80-bit). 1931 */ 1932 float_type_check(0x4e93312d); 1933 return 0; 1934 1935 case OPTION_COUNT: 1936 count_mode = 1; 1937 break; 1938 1939 default: 1940 print_usage(stderr); 1941 exit_tcpdump(S_ERR_HOST_PROGRAM); 1942 /* NOTREACHED */ 1943 } 1944 1945 #ifdef HAVE_PCAP_FINDALLDEVS 1946 if (Dflag) 1947 show_devices_and_exit(); 1948 #endif 1949 #ifdef HAVE_PCAP_FINDALLDEVS_EX 1950 if (remote_interfaces_source != NULL) 1951 show_remote_devices_and_exit(); 1952 #endif 1953 1954 #if defined(DLT_LINUX_SLL2) && defined(HAVE_PCAP_SET_DATALINK) 1955 /* Set default linktype DLT_LINUX_SLL2 when capturing on the "any" device */ 1956 if (device != NULL && 1957 strncmp (device, "any", strlen("any")) == 0 1958 && yflag_dlt == -1) 1959 yflag_dlt = DLT_LINUX_SLL2; 1960 #endif 1961 1962 switch (ndo->ndo_tflag) { 1963 1964 case 0: /* Default */ 1965 case 1: /* No time stamp */ 1966 case 2: /* Unix timeval style */ 1967 case 3: /* Microseconds/nanoseconds since previous packet */ 1968 case 4: /* Date + Default */ 1969 case 5: /* Microseconds/nanoseconds since first packet */ 1970 break; 1971 1972 default: /* Not supported */ 1973 error("only -t, -tt, -ttt, -tttt and -ttttt are supported"); 1974 break; 1975 } 1976 1977 if (ndo->ndo_fflag != 0 && (VFileName != NULL || RFileName != NULL)) 1978 error("-f can not be used with -V or -r"); 1979 1980 if (VFileName != NULL && RFileName != NULL) 1981 error("-V and -r are mutually exclusive."); 1982 1983 /* 1984 * If we're printing dissected packets to the standard output, 1985 * and either the standard output is a terminal or we're doing 1986 * "line" buffering, set the capture timeout to .1 second rather 1987 * than 1 second, as the user's probably expecting to see packets 1988 * pop up immediately shortly after they arrive. 1989 * 1990 * XXX - would there be some value appropriate for all cases, 1991 * based on, say, the buffer size and packet input rate? 1992 */ 1993 if ((WFileName == NULL || print) && (isatty(1) || lflag)) 1994 timeout = 100; 1995 1996 #ifdef WITH_CHROOT 1997 /* if run as root, prepare for chrooting */ 1998 if (getuid() == 0 || geteuid() == 0) { 1999 /* future extensibility for cmd-line arguments */ 2000 if (!chroot_dir) 2001 chroot_dir = WITH_CHROOT; 2002 } 2003 #endif 2004 2005 #ifdef WITH_USER 2006 /* if run as root, prepare for dropping root privileges */ 2007 if (getuid() == 0 || geteuid() == 0) { 2008 /* Run with '-Z root' to restore old behaviour */ 2009 if (!username) 2010 username = WITH_USER; 2011 } 2012 #endif 2013 2014 if (RFileName != NULL || VFileName != NULL) { 2015 /* 2016 * If RFileName is non-null, it's the pathname of a 2017 * savefile to read. If VFileName is non-null, it's 2018 * the pathname of a file containing a list of pathnames 2019 * (one per line) of savefiles to read. 2020 * 2021 * In either case, we're reading a savefile, not doing 2022 * a live capture. 2023 */ 2024 #ifndef _WIN32 2025 /* 2026 * We don't need network access, so relinquish any set-UID 2027 * or set-GID privileges we have (if any). 2028 * 2029 * We do *not* want set-UID privileges when opening a 2030 * trace file, as that might let the user read other 2031 * people's trace files (especially if we're set-UID 2032 * root). 2033 */ 2034 if (setgid(getgid()) != 0 || setuid(getuid()) != 0 ) 2035 fprintf(stderr, "Warning: setgid/setuid failed !\n"); 2036 #endif /* _WIN32 */ 2037 if (VFileName != NULL) { 2038 if (VFileName[0] == '-' && VFileName[1] == '\0') 2039 VFile = stdin; 2040 else 2041 VFile = fopen(VFileName, "r"); 2042 2043 if (VFile == NULL) 2044 error("Unable to open file: %s\n", pcap_strerror(errno)); 2045 2046 ret = get_next_file(VFile, VFileLine); 2047 if (!ret) 2048 error("Nothing in %s\n", VFileName); 2049 RFileName = VFileLine; 2050 } 2051 2052 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION 2053 pd = pcap_open_offline_with_tstamp_precision(RFileName, 2054 ndo->ndo_tstamp_precision, ebuf); 2055 #else 2056 pd = pcap_open_offline(RFileName, ebuf); 2057 #endif 2058 2059 if (pd == NULL) 2060 error("%s", ebuf); 2061 #ifdef HAVE_CAPSICUM 2062 cap_rights_init(&rights, CAP_READ); 2063 if (cap_rights_limit(fileno(pcap_file(pd)), &rights) < 0 && 2064 errno != ENOSYS) { 2065 error("unable to limit pcap descriptor"); 2066 } 2067 #endif 2068 dlt = pcap_datalink(pd); 2069 dlt_name = pcap_datalink_val_to_name(dlt); 2070 fprintf(stderr, "reading from file %s", RFileName); 2071 if (dlt_name == NULL) { 2072 fprintf(stderr, ", link-type %u", dlt); 2073 } else { 2074 fprintf(stderr, ", link-type %s (%s)", dlt_name, 2075 pcap_datalink_val_to_description(dlt)); 2076 } 2077 fprintf(stderr, ", snapshot length %d\n", pcap_snapshot(pd)); 2078 #ifdef DLT_LINUX_SLL2 2079 if (dlt == DLT_LINUX_SLL2) 2080 fprintf(stderr, "Warning: interface names might be incorrect\n"); 2081 #endif 2082 } else if (dflag && !device) { 2083 int dump_dlt = DLT_EN10MB; 2084 /* 2085 * We're dumping the compiled code without an explicit 2086 * device specification. (If a device is specified, we 2087 * definitely want to open it to use the DLT of that device.) 