#include <netdissect-stdinc.h>
-#ifdef USE_LIBSMI
-#include <smi.h>
+#include <sys/stat.h>
+
+#ifdef HAVE_FCNTL_H
+#include <fcntl.h>
#endif
#ifdef HAVE_LIBCRYPTO
#include <sys/capability.h>
#include <sys/ioccom.h>
#include <net/bpf.h>
-#include <fcntl.h>
#include <libgen.h>
#endif /* HAVE_CAPSICUM */
#include <pcap.h>
#include <signal.h>
#include <stdio.h>
+#include <stdarg.h>
#include <stdlib.h>
#include <string.h>
#include <limits.h>
#define SIGNAL_REQ_INFO SIGUSR1
#endif
+static int Bflag; /* buffer size */
static int Cflag; /* rotate dump files after this many bytes */
static int Cflag_count; /* Keep track of which file number we're writing */
static int Dflag; /* list available devices and exit */
-static int dflag; /* print filter code */
+/*
+ * This is exported because, in some versions of libpcap, if libpcap
+ * is built with optimizer debugging code (which is *NOT* the default
+ * configuration!), the library *imports*(!) a variable named dflag,
+ * under the expectation that tcpdump is exporting it, to govern
+ * how much debugging information to print when optimizing
+ * the generated BPF code.
+ *
+ * This is a horrible hack; newer versions of libpcap don't import
+ * dflag but, instead, *if* built with optimizer debugging code,
+ * *export* a routine to set that flag.
+ */
+int dflag; /* print filter code */
static int Gflag; /* rotate dump files after this many seconds */
static int Gflag_count; /* number of files created with Gflag rotation */
static time_t Gflag_time; /* The last time_t the dump file was rotated. */
#ifdef HAVE_PCAP_SET_TSTAMP_TYPE
static int Jflag; /* list available time stamp types */
#endif
+static int jflag = -1; /* packet time stamp source */
+static int pflag; /* don't go promiscuous */
#ifdef HAVE_PCAP_SETDIRECTION
int Qflag = -1; /* restrict captured packet by send/receive direction */
#endif
static int Wflag; /* recycle output files after this number of files */
static int WflagChars;
static char *zflag = NULL; /* compress each savefile using a specified command (like gzip or bzip2) */
+static int immediate_mode;
static int infodelay;
static int infoprint;
char *program_name;
/* Forwards */
+static void error(const char *, ...)
+ __attribute__((noreturn))
+#ifdef __ATTRIBUTE___FORMAT_OK
+ __attribute__((format (printf, 1, 2)))
+#endif /* __ATTRIBUTE___FORMAT_OK */
+ ;
+static void warning(const char *, ...)
+#ifdef __ATTRIBUTE___FORMAT_OK
+ __attribute__((format (printf, 1, 2)))
+#endif /* __ATTRIBUTE___FORMAT_OK */
+ ;
+static void exit_tcpdump(int) __attribute__((noreturn));
static RETSIGTYPE cleanup(int);
static RETSIGTYPE child_cleanup(int);
static void print_version(void);
static void info(int);
static u_int packets_captured;
+#ifdef HAVE_PCAP_FINDALLDEVS
static const struct tok status_flags[] = {
#ifdef PCAP_IF_UP
{ PCAP_IF_UP, "Up" },
{ PCAP_IF_LOOPBACK, "Loopback" },
{ 0, NULL }
};
+#endif
static pcap_t *pd;
#endif
};
+#if defined(HAVE_PCAP_SET_PARSER_DEBUG)
+/*
+ * We have pcap_set_parser_debug() in libpcap; declare it (it's not declared
+ * by any libpcap header, because it's a special hack, only available if
+ * libpcap was configured to include it, and only intended for use by
+ * libpcap developers trying to debug the parser for filter expressions).
+ */
+#ifdef _WIN32
+__declspec(dllimport)
+#else /* _WIN32 */
+extern
+#endif /* _WIN32 */
+void pcap_set_parser_debug(int);
+#elif defined(HAVE_PCAP_DEBUG) || defined(HAVE_YYDEBUG)
+/*
+ * We don't have pcap_set_parser_debug() in libpcap, but we do have
+ * pcap_debug or yydebug. Make a local version of pcap_set_parser_debug()
+ * to set the flag, and define HAVE_PCAP_SET_PARSER_DEBUG.
