]> The Tcpdump Group git mirrors - tcpdump/blob - tcpdump.c
CMake: give up on Clang on Haiku.
[tcpdump] / tcpdump.c
1 /*
2 * Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000
3 * The Regents of the University of California. All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that: (1) source code distributions
7 * retain the above copyright notice and this paragraph in its entirety, (2)
8 * distributions including binary code include the above copyright notice and
9 * this paragraph in its entirety in the documentation or other materials
10 * provided with the distribution, and (3) all advertising materials mentioning
11 * features or use of this software display the following acknowledgement:
12 * ``This product includes software developed by the University of California,
13 * Lawrence Berkeley Laboratory and its contributors.'' Neither the name of
14 * the University nor the names of its contributors may be used to endorse
15 * or promote products derived from this software without specific prior
16 * written permission.
17 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
18 * WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
19 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
20 *
21 * Support for splitting captures into multiple files with a maximum
22 * file size:
23 *
24 * Copyright (c) 2001
25 * Seth Webster <swebster@sst.ll.mit.edu>
26 */
27
28 /*
29 * tcpdump - dump traffic on a network
30 *
31 * First written in 1987 by Van Jacobson, Lawrence Berkeley Laboratory.
32 * Mercilessly hacked and occasionally improved since then via the
33 * combined efforts of Van, Steve McCanne and Craig Leres of LBL.
34 */
35
36 #ifdef HAVE_CONFIG_H
37 #include <config.h>
38 #endif
39
40 /*
41 * Some older versions of Mac OS X may ship pcap.h from libpcap 0.6 with a
42 * libpcap based on 0.8. That means it has pcap_findalldevs() but the
43 * header doesn't define pcap_if_t, meaning that we can't actually *use*
44 * pcap_findalldevs().
45 */
46 #ifdef HAVE_PCAP_FINDALLDEVS
47 #ifndef HAVE_PCAP_IF_T
48 #undef HAVE_PCAP_FINDALLDEVS
49 #endif
50 #endif
51
52 #include "netdissect-stdinc.h"
53
54 /*
55 * This must appear after including netdissect-stdinc.h, so that _U_ is
56 * defined.
57 */
58 #ifndef lint
59 static const char copyright[] _U_ =
60 "@(#) Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000\n\
61 The Regents of the University of California. All rights reserved.\n";
62 #endif
63
64 #include <sys/stat.h>
65
66 #ifdef HAVE_FCNTL_H
67 #include <fcntl.h>
68 #endif
69
70 #ifdef HAVE_LIBCRYPTO
71 #include <openssl/crypto.h>
72 #endif
73
74 #ifdef HAVE_GETOPT_LONG
75 #include <getopt.h>
76 #else
77 #include "missing/getopt_long.h"
78 #endif
79 /* Capsicum-specific code requires macros from <net/bpf.h>, which will fail
80 * to compile if <pcap.h> has already been included; including the headers
81 * in the opposite order works fine. For the most part anyway, because in
82 * FreeBSD <pcap/pcap.h> declares bpf_dump() instead of <net/bpf.h>. Thus
83 * interface.h takes care of it later to avoid a compiler warning.
84 */
85 #ifdef HAVE_CAPSICUM
86 #include <sys/capsicum.h>
87 #include <sys/ioccom.h>
88 #include <net/bpf.h>
89 #include <libgen.h>
90 #ifdef HAVE_CASPER
91 #include <libcasper.h>
92 #include <casper/cap_dns.h>
93 #include <sys/nv.h>
94 #endif /* HAVE_CASPER */
95 #endif /* HAVE_CAPSICUM */
96 #ifdef HAVE_PCAP_OPEN
97 /*
98 * We found pcap_open() in the capture library, so we'll be using
99 * the remote capture APIs; define PCAP_REMOTE before we include pcap.h,
100 * so we get those APIs declared, and the types and #defines that they
101 * use defined.
102 *
103 * WinPcap's headers require that PCAP_REMOTE be defined in order to get
104 * remote-capture APIs declared and types and #defines that they use
105 * defined.
106 *
107 * (Versions of libpcap with those APIs, and thus Npcap, which is based on
108 * those versions of libpcap, don't require it.)
109 */
110 #define HAVE_REMOTE
111 #endif
112 #include <pcap.h>
113 #include <signal.h>
114 #include <stdio.h>
115 #include <stdarg.h>
116 #include <stdlib.h>
117 #include <string.h>
118 #include <limits.h>
119 #ifdef _WIN32
120 #include <windows.h>
121 #else
122 #include <sys/time.h>
123 #include <sys/wait.h>
124 #include <sys/resource.h>
125 #include <pwd.h>
126 #include <grp.h>
127 #endif /* _WIN32 */
128
129 /*
130 * Pathname separator.
131 * Use this in pathnames, but do *not* use it in URLs.
132 */
133 #ifdef _WIN32
134 #define PATH_SEPARATOR '\\'
135 #else
136 #define PATH_SEPARATOR '/'
137 #endif
138
139 /* capabilities convenience library */
140 /* If a code depends on HAVE_LIBCAP_NG, it depends also on HAVE_CAP_NG_H.
141 * If HAVE_CAP_NG_H is not defined, undefine HAVE_LIBCAP_NG.
142 * Thus, the later tests are done only on HAVE_LIBCAP_NG.
143 */
144 #ifdef HAVE_LIBCAP_NG
145 #ifdef HAVE_CAP_NG_H
146 #include <cap-ng.h>
147 #else
148 #undef HAVE_LIBCAP_NG
149 #endif /* HAVE_CAP_NG_H */
150 #endif /* HAVE_LIBCAP_NG */
151
152 #ifdef __FreeBSD__
153 #include <sys/sysctl.h>
154 #endif /* __FreeBSD__ */
155
156 #include "netdissect-stdinc.h"
157 #include "netdissect.h"
158 #include "interface.h"
159 #include "addrtoname.h"
160 #include "machdep.h"
161 #include "pcap-missing.h"
162 #include "ascii_strcasecmp.h"
163
164 #include "print.h"
165
166 #include "diag-control.h"
167
168 #include "fptype.h"
169
170 #ifndef PATH_MAX
171 #define PATH_MAX 1024
172 #endif
173
174 #if defined(SIGINFO)
175 #define SIGNAL_REQ_INFO SIGINFO
176 #elif defined(SIGUSR1)
177 #define SIGNAL_REQ_INFO SIGUSR1
178 #endif
179
180 #if defined(HAVE_PCAP_DUMP_FLUSH) && defined(SIGUSR2)
181 #define SIGNAL_FLUSH_PCAP SIGUSR2
182 #endif
183
184 #if defined(HAVE_PCAP_CREATE) || defined(_WIN32)
185 static int Bflag; /* buffer size */
186 #endif
187 #ifdef HAVE_PCAP_DUMP_FTELL64
188 static int64_t Cflag; /* rotate dump files after this many bytes */
189 #else
190 static long Cflag; /* rotate dump files after this many bytes */
191 #endif
192 static int Cflag_count; /* Keep track of which file number we're writing */
193 #ifdef HAVE_PCAP_FINDALLDEVS
194 static int Dflag; /* list available devices and exit */
195 #endif
196 #ifdef HAVE_PCAP_FINDALLDEVS_EX
197 static char *remote_interfaces_source; /* list available devices from this source and exit */
198 #endif
199
200 /*
201 * This is exported because, in some versions of libpcap, if libpcap
202 * is built with optimizer debugging code (which is *NOT* the default
203 * configuration!), the library *imports*(!) a variable named dflag,
204 * under the expectation that tcpdump is exporting it, to govern
205 * how much debugging information to print when optimizing
206 * the generated BPF code.
207 *
208 * This is a horrible hack; newer versions of libpcap don't import
209 * dflag but, instead, *if* built with optimizer debugging code,
210 * *export* a routine to set that flag.
211 */
212 extern int dflag;
213 int dflag; /* print filter code */
214 static int Gflag; /* rotate dump files after this many seconds */
215 static int Gflag_count; /* number of files created with Gflag rotation */
216 static time_t Gflag_time; /* The last time_t the dump file was rotated. */
217 static int Lflag; /* list available data link types and exit */
218 static int Iflag; /* rfmon (monitor) mode */
219 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE
220 static int Jflag; /* list available time stamp types */
221 static int jflag = -1; /* packet time stamp source */
222 #endif
223 static int lflag; /* line-buffered output */
224 static int pflag; /* don't go promiscuous */
225 #ifdef HAVE_PCAP_SETDIRECTION
226 static int Qflag = -1; /* restrict captured packet by send/receive direction */
227 #endif
228 #ifdef HAVE_PCAP_DUMP_FLUSH
229 static int Uflag; /* "unbuffered" output of dump files */
230 #endif
231 static int Wflag; /* recycle output files after this number of files */
232 static int WflagChars;
233 static char *zflag = NULL; /* compress each savefile using a specified command (like gzip or bzip2) */
234 static int timeout = 1000; /* default timeout = 1000 ms = 1 s */
235 #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE
236 static int immediate_mode;
237 #endif
238 static int count_mode;
239
240 static int infodelay;
241 static int infoprint;
242
243 char *program_name;
244
245 /* Forwards */
246 static void (*setsignal (int sig, void (*func)(int)))(int);
247 static void cleanup(int);
248 static void child_cleanup(int);
249 static void print_version(FILE *);
250 static void print_usage(FILE *);
251
252 static void print_packet(u_char *, const struct pcap_pkthdr *, const u_char *);
253 static void dump_packet_and_trunc(u_char *, const struct pcap_pkthdr *, const u_char *);
254 static void dump_packet(u_char *, const struct pcap_pkthdr *, const u_char *);
255
256 #ifdef SIGNAL_REQ_INFO
257 static void requestinfo(int);
258 #endif
259
260 #ifdef SIGNAL_FLUSH_PCAP
261 static void flushpcap(int);
262 #endif
263
264 #ifdef _WIN32
265 static HANDLE timer_handle = INVALID_HANDLE_VALUE;
266 static void CALLBACK verbose_stats_dump(PVOID param, BOOLEAN timer_fired);
267 #else /* _WIN32 */
268 static void verbose_stats_dump(int sig);
269 #endif /* _WIN32 */
270
271 static void info(int);
272 static u_int packets_captured;
273
274 #ifdef HAVE_PCAP_FINDALLDEVS
275 static const struct tok status_flags[] = {
276 #ifdef PCAP_IF_UP
277 { PCAP_IF_UP, "Up" },
278 #endif
279 #ifdef PCAP_IF_RUNNING
280 { PCAP_IF_RUNNING, "Running" },
281 #endif
282 { PCAP_IF_LOOPBACK, "Loopback" },
283 #ifdef PCAP_IF_WIRELESS
284 { PCAP_IF_WIRELESS, "Wireless" },
285 #endif
286 { 0, NULL }
287 };
288 #endif
289
290 static pcap_t *pd;
291 static pcap_dumper_t *pdd = NULL;
292
293 static int supports_monitor_mode;
294
295 extern int optind;
296 extern int opterr;
297 extern char *optarg;
298
299 struct dump_info {
300 char *WFileName;
301 char *CurrentFileName;
302 pcap_t *pd;
303 pcap_dumper_t *pdd;
304 netdissect_options *ndo;
305 #ifdef HAVE_CAPSICUM
306 int dirfd;
307 #endif
308 };
309
310 #if defined(HAVE_PCAP_SET_PARSER_DEBUG)
311 /*
312 * We have pcap_set_parser_debug() in libpcap; declare it (it's not declared
313 * by any libpcap header, because it's a special hack, only available if
314 * libpcap was configured to include it, and only intended for use by
315 * libpcap developers trying to debug the parser for filter expressions).
316 */
317 #ifdef _WIN32
318 __declspec(dllimport)
319 #else /* _WIN32 */
320 extern
321 #endif /* _WIN32 */
322 void pcap_set_parser_debug(int);
323 #elif defined(HAVE_PCAP_DEBUG) || defined(HAVE_YYDEBUG)
324 /*
325 * We don't have pcap_set_parser_debug() in libpcap, but we do have
326 * pcap_debug or yydebug. Make a local version of pcap_set_parser_debug()
327 * to set the flag, and define HAVE_PCAP_SET_PARSER_DEBUG.
328 */
329 static void
330 pcap_set_parser_debug(int value)
331 {
332 #ifdef HAVE_PCAP_DEBUG
333 extern int pcap_debug;
334
335 pcap_debug = value;
336 #else /* HAVE_PCAP_DEBUG */
337 extern int yydebug;
338
339 yydebug = value;
340 #endif /* HAVE_PCAP_DEBUG */
341 }
342
343 #define HAVE_PCAP_SET_PARSER_DEBUG
344 #endif
345
346 #if defined(HAVE_PCAP_SET_OPTIMIZER_DEBUG)
347 /*
348 * We have pcap_set_optimizer_debug() in libpcap; declare it (it's not declared
349 * by any libpcap header, because it's a special hack, only available if
350 * libpcap was configured to include it, and only intended for use by
351 * libpcap developers trying to debug the optimizer for filter expressions).
352 */
353 #ifdef _WIN32
354 __declspec(dllimport)
355 #else /* _WIN32 */
356 extern
357 #endif /* _WIN32 */
358 void pcap_set_optimizer_debug(int);
359 #endif
360
361 static void NORETURN
362 exit_tcpdump(const int status)
363 {
364 nd_cleanup();
365 exit(status);
366 }
367
368 /* VARARGS */
369 static void NORETURN PRINTFLIKE(1, 2)
370 error(FORMAT_STRING(const char *fmt), ...)
371 {
372 va_list ap;
373
374 (void)fprintf(stderr, "%s: ", program_name);
375 va_start(ap, fmt);
376 (void)vfprintf(stderr, fmt, ap);
377 va_end(ap);
378 if (*fmt) {
379 fmt += strlen(fmt);
380 if (fmt[-1] != '\n')
381 (void)fputc('\n', stderr);
382 }
383 exit_tcpdump(S_ERR_HOST_PROGRAM);
384 /* NOTREACHED */
385 }
386
387 /* VARARGS */
388 static void PRINTFLIKE(1, 2)
389 warning(FORMAT_STRING(const char *fmt), ...)
390 {
391 va_list ap;
392
393 (void)fprintf(stderr, "%s: WARNING: ", program_name);
394 va_start(ap, fmt);
395 (void)vfprintf(stderr, fmt, ap);
396 va_end(ap);
397 if (*fmt) {
398 fmt += strlen(fmt);
399 if (fmt[-1] != '\n')
400 (void)fputc('\n', stderr);
401 }
402 }
403
404 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE
405 static void NORETURN
406 show_tstamp_types_and_exit(pcap_t *pc, const char *device)
407 {
408 int n_tstamp_types;
409 int *tstamp_types = 0;
410 const char *tstamp_type_name;
411 int i;
412
413 n_tstamp_types = pcap_list_tstamp_types(pc, &tstamp_types);
414 if (n_tstamp_types < 0)
415 error("%s", pcap_geterr(pc));
416
417 if (n_tstamp_types == 0) {
418 fprintf(stderr, "Time stamp type cannot be set for %s\n",
419 device);
420 exit_tcpdump(S_SUCCESS);
421 }
422 fprintf(stdout, "Time stamp types for %s (use option -j to set):\n",
423 device);
424 for (i = 0; i < n_tstamp_types; i++) {
425 tstamp_type_name = pcap_tstamp_type_val_to_name(tstamp_types[i]);
426 if (tstamp_type_name != NULL) {
427 (void) fprintf(stdout, " %s (%s)\n", tstamp_type_name,
428 pcap_tstamp_type_val_to_description(tstamp_types[i]));
429 } else {
430 (void) fprintf(stdout, " %d\n", tstamp_types[i]);
431 }
432 }
433 pcap_free_tstamp_types(tstamp_types);
434 exit_tcpdump(S_SUCCESS);
435 }
436 #endif
437
438 static void NORETURN
439 show_dlts_and_exit(pcap_t *pc, const char *device)
440 {
441 int n_dlts, i;
442 int *dlts = 0;
443 const char *dlt_name;
444
445 n_dlts = pcap_list_datalinks(pc, &dlts);
446 if (n_dlts < 0)
447 error("%s", pcap_geterr(pc));
448 else if (n_dlts == 0 || !dlts)
449 error("No data link types.");
450
451 /*
452 * If the interface is known to support monitor mode, indicate
453 * whether these are the data link types available when not in
454 * monitor mode, if -I wasn't specified, or when in monitor mode,
455 * when -I was specified (the link-layer types available in
456 * monitor mode might be different from the ones available when
457 * not in monitor mode).