2088 * Either default to DLT_EN10MB with a warning, or use 2089 * the user-specified value if supplied. 2090 */ 2091 /* 2092 * If no snapshot length was specified, or a length of 0 was 2093 * specified, default to 256KB. 2094 */ 2095 if (ndo->ndo_snaplen == 0) 2096 ndo->ndo_snaplen = MAXIMUM_SNAPLEN; 2097 /* 2098 * If a DLT was specified with the -y flag, use that instead. 2099 */ 2100 if (yflag_dlt != -1) 2101 dump_dlt = yflag_dlt; 2102 else 2103 fprintf(stderr, "Warning: assuming Ethernet\n"); 2104 pd = pcap_open_dead(dump_dlt, ndo->ndo_snaplen); 2105 } else { 2106 /* 2107 * We're doing a live capture. 2108 */ 2109 if (device == NULL) { 2110 /* 2111 * No interface was specified. Pick one. 2112 */ 2113 #ifdef HAVE_PCAP_FINDALLDEVS 2114 /* 2115 * Find the list of interfaces, and pick 2116 * the first interface. 2117 */ 2118 if (pcap_findalldevs(&devlist, ebuf) == -1) 2119 error("%s", ebuf); 2120 if (devlist == NULL) 2121 error("no interfaces available for capture"); 2122 device = strdup(devlist->name); 2123 pcap_freealldevs(devlist); 2124 #else /* HAVE_PCAP_FINDALLDEVS */ 2125 /* 2126 * Use whatever interface pcap_lookupdev() 2127 * chooses. 2128 */ 2129 device = pcap_lookupdev(ebuf); 2130 if (device == NULL) 2131 error("%s", ebuf); 2132 #endif 2133 } 2134 2135 /* 2136 * Try to open the interface with the specified name. 2137 */ 2138 pd = open_interface(device, ndo, ebuf); 2139 if (pd == NULL) { 2140 /* 2141 * That failed. If we can get a list of 2142 * interfaces, and the interface name 2143 * is purely numeric, try to use it as 2144 * a 1-based index in the list of 2145 * interfaces. 2146 */ 2147 #ifdef HAVE_PCAP_FINDALLDEVS 2148 devnum = parse_interface_number(device); 2149 if (devnum == -1) { 2150 /* 2151 * It's not a number; just report 2152 * the open error and fail. 2153 */ 2154 error("%s", ebuf); 2155 } 2156 2157 /* 2158 * OK, it's a number; try to find the 2159 * interface with that index, and try 2160 * to open it. 2161 * 2162 * find_interface_by_number() exits if it 2163 * couldn't be found. 2164 */ 2165 device = find_interface_by_number(device, devnum); 2166 pd = open_interface(device, ndo, ebuf); 2167 if (pd == NULL) 2168 error("%s", ebuf); 2169 #else /* HAVE_PCAP_FINDALLDEVS */ 2170 /* 2171 * We can't get a list of interfaces; just 2172 * fail. 2173 */ 2174 error("%s", ebuf); 2175 #endif /* HAVE_PCAP_FINDALLDEVS */ 2176 } 2177 2178 /* 2179 * Let user own process after capture device has 2180 * been opened. 2181 */ 2182 #ifndef _WIN32 2183 if (setgid(getgid()) != 0 || setuid(getuid()) != 0) 2184 fprintf(stderr, "Warning: setgid/setuid failed !\n"); 2185 #endif /* _WIN32 */ 2186 #if !defined(HAVE_PCAP_CREATE) && defined(_WIN32) 2187 if(Bflag != 0) 2188 if(pcap_setbuff(pd, Bflag)==-1){ 2189 error("%s", pcap_geterr(pd)); 2190 } 2191 #endif /* !defined(HAVE_PCAP_CREATE) && defined(_WIN32) */ 2192 if (Lflag) 2193 show_dlts_and_exit(pd, device); 2194 if (yflag_dlt >= 0) { 2195 #ifdef HAVE_PCAP_SET_DATALINK 2196 if (pcap_set_datalink(pd, yflag_dlt) < 0) 2197 error("%s", pcap_geterr(pd)); 2198 #else 2199 /* 2200 * We don't actually support changing the 2201 * data link type, so we only let them 2202 * set it to what it already is. 2203 */ 2204 if (yflag_dlt != pcap_datalink(pd)) { 2205 error("%s is not one of the DLTs supported by this device\n", 2206 yflag_dlt_name); 2207 } 2208 #endif 2209 (void)fprintf(stderr, "%s: data link type %s\n", 2210 program_name, 2211 pcap_datalink_val_to_name(yflag_dlt)); 2212 (void)fflush(stderr); 2213 } 2214 i = pcap_snapshot(pd); 2215 if (ndo->ndo_snaplen < i) { 2216 if (ndo->ndo_snaplen != 0) 2217 warning("snaplen raised from %d to %d", ndo->ndo_snaplen, i); 2218 ndo->ndo_snaplen = i; 2219 } else if (ndo->ndo_snaplen > i) { 2220 warning("snaplen lowered from %d to %d", ndo->ndo_snaplen, i); 2221 ndo->ndo_snaplen = i; 2222 } 2223 if(ndo->ndo_fflag != 0) { 2224 if (pcap_lookupnet(device, &localnet, &netmask, ebuf) < 0) { 2225 warning("foreign (-f) flag used but: %s", ebuf); 2226 } 2227 } 2228 2229 } 2230 if (infile) 2231 cmdbuf = read_infile(infile); 2232 else 2233 cmdbuf = copy_argv(&argv[optind]); 2234 2235 #ifdef HAVE_PCAP_SET_OPTIMIZER_DEBUG 2236 pcap_set_optimizer_debug(dflag); 2237 #endif 2238 if (pcap_compile(pd, &fcode, cmdbuf, Oflag, netmask) < 0) 2239 error("%s", pcap_geterr(pd)); 2240 if (dflag) { 2241 