+ */
+static void
+pcap_set_parser_debug(int value)
+{
+#ifdef HAVE_PCAP_DEBUG
+ extern int pcap_debug;
+
+ pcap_debug = value;
+#else /* HAVE_PCAP_DEBUG */
+ extern int yydebug;
+
+ yydebug = value;
+#endif /* HAVE_PCAP_DEBUG */
+}
+
+#define HAVE_PCAP_SET_PARSER_DEBUG
+#endif
+
+#if defined(HAVE_PCAP_SET_OPTIMIZER_DEBUG)
+/*
+ * We have pcap_set_optimizer_debug() in libpcap; declare it (it's not declared
+ * by any libpcap header, because it's a special hack, only available if
+ * libpcap was configured to include it, and only intended for use by
+ * libpcap developers trying to debug the optimizer for filter expressions).
+ */
+#ifdef _WIN32
+__declspec(dllimport)
+#else /* _WIN32 */
+extern
+#endif /* _WIN32 */
+void pcap_set_optimizer_debug(int);
+#endif
+
+/* VARARGS */
+static void
+error(const char *fmt, ...)
+{
+ va_list ap;
+
+ (void)fprintf(stderr, "%s: ", program_name);
+ va_start(ap, fmt);
+ (void)vfprintf(stderr, fmt, ap);
+ va_end(ap);
+ if (*fmt) {
+ fmt += strlen(fmt);
+ if (fmt[-1] != '\n')
+ (void)fputc('\n', stderr);
+ }
+ exit_tcpdump(1);
+ /* NOTREACHED */
+}
+
+/* VARARGS */
+static void
+warning(const char *fmt, ...)
+{
+ va_list ap;
+
+ (void)fprintf(stderr, "%s: WARNING: ", program_name);
+ va_start(ap, fmt);
+ (void)vfprintf(stderr, fmt, ap);
+ va_end(ap);
+ if (*fmt) {
+ fmt += strlen(fmt);
+ if (fmt[-1] != '\n')
+ (void)fputc('\n', stderr);
+ }
+}
+
+static void
+exit_tcpdump(int status)
+{
+ nd_cleanup();
+ exit(status);
+}
+
#ifdef HAVE_PCAP_SET_TSTAMP_TYPE
static void
show_tstamp_types_and_exit(const char *device)
if (n_tstamp_types == 0) {
fprintf(stderr, "Time stamp type cannot be set for %s\n",
device);
- exit(0);
+ exit_tcpdump(0);
}
fprintf(stderr, "Time stamp types for %s (use option -j to set):\n",
device);
}
}
pcap_free_tstamp_types(tstamp_types);
- exit(0);
+ exit_tcpdump(0);
}
#endif
#ifdef HAVE_PCAP_FREE_DATALINKS
pcap_free_datalinks(dlts);
#endif
- exit(0);
+ exit_tcpdump(0);
}
#ifdef HAVE_PCAP_FINDALLDEVS
printf("\n");
}
pcap_freealldevs(devlist);
- exit(0);
+ exit_tcpdump(0);
}
#endif /* HAVE_PCAP_FINDALLDEVS */
#ifdef HAVE_PCAP_SET_IMMEDIATE_MODE
{ "immediate-mode", no_argument, NULL, OPTION_IMMEDIATE_MODE },
#endif
-#if defined(HAVE_PCAP_DEBUG) || defined(HAVE_YYDEBUG)
+#ifdef HAVE_PCAP_SET_PARSER_DEBUG
{ "debug-filter-parser", no_argument, NULL, 'Y' },
#endif
{ "relinquish-privileges", required_argument, NULL, 'Z' },
if (chroot_dir && !username) {
fprintf(stderr, "%s: Chroot without dropping root is insecure\n",
program_name);
- exit(1);
+ exit_tcpdump(1);
}
pw = getpwnam(username);
if (chroot(chroot_dir) != 0 || chdir ("/") != 0) {
fprintf(stderr, "%s: Couldn't chroot/chdir to '%.64s': %s\n",
program_name, chroot_dir, pcap_strerror(errno));
- exit(1);
+ exit_tcpdump(1);
}
}
#ifdef HAVE_LIBCAP_NG
(unsigned long)pw->pw_uid,
(unsigned long)pw->pw_gid,
pcap_strerror(errno));
- exit(1);
+ exit_tcpdump(1);
}
else {
fprintf(stderr, "dropped privs to %s\n", username);
else {
fprintf(stderr, "%s: Couldn't find user '%.32s'\n",
program_name, username);
- exit(1);
+ exit_tcpdump(1);
}
#ifdef HAVE_LIBCAP_NG
/* We don't need CAP_SETUID and CAP_SETGID any more. */
}
#endif
+/*
+ * Copy arg vector into a new buffer, concatenating arguments with spaces.