458 */
459 (void) fprintf(stdout, "Data link types for ");
460 if (supports_monitor_mode)
461 (void) fprintf(stdout, "%s %s",
462 device,
463 Iflag ? "when in monitor mode" : "when not in monitor mode");
464 else
465 (void) fprintf(stdout, "%s",
466 device);
467 (void) fprintf(stdout, " (use option -y to set):\n");
468
469 for (i = 0; i < n_dlts; i++) {
470 dlt_name = pcap_datalink_val_to_name(dlts[i]);
471 if (dlt_name != NULL) {
472 (void) fprintf(stdout, " %s (%s)", dlt_name,
473 pcap_datalink_val_to_description(dlts[i]));
474
475 /*
476 * OK, does tcpdump handle that type?
477 */
478 if (!has_printer(dlts[i]))
479 (void) fprintf(stdout, " (printing not supported)");
480 fprintf(stdout, "\n");
481 } else {
482 (void) fprintf(stdout, " DLT %d (printing not supported)\n",
483 dlts[i]);
484 }
485 }
486 #ifdef HAVE_PCAP_FREE_DATALINKS
487 pcap_free_datalinks(dlts);
488 #endif
489 exit_tcpdump(S_SUCCESS);
490 }
491
492 #ifdef HAVE_PCAP_FINDALLDEVS
493 static void NORETURN
494 show_devices_and_exit(void)
495 {
496 pcap_if_t *dev, *devlist;
497 char ebuf[PCAP_ERRBUF_SIZE];
498 int i;
499
500 if (pcap_findalldevs(&devlist, ebuf) < 0)
501 error("%s", ebuf);
502 for (i = 0, dev = devlist; dev != NULL; i++, dev = dev->next) {
503 printf("%d.%s", i+1, dev->name);
504 if (dev->description != NULL)
505 printf(" (%s)", dev->description);
506 if (dev->flags != 0) {
507 printf(" [");
508 printf("%s", bittok2str(status_flags, "none", dev->flags));
509 #ifdef PCAP_IF_WIRELESS
510 if (dev->flags & PCAP_IF_WIRELESS) {
511 switch (dev->flags & PCAP_IF_CONNECTION_STATUS) {
512
513 case PCAP_IF_CONNECTION_STATUS_UNKNOWN:
514 printf(", Association status unknown");
515 break;
516
517 case PCAP_IF_CONNECTION_STATUS_CONNECTED:
518 printf(", Associated");
519 break;
520
521 case PCAP_IF_CONNECTION_STATUS_DISCONNECTED:
522 printf(", Not associated");
523 break;
524
525 case PCAP_IF_CONNECTION_STATUS_NOT_APPLICABLE:
526 break;
527 }
528 } else {
529 switch (dev->flags & PCAP_IF_CONNECTION_STATUS) {
530
531 case PCAP_IF_CONNECTION_STATUS_UNKNOWN:
532 printf(", Connection status unknown");
533 break;
534
535 case PCAP_IF_CONNECTION_STATUS_CONNECTED:
536 printf(", Connected");
537 break;
538
539 case PCAP_IF_CONNECTION_STATUS_DISCONNECTED:
540 printf(", Disconnected");
541 break;
542
543 case PCAP_IF_CONNECTION_STATUS_NOT_APPLICABLE:
544 break;
545 }
546 }
547 #endif
548 printf("]");
549 }
550 printf("\n");
551 }
552 pcap_freealldevs(devlist);
553 exit_tcpdump(S_SUCCESS);
554 }
555 #endif /* HAVE_PCAP_FINDALLDEVS */
556
557 #ifdef HAVE_PCAP_FINDALLDEVS_EX
558 static void NORETURN
559 show_remote_devices_and_exit(void)
560 {
561 pcap_if_t *dev, *devlist;
562 char ebuf[PCAP_ERRBUF_SIZE];
563 int i;
564
565 if (pcap_findalldevs_ex(remote_interfaces_source, NULL, &devlist,
566 ebuf) < 0)
567 error("%s", ebuf);
568 for (i = 0, dev = devlist; dev != NULL; i++, dev = dev->next) {
569 printf("%d.%s", i+1, dev->name);
570 if (dev->description != NULL)
571 printf(" (%s)", dev->description);
572 if (dev->flags != 0)
573 printf(" [%s]", bittok2str(status_flags, "none", dev->flags));
574 printf("\n");
575 }
576 pcap_freealldevs(devlist);
577 exit_tcpdump(S_SUCCESS);
578 }
579 #endif /* HAVE_PCAP_FINDALLDEVS */
580
581 /*
582 * Short options.
583 *
584 * Note that there we use all letters for short options except for g, k,
585 * o, and P, and those are used by other versions of tcpdump, and we should
586 * only use them for the same purposes that the other versions of tcpdump
587 * use them:
588 *
589 * macOS tcpdump uses -g to force non--v output for IP to be on one
590 * line, making it more "g"repable;
591 *
592 * macOS tcpdump uses -k to specify that packet comments in pcapng files
593 * should be printed;
594 *
595 * OpenBSD tcpdump uses -o to indicate that OS fingerprinting should be done
596 * for hosts sending TCP SYN packets;
597 *
598 * macOS tcpdump uses -P to indicate that -w should write pcapng rather
599 * than pcap files.
600 *
601 * macOS tcpdump also uses -Q to specify expressions that match packet
602 * metadata, including but not limited to the packet direction.
603 * The expression syntax is different from a simple "in|out|inout",
604 * and those expressions aren't accepted by macOS tcpdump, but the
605 * equivalents would be "in" = "dir=in", "out" = "dir=out", and
606 * "inout" = "dir=in or dir=out", and the parser could conceivably
607 * special-case "in", "out", and "inout" as expressions for backwards
608 * compatibility, so all is not (yet) lost.
609 */
610
611 /*
612 * Set up flags that might or might not be supported depending on the
613 * version of libpcap we're using.
614 */
615 #if defined(HAVE_PCAP_CREATE) || defined(_WIN32)
616 #define B_FLAG "B:"
617 #define B_FLAG_USAGE " [ -B size ]"
618 #else /* defined(HAVE_PCAP_CREATE) || defined(_WIN32) */
619 #define B_FLAG
620 #define B_FLAG_USAGE
621 #endif /* defined(HAVE_PCAP_CREATE) || defined(_WIN32) */
622
623 #ifdef HAVE_PCAP_FINDALLDEVS
624 #define D_FLAG "D"
625 #else
626 #define D_FLAG
627 #endif
628
629 #ifdef HAVE_PCAP_CREATE
630 #define I_FLAG "I"
631 #else /* HAVE_PCAP_CREATE */
632 #define I_FLAG
633 #endif /* HAVE_PCAP_CREATE */
634
635 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE
636 #define j_FLAG "j:"
637 #define j_FLAG_USAGE " [ -j tstamptype ]"
638 #define J_FLAG "J"
639 #else /* PCAP_ERROR_TSTAMP_TYPE_NOTSUP */
640 #define j_FLAG
641 #define j_FLAG_USAGE
642 #define J_FLAG
643 #endif /* PCAP_ERROR_TSTAMP_TYPE_NOTSUP */
644
645 #ifdef USE_LIBSMI
646 #define m_FLAG_USAGE "[ -m module ] ..."
647 #endif
648
649 #ifdef HAVE_PCAP_SETDIRECTION
650 #define Q_FLAG "Q:"
651 #define Q_FLAG_USAGE " [ -Q in|out|inout ]"
652 #else
653 #define Q_FLAG
654 #define Q_FLAG_USAGE
655 #endif
656
657 #ifdef HAVE_PCAP_DUMP_FLUSH
658 #define U_FLAG "U"
659 #else
660 #define U_FLAG
661 #endif
662
663 #define SHORTOPTS "aAb" B_FLAG "c:C:d" D_FLAG "eE:fF:G:hHi:" I_FLAG j_FLAG J_FLAG "KlLm:M:nNOpq" Q_FLAG "r:s:StT:u" U_FLAG "vV:w:W:xXy:Yz:Z:#"
664
665 /*
666 * Long options.
667 *
668 * We do not currently have long options corresponding to all short
669 * options; we should probably pick appropriate option names for them.
670 *
671 * However, the short options where the number of times the option is
672 * specified matters, such as -v and -d and -t, should probably not
673 * just map to a long option, as saying
674 *
675 * tcpdump --verbose --verbose
676 *
677 * doesn't make sense; it should be --verbosity={N} or something such
678 * as that.
679 *
680 * For long options with no corresponding short options, we define values
681 * outside the range of ASCII graphic characters, make that the last
682 * component of the entry for the long option, and have a case for that
683 * option in the switch statement.
684 */
685 #define OPTION_VERSION 128
686 #define OPTION_TSTAMP_PRECISION 129
687 #define OPTION_IMMEDIATE_MODE 130
688 #define OPTION_PRINT 131
689 #define OPTION_LIST_REMOTE_INTERFACES 132
690 #define OPTION_TSTAMP_MICRO 133
691 #define OPTION_TSTAMP_NANO 134
692 #define OPTION_FP_TYPE 135
693 #define OPTION_COUNT 136
694 #define OPTION_PRINT_SAMPLING 137
695
696 static const struct option longopts[] = {
697 #if defined(HAVE_PCAP_CREATE) || defined(_WIN32)
698 { "buffer-size", required_argument, NULL, 'B' },
699 #endif
700 { "list-interfaces", no_argument, NULL, 'D' },
701 #ifdef HAVE_PCAP_FINDALLDEVS_EX
702 { "list-remote-interfaces", required_argument, NULL, OPTION_LIST_REMOTE_INTERFACES },
703 #endif
704 { "help", no_argument, NULL, 'h' },
705 { "interface", required_argument, NULL, 'i' },
706 #ifdef HAVE_PCAP_CREATE
707 { "monitor-mode", no_argument, NULL, 'I' },
708 #endif
709 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE
710 { "time-stamp-type", required_argument, NULL, 'j' },
711 { "list-time-stamp-types", no_argument, NULL, 'J' },
712 #endif
713 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
714 { "micro", no_argument, NULL, OPTION_TSTAMP_MICRO},
715 { "nano", no_argument, NULL, OPTION_TSTAMP_NANO},
716 { "time-stamp-precision", required_argument, NULL, OPTION_TSTAMP_PRECISION},
717 #endif
718 { "dont-verify-checksums", no_argument, NULL, 'K' },
719 { "list-data-link-types", no_argument, NULL, 'L' },
720 { "no-optimize", no_argument, NULL, 'O' },
721 { "no-promiscuous-mode", no_argument, NULL, 'p' },
722 #ifdef HAVE_PCAP_SETDIRECTION
723 { "direction", required_argument, NULL, 'Q' },
724 #endif
725 { "snapshot-length", required_argument, NULL, 's' },
726 { "absolute-tcp-sequence-numbers", no_argument, NULL, 'S' },
727 #ifdef HAVE_PCAP_DUMP_FLUSH
728 { "packet-buffered", no_argument, NULL, 'U' },
729 #endif
730 { "linktype", required_argument, NULL, 'y' },
731 #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE
732 { "immediate-mode", no_argument, NULL, OPTION_IMMEDIATE_MODE },
733 #endif
734 #ifdef HAVE_PCAP_SET_PARSER_DEBUG
735 { "debug-filter-parser", no_argument, NULL, 'Y' },
736 #endif
737 { "relinquish-privileges", required_argument, NULL, 'Z' },
738 { "count", no_argument, NULL, OPTION_COUNT },
739 { "fp-type", no_argument, NULL, OPTION_FP_TYPE },
740 { "number", no_argument, NULL, '#' },
741 { "print", no_argument, NULL, OPTION_PRINT },
742 { "print-sampling", required_argument, NULL, OPTION_PRINT_SAMPLING },
743 { "version", no_argument, NULL, OPTION_VERSION },
744 { NULL, 0, NULL, 0 }
745 };
746
747 #ifdef HAVE_PCAP_FINDALLDEVS_EX
748 #define LIST_REMOTE_INTERFACES_USAGE "[ --list-remote-interfaces remote-source ]"
749 #else
750 #define LIST_REMOTE_INTERFACES_USAGE
751 #endif
752
753 #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE
754 #define IMMEDIATE_MODE_USAGE " [ --immediate-mode ]"
755 #else
756 #define IMMEDIATE_MODE_USAGE ""
757 #endif
758
759 #ifndef _WIN32
760 /* Drop root privileges and chroot if necessary */
761 static void
762 droproot(const char *username, const char *chroot_dir)
763 {
764 struct passwd *pw = NULL;
765
766 if (chroot_dir && !username)
767 error("Chroot without dropping root is insecure");
768
769 pw = getpwnam(username);
770 if (pw) {
771 if (chroot_dir) {
772 if (chroot(chroot_dir) != 0 || chdir ("/") != 0)
773 error("Couldn't chroot/chdir to '%.64s': %s",
774 chroot_dir, pcap_strerror(errno));
775 }
776 #ifdef HAVE_LIBCAP_NG
777 {
778 int ret = capng_change_id(pw->pw_uid, pw->pw_gid, CAPNG_NO_FLAG);
779 if (ret < 0)
780 error("capng_change_id(): return %d\n", ret);
781 else
782 fprintf(stderr, "dropped privs to %s\n", username);
783 }
784 #else
785 if (initgroups(pw->pw_name, pw->pw_gid) != 0 ||
786 setgid(pw->pw_gid) != 0 || setuid(pw->pw_uid) != 0)
787 error("Couldn't change to '%.32s' uid=%lu gid=%lu: %s",
788 username,
789 (unsigned long)pw->pw_uid,
790 (unsigned long)pw->pw_gid,
791 pcap_strerror(errno));
792 else {
793 fprintf(stderr, "dropped privs to %s\n", username);
794 }
795 #endif /* HAVE_LIBCAP_NG */
796 } else
797 error("Couldn't find user '%.32s'", username);
798 #ifdef HAVE_LIBCAP_NG
799 /* We don't need CAP_SETUID, CAP_SETGID and CAP_SYS_CHROOT any more. */
800 DIAG_OFF_ASSIGN_ENUM
801 capng_updatev(
802 CAPNG_DROP,
803 CAPNG_EFFECTIVE | CAPNG_PERMITTED,
804 CAP_SETUID,
805 CAP_SETGID,
806 CAP_SYS_CHROOT,
807 -1);
808 DIAG_ON_ASSIGN_ENUM
809 capng_apply(CAPNG_SELECT_BOTH);
810 #endif /* HAVE_LIBCAP_NG */
811
812 }
813 #endif /* _WIN32 */
814
815 static int
816 getWflagChars(int x)
817 {
818 int c = 0;
819
820 x -= 1;
821 while (x > 0) {
822 c += 1;
823 x /= 10;
824 }
825
826 return c;
827 }
828
829
830 static void
831 MakeFilename(char *buffer, char *orig_name, int cnt, int max_chars)
832 {
833 char *filename = malloc(PATH_MAX + 1);
834 if (filename == NULL)
835 error("%s: malloc", __func__);
836 if (strlen(orig_name) == 0)
837 error("an empty string is not a valid file name");
838
839 /* Process with strftime if Gflag is set. */
840 if (Gflag != 0) {
841 struct tm *local_tm;
842
843 /* Convert Gflag_time to a usable format */
844 if ((local_tm = localtime(&Gflag_time)) == NULL) {
845 error("%s: localtime", __func__);
846 }
847
848 /* There's no good way to detect an error in strftime since a return
849 * value of 0 isn't necessarily failure; if orig_name is an empty
850 * string, the formatted string will be empty.