bpf_dump(&fcode, dflag); 2242 pcap_close(pd); 2243 free(cmdbuf); 2244 pcap_freecode(&fcode); 2245 exit_tcpdump(S_SUCCESS); 2246 } 2247 2248 #ifdef HAVE_CASPER 2249 if (!ndo->ndo_nflag) 2250 capdns = capdns_setup(); 2251 #endif /* HAVE_CASPER */ 2252 2253 init_print(ndo, localnet, netmask); 2254 2255 #ifndef _WIN32 2256 (void)setsignal(SIGPIPE, cleanup); 2257 (void)setsignal(SIGTERM, cleanup); 2258 #endif /* _WIN32 */ 2259 (void)setsignal(SIGINT, cleanup); 2260 #if defined(HAVE_FORK) || defined(HAVE_VFORK) 2261 (void)setsignal(SIGCHLD, child_cleanup); 2262 #endif 2263 /* Cooperate with nohup(1) */ 2264 #ifndef _WIN32 2265 if ((oldhandler = setsignal(SIGHUP, cleanup)) != SIG_DFL) 2266 (void)setsignal(SIGHUP, oldhandler); 2267 #endif /* _WIN32 */ 2268 2269 #ifndef _WIN32 2270 /* 2271 * If a user name was specified with "-Z", attempt to switch to 2272 * that user's UID. This would probably be used with sudo, 2273 * to allow tcpdump to be run in a special restricted 2274 * account (if you just want to allow users to open capture 2275 * devices, and can't just give users that permission, 2276 * you'd make tcpdump set-UID or set-GID). 2277 * 2278 * Tcpdump doesn't necessarily write only to one savefile; 2279 * the general only way to allow a -Z instance to write to 2280 * savefiles as the user under whose UID it's run, rather 2281 * than as the user specified with -Z, would thus be to switch 2282 * to the original user ID before opening a capture file and 2283 * then switch back to the -Z user ID after opening the savefile. 2284 * Switching to the -Z user ID only after opening the first 2285 * savefile doesn't handle the general case. 2286 */ 2287 2288 if (getuid() == 0 || geteuid() == 0) { 2289 #ifdef HAVE_LIBCAP_NG 2290 /* Initialize capng */ 2291 capng_clear(CAPNG_SELECT_BOTH); 2292 if (username) { 2293 DIAG_OFF_CLANG(assign-enum) 2294 capng_updatev( 2295 CAPNG_ADD, 2296 CAPNG_PERMITTED | CAPNG_EFFECTIVE, 2297 CAP_SETUID, 2298 CAP_SETGID, 2299 -1); 2300 DIAG_ON_CLANG(assign-enum) 2301 } 2302 if (chroot_dir) { 2303 DIAG_OFF_CLANG(assign-enum) 2304 capng_update( 2305 CAPNG_ADD, 2306 CAPNG_PERMITTED | CAPNG_EFFECTIVE, 2307 CAP_SYS_CHROOT 2308 ); 2309 DIAG_ON_CLANG(assign-enum) 2310 } 2311 2312 if (WFileName) { 2313 DIAG_OFF_CLANG(assign-enum) 2314 capng_update( 2315 CAPNG_ADD, 2316 CAPNG_PERMITTED | CAPNG_EFFECTIVE, 2317 CAP_DAC_OVERRIDE 2318 ); 2319 DIAG_ON_CLANG(assign-enum) 2320 } 2321 capng_apply(CAPNG_SELECT_BOTH); 2322 #endif /* HAVE_LIBCAP_NG */ 2323 if (username || chroot_dir) 2324 droproot(username, chroot_dir); 2325 2326 } 2327 #endif /* _WIN32 */ 2328 2329 if (pcap_setfilter(pd, &fcode) < 0) 2330 error("%s", pcap_geterr(pd)); 2331 #ifdef HAVE_CAPSICUM 2332 if (RFileName == NULL && VFileName == NULL && pcap_fileno(pd) != -1) { 2333 static const unsigned long cmds[] = { BIOCGSTATS, BIOCROTZBUF }; 2334 2335 /* 2336 * The various libpcap devices use a combination of 2337 * read (bpf), ioctl (bpf, netmap), poll (netmap) 2338 * so we add the relevant access rights. 2339 */ 2340 cap_rights_init(&rights, CAP_IOCTL, CAP_READ, CAP_EVENT); 2341 if (cap_rights_limit(pcap_fileno(pd), &rights) < 0 && 2342 errno != ENOSYS) { 2343 error("unable to limit pcap descriptor"); 2344 } 2345 if (cap_ioctls_limit(pcap_fileno(pd), cmds, 2346 sizeof(cmds) / sizeof(cmds[0])) < 0 && errno != ENOSYS) { 2347 error("unable to limit ioctls on pcap descriptor"); 2348 } 2349 } 2350 #endif 2351 if (WFileName) { 2352 /* Do not exceed the default PATH_MAX for files. */ 2353 dumpinfo.CurrentFileName = (char *)malloc(PATH_MAX + 1); 2354 2355 if (dumpinfo.CurrentFileName == NULL) 2356 error("malloc of dumpinfo.CurrentFileName"); 2357 2358 /* We do not need numbering for dumpfiles if Cflag isn't set. */ 2359 if (Cflag != 0) 2360 MakeFilename(dumpinfo.CurrentFileName, WFileName, 0, WflagChars); 2361 else 2362 MakeFilename(dumpinfo.CurrentFileName, WFileName, 0, 0); 2363 2364 pdd = pcap_dump_open(pd, dumpinfo.CurrentFileName); 2365 #ifdef HAVE_LIBCAP_NG 2366 /* Give up CAP_DAC_OVERRIDE capability. 2367 * Only allow it to be restored if the -C or -G flag have been 2368 * set since we may need to create more files later on. 2369 */ 2370 capng_update( 2371 CAPNG_DROP, 2372 (Cflag || Gflag ? 