+ */
+static char *
+copy_argv(register char **argv)
+{
+ register char **p;
+ register u_int len = 0;
+ char *buf;
+ char *src, *dst;
+
+ p = argv;
+ if (*p == 0)
+ return 0;
+
+ while (*p)
+ len += strlen(*p++) + 1;
+
+ buf = (char *)malloc(len);
+ if (buf == NULL)
+ error("copy_argv: malloc");
+
+ p = argv;
+ dst = buf;
+ while ((src = *p++) != NULL) {
+ while ((*dst++ = *src++) != '\0')
+ ;
+ dst[-1] = ' ';
+ }
+ dst[-1] = '\0';
+
+ return buf;
+}
+
+/*
+ * On Windows, we need to open the file in binary mode, so that
+ * we get all the bytes specified by the size we get from "fstat()".
+ * On UNIX, that's not necessary. O_BINARY is defined on Windows;
+ * we define it as 0 if it's not defined, so it does nothing.
+ */
+#ifndef O_BINARY
+#define O_BINARY 0
+#endif
+
+static char *
+read_infile(char *fname)
+{
+ register int i, fd, cc;
+ register char *cp;
+ struct stat buf;
+
+ fd = open(fname, O_RDONLY|O_BINARY);
+ if (fd < 0)
+ error("can't open %s: %s", fname, pcap_strerror(errno));
+
+ if (fstat(fd, &buf) < 0)
+ error("can't stat %s: %s", fname, pcap_strerror(errno));
+
+ cp = malloc((u_int)buf.st_size + 1);
+ if (cp == NULL)
+ error("malloc(%d) for %s: %s", (u_int)buf.st_size + 1,
+ fname, pcap_strerror(errno));
+ cc = read(fd, cp, (u_int)buf.st_size);
+ if (cc < 0)
+ error("read %s: %s", fname, pcap_strerror(errno));
+ if (cc != buf.st_size)
+ error("short read %s (%d != %d)", fname, cc, (int)buf.st_size);
+
+ close(fd);
+ /* replace "# comment" with spaces */
+ for (i = 0; i < cc; i++) {
+ if (cp[i] == '#')
+ while (i < cc && cp[i] != '\n')
+ cp[i++] = ' ';
+ }
+ cp[cc] = '\0';
+ return (cp);
+}
+
+#ifdef HAVE_PCAP_FINDALLDEVS
+static long
+parse_interface_number(const char *device)
+{
+ long devnum;
+ char *end;
+
+ devnum = strtol(device, &end, 10);
+ if (device != end && *end == '\0') {
+ /*
+ * It's all-numeric, but is it a valid number?
+ */
+ if (devnum <= 0) {
+ /*
+ * No, it's not an ordinal.
+ */
+ error("Invalid adapter index");
+ }
+ return (devnum);
+ } else {
+ /*
+ * It's not all-numeric; return -1, so our caller
+ * knows that.
+ */
+ return (-1);
+ }
+}
+
+static char *
+find_interface_by_number(long devnum)
+{
+ pcap_if_t *dev, *devlist;
+ long i;
+ char ebuf[PCAP_ERRBUF_SIZE];
+ char *device;
+
+ if (pcap_findalldevs(&devlist, ebuf) < 0)
+ error("%s", ebuf);
+ /*
+ * Look for the devnum-th entry in the list of devices (1-based).