851 *
852 * However, the C90 standard says that, if there *is* a
853 * buffer overflow, the content of the buffer is undefined,
854 * so we must check for a buffer overflow.
855 *
856 * So we check above for an empty orig_name, and only call
857 * strftime() if it's non-empty, in which case the return
858 * value will only be 0 if the formatted date doesn't fit
859 * in the buffer.
860 *
861 * (We check above because, even if we don't use -G, we
862 * want a better error message than "tcpdump: : No such
863 * file or directory" for this case.)
864 */
865 if (strftime(filename, PATH_MAX, orig_name, local_tm) == 0) {
866 error("%s: strftime", __func__);
867 }
868 } else {
869 strncpy(filename, orig_name, PATH_MAX);
870 }
871
872 if (cnt == 0 && max_chars == 0)
873 strncpy(buffer, filename, PATH_MAX + 1);
874 else
875 if (snprintf(buffer, PATH_MAX + 1, "%s%0*d", filename, max_chars, cnt) > PATH_MAX)
876 /* Report an error if the filename is too large */
877 error("too many output files or filename is too long (> %d)", PATH_MAX);
878 free(filename);
879 }
880
881 static char *
882 get_next_file(FILE *VFile, char *ptr)
883 {
884 char *ret;
885 size_t len;
886
887 ret = fgets(ptr, PATH_MAX, VFile);
888 if (!ret)
889 return NULL;
890
891 len = strlen (ptr);
892 if (len > 0 && ptr[len - 1] == '\n')
893 ptr[len - 1] = '\0';
894
895 return ret;
896 }
897
898 #ifdef HAVE_CASPER
899 static cap_channel_t *
900 capdns_setup(void)
901 {
902 cap_channel_t *capcas, *capdnsloc;
903 const char *types[1];
904 int families[2];
905
906 capcas = cap_init();
907 if (capcas == NULL)
908 error("unable to create casper process");
909 capdnsloc = cap_service_open(capcas, "system.dns");
910 /* Casper capability no longer needed. */
911 cap_close(capcas);
912 if (capdnsloc == NULL)
913 error("unable to open system.dns service");
914 /* Limit system.dns to reverse DNS lookups. */
915 types[0] = "ADDR";
916 if (cap_dns_type_limit(capdnsloc, types, 1) < 0)
917 error("unable to limit access to system.dns service");
918 families[0] = AF_INET;
919 families[1] = AF_INET6;
920 if (cap_dns_family_limit(capdnsloc, families, 2) < 0)
921 error("unable to limit access to system.dns service");
922
923 return (capdnsloc);
924 }
925 #endif /* HAVE_CASPER */
926
927 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
928 static int
929 tstamp_precision_from_string(const char *precision)
930 {
931 if (strncmp(precision, "nano", strlen("nano")) == 0)
932 return PCAP_TSTAMP_PRECISION_NANO;
933
934 if (strncmp(precision, "micro", strlen("micro")) == 0)
935 return PCAP_TSTAMP_PRECISION_MICRO;
936
937 return -EINVAL;
938 }
939
940 static const char *
941 tstamp_precision_to_string(int precision)
942 {
943 switch (precision) {
944
945 case PCAP_TSTAMP_PRECISION_MICRO:
946 return "micro";
947
948 case PCAP_TSTAMP_PRECISION_NANO:
949 return "nano";
950
951 default:
952 return "unknown";
953 }
954 }
955 #endif
956
957 #ifdef HAVE_CAPSICUM
958 /*
959 * Ensure that, on a dump file's descriptor, we have all the rights
960 * necessary to make the standard I/O library work with an fdopen()ed
961 * FILE * from that descriptor.
962 *
963 * A long time ago in a galaxy far, far away, AT&T decided that, instead
964 * of providing separate APIs for getting and setting the FD_ flags on a
965 * descriptor, getting and setting the O_ flags on a descriptor, and
966 * locking files, they'd throw them all into a kitchen-sink fcntl() call
967 * along the lines of ioctl(), the fact that ioctl() operations are
968 * largely specific to particular character devices but fcntl() operations
969 * are either generic to all descriptors or generic to all descriptors for
970 * regular files nonwithstanding.
971 *
972 * The Capsicum people decided that fine-grained control of descriptor
973 * operations was required, so that you need to grant permission for
974 * reading, writing, seeking, and fcntl-ing. The latter, courtesy of
975 * AT&T's decision, means that "fcntl-ing" isn't a thing, but a motley
976 * collection of things, so there are *individual* fcntls for which
977 * permission needs to be granted.
978 *
979 * The FreeBSD standard I/O people implemented some optimizations that
980 * requires that the standard I/O routines be able to determine whether
981 * the descriptor for the FILE * is open append-only or not; as that
982 * descriptor could have come from an open() rather than an fopen(),
983 * that requires that it be able to do an F_GETFL fcntl() to read
984 * the O_ flags.
985 *
986 * Tcpdump uses ftell() to determine how much data has been written
987 * to a file in order to, when used with -C, determine when it's time
988 * to rotate capture files. ftell() therefore needs to do an lseek()
989 * to find out the file offset and must, thanks to the aforementioned
990 * optimization, also know whether the descriptor is open append-only
991 * or not.
992 *
993 * The net result of all the above is that we need to grant CAP_SEEK,
994 * CAP_WRITE, and CAP_FCNTL with the CAP_FCNTL_GETFL subcapability.
995 *
996 * Perhaps this is the universe's way of saying that either
997 *
998 * 1) there needs to be an fopenat() call and a pcap_dump_openat() call
999 * using it, so that Capsicum-capable tcpdump wouldn't need to do
1000 * an fdopen()
1001 *
1002 * or
1003 *
1004 * 2) there needs to be a cap_fdopen() call in the FreeBSD standard
1005 * I/O library that knows what rights are needed by the standard
1006 * I/O library, based on the open mode, and assigns them, perhaps
1007 * with an additional argument indicating, for example, whether
1008 * seeking should be allowed, so that tcpdump doesn't need to know
1009 * what the standard I/O library happens to require this week.
1010 */
1011 static void
1012 set_dumper_capsicum_rights(pcap_dumper_t *p)
1013 {
1014 int fd = fileno(pcap_dump_file(p));
1015 cap_rights_t rights;
1016
1017 cap_rights_init(&rights, CAP_SEEK, CAP_WRITE, CAP_FCNTL);
1018 if (cap_rights_limit(fd, &rights) < 0 && errno != ENOSYS) {
1019 error("unable to limit dump descriptor");
1020 }
1021 if (cap_fcntls_limit(fd, CAP_FCNTL_GETFL) < 0 && errno != ENOSYS) {
1022 error("unable to limit dump descriptor fcntls");
1023 }
1024 }
1025 #endif
1026
1027 /*
1028 * Copy arg vector into a new buffer, concatenating arguments with spaces.
1029 */
1030 static char *
1031 copy_argv(char **argv)
1032 {
1033 char **p;
1034 size_t len = 0;
1035 char *buf;
1036 char *src, *dst;
1037
1038 p = argv;
1039 if (*p == NULL)
1040 return 0;
1041
1042 while (*p)
1043 len += strlen(*p++) + 1;
1044
1045 buf = (char *)malloc(len);
1046 if (buf == NULL)
1047 error("%s: malloc", __func__);
1048
1049 p = argv;
1050 dst = buf;
1051 while ((src = *p++) != NULL) {
1052 while ((*dst++ = *src++) != '\0')
1053 ;
1054 dst[-1] = ' ';
1055 }
1056 dst[-1] = '\0';
1057
1058 return buf;
1059 }
1060
1061 /*
1062 * On Windows, we need to open the file in binary mode, so that
1063 * we get all the bytes specified by the size we get from "fstat()".
1064 * On UNIX, that's not necessary. O_BINARY is defined on Windows;
1065 * we define it as 0 if it's not defined, so it does nothing.
1066 */
1067 #ifndef O_BINARY
1068 #define O_BINARY 0
1069 #endif
1070
1071 static char *
1072 read_infile(char *fname)
1073 {
1074 int i, fd;
1075 ssize_t cc;
1076 char *cp;
1077 our_statb buf;
1078
1079 fd = open(fname, O_RDONLY|O_BINARY);
1080 if (fd < 0)
1081 error("can't open %s: %s", fname, pcap_strerror(errno));
1082
1083 if (our_fstat(fd, &buf) < 0)
1084 error("can't stat %s: %s", fname, pcap_strerror(errno));
1085
1086 /*
1087 * Reject files whose size doesn't fit into an int; a filter
1088 * *that* large will probably be too big.
1089 */
1090 if (buf.st_size > INT_MAX)
1091 error("%s is too large", fname);
1092
1093 cp = malloc((u_int)buf.st_size + 1);
1094 if (cp == NULL)
1095 error("malloc(%d) for %s: %s", (u_int)buf.st_size + 1,
1096 fname, pcap_strerror(errno));
1097 cc = read(fd, cp, (u_int)buf.st_size);
1098 if (cc < 0)
1099 error("read %s: %s", fname, pcap_strerror(errno));
1100 if (cc != buf.st_size)
1101 error("short read %s (%d != %d)", fname, (int) cc,
1102 (int)buf.st_size);
1103
1104 close(fd);
1105 /* replace "# comment" with spaces */
1106 for (i = 0; i < cc; i++) {
1107 if (cp[i] == '#')
1108 while (i < cc && cp[i] != '\n')
1109 cp[i++] = ' ';
1110 }
1111 cp[cc] = '\0';
1112 return (cp);
1113 }
1114
1115 #ifdef HAVE_PCAP_FINDALLDEVS
1116 static long
1117 parse_interface_number(const char *device)
1118 {
1119 const char *p;
1120 long devnum;
1121 char *end;
1122
1123 /*
1124 * Search for a colon, terminating any scheme at the beginning
1125 * of the device.
1126 */
1127 p = strchr(device, ':');
1128 if (p != NULL) {
1129 /*
1130 * We found it. Is it followed by "//"?
1131 */
1132 p++; /* skip the : */
1133 if (strncmp(p, "//", 2) == 0) {
1134 /*
1135 * Yes. Search for the next /, at the end of the
1136 * authority part of the URL.
1137 */
1138 p += 2; /* skip the // */
1139 p = strchr(p, '/');
1140 if (p != NULL) {
1141 /*
1142 * OK, past the / is the path.
1143 */
1144 device = p + 1;
1145 }
1146 }
1147 }
1148 devnum = strtol(device, &end, 10);
1149 if (device != end && *end == '\0') {
1150 /*
1151 * It's all-numeric, but is it a valid number?
1152 */
1153 if (devnum <= 0) {
1154 /*
1155 * No, it's not an ordinal.
1156 */
1157 error("Invalid adapter index");
1158 }
1159 return (devnum);
1160 } else {
1161 /*
1162 * It's not all-numeric; return -1, so our caller
1163 * knows that.
1164 */
1165 return (-1);
1166 }
1167 }
1168
1169 static char *
1170 find_interface_by_number(const char *url
1171 #ifndef HAVE_PCAP_FINDALLDEVS_EX
1172 _U_
1173 #endif
1174 , long devnum)
1175 {
1176 pcap_if_t *dev, *devlist;
1177 long i;
1178 char ebuf[PCAP_ERRBUF_SIZE];
1179 char *device;
1180 #ifdef HAVE_PCAP_FINDALLDEVS_EX
1181 const char *endp;
1182 char *host_url;
1183 #endif
1184 int status;
1185
1186 #ifdef HAVE_PCAP_FINDALLDEVS_EX
1187 /*
1188 * Search for a colon, terminating any scheme at the beginning
1189 * of the URL.
1190 */
1191 endp = strchr(url, ':');
1192 if (endp != NULL) {
1193 /*
1194 * We found it. Is it followed by "//"?
1195 */
1196 endp++; /* skip the : */
1197 if (strncmp(endp, "//", 2) == 0) {
1198 /*
1199 * Yes. Search for the next /, at the end of the
1200 * authority part of the URL.
1201 */
1202 endp += 2; /* skip the // */
1203 endp = strchr(endp, '/');
1204 } else
1205 endp = NULL;
1206 }
1207 if (endp != NULL) {
1208 /*
1209 * OK, everything from device to endp is a URL to hand
1210 * to pcap_findalldevs_ex().
1211 */
1212 endp++; /* Include the trailing / in the URL; pcap_findalldevs_ex() requires it */
1213 host_url = malloc(endp - url + 1);
1214 if (host_url == NULL && (endp - url + 1) > 0)
1215 error("Invalid allocation for host");
1216
1217 memcpy(host_url, url, endp - url);
1218 host_url[endp - url] = '\0';
1219 status = pcap_findalldevs_ex(host_url, NULL, &devlist, ebuf);
1220 free(host_url);
1221 } else
1222 #endif
1223 status = pcap_findalldevs(&devlist, ebuf);
1224 if (status < 0)
1225 error("%s", ebuf);
1226 /*
1227 * Look for the devnum-th entry in the list of devices (1-based).
1228 */
1229 for (i = 0, dev = devlist; i < devnum-1 && dev != NULL;
1230 i++, dev = dev->next)
1231 ;
1232 if (dev == NULL)
1233 error("Invalid adapter index");
1234 device = strdup(dev->name);
1235 pcap_freealldevs(devlist);
1236 return (device);
1237 }
1238 #endif
1239
1240 #ifdef HAVE_PCAP_OPEN
1241 /*
1242 * Prefixes for rpcap URLs.
1243 */
1244 static char rpcap_prefix[] = "rpcap://";
1245 static char rpcap_ssl_prefix[] = "rpcaps://";
1246 #endif
1247
1248 static pcap_t *
1249 open_interface(const char *device, netdissect_options *ndo, char *ebuf)
1250 {
1251 pcap_t *pc;
1252 #ifdef HAVE_PCAP_CREATE
1253 int status;
1254 char *cp;
1255 #endif
1256
1257 #ifdef HAVE_PCAP_OPEN
1258 /*
1259 * Is this an rpcap URL?
1260 */
1261 if (strncmp(device, rpcap_prefix, sizeof(rpcap_prefix) - 1) == 0 ||
1262 strncmp(device, rpcap_ssl_prefix, sizeof(rpcap_ssl_prefix) - 1) == 0) {
1263 /*
1264 * Yes. Open it with pcap_open().