0 : CAPNG_PERMITTED) 2373 | CAPNG_EFFECTIVE, 2374 CAP_DAC_OVERRIDE 2375 ); 2376 capng_apply(CAPNG_SELECT_BOTH); 2377 #endif /* HAVE_LIBCAP_NG */ 2378 if (pdd == NULL) 2379 error("%s", pcap_geterr(pd)); 2380 #ifdef HAVE_CAPSICUM 2381 set_dumper_capsicum_rights(pdd); 2382 #endif 2383 if (Cflag != 0 || Gflag != 0) { 2384 #ifdef HAVE_CAPSICUM 2385 dumpinfo.WFileName = strdup(basename(WFileName)); 2386 if (dumpinfo.WFileName == NULL) { 2387 error("Unable to allocate memory for file %s", 2388 WFileName); 2389 } 2390 dumpinfo.dirfd = open(dirname(WFileName), 2391 O_DIRECTORY | O_RDONLY); 2392 if (dumpinfo.dirfd < 0) { 2393 error("unable to open directory %s", 2394 dirname(WFileName)); 2395 } 2396 cap_rights_init(&rights, CAP_CREATE, CAP_FCNTL, 2397 CAP_FTRUNCATE, CAP_LOOKUP, CAP_SEEK, CAP_WRITE); 2398 if (cap_rights_limit(dumpinfo.dirfd, &rights) < 0 && 2399 errno != ENOSYS) { 2400 error("unable to limit directory rights"); 2401 } 2402 if (cap_fcntls_limit(dumpinfo.dirfd, CAP_FCNTL_GETFL) < 0 && 2403 errno != ENOSYS) { 2404 error("unable to limit dump descriptor fcntls"); 2405 } 2406 #else /* !HAVE_CAPSICUM */ 2407 dumpinfo.WFileName = WFileName; 2408 #endif 2409 callback = dump_packet_and_trunc; 2410 dumpinfo.pd = pd; 2411 dumpinfo.pdd = pdd; 2412 pcap_userdata = (u_char *)&dumpinfo; 2413 } else { 2414 callback = dump_packet; 2415 dumpinfo.WFileName = WFileName; 2416 dumpinfo.pd = pd; 2417 dumpinfo.pdd = pdd; 2418 pcap_userdata = (u_char *)&dumpinfo; 2419 } 2420 if (print) { 2421 dlt = pcap_datalink(pd); 2422 ndo->ndo_if_printer = get_if_printer(dlt); 2423 dumpinfo.ndo = ndo; 2424 } else 2425 dumpinfo.ndo = NULL; 2426 2427 #ifdef HAVE_PCAP_DUMP_FLUSH 2428 if (Uflag) 2429 pcap_dump_flush(pdd); 2430 #endif 2431 } else { 2432 dlt = pcap_datalink(pd); 2433 ndo->ndo_if_printer = get_if_printer(dlt); 2434 callback = print_packet; 2435 pcap_userdata = (u_char *)ndo; 2436 } 2437 2438 #ifdef SIGNAL_REQ_INFO 2439 /* 2440 * We can't get statistics when reading from a file rather 2441 * than capturing from a device. 2442 */ 2443 if (RFileName == NULL) 2444 (void)setsignal(SIGNAL_REQ_INFO, requestinfo); 2445 #endif 2446 #ifdef SIGNAL_FLUSH_PCAP 2447 (void)setsignal(SIGNAL_FLUSH_PCAP, flushpcap); 2448 #endif 2449 2450 if (ndo->ndo_vflag > 0 && WFileName && RFileName == NULL && !print) { 2451 /* 2452 * When capturing to a file, if "--print" wasn't specified, 2453 *"-v" means tcpdump should, once per second, 2454 * "v"erbosely report the number of packets captured. 2455 * Except when reading from a file, because -r, -w and -v 2456 * together used to make a corner case, in which pcap_loop() 2457 * errored due to EINTR (see GH #155 for details). 2458 */ 2459 #ifdef _WIN32 2460 /* 2461 * https://blogs.msdn.microsoft.com/oldnewthing/20151230-00/?p=92741 2462 * 2463 * suggests that this dates back to W2K. 2464 * 2465 * I don't know what a "long wait" is, but we'll assume 2466 * that printing the stats could be a "long wait". 2467 */ 2468 CreateTimerQueueTimer(&timer_handle, NULL, 2469 verbose_stats_dump, NULL, 1000, 1000, 2470 WT_EXECUTEDEFAULT|WT_EXECUTELONGFUNCTION); 2471 setvbuf(stderr, NULL, _IONBF, 0); 2472 #else /* _WIN32 */ 2473 /* 2474 * Assume this is UN*X, and that it has setitimer(); that 2475 * dates back to UNIX 95. 2476 */ 2477 struct itimerval timer; 2478 (void)setsignal(SIGALRM, verbose_stats_dump); 2479 timer.it_interval.tv_sec = 1; 2480 timer.it_interval.tv_usec = 0; 2481 timer.it_value.tv_sec = 1; 2482 timer.it_value.tv_usec = 1; 2483 setitimer(ITIMER_REAL, &timer, NULL); 2484 #endif /* _WIN32 */ 2485 } 2486 2487 if (RFileName == NULL) { 2488 /* 2489 * Live capture (if -V was specified, we set RFileName 2490 * to a file from the -V file). Print a message to 2491 * the standard error on UN*X. 2492 */ 2493 if (!ndo->ndo_vflag && !WFileName) { 2494 (void)fprintf(stderr, 2495 "%s: verbose output suppressed, use -v[v]... for full protocol decode\n", 2496 program_name); 2497 } else 2498 (void)fprintf(stderr, "%s: ", program_name); 2499 dlt = pcap_datalink(pd); 2500 dlt_name = pcap_datalink_val_to_name(dlt); 2501 (void)fprintf(stderr, "listening on %s", device); 2502 if (dlt_name == NULL) { 2503 (void)fprintf(stderr, ", link-type %u", dlt); 2504 } else { 2505 (void)fprintf(stderr, ", link-type %s (%s)", dlt_name, 2506 pcap_datalink_val_to_description(dlt)); 2507 } 2508 (void)fprintf(stderr, ", snapshot length %d bytes\n", ndo->ndo_snaplen); 2509 (void)fflush(stderr); 2510 } 2511 2512 #ifdef HAVE_CAPSICUM 2513 cansandbox = (VFileName == NULL && zflag == NULL); 2514 #ifdef HAVE_CASPER 2515 cansandbox = (cansandbox && (ndo->ndo_nflag || capdns != NULL)); 2516 #else 2517 cansandbox = (cansandbox && ndo->ndo_nflag); 2518 #endif /* HAVE_CASPER */ 2519 if (cansandbox && cap_enter() < 0 && errno != ENOSYS) 2520 error("unable to enter the capability mode"); 2521 #endif /* HAVE_CAPSICUM */ 2522 2523 do { 2524 status = pcap_loop(pd, cnt, callback, pcap_userdata); 2525 if (WFileName == NULL) { 2526 /* 2527 * We're printing packets. Flush the printed output, 2528 * so it doesn't get intermingled with error output. 2529 */ 2530 if (status == -2) { 2531 /* 2532 * We got interrupted, so perhaps we didn't 2533 * manage to finish a line we were printing. 