+ */
+ for (i = 0, dev = devlist; i < devnum-1 && dev != NULL;
+ i++, dev = dev->next)
+ ;
+ if (dev == NULL)
+ error("Invalid adapter index");
+ device = strdup(dev->name);
+ pcap_freealldevs(devlist);
+ return (device);
+}
+#endif
+
+static pcap_t *
+open_interface(const char *device, netdissect_options *ndo, char *ebuf)
+{
+ pcap_t *pc;
+#ifdef HAVE_PCAP_CREATE
+ int status;
+ char *cp;
+#endif
+
+#ifdef HAVE_PCAP_CREATE
+ pc = pcap_create(device, ebuf);
+ if (pc == NULL)
+ error("%s", ebuf);
+#ifdef HAVE_PCAP_SET_TSTAMP_TYPE
+ if (Jflag)
+ show_tstamp_types_and_exit(device);
+#endif
+#ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
+ status = pcap_set_tstamp_precision(pc, ndo->ndo_tstamp_precision);
+ if (status != 0)
+ error("%s: Can't set %ssecond time stamp precision: %s",
+ device,
+ tstamp_precision_to_string(ndo->ndo_tstamp_precision),
+ pcap_statustostr(status));
+#endif
+
+#ifdef HAVE_PCAP_SET_IMMEDIATE_MODE
+ if (immediate_mode) {
+ status = pcap_set_immediate_mode(pc, 1);
+ if (status != 0)
+ error("%s: Can't set immediate mode: %s",
+ device,
+ pcap_statustostr(status));
+ }
+#endif
+ /*
+ * Is this an interface that supports monitor mode?
+ */
+ if (pcap_can_set_rfmon(pc) == 1)
+ supports_monitor_mode = 1;
+ else
+ supports_monitor_mode = 0;
+ status = pcap_set_snaplen(pc, ndo->ndo_snaplen);
+ if (status != 0)
+ error("%s: Can't set snapshot length: %s",
+ device, pcap_statustostr(status));
+ status = pcap_set_promisc(pc, !pflag);
+ if (status != 0)
+ error("%s: Can't set promiscuous mode: %s",
+ device, pcap_statustostr(status));
+ if (Iflag) {
+ status = pcap_set_rfmon(pc, 1);
+ if (status != 0)
+ error("%s: Can't set monitor mode: %s",
+ device, pcap_statustostr(status));
+ }
+ status = pcap_set_timeout(pc, 1000);
+ if (status != 0)
+ error("%s: pcap_set_timeout failed: %s",
+ device, pcap_statustostr(status));
+ if (Bflag != 0) {
+ status = pcap_set_buffer_size(pc, Bflag);
+ if (status != 0)
+ error("%s: Can't set buffer size: %s",
+ device, pcap_statustostr(status));
+ }
+#ifdef HAVE_PCAP_SET_TSTAMP_TYPE
+ if (jflag != -1) {
+ status = pcap_set_tstamp_type(pc, jflag);
+ if (status < 0)
+ error("%s: Can't set time stamp type: %s",
+ device, pcap_statustostr(status));
+ }
+#endif
+ status = pcap_activate(pc);
+ if (status < 0) {
+ /*
+ * pcap_activate() failed.
+ */
+ cp = pcap_geterr(pc);
+ if (status == PCAP_ERROR)
+ error("%s", cp);
+ else if (status == PCAP_ERROR_NO_SUCH_DEVICE) {
+ /*
+ * Return an error for our caller to handle.
+ */
+ pcap_close(pc);
+ snprintf(ebuf, PCAP_ERRBUF_SIZE, "%s: %s\n(%s)",
+ device, pcap_statustostr(status), cp);
+ return (NULL);
+ } else if (status == PCAP_ERROR_PERM_DENIED && *cp != '\0')
+ error("%s: %s\n(%s)", device,
+ pcap_statustostr(status), cp);
+ else
+ error("%s: %s", device,
+ pcap_statustostr(status));
+ } else if (status > 0) {
+ /*
+ * pcap_activate() succeeded, but it's warning us
+ * of a problem it had.