1265 */
1266 *ebuf = '\0';
1267 pc = pcap_open(device, ndo->ndo_snaplen,
1268 pflag ? 0 : PCAP_OPENFLAG_PROMISCUOUS, timeout, NULL,
1269 ebuf);
1270 if (pc == NULL) {
1271 /*
1272 * If this failed with "No such device" or "The system
1273 * cannot find the device specified", that means
1274 * the interface doesn't exist; return NULL, so that
1275 * the caller can see whether the device name is
1276 * actually an interface index.
1277 */
1278 if (strstr(ebuf, "No such device") != NULL ||
1279 strstr(ebuf, "The system cannot find the device specified") != NULL)
1280 return (NULL);
1281 error("%s", ebuf);
1282 }
1283 if (*ebuf)
1284 warning("%s", ebuf);
1285 return (pc);
1286 }
1287 #endif /* HAVE_PCAP_OPEN */
1288
1289 #ifdef HAVE_PCAP_CREATE
1290 pc = pcap_create(device, ebuf);
1291 if (pc == NULL) {
1292 /*
1293 * If this failed with "No such device", that means
1294 * the interface doesn't exist; return NULL, so that
1295 * the caller can see whether the device name is
1296 * actually an interface index.
1297 */
1298 if (strstr(ebuf, "No such device") != NULL)
1299 return (NULL);
1300 error("%s", ebuf);
1301 }
1302 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE
1303 if (Jflag)
1304 show_tstamp_types_and_exit(pc, device);
1305 #endif
1306 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
1307 status = pcap_set_tstamp_precision(pc, ndo->ndo_tstamp_precision);
1308 if (status != 0)
1309 error("%s: Can't set %ssecond time stamp precision: %s",
1310 device,
1311 tstamp_precision_to_string(ndo->ndo_tstamp_precision),
1312 pcap_statustostr(status));
1313 #endif
1314
1315 #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE
1316 if (immediate_mode) {
1317 status = pcap_set_immediate_mode(pc, 1);
1318 if (status != 0)
1319 error("%s: Can't set immediate mode: %s",
1320 device, pcap_statustostr(status));
1321 }
1322 #endif
1323 /*
1324 * Is this an interface that supports monitor mode?
1325 */
1326 if (pcap_can_set_rfmon(pc) == 1)
1327 supports_monitor_mode = 1;
1328 else
1329 supports_monitor_mode = 0;
1330 if (ndo->ndo_snaplen != 0) {
1331 /*
1332 * A snapshot length was explicitly specified;
1333 * use it.
1334 */
1335 status = pcap_set_snaplen(pc, ndo->ndo_snaplen);
1336 if (status != 0)
1337 error("%s: Can't set snapshot length: %s",
1338 device, pcap_statustostr(status));
1339 }
1340 status = pcap_set_promisc(pc, !pflag);
1341 if (status != 0)
1342 error("%s: Can't set promiscuous mode: %s",
1343 device, pcap_statustostr(status));
1344 if (Iflag) {
1345 status = pcap_set_rfmon(pc, 1);
1346 if (status != 0)
1347 error("%s: Can't set monitor mode: %s",
1348 device, pcap_statustostr(status));
1349 }
1350 status = pcap_set_timeout(pc, timeout);
1351 if (status != 0)
1352 error("%s: pcap_set_timeout failed: %s",
1353 device, pcap_statustostr(status));
1354 if (Bflag != 0) {
1355 status = pcap_set_buffer_size(pc, Bflag);
1356 if (status != 0)
1357 error("%s: Can't set buffer size: %s",
1358 device, pcap_statustostr(status));
1359 }
1360 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE
1361 if (jflag != -1) {
1362 status = pcap_set_tstamp_type(pc, jflag);
1363 if (status < 0)
1364 error("%s: Can't set time stamp type: %s",
1365 device, pcap_statustostr(status));
1366 else if (status > 0)
1367 warning("When trying to set timestamp type '%s' on %s: %s",
1368 pcap_tstamp_type_val_to_name(jflag), device,
1369 pcap_statustostr(status));
1370 }
1371 #endif
1372 status = pcap_activate(pc);
1373 if (status < 0) {
1374 /*
1375 * pcap_activate() failed.
1376 */
1377 cp = pcap_geterr(pc);
1378 if (status == PCAP_ERROR)
1379 error("%s", cp);
1380 else if (status == PCAP_ERROR_NO_SUCH_DEVICE) {
1381 /*
1382 * Return an error for our caller to handle.
1383 */
1384 snprintf(ebuf, PCAP_ERRBUF_SIZE, "%s: %s\n(%s)",
1385 device, pcap_statustostr(status), cp);
1386 } else if (status == PCAP_ERROR_PERM_DENIED && *cp != '\0')
1387 error("%s: %s\n(%s)", device,
1388 pcap_statustostr(status), cp);
1389 #ifdef __FreeBSD__
1390 else if (status == PCAP_ERROR_RFMON_NOTSUP &&
1391 strncmp(device, "wlan", 4) == 0) {
1392 char parent[8], newdev[8];
1393 char sysctl[32];
1394 size_t s = sizeof(parent);
1395
1396 snprintf(sysctl, sizeof(sysctl),
1397 "net.wlan.%d.%%parent", atoi(device + 4));
1398 sysctlbyname(sysctl, parent, &s, NULL, 0);
1399 strlcpy(newdev, device, sizeof(newdev));
1400 /* Suggest a new wlan device. */
1401 /* FIXME: incrementing the index this way is not going to work well
1402 * when the index is 9 or greater but the only consequence in this
1403 * specific case would be an error message that looks a bit odd.
1404 */
1405 newdev[strlen(newdev)-1]++;
1406 error("%s is not a monitor mode VAP\n"
1407 "To create a new monitor mode VAP use:\n"
1408 " ifconfig %s create wlandev %s wlanmode monitor\n"
1409 "and use %s as the tcpdump interface",
1410 device, newdev, parent, newdev);
1411 }
1412 #endif
1413 else
1414 error("%s: %s", device,
1415 pcap_statustostr(status));
1416 pcap_close(pc);
1417 return (NULL);
1418 } else if (status > 0) {
1419 /*
1420 * pcap_activate() succeeded, but it's warning us
1421 * of a problem it had.
1422 */
1423 cp = pcap_geterr(pc);
1424 if (status == PCAP_WARNING)
1425 warning("%s", cp);
1426 else if (status == PCAP_WARNING_PROMISC_NOTSUP &&
1427 *cp != '\0')
1428 warning("%s: %s\n(%s)", device,
1429 pcap_statustostr(status), cp);
1430 else
1431 warning("%s: %s", device,
1432 pcap_statustostr(status));
1433 }
1434 #ifdef HAVE_PCAP_SETDIRECTION
1435 if (Qflag != -1) {
1436 status = pcap_setdirection(pc, Qflag);
1437 if (status != 0)
1438 error("%s: pcap_setdirection() failed: %s",
1439 device, pcap_geterr(pc));
1440 }
1441 #endif /* HAVE_PCAP_SETDIRECTION */
1442 #else /* HAVE_PCAP_CREATE */
1443 *ebuf = '\0';
1444 /*
1445 * If no snapshot length was specified, or a length of 0 was
1446 * specified, default to 256KB.
1447 */
1448 if (ndo->ndo_snaplen == 0)
1449 ndo->ndo_snaplen = MAXIMUM_SNAPLEN;
1450 pc = pcap_open_live(device, ndo->ndo_snaplen, !pflag, timeout, ebuf);
1451 if (pc == NULL) {
1452 /*
1453 * If this failed with "No such device", that means
1454 * the interface doesn't exist; return NULL, so that
1455 * the caller can see whether the device name is
1456 * actually an interface index.
1457 */
1458 if (strstr(ebuf, "No such device") != NULL)
1459 return (NULL);
1460 error("%s", ebuf);
1461 }
1462 if (*ebuf)
1463 warning("%s", ebuf);
1464 #endif /* HAVE_PCAP_CREATE */
1465
1466 return (pc);
1467 }
1468
1469 int
1470 main(int argc, char **argv)
1471 {
1472 int cnt, op, i;
1473 bpf_u_int32 localnet = 0, netmask = 0;
1474 char *cp, *infile, *cmdbuf, *device, *RFileName, *VFileName, *WFileName;
1475 char *endp;
1476 pcap_handler callback;
1477 int dlt;
1478 const char *dlt_name;
1479 struct bpf_program fcode;
1480 #ifndef _WIN32
1481 void (*oldhandler)(int);
1482 #endif
1483 struct dump_info dumpinfo;
1484 u_char *pcap_userdata;
1485 char ebuf[PCAP_ERRBUF_SIZE];
1486 char VFileLine[PATH_MAX + 1];
1487 const char *username = NULL;
1488 #ifndef _WIN32
1489 const char *chroot_dir = NULL;
1490 #endif
1491 char *ret = NULL;
1492 char *end;
1493 #ifdef HAVE_PCAP_FINDALLDEVS
1494 pcap_if_t *devlist;
1495 long devnum;
1496 #endif
1497 int status;
1498 FILE *VFile;
1499 #ifdef HAVE_CAPSICUM
1500 cap_rights_t rights;
1501 int cansandbox;
1502 #endif /* HAVE_CAPSICUM */
1503 int Oflag = 1; /* run filter code optimizer */
1504 int yflag_dlt = -1;
1505 const char *yflag_dlt_name = NULL;
1506 int print = 0;
1507 long Cflagmult;
1508
1509 netdissect_options Ndo;
1510 netdissect_options *ndo = &Ndo;
1511
1512 /*
1513 * Initialize the netdissect code.
1514 */
1515 if (nd_init(ebuf, sizeof(ebuf)) == -1)
1516 error("%s", ebuf);
1517
1518 memset(ndo, 0, sizeof(*ndo));
1519 ndo_set_function_pointers(ndo);
1520
1521 cnt = -1;
1522 device = NULL;
1523 infile = NULL;
1524 RFileName = NULL;
1525 VFileName = NULL;
1526 VFile = NULL;
1527 WFileName = NULL;
1528 dlt = -1;
1529 if ((cp = strrchr(argv[0], PATH_SEPARATOR)) != NULL)
1530 ndo->program_name = program_name = cp + 1;
1531 else
1532 ndo->program_name = program_name = argv[0];
1533
1534 #if defined(HAVE_PCAP_WSOCKINIT)
1535 if (pcap_wsockinit() != 0)
1536 error("Attempting to initialize Winsock failed");
1537 #elif defined(HAVE_WSOCKINIT)
1538 if (wsockinit() != 0)
1539 error("Attempting to initialize Winsock failed");
1540 #endif
1541
1542 /*
1543 * On platforms where the CPU doesn't support unaligned loads,
1544 * force unaligned accesses to abort with SIGBUS, rather than
1545 * being fixed up (slowly) by the OS kernel; on those platforms,
1546 * misaligned accesses are bugs, and we want tcpdump to crash so
1547 * that the bugs are reported.
1548 */
1549 if (abort_on_misalignment(ebuf, sizeof(ebuf)) < 0)
1550 error("%s", ebuf);
1551
1552 while (
1553 (op = getopt_long(argc, argv, SHORTOPTS, longopts, NULL)) != -1)
1554 switch (op) {
1555
1556 case 'a':
1557 /* compatibility for old -a */
1558 break;
1559
1560 case 'A':
1561 ++ndo->ndo_Aflag;
1562 break;
1563
1564 case 'b':
1565 ++ndo->ndo_bflag;
1566 break;
1567
1568 #if defined(HAVE_PCAP_CREATE) || defined(_WIN32)
1569 case 'B':
1570 Bflag = atoi(optarg)*1024;
1571 if (Bflag <= 0)
1572 error("invalid packet buffer size %s", optarg);
1573 break;
1574 #endif /* defined(HAVE_PCAP_CREATE) || defined(_WIN32) */
1575
1576 case 'c':
1577 cnt = atoi(optarg);
1578 if (cnt <= 0)
1579 error("invalid packet count %s", optarg);
1580 break;
1581
1582 case 'C':
1583 errno = 0;
1584 #ifdef HAVE_PCAP_DUMP_FTELL64
1585 Cflag = strtoint64_t(optarg, &endp, 10);
1586 #else
1587 Cflag = strtol(optarg, &endp, 10);
1588 #endif
1589 if (endp == optarg || errno != 0 || Cflag <= 0)
1590 error("invalid file size %s", optarg);
1591
1592 if (*endp == '\0') {
1593 /*
1594 * There's nothing after the file size,
1595 * so the size is in units of 1 MB
1596 * (1,000,000 bytes).
1597 */
1598 Cflagmult = 1000000;
1599 } else {
1600 /*
1601 * There's something after the file
1602 * size.
1603 *
1604 * If it's a single letter, then:
1605 *
1606 * if the letter is k or K, the size
1607 * is in units of 1 KiB (1024 bytes);
1608 *
1609 * if the letter is m or M, the size
1610 * is in units of 1 MiB (1,048,576 bytes);
1611 *
1612 * if the letter is g or G, the size
1613 * is in units of 1 GiB (1,073,741,824 bytes).
1614 *
1615 * Otherwise, it's an error.
1616 */
1617 switch (*endp) {
1618
1619 case 'k':
1620 case 'K':
1621 Cflagmult = 1024;
1622 break;
1623
1624 case 'm':
1625 case 'M':
1626 Cflagmult = 1024*1024;
1627 break;
1628
1629 case 'g':
1630 case 'G':
1631 Cflagmult = 1024*1024*1024;
1632 break;
1633
1634 default:
1635 error("invalid file size %s", optarg);
1636 }
1637
1638 /*
1639 * OK, there was a letter that we treat
1640 * as a units indication; was there
1641 * anything after it?
1642 */
1643 endp++;
1644 if (*endp != '\0') {
1645 /* Yes - error */
1646 error("invalid file size %s", optarg);
1647 }
1648 }
1649
1650 /*
1651 * Will multiplying it by multiplier overflow?
1652 */
1653 #ifdef HAVE_PCAP_DUMP_FTELL64
1654 if (Cflag > INT64_T_CONSTANT(0x7fffffffffffffff) / Cflagmult)
1655 #else
1656 if (Cflag > LONG_MAX / Cflagmult)
1657 #endif
1658 error("file size %s is too large", optarg);
1659 Cflag *= Cflagmult;
1660 break;
1661
1662 case 'd':
1663 ++dflag;
1664 break;
1665
1666 #ifdef HAVE_PCAP_FINDALLDEVS
1667 case 'D':
1668 Dflag++;
1669 break;
1670 #endif
1671
1672 #ifdef HAVE_PCAP_FINDALLDEVS_EX
1673 case OPTION_LIST_REMOTE_INTERFACES:
1674 remote_interfaces_source = optarg;
1675 break;
1676 #endif
1677
1678 case 'L':
1679 Lflag++;
1680 break;
1681
1682 case 'e':
1683 ++ndo->ndo_eflag;
1684 break;
1685
1686 case 'E':
1687 #ifndef HAVE_LIBCRYPTO
1688 warning("crypto code not compiled in");
1689 #endif
1690 ndo->ndo_espsecret = optarg;
1691 break;
1692
1693 case 'f':
1694 ++ndo->ndo_fflag;
1695 break;
1696
1697 case 'F':
1698 infile = optarg;
1699 break;
1700
1701 case 'G':
1702 Gflag = atoi(optarg);
1703 if (Gflag < 0)
1704 error("invalid number of seconds %s", optarg);
1705
1706 /* We will create one file initially. */
1707 Gflag_count = 0;
1708
1709 /* Grab the current time for rotation use. */
1710 if ((Gflag_time = time(NULL)) == (time_t)-1) {
1711 error("%s: can't get current time: %s",
1712 __func__, pcap_strerror(errno));
1713 }
1714 break;
1715
1716 case 'h':
1717 print_usage(stdout);
1718 exit_tcpdump(S_SUCCESS);
1719 break;
1720
1721 case 'H':
1722 ++ndo->ndo_Hflag;
1723 break;
1724
1725 case 'i':
1726 device = optarg;
1727 break;
1728
1729 #ifdef HAVE_PCAP_CREATE
1730 case 'I':
1731 ++Iflag;
1732 break;
1733 #endif /* HAVE_PCAP_CREATE */
1734
1735 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE
1736 case 'j':
1737 jflag = pcap_tstamp_type_name_to_val(optarg);
1738 if (jflag < 0)
1739 error("invalid time stamp type %s", optarg);
1740 break;
1741
1742 case 'J':
1743 Jflag++;
1744 break;
1745 #endif
1746
1747 case 'l':
1748 #ifdef _WIN32
1749 /*
1750 * _IOLBF is the same as _IOFBF in Microsoft's C
1751 * libraries; the only alternative they offer
1752 * is _IONBF.