2534 * Print an extra newline, just in case. 2535 */ 2536 putchar('\n'); 2537 } 2538 (void)fflush(stdout); 2539 } 2540 if (status == -2) { 2541 /* 2542 * We got interrupted. If we are reading multiple 2543 * files (via -V) set these so that we stop. 2544 */ 2545 VFileName = NULL; 2546 ret = NULL; 2547 } 2548 if (status == -1) { 2549 /* 2550 * Error. Report it. 2551 */ 2552 (void)fprintf(stderr, "%s: pcap_loop: %s\n", 2553 program_name, pcap_geterr(pd)); 2554 } 2555 if (RFileName == NULL) { 2556 /* 2557 * We're doing a live capture. Report the capture 2558 * statistics. 2559 */ 2560 info(1); 2561 } 2562 pcap_close(pd); 2563 if (VFileName != NULL) { 2564 ret = get_next_file(VFile, VFileLine); 2565 if (ret) { 2566 int new_dlt; 2567 2568 RFileName = VFileLine; 2569 pd = pcap_open_offline(RFileName, ebuf); 2570 if (pd == NULL) 2571 error("%s", ebuf); 2572 #ifdef HAVE_CAPSICUM 2573 cap_rights_init(&rights, CAP_READ); 2574 if (cap_rights_limit(fileno(pcap_file(pd)), 2575 &rights) < 0 && errno != ENOSYS) { 2576 error("unable to limit pcap descriptor"); 2577 } 2578 #endif 2579 new_dlt = pcap_datalink(pd); 2580 if (new_dlt != dlt) { 2581 /* 2582 * The new file has a different 2583 * link-layer header type from the 2584 * previous one. 2585 */ 2586 if (WFileName != NULL) { 2587 /* 2588 * We're writing raw packets 2589 * that match the filter to 2590 * a pcap file. pcap files 2591 * don't support multiple 2592 * different link-layer 2593 * header types, so we fail 2594 * here. 2595 */ 2596 error("%s: new dlt does not match original", RFileName); 2597 } 2598 2599 /* 2600 * We're printing the decoded packets; 2601 * switch to the new DLT. 2602 * 2603 * To do that, we need to change 2604 * the printer, change the DLT name, 2605 * and recompile the filter with 2606 * the new DLT. 2607 */ 2608 dlt = new_dlt; 2609 ndo->ndo_if_printer = get_if_printer(dlt); 2610 if (pcap_compile(pd, &fcode, cmdbuf, Oflag, netmask) < 0) 2611 error("%s", pcap_geterr(pd)); 2612 } 2613 2614 /* 2615 * Set the filter on the new file. 2616 */ 2617 if (pcap_setfilter(pd, &fcode) < 0) 2618 error("%s", pcap_geterr(pd)); 2619 2620 /* 2621 * Report the new file. 2622 */ 2623 dlt_name = pcap_datalink_val_to_name(dlt); 2624 fprintf(stderr, "reading from file %s", RFileName); 2625 if (dlt_name == NULL) { 2626 fprintf(stderr, ", link-type %u", dlt); 2627 } else { 2628 fprintf(stderr, ", link-type %s (%s)", 2629 dlt_name, 2630 pcap_datalink_val_to_description(dlt)); 2631 } 2632 fprintf(stderr, ", snapshot length %d\n", pcap_snapshot(pd)); 2633 } 2634 } 2635 } 2636 while (ret != NULL); 2637 2638 if (count_mode && RFileName != NULL) 2639 fprintf(stdout, "%u packet%s\n", packets_captured, 2640 PLURAL_SUFFIX(packets_captured)); 2641 2642 free(cmdbuf); 2643 pcap_freecode(&fcode); 2644 exit_tcpdump(status == -1 ? 1 : 0); 2645 } 2646 2647 /* 2648 * Catch a signal. 2649 */ 2650 static void 2651 (*setsignal (int sig, void (*func)(int)))(int) 2652 { 2653 #ifdef _WIN32 2654 return (signal(sig, func)); 2655 #else 2656 struct sigaction old, new; 2657 2658 memset(&new, 0, sizeof(new)); 2659 new.sa_handler = func; 2660 if (sig == SIGCHLD) 2661 new.sa_flags = SA_RESTART; 2662 if (sigaction(sig, &new, &old) < 0) 2663 return (SIG_ERR); 2664 return (old.sa_handler); 2665 #endif 2666 } 2667 2668 /* make a clean exit on interrupts */ 2669 static void 2670 cleanup(int signo _U_) 2671 { 2672 #ifdef _WIN32 2673 if (timer_handle != INVALID_HANDLE_VALUE) { 2674 DeleteTimerQueueTimer(NULL, timer_handle, NULL); 2675 CloseHandle(timer_handle); 2676 timer_handle = INVALID_HANDLE_VALUE; 2677 } 2678 #else /* _WIN32 */ 2679 struct itimerval timer; 2680 2681 timer.it_interval.tv_sec = 0; 2682 timer.it_interval.tv_usec = 0; 2683 timer.it_value.tv_sec = 0; 2684 timer.it_value.tv_usec = 0; 2685 setitimer(ITIMER_REAL, &timer, NULL); 2686 #endif /* _WIN32 */ 2687 2688 #ifdef HAVE_PCAP_BREAKLOOP 2689 /* 2690 * We have "pcap_breakloop()"; use it, so that we do as little 2691 * as possible in the signal handler (it's probably not safe 2692 * to do anything with standard I/O streams in a signal handler - 2693 * the ANSI C standard doesn't say it is). 2694 */ 2695 pcap_breakloop(pd); 2696 #else 2697 /* 2698 * We don't have "pcap_breakloop()"; this isn't safe, but 2699 * it's the best we can do. Print the summary if we're 2700 * not reading from a savefile - i.e., if we're doing a 2701 * live capture - and exit. 2702 */ 2703 if (pd != NULL && pcap_file(pd) == NULL) { 2704 /* 2705 * We got interrupted, so perhaps we didn't 2706 * manage to finish a line we were printing. 