+ */
+ cp = pcap_geterr(pc);
+ if (status == PCAP_WARNING)
+ warning("%s", cp);
+ else if (status == PCAP_WARNING_PROMISC_NOTSUP &&
+ *cp != '\0')
+ warning("%s: %s\n(%s)", device,
+ pcap_statustostr(status), cp);
+ else
+ warning("%s: %s", device,
+ pcap_statustostr(status));
+ }
+#ifdef HAVE_PCAP_SETDIRECTION
+ if (Qflag != -1) {
+ status = pcap_setdirection(pc, Qflag);
+ if (status != 0)
+ error("%s: pcap_setdirection() failed: %s",
+ device, pcap_geterr(pc));
+ }
+#endif /* HAVE_PCAP_SETDIRECTION */
+#else /* HAVE_PCAP_CREATE */
+ *ebuf = '\0';
+ pc = pcap_open_live(device, ndo->ndo_snaplen, !pflag, 1000, ebuf);
+ if (pc == NULL)
+ error("%s", ebuf);
+ else if (*ebuf)
+ warning("%s", ebuf);
+#endif /* HAVE_PCAP_CREATE */
+
+ return (pc);
+}
+
int
main(int argc, char **argv)
{
register char *cp, *infile, *cmdbuf, *device, *RFileName, *VFileName, *WFileName;
pcap_handler callback;
int dlt;
- int new_dlt;
const char *dlt_name;
struct bpf_program fcode;
#ifndef _WIN32
char *ret = NULL;
char *end;
#ifdef HAVE_PCAP_FINDALLDEVS
- pcap_if_t *dev, *devlist;
- int devnum;
+ pcap_if_t *devlist;
+ long devnum;
#endif
int status;
FILE *VFile;
cap_rights_t rights;
int cansandbox;
#endif /* HAVE_CAPSICUM */
- int Bflag = 0; /* buffer size */
- int jflag = -1; /* packet time stamp source */
int Oflag = 1; /* run filter code optimizer */
- int pflag = 0; /* don't go promiscuous */
int yflag_dlt = -1;
const char *yflag_dlt_name = NULL;
netdissect_options Ndo;
netdissect_options *ndo = &Ndo;
- int immediate_mode = 0;
+
+ /*
+ * Initialize the netdissect code.
+ */
+ if (nd_init(ebuf, sizeof ebuf) == -1)
+ error("%s", ebuf);
memset(ndo, 0, sizeof(*ndo));
ndo_set_function_pointers(ndo);
if (abort_on_misalignment(ebuf, sizeof(ebuf)) < 0)
error("%s", ebuf);
-#ifdef USE_LIBSMI
- smiInit("tcpdump");
-#endif
-
while (
(op = getopt_long(argc, argv, SHORTOPTS, longopts, NULL)) != -1)
switch (op) {
case 'C':
Cflag = atoi(optarg) * 1000000;
- if (Cflag < 0)
+ if (Cflag <= 0)
error("invalid file size %s", optarg);
break;
case 'h':
print_usage();
- exit(0);
+ exit_tcpdump(0);
break;
case 'H':
break;
case 'i':
- if (optarg[0] == '0' && optarg[1] == 0)
- error("Invalid adapter index");
-
-#ifdef HAVE_PCAP_FINDALLDEVS
- /*
- * If the argument is a number, treat it as
- * an index into the list of adapters, as
- * printed by "tcpdump -D".
- *
- * This should be OK on UNIX systems, as interfaces
- * shouldn't have names that begin with digits.
- * It can be useful on Windows, where more than
- * one interface can have the same name.
- */
- devnum = strtol(optarg, &end, 10);
- if (optarg != end && *end == '\0') {
- if (devnum < 0)
- error("Invalid adapter index");
-
- if (pcap_findalldevs(&devlist, ebuf) < 0)
- error("%s", ebuf);
- /*
- * Look for the devnum-th entry in the
- * list of devices (1-based).