1753 *
1754 * XXX - this should really be checking for MSVC++,
1755 * not _WIN32, if, for example, MinGW has its own
1756 * C library that is more UNIX-compatible.
1757 */
1758 setvbuf(stdout, NULL, _IONBF, 0);
1759 #else /* _WIN32 */
1760 #ifdef HAVE_SETLINEBUF
1761 setlinebuf(stdout);
1762 #else
1763 setvbuf(stdout, NULL, _IOLBF, 0);
1764 #endif
1765 #endif /* _WIN32 */
1766 lflag = 1;
1767 break;
1768
1769 case 'K':
1770 ++ndo->ndo_Kflag;
1771 break;
1772
1773 case 'm':
1774 if (nd_have_smi_support()) {
1775 if (nd_load_smi_module(optarg, ebuf, sizeof(ebuf)) == -1)
1776 error("%s", ebuf);
1777 } else {
1778 (void)fprintf(stderr, "%s: ignoring option `-m %s' ",
1779 program_name, optarg);
1780 (void)fprintf(stderr, "(no libsmi support)\n");
1781 }
1782 break;
1783
1784 case 'M':
1785 /* TCP-MD5 shared secret */
1786 #ifndef HAVE_LIBCRYPTO
1787 warning("crypto code not compiled in");
1788 #endif
1789 ndo->ndo_sigsecret = optarg;
1790 break;
1791
1792 case 'n':
1793 ++ndo->ndo_nflag;
1794 break;
1795
1796 case 'N':
1797 ++ndo->ndo_Nflag;
1798 break;
1799
1800 case 'O':
1801 Oflag = 0;
1802 break;
1803
1804 case 'p':
1805 ++pflag;
1806 break;
1807
1808 case 'q':
1809 ++ndo->ndo_qflag;
1810 ++ndo->ndo_suppress_default_print;
1811 break;
1812
1813 #ifdef HAVE_PCAP_SETDIRECTION
1814 case 'Q':
1815 if (ascii_strcasecmp(optarg, "in") == 0)
1816 Qflag = PCAP_D_IN;
1817 else if (ascii_strcasecmp(optarg, "out") == 0)
1818 Qflag = PCAP_D_OUT;
1819 else if (ascii_strcasecmp(optarg, "inout") == 0)
1820 Qflag = PCAP_D_INOUT;
1821 else
1822 error("unknown capture direction `%s'", optarg);
1823 break;
1824 #endif /* HAVE_PCAP_SETDIRECTION */
1825
1826 case 'r':
1827 RFileName = optarg;
1828 break;
1829
1830 case 's':
1831 ndo->ndo_snaplen = (int)strtol(optarg, &end, 0);
1832 if (optarg == end || *end != '\0'
1833 || ndo->ndo_snaplen < 0 || ndo->ndo_snaplen > MAXIMUM_SNAPLEN)
1834 error("invalid snaplen %s (must be >= 0 and <= %d)",
1835 optarg, MAXIMUM_SNAPLEN);
1836 break;
1837
1838 case 'S':
1839 ++ndo->ndo_Sflag;
1840 break;
1841
1842 case 't':
1843 ++ndo->ndo_tflag;
1844 break;
1845
1846 case 'T':
1847 if (ascii_strcasecmp(optarg, "vat") == 0)
1848 ndo->ndo_packettype = PT_VAT;
1849 else if (ascii_strcasecmp(optarg, "wb") == 0)
1850 ndo->ndo_packettype = PT_WB;
1851 else if (ascii_strcasecmp(optarg, "rpc") == 0)
1852 ndo->ndo_packettype = PT_RPC;
1853 else if (ascii_strcasecmp(optarg, "rtp") == 0)
1854 ndo->ndo_packettype = PT_RTP;
1855 else if (ascii_strcasecmp(optarg, "rtcp") == 0)
1856 ndo->ndo_packettype = PT_RTCP;
1857 else if (ascii_strcasecmp(optarg, "snmp") == 0)
1858 ndo->ndo_packettype = PT_SNMP;
1859 else if (ascii_strcasecmp(optarg, "cnfp") == 0)
1860 ndo->ndo_packettype = PT_CNFP;
1861 else if (ascii_strcasecmp(optarg, "tftp") == 0)
1862 ndo->ndo_packettype = PT_TFTP;
1863 else if (ascii_strcasecmp(optarg, "aodv") == 0)
1864 ndo->ndo_packettype = PT_AODV;
1865 else if (ascii_strcasecmp(optarg, "carp") == 0)
1866 ndo->ndo_packettype = PT_CARP;
1867 else if (ascii_strcasecmp(optarg, "radius") == 0)
1868 ndo->ndo_packettype = PT_RADIUS;
1869 else if (ascii_strcasecmp(optarg, "zmtp1") == 0)
1870 ndo->ndo_packettype = PT_ZMTP1;
1871 else if (ascii_strcasecmp(optarg, "vxlan") == 0)
1872 ndo->ndo_packettype = PT_VXLAN;
1873 else if (ascii_strcasecmp(optarg, "pgm") == 0)
1874 ndo->ndo_packettype = PT_PGM;
1875 else if (ascii_strcasecmp(optarg, "pgm_zmtp1") == 0)
1876 ndo->ndo_packettype = PT_PGM_ZMTP1;
1877 else if (ascii_strcasecmp(optarg, "lmp") == 0)
1878 ndo->ndo_packettype = PT_LMP;
1879 else if (ascii_strcasecmp(optarg, "resp") == 0)
1880 ndo->ndo_packettype = PT_RESP;
1881 else if (ascii_strcasecmp(optarg, "ptp") == 0)
1882 ndo->ndo_packettype = PT_PTP;
1883 else if (ascii_strcasecmp(optarg, "someip") == 0)
1884 ndo->ndo_packettype = PT_SOMEIP;
1885 else if (ascii_strcasecmp(optarg, "domain") == 0)
1886 ndo->ndo_packettype = PT_DOMAIN;
1887 else if (ascii_strcasecmp(optarg, "quic") == 0)
1888 ndo->ndo_packettype = PT_QUIC;
1889 else
1890 error("unknown packet type `%s'", optarg);
1891 break;
1892
1893 case 'u':
1894 ++ndo->ndo_uflag;
1895 break;
1896
1897 #ifdef HAVE_PCAP_DUMP_FLUSH
1898 case 'U':
1899 ++Uflag;
1900 break;
1901 #endif
1902
1903 case 'v':
1904 ++ndo->ndo_vflag;
1905 break;
1906
1907 case 'V':
1908 VFileName = optarg;
1909 break;
1910
1911 case 'w':
1912 WFileName = optarg;
1913 break;
1914
1915 case 'W':
1916 Wflag = atoi(optarg);
1917 if (Wflag <= 0)
1918 error("invalid number of output files %s", optarg);
1919 WflagChars = getWflagChars(Wflag);
1920 break;
1921
1922 case 'x':
1923 ++ndo->ndo_xflag;
1924 ++ndo->ndo_suppress_default_print;
1925 break;
1926
1927 case 'X':
1928 ++ndo->ndo_Xflag;
1929 ++ndo->ndo_suppress_default_print;
1930 break;
1931
1932 case 'y':
1933 yflag_dlt_name = optarg;
1934 yflag_dlt =
1935 pcap_datalink_name_to_val(yflag_dlt_name);
1936 if (yflag_dlt < 0)
1937 error("invalid data link type %s", yflag_dlt_name);
1938 break;
1939
1940 #ifdef HAVE_PCAP_SET_PARSER_DEBUG
1941 case 'Y':
1942 {
1943 /* Undocumented flag */
1944 pcap_set_parser_debug(1);
1945 }
1946 break;
1947 #endif
1948 case 'z':
1949 zflag = optarg;
1950 break;
1951
1952 case 'Z':
1953 username = optarg;
1954 break;
1955
1956 case '#':
1957 ndo->ndo_packet_number = 1;
1958 break;
1959
1960 case OPTION_VERSION:
1961 print_version(stdout);
1962 exit_tcpdump(S_SUCCESS);
1963 break;
1964
1965 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
1966 case OPTION_TSTAMP_PRECISION:
1967 ndo->ndo_tstamp_precision = tstamp_precision_from_string(optarg);
1968 if (ndo->ndo_tstamp_precision < 0)
1969 error("unsupported time stamp precision");
1970 break;
1971 #endif
1972
1973 #ifdef HAVE_PCAP_SET_IMMEDIATE_MODE
1974 case OPTION_IMMEDIATE_MODE:
1975 immediate_mode = 1;
1976 break;
1977 #endif
1978
1979 case OPTION_PRINT:
1980 print = 1;
1981 break;
1982
1983 case OPTION_PRINT_SAMPLING:
1984 print = 1;
1985 ++ndo->ndo_Sflag;
1986 ndo->ndo_print_sampling = atoi(optarg);
1987 if (ndo->ndo_print_sampling <= 0)
1988 error("invalid print sampling %s", optarg);
1989 break;
1990
1991 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
1992 case OPTION_TSTAMP_MICRO:
1993 ndo->ndo_tstamp_precision = PCAP_TSTAMP_PRECISION_MICRO;
1994 break;
1995
1996 case OPTION_TSTAMP_NANO:
1997 ndo->ndo_tstamp_precision = PCAP_TSTAMP_PRECISION_NANO;
1998 break;
1999 #endif
2000
2001 case OPTION_FP_TYPE:
2002 /*
2003 * Print out the type of floating-point arithmetic
2004 * we're doing; it's probably IEEE, unless somebody
2005 * tries to run this on a VAX, but the precision
2006 * may differ (e.g., it might be 32-bit, 64-bit,
2007 * or 80-bit).
2008 */
2009 float_type_check(0x4e93312d);
2010 return 0;
2011
2012 case OPTION_COUNT:
2013 count_mode = 1;
2014 break;
2015
2016 default:
2017 print_usage(stderr);
2018 exit_tcpdump(S_ERR_HOST_PROGRAM);
2019 /* NOTREACHED */
2020 }
2021
2022 #ifdef HAVE_PCAP_FINDALLDEVS
2023 if (Dflag)
2024 show_devices_and_exit();
2025 #endif
2026 #ifdef HAVE_PCAP_FINDALLDEVS_EX
2027 if (remote_interfaces_source != NULL)
2028 show_remote_devices_and_exit();
2029 #endif
2030
2031 #if defined(DLT_LINUX_SLL2) && defined(HAVE_PCAP_SET_DATALINK)
2032 /* Set default linktype DLT_LINUX_SLL2 when capturing on the "any" device */
2033 if (device != NULL &&
2034 strncmp (device, "any", strlen("any")) == 0
2035 && yflag_dlt == -1)
2036 yflag_dlt = DLT_LINUX_SLL2;
2037 #endif
2038
2039 switch (ndo->ndo_tflag) {
2040
2041 case 0: /* Default */
2042 case 1: /* No time stamp */
2043 case 2: /* Unix timeval style */
2044 case 3: /* Microseconds/nanoseconds since previous packet */
2045 case 4: /* Date + Default */
2046 case 5: /* Microseconds/nanoseconds since first packet */
2047 break;
2048
2049 default: /* Not supported */
2050 error("only -t, -tt, -ttt, -tttt and -ttttt are supported");
2051 break;
2052 }
2053
2054 if (ndo->ndo_fflag != 0 && (VFileName != NULL || RFileName != NULL))
2055 error("-f can not be used with -V or -r");
2056
2057 if (VFileName != NULL && RFileName != NULL)
2058 error("-V and -r are mutually exclusive.");
2059
2060 /*
2061 * If we're printing dissected packets to the standard output,
2062 * and either the standard output is a terminal or we're doing
2063 * "line" buffering, set the capture timeout to .1 second rather
2064 * than 1 second, as the user's probably expecting to see packets
2065 * pop up immediately shortly after they arrive.
2066 *
2067 * XXX - would there be some value appropriate for all cases,
2068 * based on, say, the buffer size and packet input rate?
2069 */
2070 if ((WFileName == NULL || print) && (isatty(1) || lflag))
2071 timeout = 100;
2072
2073 #ifdef WITH_CHROOT
2074 /* if run as root, prepare for chrooting */
2075 if (getuid() == 0 || geteuid() == 0) {
2076 /* future extensibility for cmd-line arguments */
2077 if (!chroot_dir)
2078 chroot_dir = WITH_CHROOT;
2079 }
2080 #endif
2081
2082 #ifdef WITH_USER
2083 /* if run as root, prepare for dropping root privileges */
2084 if (getuid() == 0 || geteuid() == 0) {
2085 /* Run with '-Z root' to restore old behaviour */
2086 if (!username)
2087 username = WITH_USER;
2088 }
2089 #endif
2090
2091 if (RFileName != NULL || VFileName != NULL) {
2092 /*
2093 * If RFileName is non-null, it's the pathname of a
2094 * savefile to read. If VFileName is non-null, it's
2095 * the pathname of a file containing a list of pathnames
2096 * (one per line) of savefiles to read.
2097 *
2098 * In either case, we're reading a savefile, not doing
2099 * a live capture.
2100 */
2101 #ifndef _WIN32
2102 /*
2103 * We don't need network access, so relinquish any set-UID
2104 * or set-GID privileges we have (if any).
2105 *
2106 * We do *not* want set-UID privileges when opening a
2107 * trace file, as that might let the user read other
2108 * people's trace files (especially if we're set-UID
2109 * root).