2707 * Print an extra newline, just in case. 2708 */ 2709 putchar('\n'); 2710 (void)fflush(stdout); 2711 info(1); 2712 } 2713 exit_tcpdump(S_SUCCESS); 2714 #endif 2715 } 2716 2717 /* 2718 On windows, we do not use a fork, so we do not care less about 2719 waiting a child processes to die 2720 */ 2721 #if defined(HAVE_FORK) || defined(HAVE_VFORK) 2722 static void 2723 child_cleanup(int signo _U_) 2724 { 2725 wait(NULL); 2726 } 2727 #endif /* HAVE_FORK && HAVE_VFORK */ 2728 2729 static void 2730 info(int verbose) 2731 { 2732 struct pcap_stat stats; 2733 2734 /* 2735 * Older versions of libpcap didn't set ps_ifdrop on some 2736 * platforms; initialize it to 0 to handle that. 2737 */ 2738 stats.ps_ifdrop = 0; 2739 if (pcap_stats(pd, &stats) < 0) { 2740 (void)fprintf(stderr, "pcap_stats: %s\n", pcap_geterr(pd)); 2741 infoprint = 0; 2742 return; 2743 } 2744 2745 if (!verbose) 2746 fprintf(stderr, "%s: ", program_name); 2747 2748 (void)fprintf(stderr, "%u packet%s captured", packets_captured, 2749 PLURAL_SUFFIX(packets_captured)); 2750 if (!verbose) 2751 fputs(", ", stderr); 2752 else 2753 putc('\n', stderr); 2754 (void)fprintf(stderr, "%u packet%s received by filter", stats.ps_recv, 2755 PLURAL_SUFFIX(stats.ps_recv)); 2756 if (!verbose) 2757 fputs(", ", stderr); 2758 else 2759 putc('\n', stderr); 2760 (void)fprintf(stderr, "%u packet%s dropped by kernel", stats.ps_drop, 2761 PLURAL_SUFFIX(stats.ps_drop)); 2762 if (stats.ps_ifdrop != 0) { 2763 if (!verbose) 2764 fputs(", ", stderr); 2765 else 2766 putc('\n', stderr); 2767 (void)fprintf(stderr, "%u packet%s dropped by interface\n", 2768 stats.ps_ifdrop, PLURAL_SUFFIX(stats.ps_ifdrop)); 2769 } else 2770 putc('\n', stderr); 2771 infoprint = 0; 2772 } 2773 2774 #if defined(HAVE_FORK) || defined(HAVE_VFORK) 2775 #ifdef HAVE_FORK 2776 #define fork_subprocess() fork() 2777 #else 2778 #define fork_subprocess() vfork() 2779 #endif 2780 static void 2781 compress_savefile(const char *filename) 2782 { 2783 pid_t child; 2784 2785 child = fork_subprocess(); 2786 if (child == -1) { 2787 fprintf(stderr, 2788 "compress_savefile: fork failed: %s\n", 2789 pcap_strerror(errno)); 2790 return; 2791 } 2792 if (child != 0) { 2793 /* Parent process. */ 2794 return; 2795 } 2796 2797 /* 2798 * Child process. 2799 * Set to lowest priority so that this doesn't disturb the capture. 2800 */ 2801 #ifdef NZERO 2802 setpriority(PRIO_PROCESS, 0, NZERO - 1); 2803 #else 2804 setpriority(PRIO_PROCESS, 0, 19); 2805 #endif 2806 if (execlp(zflag, zflag, filename, (char *)NULL) == -1) 2807 fprintf(stderr, 2808 "compress_savefile: execlp(%s, %s) failed: %s\n", 2809 zflag, 2810 filename, 2811 pcap_strerror(errno)); 2812 #ifdef HAVE_FORK 2813 exit(S_ERR_HOST_PROGRAM); 2814 #else 2815 _exit(S_ERR_HOST_PROGRAM); 2816 #endif 2817 } 2818 #else /* HAVE_FORK && HAVE_VFORK */ 2819 static void 2820 compress_savefile(const char *filename) 2821 { 2822 fprintf(stderr, 2823 "compress_savefile failed. Functionality not implemented under your system\n"); 2824 } 2825 #endif /* HAVE_FORK && HAVE_VFORK */ 2826 2827 static void 2828 dump_packet_and_trunc(u_char *user, const struct pcap_pkthdr *h, const u_char *sp) 2829 { 2830 struct dump_info *dump_info; 2831 2832 ++packets_captured; 2833 2834 ++infodelay; 2835 2836 dump_info = (struct dump_info *)user; 2837 2838 /* 2839 * XXX - this won't force the file to rotate on the specified time 2840 * boundary, but it will rotate on the first packet received after the 2841 * specified Gflag number of seconds. Note: if a Gflag time boundary 2842 * and a Cflag size boundary coincide, the time rotation will occur 2843 * first thereby cancelling the Cflag boundary (since the file should 2844 * be 0). 2845 */ 2846 if (Gflag != 0) { 2847 /* Check if it is time to rotate */ 2848 time_t t; 2849 2850 /* Get the current time */ 2851 if ((t = time(NULL)) == (time_t)-1) { 2852 error("%s: can't get current_time: %s", 2853 __func__, pcap_strerror(errno)); 2854 } 2855 2856 2857 /* If the time is greater than the specified window, rotate */ 2858 if (t - Gflag_time >= Gflag) { 2859 #ifdef HAVE_CAPSICUM 2860 FILE *fp; 2861 int fd; 2862 #endif 2863 2864 /* Update the Gflag_time */ 2865 Gflag_time = t; 2866 /* Update Gflag_count */ 2867 Gflag_count++; 2868 /* 2869 * Close the current file and open a new one. 2870 */ 2871 pcap_dump_close(dump_info->pdd); 2872 2873 /* 2874 * Compress the file we just closed, if the user asked for it 2875 */ 2876 if (zflag != NULL) 2877 compress_savefile(dump_info->CurrentFileName); 2878 2879 /* 2880 * Check to see if we've exceeded the Wflag (when 2881 * not using Cflag). 