- */
- for (i = 0, dev = devlist;
- i < devnum-1 && dev != NULL;
- i++, dev = dev->next)
- ;
- if (dev == NULL)
- error("Invalid adapter index");
- device = strdup(dev->name);
- pcap_freealldevs(devlist);
- break;
- }
-#endif /* HAVE_PCAP_FINDALLDEVS */
device = optarg;
break;
break;
case 'm':
-#ifdef USE_LIBSMI
- if (smiLoadModule(optarg) == 0) {
- error("could not load MIB module %s", optarg);
+ if (nd_have_smi_support()) {
+ if (nd_load_smi_module(optarg, ebuf, sizeof ebuf) == -1)
+ error("%s", ebuf);
+ } else {
+ (void)fprintf(stderr, "%s: ignoring option `-m %s' ",
+ program_name, optarg);
+ (void)fprintf(stderr, "(no libsmi support)\n");
}
- ndo->ndo_mflag = 1;
-#else
- (void)fprintf(stderr, "%s: ignoring option `-m %s' ",
- program_name, optarg);
- (void)fprintf(stderr, "(no libsmi support)\n");
-#endif
break;
case 'M':
ndo->ndo_packettype = PT_PGM_ZMTP1;
else if (ascii_strcasecmp(optarg, "lmp") == 0)
ndo->ndo_packettype = PT_LMP;
+ else if (ascii_strcasecmp(optarg, "resp") == 0)
+ ndo->ndo_packettype = PT_RESP;
else
error("unknown packet type `%s'", optarg);
break;
case 'W':
Wflag = atoi(optarg);
- if (Wflag < 0)
+ if (Wflag <= 0)
error("invalid number of output files %s", optarg);
WflagChars = getWflagChars(Wflag);
break;
error("invalid data link type %s", yflag_dlt_name);
break;
-#if defined(HAVE_PCAP_DEBUG) || defined(HAVE_YYDEBUG)
+#ifdef HAVE_PCAP_SET_PARSER_DEBUG
case 'Y':
{
/* Undocumented flag */
-#ifdef HAVE_PCAP_DEBUG
- extern int pcap_debug;
- pcap_debug = 1;
-#else
- extern int yydebug;
- yydebug = 1;
-#endif
+ pcap_set_parser_debug(1);
}
break;
#endif
case OPTION_VERSION:
print_version();
- exit(0);
+ exit_tcpdump(0);
break;
#ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
default:
print_usage();
- exit(1);
+ exit_tcpdump(1);
/* NOTREACHED */
}
* We're doing a live capture.
*/
if (device == NULL) {
+ /*
+ * No interface was specified. Pick one.
+ */
#ifdef HAVE_PCAP_FINDALLDEVS
+ /*
+ * Find the list of interfaces, and pick
+ * the first interface.
+ */
if (pcap_findalldevs(&devlist, ebuf) >= 0 &&
devlist != NULL) {
device = strdup(devlist->name);
pcap_freealldevs(devlist);
}
#else /* HAVE_PCAP_FINDALLDEVS */
+ /*
+ * Use whatever interface pcap_lookupdev()
+ * chooses.
+ */
device = pcap_lookupdev(ebuf);
#endif
if (device == NULL)
fflush(stderr);
#endif /* _WIN32 */
-#ifdef HAVE_PCAP_CREATE
- pd = pcap_create(device, ebuf);
- if (pd == NULL)
- error("%s", ebuf);
-#ifdef HAVE_PCAP_SET_TSTAMP_TYPE
- if (Jflag)
- show_tstamp_types_and_exit(device);
-#endif
-#ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
- status = pcap_set_tstamp_precision(pd, ndo->ndo_tstamp_precision);
- if (status != 0)
- error("%s: Can't set %ssecond time stamp precision: %s",
- device,
- tstamp_precision_to_string(ndo->ndo_tstamp_precision),
- pcap_statustostr(status));
-#endif
-#ifdef HAVE_PCAP_SET_IMMEDIATE_MODE
- if (immediate_mode) {
- status = pcap_set_immediate_mode(pd, 1);
- if (status != 0)
- error("%s: Can't set immediate mode: %s",
- device,
- pcap_statustostr(status));
- }
-#endif
/*
- * Is this an interface that supports monitor mode?
+ * Try to open the interface with the specified name.