2110 */
2111 if (setgid(getgid()) != 0 || setuid(getuid()) != 0 )
2112 fprintf(stderr, "Warning: setgid/setuid failed !\n");
2113 #endif /* _WIN32 */
2114 if (VFileName != NULL) {
2115 if (VFileName[0] == '-' && VFileName[1] == '\0')
2116 VFile = stdin;
2117 else
2118 VFile = fopen(VFileName, "r");
2119
2120 if (VFile == NULL)
2121 error("Unable to open file: %s\n", pcap_strerror(errno));
2122
2123 ret = get_next_file(VFile, VFileLine);
2124 if (!ret)
2125 error("Nothing in %s\n", VFileName);
2126 RFileName = VFileLine;
2127 }
2128
2129 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
2130 pd = pcap_open_offline_with_tstamp_precision(RFileName,
2131 ndo->ndo_tstamp_precision, ebuf);
2132 #else
2133 pd = pcap_open_offline(RFileName, ebuf);
2134 #endif
2135
2136 if (pd == NULL)
2137 error("%s", ebuf);
2138 #ifdef HAVE_CAPSICUM
2139 cap_rights_init(&rights, CAP_READ);
2140 if (cap_rights_limit(fileno(pcap_file(pd)), &rights) < 0 &&
2141 errno != ENOSYS) {
2142 error("unable to limit pcap descriptor");
2143 }
2144 #endif
2145 dlt = pcap_datalink(pd);
2146 dlt_name = pcap_datalink_val_to_name(dlt);
2147 fprintf(stderr, "reading from file %s", RFileName);
2148 if (dlt_name == NULL) {
2149 fprintf(stderr, ", link-type %u", dlt);
2150 } else {
2151 fprintf(stderr, ", link-type %s (%s)", dlt_name,
2152 pcap_datalink_val_to_description(dlt));
2153 }
2154 fprintf(stderr, ", snapshot length %d\n", pcap_snapshot(pd));
2155 #ifdef DLT_LINUX_SLL2
2156 if (dlt == DLT_LINUX_SLL2)
2157 fprintf(stderr, "Warning: interface names might be incorrect\n");
2158 #endif
2159 } else if (dflag && !device) {
2160 int dump_dlt = DLT_EN10MB;
2161 /*
2162 * We're dumping the compiled code without an explicit
2163 * device specification. (If a device is specified, we
2164 * definitely want to open it to use the DLT of that device.)
2165 * Either default to DLT_EN10MB with a warning, or use
2166 * the user-specified value if supplied.
2167 */
2168 /*
2169 * If no snapshot length was specified, or a length of 0 was
2170 * specified, default to 256KB.
2171 */
2172 if (ndo->ndo_snaplen == 0)
2173 ndo->ndo_snaplen = MAXIMUM_SNAPLEN;
2174 /*
2175 * If a DLT was specified with the -y flag, use that instead.
2176 */
2177 if (yflag_dlt != -1)
2178 dump_dlt = yflag_dlt;
2179 else
2180 fprintf(stderr, "Warning: assuming Ethernet\n");
2181 pd = pcap_open_dead(dump_dlt, ndo->ndo_snaplen);
2182 } else {
2183 /*
2184 * We're doing a live capture.
2185 */
2186 if (device == NULL) {
2187 /*
2188 * No interface was specified. Pick one.
2189 */
2190 #ifdef HAVE_PCAP_FINDALLDEVS
2191 /*
2192 * Find the list of interfaces, and pick
2193 * the first interface.
2194 */
2195 if (pcap_findalldevs(&devlist, ebuf) == -1)
2196 error("%s", ebuf);
2197 if (devlist == NULL)
2198 error("no interfaces available for capture");
2199 device = strdup(devlist->name);
2200 pcap_freealldevs(devlist);
2201 #else /* HAVE_PCAP_FINDALLDEVS */
2202 /*
2203 * Use whatever interface pcap_lookupdev()
2204 * chooses.
2205 */
2206 device = pcap_lookupdev(ebuf);
2207 if (device == NULL)
2208 error("%s", ebuf);
2209 #endif
2210 }
2211
2212 /*
2213 * Try to open the interface with the specified name.
2214 */
2215 pd = open_interface(device, ndo, ebuf);
2216 if (pd == NULL) {
2217 /*
2218 * That failed. If we can get a list of
2219 * interfaces, and the interface name
2220 * is purely numeric, try to use it as
2221 * a 1-based index in the list of
2222 * interfaces.
2223 */
2224 #ifdef HAVE_PCAP_FINDALLDEVS
2225 devnum = parse_interface_number(device);
2226 if (devnum == -1) {
2227 /*
2228 * It's not a number; just report
2229 * the open error and fail.
2230 */
2231 error("%s", ebuf);
2232 }
2233
2234 /*
2235 * OK, it's a number; try to find the
2236 * interface with that index, and try
2237 * to open it.
2238 *
2239 * find_interface_by_number() exits if it
2240 * couldn't be found.
2241 */
2242 device = find_interface_by_number(device, devnum);
2243 pd = open_interface(device, ndo, ebuf);
2244 if (pd == NULL)
2245 error("%s", ebuf);
2246 #else /* HAVE_PCAP_FINDALLDEVS */
2247 /*
2248 * We can't get a list of interfaces; just
2249 * fail.
2250 */
2251 error("%s", ebuf);
2252 #endif /* HAVE_PCAP_FINDALLDEVS */
2253 }
2254
2255 /*
2256 * Let user own process after capture device has
2257 * been opened.
2258 */
2259 #ifndef _WIN32
2260 if (setgid(getgid()) != 0 || setuid(getuid()) != 0)
2261 fprintf(stderr, "Warning: setgid/setuid failed !\n");
2262 #endif /* _WIN32 */
2263 #if !defined(HAVE_PCAP_CREATE) && defined(_WIN32)
2264 if(Bflag != 0)
2265 if(pcap_setbuff(pd, Bflag)==-1){
2266 error("%s", pcap_geterr(pd));
2267 }
2268 #endif /* !defined(HAVE_PCAP_CREATE) && defined(_WIN32) */
2269 if (Lflag)
2270 show_dlts_and_exit(pd, device);
2271 if (yflag_dlt >= 0) {
2272 #ifdef HAVE_PCAP_SET_DATALINK
2273 if (pcap_set_datalink(pd, yflag_dlt) < 0)
2274 error("%s", pcap_geterr(pd));
2275 #else
2276 /*
2277 * We don't actually support changing the
2278 * data link type, so we only let them
2279 * set it to what it already is.
2280 */
2281 if (yflag_dlt != pcap_datalink(pd)) {
2282 error("%s is not one of the DLTs supported by this device\n",
2283 yflag_dlt_name);
2284 }
2285 #endif
2286 (void)fprintf(stderr, "%s: data link type %s\n",
2287 program_name,
2288 pcap_datalink_val_to_name(yflag_dlt));
2289 (void)fflush(stderr);
2290 }
2291 i = pcap_snapshot(pd);
2292 if (ndo->ndo_snaplen < i) {
2293 if (ndo->ndo_snaplen != 0)
2294 warning("snaplen raised from %d to %d", ndo->ndo_snaplen, i);
2295 ndo->ndo_snaplen = i;
2296 } else if (ndo->ndo_snaplen > i) {
2297 warning("snaplen lowered from %d to %d", ndo->ndo_snaplen, i);
2298 ndo->ndo_snaplen = i;
2299 }
2300 if(ndo->ndo_fflag != 0) {
2301 if (pcap_lookupnet(device, &localnet, &netmask, ebuf) < 0) {
2302 warning("foreign (-f) flag used but: %s", ebuf);
2303 }
2304 }
2305
2306 }
2307 if (infile)
2308 cmdbuf = read_infile(infile);
2309 else
2310 cmdbuf = copy_argv(&argv[optind]);
2311
2312 #ifdef HAVE_PCAP_SET_OPTIMIZER_DEBUG
2313 pcap_set_optimizer_debug(dflag);
2314 #endif
2315 if (pcap_compile(pd, &fcode, cmdbuf, Oflag, netmask) < 0)
2316 error("%s", pcap_geterr(pd));
2317 if (dflag) {
2318 bpf_dump(&fcode, dflag);
2319 pcap_close(pd);
2320 free(cmdbuf);
2321 pcap_freecode(&fcode);
2322 exit_tcpdump(S_SUCCESS);
2323 }
2324
2325 #ifdef HAVE_CASPER
2326 if (!ndo->ndo_nflag)
2327 capdns = capdns_setup();
2328 #endif /* HAVE_CASPER */
2329
2330 init_print(ndo, localnet, netmask);
2331
2332 #ifndef _WIN32
2333 (void)setsignal(SIGPIPE, cleanup);
2334 (void)setsignal(SIGTERM, cleanup);
2335 #endif /* _WIN32 */
2336 (void)setsignal(SIGINT, cleanup);
2337 #if defined(HAVE_FORK) || defined(HAVE_VFORK)
2338 (void)setsignal(SIGCHLD, child_cleanup);
2339 #endif
2340 /* Cooperate with nohup(1) */
2341 #ifndef _WIN32
2342 if ((oldhandler = setsignal(SIGHUP, cleanup)) != SIG_DFL)
2343 (void)setsignal(SIGHUP, oldhandler);
2344 #endif /* _WIN32 */
2345
2346 #ifndef _WIN32
2347 /*
2348 * If a user name was specified with "-Z", attempt to switch to
2349 * that user's UID. This would probably be used with sudo,
2350 * to allow tcpdump to be run in a special restricted
2351 * account (if you just want to allow users to open capture
2352 * devices, and can't just give users that permission,
2353 * you'd make tcpdump set-UID or set-GID).
2354 *
2355 * Tcpdump doesn't necessarily write only to one savefile;
2356 * the general only way to allow a -Z instance to write to
2357 * savefiles as the user under whose UID it's run, rather
2358 * than as the user specified with -Z, would thus be to switch
2359 * to the original user ID before opening a capture file and
2360 * then switch back to the -Z user ID after opening the savefile.
2361 * Switching to the -Z user ID only after opening the first
2362 * savefile doesn't handle the general case.
2363 */
2364
2365 if (getuid() == 0 || geteuid() == 0) {
2366 #ifdef HAVE_LIBCAP_NG
2367 /* Initialize capng */
2368 capng_clear(CAPNG_SELECT_BOTH);
2369 if (username) {
2370 DIAG_OFF_ASSIGN_ENUM
2371 capng_updatev(
2372 CAPNG_ADD,
2373 CAPNG_PERMITTED | CAPNG_EFFECTIVE,
2374 CAP_SETUID,
2375 CAP_SETGID,
2376 -1);
2377 DIAG_ON_ASSIGN_ENUM
2378 }
2379 if (chroot_dir) {
2380 DIAG_OFF_ASSIGN_ENUM
2381 capng_update(
2382 CAPNG_ADD,
2383 CAPNG_PERMITTED | CAPNG_EFFECTIVE,
2384 CAP_SYS_CHROOT
2385 );
2386 DIAG_ON_ASSIGN_ENUM
2387 }
2388
2389 if (WFileName) {
2390 DIAG_OFF_ASSIGN_ENUM
2391 capng_update(
2392 CAPNG_ADD,
2393 CAPNG_PERMITTED | CAPNG_EFFECTIVE,
2394 CAP_DAC_OVERRIDE
2395 );
2396 DIAG_ON_ASSIGN_ENUM
2397 }
2398 capng_apply(CAPNG_SELECT_BOTH);
2399 #endif /* HAVE_LIBCAP_NG */
2400 if (username || chroot_dir)
2401 droproot(username, chroot_dir);
2402
2403 }
2404 #endif /* _WIN32 */
2405
2406 if (pcap_setfilter(pd, &fcode) < 0)
2407 error("%s", pcap_geterr(pd));
2408 #ifdef HAVE_CAPSICUM
2409 if (RFileName == NULL && VFileName == NULL && pcap_fileno(pd) != -1) {
2410 static const unsigned long cmds[] = { BIOCGSTATS, BIOCROTZBUF };
2411
2412 /*
2413 * The various libpcap devices use a combination of
2414 * read (bpf), ioctl (bpf, netmap), poll (netmap)
2415 * so we add the relevant access rights.
2416 */
2417 cap_rights_init(&rights, CAP_IOCTL, CAP_READ, CAP_EVENT);
2418 if (cap_rights_limit(pcap_fileno(pd), &rights) < 0 &&
2419 errno != ENOSYS) {
2420 error("unable to limit pcap descriptor");
2421 }
2422 if (cap_ioctls_limit(pcap_fileno(pd), cmds,
2423 sizeof(cmds) / sizeof(cmds[0])) < 0 && errno != ENOSYS) {
2424 error("unable to limit ioctls on pcap descriptor");
2425 }
2426 }
2427 #endif
2428 if (WFileName) {
2429 /* Do not exceed the default PATH_MAX for files. */
2430 dumpinfo.CurrentFileName = (char *)malloc(PATH_MAX + 1);
2431
2432 if (dumpinfo.CurrentFileName == NULL)
2433 error("malloc of dumpinfo.CurrentFileName");
2434
2435 /* We do not need numbering for dumpfiles if Cflag isn't set. */
2436 if (Cflag != 0)
2437 MakeFilename(dumpinfo.CurrentFileName, WFileName, 0, WflagChars);
2438 else
2439 MakeFilename(dumpinfo.CurrentFileName, WFileName, 0, 0);
2440
2441 pdd = pcap_dump_open(pd, dumpinfo.CurrentFileName);
2442 #ifdef HAVE_LIBCAP_NG
2443 /* Give up CAP_DAC_OVERRIDE capability.
2444 * Only allow it to be restored if the -C or -G flag have been
2445 * set since we may need to create more files later on.
2446 */
2447 capng_update(
2448 CAPNG_DROP,
2449 (Cflag || Gflag ? 0 : CAPNG_PERMITTED)
2450 | CAPNG_EFFECTIVE,
2451 CAP_DAC_OVERRIDE
2452 );
2453 capng_apply(CAPNG_SELECT_BOTH);
2454 #endif /* HAVE_LIBCAP_NG */
2455 if (pdd == NULL)
2456 error("%s", pcap_geterr(pd));
2457 #ifdef HAVE_CAPSICUM
2458 set_dumper_capsicum_rights(pdd);
2459 #endif
2460 if (Cflag != 0 || Gflag != 0) {
2461 #ifdef HAVE_CAPSICUM
2462 /*
2463 * basename() and dirname() may modify their input buffer
2464 * and they do since FreeBSD 12.0, but they didn't before.
2465 * Hence use the return value only, but always assume the
2466 * input buffer has been modified and would need to be
2467 * reset before the next use.