2882 */ 2883 if (Cflag == 0 && Wflag > 0 && Gflag_count >= Wflag) { 2884 (void)fprintf(stderr, "Maximum file limit reached: %d\n", 2885 Wflag); 2886 info(1); 2887 exit_tcpdump(S_SUCCESS); 2888 /* NOTREACHED */ 2889 } 2890 if (dump_info->CurrentFileName != NULL) 2891 free(dump_info->CurrentFileName); 2892 /* Allocate space for max filename + \0. */ 2893 dump_info->CurrentFileName = (char *)malloc(PATH_MAX + 1); 2894 if (dump_info->CurrentFileName == NULL) 2895 error("dump_packet_and_trunc: malloc"); 2896 /* 2897 * Gflag was set otherwise we wouldn't be here. Reset the count 2898 * so multiple files would end with 1,2,3 in the filename. 2899 * The counting is handled with the -C flow after this. 2900 */ 2901 Cflag_count = 0; 2902 2903 /* 2904 * This is always the first file in the Cflag 2905 * rotation: e.g. 0 2906 * We also don't need numbering if Cflag is not set. 2907 */ 2908 if (Cflag != 0) 2909 MakeFilename(dump_info->CurrentFileName, dump_info->WFileName, 0, 2910 WflagChars); 2911 else 2912 MakeFilename(dump_info->CurrentFileName, dump_info->WFileName, 0, 0); 2913 2914 #ifdef HAVE_LIBCAP_NG 2915 capng_update(CAPNG_ADD, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE); 2916 capng_apply(CAPNG_SELECT_BOTH); 2917 #endif /* HAVE_LIBCAP_NG */ 2918 #ifdef HAVE_CAPSICUM 2919 fd = openat(dump_info->dirfd, 2920 dump_info->CurrentFileName, 2921 O_CREAT | O_WRONLY | O_TRUNC, 0644); 2922 if (fd < 0) { 2923 error("unable to open file %s", 2924 dump_info->CurrentFileName); 2925 } 2926 fp = fdopen(fd, "w"); 2927 if (fp == NULL) { 2928 error("unable to fdopen file %s", 2929 dump_info->CurrentFileName); 2930 } 2931 dump_info->pdd = pcap_dump_fopen(dump_info->pd, fp); 2932 #else /* !HAVE_CAPSICUM */ 2933 dump_info->pdd = pcap_dump_open(dump_info->pd, dump_info->CurrentFileName); 2934 #endif 2935 #ifdef HAVE_LIBCAP_NG 2936 capng_update(CAPNG_DROP, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE); 2937 capng_apply(CAPNG_SELECT_BOTH); 2938 #endif /* HAVE_LIBCAP_NG */ 2939 if (dump_info->pdd == NULL) 2940 error("%s", pcap_geterr(pd)); 2941 #ifdef HAVE_CAPSICUM 2942 set_dumper_capsicum_rights(dump_info->pdd); 2943 #endif 2944 } 2945 } 2946 2947 /* 2948 * XXX - this won't prevent capture files from getting 2949 * larger than Cflag - the last packet written to the 2950 * file could put it over Cflag. 2951 */ 2952 if (Cflag != 0) { 2953 #ifdef HAVE_PCAP_DUMP_FTELL64 2954 int64_t size = pcap_dump_ftell64(dump_info->pdd); 2955 #else 2956 /* 2957 * XXX - this only handles a Cflag value > 2^31-1 on 2958 * LP64 platforms; to handle ILP32 (32-bit UN*X and 2959 * Windows) or LLP64 (64-bit Windows) would require 2960 * a version of libpcap with pcap_dump_ftell64(). 2961 */ 2962 long size = pcap_dump_ftell(dump_info->pdd); 2963 #endif 2964 2965 if (size == -1) 2966 error("ftell fails on output file"); 2967 if (size > Cflag) { 2968 #ifdef HAVE_CAPSICUM 2969 FILE *fp; 2970 int fd; 2971 #endif 2972 2973 /* 2974 * Close the current file and open a new one. 2975 */ 2976 pcap_dump_close(dump_info->pdd); 2977 2978 /* 2979 * Compress the file we just closed, if the user 2980 * asked for it. 2981 */ 2982 if (zflag != NULL) 2983 compress_savefile(dump_info->CurrentFileName); 2984 2985 Cflag_count++; 2986 if (Wflag > 0) { 2987 if (Cflag_count >= Wflag) 2988 Cflag_count = 0; 2989 } 2990 if (dump_info->CurrentFileName != NULL) 2991 free(dump_info->CurrentFileName); 2992 dump_info->CurrentFileName = (char *)malloc(PATH_MAX + 1); 2993 if (dump_info->CurrentFileName == NULL) 2994 error("%s: malloc", __func__); 2995 MakeFilename(dump_info->CurrentFileName, dump_info->WFileName, Cflag_count, WflagChars); 2996 #ifdef HAVE_LIBCAP_NG 2997 capng_update(CAPNG_ADD, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE); 2998 capng_apply(CAPNG_SELECT_BOTH); 2999 #endif /* HAVE_LIBCAP_NG */ 3000 #ifdef HAVE_CAPSICUM 3001 fd = openat(dump_info->dirfd, dump_info->CurrentFileName, 3002 O_CREAT | O_WRONLY | O_TRUNC, 0644); 3003 if (fd < 0) { 3004 error("unable to open file %s", 3005 dump_info->CurrentFileName); 3006 } 3007 fp = fdopen(fd, "w"); 3008 if (fp == NULL) { 3009 error("unable to fdopen file %s", 3010 dump_info->CurrentFileName); 3011 } 3012 dump_info->pdd = pcap_dump_fopen(dump_info->pd, fp); 3013 #else /* !HAVE_CAPSICUM */ 3014 dump_info->pdd = pcap_dump_open(dump_info->pd, dump_info->CurrentFileName); 3015 #endif 3016 #ifdef HAVE_LIBCAP_NG 3017 capng_update(CAPNG_DROP, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE); 3018 capng_apply(CAPNG_SELECT_BOTH); 3019 #endif /* HAVE_LIBCAP_NG */ 3020 if (dump_info->pdd == NULL) 3021 error("%s", pcap_geterr(pd)); 3022 #ifdef HAVE_CAPSICUM 3023 set_dumper_capsicum_rights(dump_info->pdd); 3024 #endif 3025 } 3026 } 3027 3028 pcap_dump((u_char *)dump_info->pdd, h, sp); 3029 #ifdef HAVE_PCAP_DUMP_FLUSH 3030 if (Uflag) 3031 pcap_dump_flush(dump_info->pdd); 3032 #endif 3033 3034 if (dump_info->ndo != NULL) 