*/
- if (pcap_can_set_rfmon(pd) == 1)
- supports_monitor_mode = 1;
- else
- supports_monitor_mode = 0;
- status = pcap_set_snaplen(pd, ndo->ndo_snaplen);
- if (status != 0)
- error("%s: Can't set snapshot length: %s",
- device, pcap_statustostr(status));
- status = pcap_set_promisc(pd, !pflag);
- if (status != 0)
- error("%s: Can't set promiscuous mode: %s",
- device, pcap_statustostr(status));
- if (Iflag) {
- status = pcap_set_rfmon(pd, 1);
- if (status != 0)
- error("%s: Can't set monitor mode: %s",
- device, pcap_statustostr(status));
- }
- status = pcap_set_timeout(pd, 1000);
- if (status != 0)
- error("%s: pcap_set_timeout failed: %s",
- device, pcap_statustostr(status));
- if (Bflag != 0) {
- status = pcap_set_buffer_size(pd, Bflag);
- if (status != 0)
- error("%s: Can't set buffer size: %s",
- device, pcap_statustostr(status));
- }
-#ifdef HAVE_PCAP_SET_TSTAMP_TYPE
- if (jflag != -1) {
- status = pcap_set_tstamp_type(pd, jflag);
- if (status < 0)
- error("%s: Can't set time stamp type: %s",
- device, pcap_statustostr(status));
- }
-#endif
- status = pcap_activate(pd);
- if (status < 0) {
+ pd = open_interface(device, ndo, ebuf);
+ if (pd == NULL) {
/*
- * pcap_activate() failed.
+ * That failed. If we can get a list of
+ * interfaces, and the interface name
+ * is purely numeric, try to use it as
+ * a 1-based index in the list of
+ * interfaces.
*/
- cp = pcap_geterr(pd);
- if (status == PCAP_ERROR)
- error("%s", cp);
- else if ((status == PCAP_ERROR_NO_SUCH_DEVICE ||
- status == PCAP_ERROR_PERM_DENIED) &&
- *cp != '\0')
- error("%s: %s\n(%s)", device,
- pcap_statustostr(status), cp);
- else
- error("%s: %s", device,
- pcap_statustostr(status));
- } else if (status > 0) {
+#ifdef HAVE_PCAP_FINDALLDEVS
+ devnum = parse_interface_number(device);
+ if (devnum == -1) {
+ /*
+ * It's not a number; just report
+ * the open error and fail.
+ */
+ error("%s", ebuf);
+ }
+
/*
- * pcap_activate() succeeded, but it's warning us
- * of a problem it had.
+ * OK, it's a number; try to find the
+ * interface with that index, and try
+ * to open it.
+ *
+ * find_interface_by_number() exits if it
+ * couldn't be found.
+ */
+ device = find_interface_by_number(devnum);
+ pd = open_interface(device, ndo, ebuf);
+ if (pd == NULL)
+ error("%s", ebuf);
+#else /* HAVE_PCAP_FINDALLDEVS */
+ /*
+ * We can't get a list of interfaces; just
+ * fail.
*/
- cp = pcap_geterr(pd);
- if (status == PCAP_WARNING)
- warning("%s", cp);
- else if (status == PCAP_WARNING_PROMISC_NOTSUP &&
- *cp != '\0')
- warning("%s: %s\n(%s)", device,
- pcap_statustostr(status), cp);
- else
- warning("%s: %s", device,
- pcap_statustostr(status));
- }
-#ifdef HAVE_PCAP_SETDIRECTION
- if (Qflag != -1) {
- status = pcap_setdirection(pd, Qflag);
- if (status != 0)
- error("%s: pcap_setdirection() failed: %s",
- device, pcap_geterr(pd));
- }
-#endif /* HAVE_PCAP_SETDIRECTION */
-#else
- *ebuf = '\0';
- pd = pcap_open_live(device, ndo->ndo_snaplen, !pflag, 1000,
- ebuf);
- if (pd == NULL)
error("%s", ebuf);
- else if (*ebuf)
- warning("%s", ebuf);
-#endif /* HAVE_PCAP_CREATE */
+#endif /* HAVE_PCAP_FINDALLDEVS */
+ }
+
/*
* Let user own process after socket has been opened.
*/
else
cmdbuf = copy_argv(&argv[optind]);
+#ifdef HAVE_PCAP_SET_OPTIMIZER_DEBUG
+ pcap_set_optimizer_debug(dflag);
+#endif
if (pcap_compile(pd, &fcode, cmdbuf, Oflag, netmask) < 0)
error("%s", pcap_geterr(pd));
if (dflag) {
pcap_close(pd);
free(cmdbuf);
pcap_freecode(&fcode);
- exit(0);
+ exit_tcpdump(0);
}
init_print(ndo, localnet, netmask, timezone_offset);
if (VFileName != NULL) {
ret = get_next_file(VFile, VFileLine);
if (ret) {
+ int new_dlt;
+
RFileName = VFileLine;
pd = pcap_open_offline(RFileName, ebuf);
if (pd == NULL)
}
#endif
new_dlt = pcap_datalink(pd);
- if (WFileName && new_dlt != dlt)
- error("%s: new dlt does not match original", RFileName);
- ndo->ndo_if_printer = get_if_printer(ndo, new_dlt);
- dlt_name = pcap_datalink_val_to_name(new_dlt);
+ if (new_dlt != dlt) {
+ /*
+ * The new file has a different
+ * link-layer header type from the
+ * previous one.