2468 */
2469 char *WFileName_copy;
2470
2471 if ((WFileName_copy = strdup(WFileName)) == NULL) {
2472 error("Unable to allocate memory for file %s",
2473 WFileName);
2474 }
2475 DIAG_OFF_C11_EXTENSIONS
2476 dumpinfo.WFileName = strdup(basename(WFileName_copy));
2477 DIAG_ON_C11_EXTENSIONS
2478 if (dumpinfo.WFileName == NULL) {
2479 error("Unable to allocate memory for file %s",
2480 WFileName);
2481 }
2482 free(WFileName_copy);
2483
2484 if ((WFileName_copy = strdup(WFileName)) == NULL) {
2485 error("Unable to allocate memory for file %s",
2486 WFileName);
2487 }
2488 DIAG_OFF_C11_EXTENSIONS
2489 char *WFileName_dirname = dirname(WFileName_copy);
2490 DIAG_ON_C11_EXTENSIONS
2491 dumpinfo.dirfd = open(WFileName_dirname,
2492 O_DIRECTORY | O_RDONLY);
2493 if (dumpinfo.dirfd < 0) {
2494 error("unable to open directory %s",
2495 WFileName_dirname);
2496 }
2497 free(WFileName_dirname);
2498 free(WFileName_copy);
2499
2500 cap_rights_init(&rights, CAP_CREATE, CAP_FCNTL,
2501 CAP_FTRUNCATE, CAP_LOOKUP, CAP_SEEK, CAP_WRITE);
2502 if (cap_rights_limit(dumpinfo.dirfd, &rights) < 0 &&
2503 errno != ENOSYS) {
2504 error("unable to limit directory rights");
2505 }
2506 if (cap_fcntls_limit(dumpinfo.dirfd, CAP_FCNTL_GETFL) < 0 &&
2507 errno != ENOSYS) {
2508 error("unable to limit dump descriptor fcntls");
2509 }
2510 #else /* !HAVE_CAPSICUM */
2511 dumpinfo.WFileName = WFileName;
2512 #endif
2513 callback = dump_packet_and_trunc;
2514 dumpinfo.pd = pd;
2515 dumpinfo.pdd = pdd;
2516 pcap_userdata = (u_char *)&dumpinfo;
2517 } else {
2518 callback = dump_packet;
2519 dumpinfo.WFileName = WFileName;
2520 dumpinfo.pd = pd;
2521 dumpinfo.pdd = pdd;
2522 pcap_userdata = (u_char *)&dumpinfo;
2523 }
2524 if (print) {
2525 dlt = pcap_datalink(pd);
2526 ndo->ndo_if_printer = get_if_printer(dlt);
2527 dumpinfo.ndo = ndo;
2528 } else
2529 dumpinfo.ndo = NULL;
2530
2531 #ifdef HAVE_PCAP_DUMP_FLUSH
2532 if (Uflag)
2533 pcap_dump_flush(pdd);
2534 #endif
2535 } else {
2536 dlt = pcap_datalink(pd);
2537 ndo->ndo_if_printer = get_if_printer(dlt);
2538 callback = print_packet;
2539 pcap_userdata = (u_char *)ndo;
2540 }
2541
2542 #ifdef SIGNAL_REQ_INFO
2543 /*
2544 * We can't get statistics when reading from a file rather
2545 * than capturing from a device.
2546 */
2547 if (RFileName == NULL)
2548 (void)setsignal(SIGNAL_REQ_INFO, requestinfo);
2549 #endif
2550 #ifdef SIGNAL_FLUSH_PCAP
2551 (void)setsignal(SIGNAL_FLUSH_PCAP, flushpcap);
2552 #endif
2553
2554 if (ndo->ndo_vflag > 0 && WFileName && RFileName == NULL && !print) {
2555 /*
2556 * When capturing to a file, if "--print" wasn't specified,
2557 *"-v" means tcpdump should, once per second,
2558 * "v"erbosely report the number of packets captured.
2559 * Except when reading from a file, because -r, -w and -v
2560 * together used to make a corner case, in which pcap_loop()
2561 * errored due to EINTR (see GH #155 for details).
2562 */
2563 #ifdef _WIN32
2564 /*
2565 * https://blogs.msdn.microsoft.com/oldnewthing/20151230-00/?p=92741
2566 *
2567 * suggests that this dates back to W2K.
2568 *
2569 * I don't know what a "long wait" is, but we'll assume
2570 * that printing the stats could be a "long wait".
2571 */
2572 CreateTimerQueueTimer(&timer_handle, NULL,
2573 verbose_stats_dump, NULL, 1000, 1000,
2574 WT_EXECUTEDEFAULT|WT_EXECUTELONGFUNCTION);
2575 setvbuf(stderr, NULL, _IONBF, 0);
2576 #else /* _WIN32 */
2577 /*
2578 * Assume this is UN*X, and that it has setitimer(); that
2579 * dates back to UNIX 95.
2580 */
2581 struct itimerval timer;
2582 (void)setsignal(SIGALRM, verbose_stats_dump);
2583 timer.it_interval.tv_sec = 1;
2584 timer.it_interval.tv_usec = 0;
2585 timer.it_value.tv_sec = 1;
2586 timer.it_value.tv_usec = 1;
2587 setitimer(ITIMER_REAL, &timer, NULL);
2588 #endif /* _WIN32 */
2589 }
2590
2591 if (RFileName == NULL) {
2592 /*
2593 * Live capture (if -V was specified, we set RFileName
2594 * to a file from the -V file). Print a message to
2595 * the standard error on UN*X.
2596 */
2597 if (!ndo->ndo_vflag && !WFileName) {
2598 (void)fprintf(stderr,
2599 "%s: verbose output suppressed, use -v[v]... for full protocol decode\n",
2600 program_name);
2601 } else
2602 (void)fprintf(stderr, "%s: ", program_name);
2603 dlt = pcap_datalink(pd);
2604 dlt_name = pcap_datalink_val_to_name(dlt);
2605 (void)fprintf(stderr, "listening on %s", device);
2606 if (dlt_name == NULL) {
2607 (void)fprintf(stderr, ", link-type %u", dlt);
2608 } else {
2609 (void)fprintf(stderr, ", link-type %s (%s)", dlt_name,
2610 pcap_datalink_val_to_description(dlt));
2611 }
2612 (void)fprintf(stderr, ", snapshot length %d bytes\n", ndo->ndo_snaplen);
2613 (void)fflush(stderr);
2614 }
2615
2616 #ifdef HAVE_CAPSICUM
2617 cansandbox = (VFileName == NULL && zflag == NULL);
2618 #ifdef HAVE_CASPER
2619 cansandbox = (cansandbox && (ndo->ndo_nflag || capdns != NULL));
2620 #else
2621 cansandbox = (cansandbox && ndo->ndo_nflag);
2622 #endif /* HAVE_CASPER */
2623 if (cansandbox && cap_enter() < 0 && errno != ENOSYS)
2624 error("unable to enter the capability mode");
2625 #endif /* HAVE_CAPSICUM */
2626
2627 do {
2628 status = pcap_loop(pd, cnt, callback, pcap_userdata);
2629 if (WFileName == NULL) {
2630 /*
2631 * We're printing packets. Flush the printed output,
2632 * so it doesn't get intermingled with error output.
2633 */
2634 if (status == -2) {
2635 /*
2636 * We got interrupted, so perhaps we didn't
2637 * manage to finish a line we were printing.
2638 * Print an extra newline, just in case.
2639 */
2640 putchar('\n');
2641 }
2642 (void)fflush(stdout);
2643 }
2644 if (status == -2) {
2645 /*
2646 * We got interrupted. If we are reading multiple
2647 * files (via -V) set these so that we stop.
2648 */
2649 VFileName = NULL;
2650 ret = NULL;
2651 }
2652 if (status == -1) {
2653 /*
2654 * Error. Report it.
2655 */
2656 (void)fprintf(stderr, "%s: pcap_loop: %s\n",
2657 program_name, pcap_geterr(pd));
2658 }
2659 if (RFileName == NULL) {
2660 /*
2661 * We're doing a live capture. Report the capture
2662 * statistics.
2663 */
2664 info(1);
2665 }
2666 pcap_close(pd);
2667 if (VFileName != NULL) {
2668 ret = get_next_file(VFile, VFileLine);
2669 if (ret) {
2670 int new_dlt;
2671
2672 RFileName = VFileLine;
2673 pd = pcap_open_offline(RFileName, ebuf);
2674 if (pd == NULL)
2675 error("%s", ebuf);
2676 #ifdef HAVE_CAPSICUM
2677 cap_rights_init(&rights, CAP_READ);
2678 if (cap_rights_limit(fileno(pcap_file(pd)),
2679 &rights) < 0 && errno != ENOSYS) {
2680 error("unable to limit pcap descriptor");
2681 }
2682 #endif
2683 new_dlt = pcap_datalink(pd);
2684 if (new_dlt != dlt) {
2685 /*
2686 * The new file has a different
2687 * link-layer header type from the
2688 * previous one.
2689 */
2690 if (WFileName != NULL) {
2691 /*
2692 * We're writing raw packets
2693 * that match the filter to
2694 * a pcap file. pcap files
2695 * don't support multiple
2696 * different link-layer
2697 * header types, so we fail
2698 * here.
2699 */
2700 error("%s: new dlt does not match original", RFileName);
2701 }
2702
2703 /*
2704 * We're printing the decoded packets;
2705 * switch to the new DLT.
2706 *
2707 * To do that, we need to change
2708 * the printer, change the DLT name,
2709 * and recompile the filter with
2710 * the new DLT.
2711 */
2712 dlt = new_dlt;
2713 ndo->ndo_if_printer = get_if_printer(dlt);
2714 /* Free the old filter */
2715 pcap_freecode(&fcode);
2716 if (pcap_compile(pd, &fcode, cmdbuf, Oflag, netmask) < 0)
2717 error("%s", pcap_geterr(pd));
2718 }
2719
2720 /*
2721 * Set the filter on the new file.
2722 */
2723 if (pcap_setfilter(pd, &fcode) < 0)
2724 error("%s", pcap_geterr(pd));
2725
2726 /*
2727 * Report the new file.
2728 */
2729 dlt_name = pcap_datalink_val_to_name(dlt);
2730 fprintf(stderr, "reading from file %s", RFileName);
2731 if (dlt_name == NULL) {
2732 fprintf(stderr, ", link-type %u", dlt);
2733 } else {
2734 fprintf(stderr, ", link-type %s (%s)",
2735 dlt_name,
2736 pcap_datalink_val_to_description(dlt));
2737 }
2738 fprintf(stderr, ", snapshot length %d\n", pcap_snapshot(pd));
2739 }
2740 }
2741 }
2742 while (ret != NULL);
2743
2744 if (count_mode && RFileName != NULL)
2745 fprintf(stdout, "%u packet%s\n", packets_captured,
2746 PLURAL_SUFFIX(packets_captured));
2747
2748 free(cmdbuf);
2749 pcap_freecode(&fcode);
2750 exit_tcpdump(status == -1 ? S_ERR_HOST_PROGRAM : S_SUCCESS);
2751 }
2752
2753 /*
2754 * Catch a signal.
2755 */
2756 static void
2757 (*setsignal (int sig, void (*func)(int)))(int)
2758 {
2759 #ifdef _WIN32
2760 return (signal(sig, func));
2761 #else
2762 struct sigaction old, new;
2763
2764 memset(&new, 0, sizeof(new));
2765 new.sa_handler = func;
2766 if ((sig == SIGCHLD)
2767 # ifdef SIGNAL_REQ_INFO
2768 || (sig == SIGNAL_REQ_INFO)
2769 # endif
2770 # ifdef SIGNAL_FLUSH_PCAP
2771 || (sig == SIGNAL_FLUSH_PCAP)
2772 # endif
2773 )
2774 new.sa_flags = SA_RESTART;
2775 if (sigaction(sig, &new, &old) < 0)
2776 return (SIG_ERR);
2777 return (old.sa_handler);
2778 #endif
2779 }
2780
2781 /* make a clean exit on interrupts */
2782 static void
2783 cleanup(int signo _U_)
2784 {
2785 #ifdef _WIN32
2786 if (timer_handle != INVALID_HANDLE_VALUE) {
2787 DeleteTimerQueueTimer(NULL, timer_handle, NULL);
2788 CloseHandle(timer_handle);
2789 timer_handle = INVALID_HANDLE_VALUE;
2790 }
2791 #else /* _WIN32 */
2792 struct itimerval timer;
2793
2794 timer.it_interval.tv_sec = 0;
2795 timer.it_interval.tv_usec = 0;
2796 timer.it_value.tv_sec = 0;
2797 timer.it_value.tv_usec = 0;
2798 setitimer(ITIMER_REAL, &timer, NULL);
2799 #endif /* _WIN32 */
2800
2801 #ifdef HAVE_PCAP_BREAKLOOP
2802 /*
2803 * We have "pcap_breakloop()"; use it, so that we do as little
2804 * as possible in the signal handler (it's probably not safe
2805 * to do anything with standard I/O streams in a signal handler -
2806 * the ANSI C standard doesn't say it is).
2807 */
2808 pcap_breakloop(pd);
2809 #else
2810 /*
2811 * We don't have "pcap_breakloop()"; this isn't safe, but
2812 * it's the best we can do. Print the summary if we're
2813 * not reading from a savefile - i.e., if we're doing a
2814 * live capture - and exit.
2815 */
2816 if (pd != NULL && pcap_file(pd) == NULL) {
2817 /*
2818 * We got interrupted, so perhaps we didn't
2819 * manage to finish a line we were printing.
2820 * Print an extra newline, just in case.
2821 */
2822 putchar('\n');
2823 (void)fflush(stdout);
2824 info(1);
2825 }
2826 exit_tcpdump(S_SUCCESS);
2827 #endif
2828 }
2829
2830 /*
2831 On windows, we do not use a fork, so we do not care less about
2832 waiting a child processes to die
2833 */
2834 #if defined(HAVE_FORK) || defined(HAVE_VFORK)
2835 static void
2836 child_cleanup(int signo _U_)
2837 {
2838 wait(NULL);
2839 }
2840 #endif /* HAVE_FORK && HAVE_VFORK */
2841
2842 static void
2843 info(int verbose)
2844 {
2845 struct pcap_stat stats;
2846
2847 /*
2848 * Older versions of libpcap didn't set ps_ifdrop on some
2849 * platforms; initialize it to 0 to handle that.
2850 */
2851 stats.ps_ifdrop = 0;
2852 if (pcap_stats(pd, &stats) < 0) {
2853 (void)fprintf(stderr, "pcap_stats: %s\n", pcap_geterr(pd));
2854 infoprint = 0;
2855 return;
2856 }
2857
2858 if (!verbose)
2859 fprintf(stderr, "%s: ", program_name);
2860
2861 (void)fprintf(stderr, "%u packet%s captured", packets_captured,
2862 PLURAL_SUFFIX(packets_captured));
2863 if (!verbose)
2864 fputs(", ", stderr);
2865 else
2866 putc('\n', stderr);
2867 (void)fprintf(stderr, "%u packet%s received by filter", stats.ps_recv,
2868 PLURAL_SUFFIX(stats.ps_recv));
2869 if (!verbose)
2870 fputs(", ", stderr);
2871 else
2872 putc('\n', stderr);
2873 (void)fprintf(stderr, "%u packet%s dropped by kernel", stats.ps_drop,
2874 PLURAL_SUFFIX(stats.ps_drop));
2875 if (stats.ps_ifdrop != 0) {
2876 if (!verbose)
2877 fputs(", ", stderr);
2878 else
2879 putc('\n', stderr);
2880 (void)fprintf(stderr, "%u packet%s dropped by interface\n",
2881 stats.ps_ifdrop, PLURAL_SUFFIX(stats.ps_ifdrop));
2882 } else
2883 putc('\n', stderr);
2884 infoprint = 0;
2885 }
2886
2887 #if defined(HAVE_FORK) || defined(HAVE_VFORK)
2888 #ifdef HAVE_FORK
2889 #define fork_subprocess() fork()
2890 #else
2891 #define fork_subprocess() vfork()
2892 #endif
2893 static void
2894 compress_savefile(const char *filename)
2895 {
2896 pid_t child;
2897
2898 child = fork_subprocess();
2899 if (child == -1) {
2900 fprintf(stderr,
2901 "compress_savefile: fork failed: %s\n",
2902 pcap_strerror(errno));
2903 return;
2904 }
2905 if (child != 0) {
2906 /* Parent process. */
2907 return;
2908 }
2909
2910 /*
2911 * Child process.
2912 * Set to lowest priority so that this doesn't disturb the capture.