3035 pretty_print_packet(dump_info->ndo, h, sp, packets_captured); 3036 3037 --infodelay; 3038 if (infoprint) 3039 info(0); 3040 } 3041 3042 static void 3043 dump_packet(u_char *user, const struct pcap_pkthdr *h, const u_char *sp) 3044 { 3045 struct dump_info *dump_info; 3046 3047 ++packets_captured; 3048 3049 ++infodelay; 3050 3051 dump_info = (struct dump_info *)user; 3052 3053 pcap_dump((u_char *)dump_info->pdd, h, sp); 3054 #ifdef HAVE_PCAP_DUMP_FLUSH 3055 if (Uflag) 3056 pcap_dump_flush(dump_info->pdd); 3057 #endif 3058 3059 if (dump_info->ndo != NULL) 3060 pretty_print_packet(dump_info->ndo, h, sp, packets_captured); 3061 3062 --infodelay; 3063 if (infoprint) 3064 info(0); 3065 } 3066 3067 static void 3068 print_packet(u_char *user, const struct pcap_pkthdr *h, const u_char *sp) 3069 { 3070 ++packets_captured; 3071 3072 ++infodelay; 3073 3074 if (!count_mode) 3075 pretty_print_packet((netdissect_options *)user, h, sp, packets_captured); 3076 3077 --infodelay; 3078 if (infoprint) 3079 info(0); 3080 } 3081 3082 #ifdef SIGNAL_REQ_INFO 3083 static void 3084 requestinfo(int signo _U_) 3085 { 3086 if (infodelay) 3087 ++infoprint; 3088 else 3089 info(0); 3090 } 3091 #endif 3092 3093 #ifdef SIGNAL_FLUSH_PCAP 3094 static void 3095 flushpcap(int signo _U_) 3096 { 3097 if (pdd != NULL) 3098 pcap_dump_flush(pdd); 3099 } 3100 #endif 3101 3102 static void 3103 print_packets_captured (void) 3104 { 3105 static u_int prev_packets_captured, first = 1; 3106 3107 if (infodelay == 0 && (first || packets_captured != prev_packets_captured)) { 3108 fprintf(stderr, "Got %u\r", packets_captured); 3109 first = 0; 3110 prev_packets_captured = packets_captured; 3111 } 3112 } 3113 3114 /* 3115 * Called once each second in verbose mode while dumping to file 3116 */ 3117 #ifdef _WIN32 3118 static void CALLBACK verbose_stats_dump(PVOID param _U_, 3119 BOOLEAN timer_fired _U_) 3120 { 3121 print_packets_captured(); 3122 } 3123 #else /* _WIN32 */ 3124 static void verbose_stats_dump(int sig _U_) 3125 { 3126 print_packets_captured(); 3127 } 3128 #endif /* _WIN32 */ 3129 3130 USES_APPLE_DEPRECATED_API 3131 static void 3132 print_version(FILE *f) 3133 { 3134 #ifndef HAVE_PCAP_LIB_VERSION 3135 #ifdef HAVE_PCAP_VERSION 3136 extern char pcap_version[]; 3137 #else /* HAVE_PCAP_VERSION */ 3138 static char pcap_version[] = "unknown"; 3139 #endif /* HAVE_PCAP_VERSION */ 3140 #endif /* HAVE_PCAP_LIB_VERSION */ 3141 const char *smi_version_string; 3142 3143 (void)fprintf(f, "%s version " PACKAGE_VERSION "\n", program_name); 3144 #ifdef HAVE_PCAP_LIB_VERSION 3145 (void)fprintf(f, "%s\n", pcap_lib_version()); 3146 #else /* HAVE_PCAP_LIB_VERSION */ 3147 (void)fprintf(f, "libpcap version %s\n", pcap_version); 3148 #endif /* HAVE_PCAP_LIB_VERSION */ 3149 3150 #if defined(HAVE_LIBCRYPTO) && defined(SSLEAY_VERSION) 3151 (void)fprintf (f, "%s\n", SSLeay_version(SSLEAY_VERSION)); 3152 #endif 3153 3154 smi_version_string = nd_smi_version_string(); 3155 if (smi_version_string != NULL) 3156 (void)fprintf (f, "SMI-library: %s\n", smi_version_string); 3157 3158 #if defined(__SANITIZE_ADDRESS__) 3159 (void)fprintf (f, "Compiled with AddressSanitizer/GCC.\n"); 3160 #elif defined(__has_feature) 3161 # if __has_feature(address_sanitizer) 3162 (void)fprintf (f, "Compiled with AddressSanitizer/Clang.\n"); 3163 # elif __has_feature(memory_sanitizer) 3164 (void)fprintf (f, "Compiled with MemorySanitizer/Clang.\n"); 3165 # endif 3166 #endif /* __SANITIZE_ADDRESS__ or __has_feature */ 3167 } 3168 USES_APPLE_RST 3169 3170 static void 3171 print_usage(FILE *f) 3172 { 3173 print_version(f); 3174 (void)fprintf(f, 3175 "Usage: %s [-Abd" D_FLAG "efhH" I_FLAG J_FLAG "KlLnNOpqStu" U_FLAG "vxX#]" B_FLAG_USAGE " [ -c count ] [--count]\n", program_name); 3176 (void)fprintf(f, 3177 "\t\t[ -C file_size ] [ -E algo:secret ] [ -F file ] [ -G seconds ]\n"); 3178 (void)fprintf(f, 3179 "\t\t[ -i interface ]" IMMEDIATE_MODE_USAGE j_FLAG_USAGE "\n"); 3180 #ifdef HAVE_PCAP_FINDALLDEVS_EX 3181 (void)fprintf(f, 3182 "\t\t" LIST_REMOTE_INTERFACES_USAGE "\n"); 3183 #endif 3184 #ifdef USE_LIBSMI 3185 (void)fprintf(f, 3186 "\t\t" m_FLAG_USAGE "\n"); 3187 #endif 3188 (void)fprintf(f, 3189 "\t\t[ -M secret ] [ --number ] [ --print ]" Q_FLAG_USAGE "\n"); 3190 (void)fprintf(f, 3191 "\t\t[ -r file ] [ -s snaplen ] [ -T type ] [ --version ]\n"); 3192 (void)fprintf(f, 3193 "\t\t[ -V file ] [ -w file ] [ -W filecount ] [ -y datalinktype ]\n"); 3194 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION 3195 (void)fprintf(f, 3196 "\t\t[ --time-stamp-precision precision ] [ --micro ] [ --nano ]\n"); 3197 #endif 3198 (void)fprintf(f, 3199 "\t\t[ -z postrotate-command ] [ -Z user ] [ expression ]\n"); 3200 } 3201