+ */
+ if (WFileName != NULL) {
+ /*
+ * We're writing raw packets
+ * that match the filter to
+ * a pcap file. pcap files
+ * don't support multiple
+ * different link-layer
+ * header types, so we fail
+ * here.
+ */
+ error("%s: new dlt does not match original", RFileName);
+ }
+
+ /*
+ * We're printing the decoded packets;
+ * switch to the new DLT.
+ *
+ * To do that, we need to change
+ * the printer, change the DLT name,
+ * and recompile the filter with
+ * the new DLT.
+ */
+ dlt = new_dlt;
+ ndo->ndo_if_printer = get_if_printer(ndo, dlt);
+ if (pcap_compile(pd, &fcode, cmdbuf, Oflag, netmask) < 0)
+ error("%s", pcap_geterr(pd));
+ }
+
+ /*
+ * Set the filter on the new file.
+ */
+ if (pcap_setfilter(pd, &fcode) < 0)
+ error("%s", pcap_geterr(pd));
+
+ /*
+ * Report the new file.
+ */
+ dlt_name = pcap_datalink_val_to_name(dlt);
if (dlt_name == NULL) {
fprintf(stderr, "reading from file %s, link-type %u\n",
- RFileName, new_dlt);
+ RFileName, dlt);
} else {
fprintf(stderr,
"reading from file %s, link-type %s (%s)\n",
- RFileName, dlt_name,
- pcap_datalink_val_to_description(new_dlt));
+ RFileName, dlt_name,
+ pcap_datalink_val_to_description(dlt));
}
- if (pcap_compile(pd, &fcode, cmdbuf, Oflag, netmask) < 0)
- error("%s", pcap_geterr(pd));
- if (pcap_setfilter(pd, &fcode) < 0)
- error("%s", pcap_geterr(pd));
}
}
}
free(cmdbuf);
pcap_freecode(&fcode);
- exit(status == -1 ? 1 : 0);
+ exit_tcpdump(status == -1 ? 1 : 0);
}
/* make a clean exit on interrupts */
(void)fflush(stdout);
info(1);
}
- exit(0);
+ exit_tcpdump(0);
#endif
}
if (Cflag == 0 && Wflag > 0 && Gflag_count >= Wflag) {
(void)fprintf(stderr, "Maximum file limit reached: %d\n",
Wflag);
- exit(0);
+ exit_tcpdump(0);
/* NOTREACHED */
}
if (dump_info->CurrentFileName != NULL)
static char pcap_version[] = "unknown";
#endif /* defined(_WIN32) || defined(HAVE_PCAP_VERSION) */
#endif /* HAVE_PCAP_LIB_VERSION */
+ const char *smi_version_string;
#ifdef HAVE_PCAP_LIB_VERSION
#ifdef _WIN32
(void)fprintf (stderr, "%s\n", SSLeay_version(SSLEAY_VERSION));
#endif
-#ifdef USE_LIBSMI
- (void)fprintf (stderr, "SMI-library: %s\n", smi_version_string);
-#endif
+ smi_version_string = nd_smi_version_string();
+ if (smi_version_string != NULL)
+ (void)fprintf (stderr, "SMI-library: %s\n", smi_version_string);
}
USES_APPLE_RST
#endif
(void)fprintf(stderr, "[ -T type ] [ --version ] [ -V file ]\n");
(void)fprintf(stderr,
-"\t\t[ -w file ] [ -W filecount ] [ -y datalinktype ] [ -z command ]\n");
+"\t\t[ -w file ] [ -W filecount ] [ -y datalinktype ] [ -z postrotate-command ]\n");
(void)fprintf(stderr,
"\t\t[ -Z user ] [ expression ]\n");
}
projects / tcpdump / blobdiff