2913 */
2914 #ifdef NZERO
2915 setpriority(PRIO_PROCESS, 0, NZERO - 1);
2916 #else
2917 setpriority(PRIO_PROCESS, 0, 19);
2918 #endif
2919 if (execlp(zflag, zflag, filename, (char *)NULL) == -1)
2920 fprintf(stderr,
2921 "compress_savefile: execlp(%s, %s) failed: %s\n",
2922 zflag,
2923 filename,
2924 pcap_strerror(errno));
2925 #ifdef HAVE_FORK
2926 exit(S_ERR_HOST_PROGRAM);
2927 #else
2928 _exit(S_ERR_HOST_PROGRAM);
2929 #endif
2930 }
2931 #else /* HAVE_FORK && HAVE_VFORK */
2932 static void
2933 compress_savefile(const char *filename)
2934 {
2935 fprintf(stderr,
2936 "compress_savefile failed. Functionality not implemented under your system\n");
2937 }
2938 #endif /* HAVE_FORK && HAVE_VFORK */
2939
2940 static void
2941 dump_packet_and_trunc(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
2942 {
2943 struct dump_info *dump_info;
2944
2945 ++packets_captured;
2946
2947 ++infodelay;
2948
2949 dump_info = (struct dump_info *)user;
2950
2951 /*
2952 * XXX - this won't force the file to rotate on the specified time
2953 * boundary, but it will rotate on the first packet received after the
2954 * specified Gflag number of seconds. Note: if a Gflag time boundary
2955 * and a Cflag size boundary coincide, the time rotation will occur
2956 * first thereby cancelling the Cflag boundary (since the file should
2957 * be 0).
2958 */
2959 if (Gflag != 0) {
2960 /* Check if it is time to rotate */
2961 time_t t;
2962
2963 /* Get the current time */
2964 if ((t = time(NULL)) == (time_t)-1) {
2965 error("%s: can't get current_time: %s",
2966 __func__, pcap_strerror(errno));
2967 }
2968
2969
2970 /* If the time is greater than the specified window, rotate */
2971 if (t - Gflag_time >= Gflag) {
2972 #ifdef HAVE_CAPSICUM
2973 FILE *fp;
2974 int fd;
2975 #endif
2976
2977 /* Update the Gflag_time */
2978 Gflag_time = t;
2979 /* Update Gflag_count */
2980 Gflag_count++;
2981 /*
2982 * Close the current file and open a new one.
2983 */
2984 pcap_dump_close(dump_info->pdd);
2985
2986 /*
2987 * Compress the file we just closed, if the user asked for it
2988 */
2989 if (zflag != NULL)
2990 compress_savefile(dump_info->CurrentFileName);
2991
2992 /*
2993 * Check to see if we've exceeded the Wflag (when
2994 * not using Cflag).
2995 */
2996 if (Cflag == 0 && Wflag > 0 && Gflag_count >= Wflag) {
2997 (void)fprintf(stderr, "Maximum file limit reached: %d\n",
2998 Wflag);
2999 info(1);
3000 exit_tcpdump(S_SUCCESS);
3001 /* NOTREACHED */
3002 }
3003 if (dump_info->CurrentFileName != NULL)
3004 free(dump_info->CurrentFileName);
3005 /* Allocate space for max filename + \0. */
3006 dump_info->CurrentFileName = (char *)malloc(PATH_MAX + 1);
3007 if (dump_info->CurrentFileName == NULL)
3008 error("dump_packet_and_trunc: malloc");
3009 /*
3010 * Gflag was set otherwise we wouldn't be here. Reset the count
3011 * so multiple files would end with 1,2,3 in the filename.
3012 * The counting is handled with the -C flow after this.
3013 */
3014 Cflag_count = 0;
3015
3016 /*
3017 * This is always the first file in the Cflag
3018 * rotation: e.g. 0
3019 * We also don't need numbering if Cflag is not set.
3020 */
3021 if (Cflag != 0)
3022 MakeFilename(dump_info->CurrentFileName, dump_info->WFileName, 0,
3023 WflagChars);
3024 else
3025 MakeFilename(dump_info->CurrentFileName, dump_info->WFileName, 0, 0);
3026
3027 #ifdef HAVE_LIBCAP_NG
3028 capng_update(CAPNG_ADD, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE);
3029 capng_apply(CAPNG_SELECT_BOTH);
3030 #endif /* HAVE_LIBCAP_NG */
3031 #ifdef HAVE_CAPSICUM
3032 fd = openat(dump_info->dirfd,
3033 dump_info->CurrentFileName,
3034 O_CREAT | O_WRONLY | O_TRUNC, 0644);
3035 if (fd < 0) {
3036 error("unable to open file %s",
3037 dump_info->CurrentFileName);
3038 }
3039 fp = fdopen(fd, "w");
3040 if (fp == NULL) {
3041 error("unable to fdopen file %s",
3042 dump_info->CurrentFileName);
3043 }
3044 dump_info->pdd = pcap_dump_fopen(dump_info->pd, fp);
3045 #else /* !HAVE_CAPSICUM */
3046 dump_info->pdd = pcap_dump_open(dump_info->pd, dump_info->CurrentFileName);
3047 #endif
3048 #ifdef HAVE_LIBCAP_NG
3049 capng_update(CAPNG_DROP, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE);
3050 capng_apply(CAPNG_SELECT_BOTH);
3051 #endif /* HAVE_LIBCAP_NG */
3052 if (dump_info->pdd == NULL)
3053 error("%s", pcap_geterr(pd));
3054 #ifdef HAVE_CAPSICUM
3055 set_dumper_capsicum_rights(dump_info->pdd);
3056 #endif
3057 }
3058 }
3059
3060 /*
3061 * XXX - this won't prevent capture files from getting
3062 * larger than Cflag - the last packet written to the
3063 * file could put it over Cflag.
3064 */
3065 if (Cflag != 0) {
3066 #ifdef HAVE_PCAP_DUMP_FTELL64
3067 int64_t size = pcap_dump_ftell64(dump_info->pdd);
3068 #else
3069 /*
3070 * XXX - this only handles a Cflag value > 2^31-1 on
3071 * LP64 platforms; to handle ILP32 (32-bit UN*X and
3072 * Windows) or LLP64 (64-bit Windows) would require
3073 * a version of libpcap with pcap_dump_ftell64().
3074 */
3075 long size = pcap_dump_ftell(dump_info->pdd);
3076 #endif
3077
3078 if (size == -1)
3079 error("ftell fails on output file");
3080 if (size > Cflag) {
3081 #ifdef HAVE_CAPSICUM
3082 FILE *fp;
3083 int fd;
3084 #endif
3085
3086 /*
3087 * Close the current file and open a new one.
3088 */
3089 pcap_dump_close(dump_info->pdd);
3090
3091 /*
3092 * Compress the file we just closed, if the user
3093 * asked for it.
3094 */
3095 if (zflag != NULL)
3096 compress_savefile(dump_info->CurrentFileName);
3097
3098 Cflag_count++;
3099 if (Wflag > 0) {
3100 if (Cflag_count >= Wflag)
3101 Cflag_count = 0;
3102 }
3103 if (dump_info->CurrentFileName != NULL)
3104 free(dump_info->CurrentFileName);
3105 dump_info->CurrentFileName = (char *)malloc(PATH_MAX + 1);
3106 if (dump_info->CurrentFileName == NULL)
3107 error("%s: malloc", __func__);
3108 MakeFilename(dump_info->CurrentFileName, dump_info->WFileName, Cflag_count, WflagChars);
3109 #ifdef HAVE_LIBCAP_NG
3110 capng_update(CAPNG_ADD, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE);
3111 capng_apply(CAPNG_SELECT_BOTH);
3112 #endif /* HAVE_LIBCAP_NG */
3113 #ifdef HAVE_CAPSICUM
3114 fd = openat(dump_info->dirfd, dump_info->CurrentFileName,
3115 O_CREAT | O_WRONLY | O_TRUNC, 0644);
3116 if (fd < 0) {
3117 error("unable to open file %s",
3118 dump_info->CurrentFileName);
3119 }
3120 fp = fdopen(fd, "w");
3121 if (fp == NULL) {
3122 error("unable to fdopen file %s",
3123 dump_info->CurrentFileName);
3124 }
3125 dump_info->pdd = pcap_dump_fopen(dump_info->pd, fp);
3126 #else /* !HAVE_CAPSICUM */
3127 dump_info->pdd = pcap_dump_open(dump_info->pd, dump_info->CurrentFileName);
3128 #endif
3129 #ifdef HAVE_LIBCAP_NG
3130 capng_update(CAPNG_DROP, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE);
3131 capng_apply(CAPNG_SELECT_BOTH);
3132 #endif /* HAVE_LIBCAP_NG */
3133 if (dump_info->pdd == NULL)
3134 error("%s", pcap_geterr(pd));
3135 #ifdef HAVE_CAPSICUM
3136 set_dumper_capsicum_rights(dump_info->pdd);
3137 #endif
3138 }
3139 }
3140
3141 pcap_dump((u_char *)dump_info->pdd, h, sp);
3142 #ifdef HAVE_PCAP_DUMP_FLUSH
3143 if (Uflag)
3144 pcap_dump_flush(dump_info->pdd);
3145 #endif
3146
3147 if (dump_info->ndo != NULL)
3148 pretty_print_packet(dump_info->ndo, h, sp, packets_captured);
3149
3150 --infodelay;
3151 if (infoprint)
3152 info(0);
3153 }
3154
3155 static void
3156 dump_packet(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
3157 {
3158 struct dump_info *dump_info;
3159
3160 ++packets_captured;
3161
3162 ++infodelay;
3163
3164 dump_info = (struct dump_info *)user;
3165
3166 pcap_dump((u_char *)dump_info->pdd, h, sp);
3167 #ifdef HAVE_PCAP_DUMP_FLUSH
3168 if (Uflag)
3169 pcap_dump_flush(dump_info->pdd);
3170 #endif
3171
3172 if (dump_info->ndo != NULL)
3173 pretty_print_packet(dump_info->ndo, h, sp, packets_captured);
3174
3175 --infodelay;
3176 if (infoprint)
3177 info(0);
3178 }
3179
3180 static void
3181 print_packet(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
3182 {
3183 ++packets_captured;
3184
3185 ++infodelay;
3186
3187 if (!count_mode)
3188 pretty_print_packet((netdissect_options *)user, h, sp, packets_captured);
3189
3190 --infodelay;
3191 if (infoprint)
3192 info(0);
3193 }
3194
3195 #ifdef SIGNAL_REQ_INFO
3196 static void
3197 requestinfo(int signo _U_)
3198 {
3199 if (infodelay)
3200 ++infoprint;
3201 else
3202 info(0);
3203 }
3204 #endif
3205
3206 #ifdef SIGNAL_FLUSH_PCAP
3207 static void
3208 flushpcap(int signo _U_)
3209 {
3210 if (pdd != NULL)
3211 pcap_dump_flush(pdd);
3212 }
3213 #endif
3214
3215 static void
3216 print_packets_captured (void)
3217 {
3218 static u_int prev_packets_captured, first = 1;
3219
3220 if (infodelay == 0 && (first || packets_captured != prev_packets_captured)) {
3221 fprintf(stderr, "Got %u\r", packets_captured);
3222 first = 0;
3223 prev_packets_captured = packets_captured;
3224 }
3225 }
3226
3227 /*
3228 * Called once each second in verbose mode while dumping to file
3229 */
3230 #ifdef _WIN32
3231 static void CALLBACK verbose_stats_dump(PVOID param _U_,
3232 BOOLEAN timer_fired _U_)
3233 {
3234 print_packets_captured();
3235 }
3236 #else /* _WIN32 */
3237 static void verbose_stats_dump(int sig _U_)
3238 {
3239 print_packets_captured();
3240 }
3241 #endif /* _WIN32 */
3242
3243 DIAG_OFF_DEPRECATION
3244 static void
3245 print_version(FILE *f)
3246 {
3247 #ifndef HAVE_PCAP_LIB_VERSION
3248 #ifdef HAVE_PCAP_VERSION
3249 extern char pcap_version[];
3250 #else /* HAVE_PCAP_VERSION */
3251 static char pcap_version[] = "unknown";
3252 #endif /* HAVE_PCAP_VERSION */
3253 #endif /* HAVE_PCAP_LIB_VERSION */
3254 const char *smi_version_string;
3255
3256 (void)fprintf(f, "%s version " PACKAGE_VERSION "\n", program_name);
3257 #ifdef HAVE_PCAP_LIB_VERSION
3258 (void)fprintf(f, "%s\n", pcap_lib_version());
3259 #else /* HAVE_PCAP_LIB_VERSION */
3260 (void)fprintf(f, "libpcap version %s\n", pcap_version);
3261 #endif /* HAVE_PCAP_LIB_VERSION */
3262
3263 #if defined(HAVE_LIBCRYPTO) && defined(SSLEAY_VERSION)
3264 (void)fprintf (f, "%s\n", SSLeay_version(SSLEAY_VERSION));
3265 #endif
3266
3267 smi_version_string = nd_smi_version_string();
3268 if (smi_version_string != NULL)
3269 (void)fprintf (f, "SMI-library: %s\n", smi_version_string);
3270
3271 #if defined(__SANITIZE_ADDRESS__)
3272 (void)fprintf (f, "Compiled with AddressSanitizer/GCC.\n");
3273 #elif defined(__has_feature)
3274 # if __has_feature(address_sanitizer)
3275 (void)fprintf (f, "Compiled with AddressSanitizer/Clang.\n");
3276 # elif __has_feature(memory_sanitizer)
3277 (void)fprintf (f, "Compiled with MemorySanitizer/Clang.\n");
3278 # endif
3279 #endif /* __SANITIZE_ADDRESS__ or __has_feature */
3280 }
3281 DIAG_ON_DEPRECATION
3282
3283 static void
3284 print_usage(FILE *f)
3285 {
3286 print_version(f);
3287 (void)fprintf(f,
3288 "Usage: %s [-Abd" D_FLAG "efhH" I_FLAG J_FLAG "KlLnNOpqStu" U_FLAG "vxX#]" B_FLAG_USAGE " [ -c count ] [--count]\n", program_name);
3289 (void)fprintf(f,
3290 "\t\t[ -C file_size ] [ -E algo:secret ] [ -F file ] [ -G seconds ]\n");
3291 (void)fprintf(f,
3292 "\t\t[ -i interface ]" IMMEDIATE_MODE_USAGE j_FLAG_USAGE "\n");
3293 #ifdef HAVE_PCAP_FINDALLDEVS_EX
3294 (void)fprintf(f,
3295 "\t\t" LIST_REMOTE_INTERFACES_USAGE "\n");
3296 #endif
3297 #ifdef USE_LIBSMI
3298 (void)fprintf(f,
3299 "\t\t" m_FLAG_USAGE "\n");
3300 #endif
3301 (void)fprintf(f,
3302 "\t\t[ -M secret ] [ --number ] [ --print ]\n");
3303 (void)fprintf(f,
3304 "\t\t[ --print-sampling nth ]" Q_FLAG_USAGE " [ -r file ]\n");
3305 (void)fprintf(f,
3306 "\t\t[ -s snaplen ] [ -T type ] [ --version ]\n");
3307 (void)fprintf(f,
3308 "\t\t[ -V file ] [ -w file ] [ -W filecount ] [ -y datalinktype ]\n");
3309 #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
3310 (void)fprintf(f,
3311 "\t\t[ --time-stamp-precision precision ] [ --micro ] [ --nano ]\n");
3312 #endif
3313 (void)fprintf(f,
3314 "\t\t[ -z postrotate-command ] [ -Z user ] [ expression ]\n");
3315 }