#ifdef HAVE_GETOPT_LONG
#include <getopt.h>
#else
-#include "getopt_long.h"
+#include "missing/getopt_long.h"
#endif
/* Capsicum-specific code requires macros from <net/bpf.h>, which will fail
* to compile if <pcap.h> has already been included; including the headers
* in the opposite order works fine.
*/
#ifdef HAVE_CAPSICUM
-#include <sys/capability.h>
+#include <sys/capsicum.h>
#include <sys/ioccom.h>
#include <net/bpf.h>
#include <libgen.h>
#endif /* HAVE_CASPER */
#endif /* HAVE_CAPSICUM */
#ifdef HAVE_PCAP_OPEN
+/*
+ * We found pcap_open() in the capture library, so we'll be using
+ * the remote capture APIs; define PCAP_REMOTE before we include pcap.h,
+ * so we get those APIs declared, and the types and #defines that they
+ * use defined.
+ *
+ * WinPcap's headers require that PCAP_REMOTE be defined in order to get
+ * remote-capture APIs declared and types and #defines that they use
+ * defined.
+ *
+ * (Versions of libpcap with those APIs, and thus Npcap, which is based on
+ * those versions of libpcap, don't require it.)
+ */
#define HAVE_REMOTE
#endif
#include <pcap.h>
#include "interface.h"
#include "addrtoname.h"
#include "machdep.h"
-#include "gmt2local.h"
#include "pcap-missing.h"
#include "ascii_strcasecmp.h"
#define PATH_MAX 1024
#endif
-#ifdef SIGINFO
+#if defined(SIGINFO)
#define SIGNAL_REQ_INFO SIGINFO
-#elif SIGUSR1
+#elif defined(SIGUSR1)
#define SIGNAL_REQ_INFO SIGUSR1
#endif
#define SIGNAL_FLUSH_PCAP SIGUSR2
#endif
+#if defined(HAVE_PCAP_CREATE) || defined(_WIN32)
static int Bflag; /* buffer size */
+#endif
#ifdef HAVE_PCAP_DUMP_FTELL64
static int64_t Cflag; /* rotate dump files after this many bytes */
#else
* dflag but, instead, *if* built with optimizer debugging code,
* *export* a routine to set that flag.
*/
+extern int dflag;
int dflag; /* print filter code */
static int Gflag; /* rotate dump files after this many seconds */
static int Gflag_count; /* number of files created with Gflag rotation */
static int Iflag; /* rfmon (monitor) mode */
#ifdef HAVE_PCAP_SET_TSTAMP_TYPE
static int Jflag; /* list available time stamp types */
-#endif
static int jflag = -1; /* packet time stamp source */
+#endif
static int pflag; /* don't go promiscuous */
#ifdef HAVE_PCAP_SETDIRECTION
static int Qflag = -1; /* restrict captured packet by send/receive direction */
#endif
+#ifdef HAVE_PCAP_DUMP_FLUSH
static int Uflag; /* "unbuffered" output of dump files */
+#endif
static int Wflag; /* recycle output files after this number of files */
static int WflagChars;
static char *zflag = NULL; /* compress each savefile using a specified command (like gzip or bzip2) */
static void child_cleanup(int);
static void print_version(void);
static void print_usage(void);
+#ifdef HAVE_PCAP_SET_TSTAMP_TYPE
static NORETURN void show_tstamp_types_and_exit(pcap_t *, const char *device);
+#endif
static NORETURN void show_dlts_and_exit(pcap_t *, const char *device);
#ifdef HAVE_PCAP_FINDALLDEVS
static NORETURN void show_devices_and_exit(void);
static void droproot(const char *, const char *);
#ifdef SIGNAL_REQ_INFO
-void requestinfo(int);
+static void requestinfo(int);
#endif
#ifdef SIGNAL_FLUSH_PCAP
-void flushpcap(int);
+static void flushpcap(int);
#endif
#ifdef _WIN32
{ PCAP_IF_RUNNING, "Running" },
#endif
{ PCAP_IF_LOOPBACK, "Loopback" },
+#ifdef PCAP_IF_WIRELESS
+ { PCAP_IF_WIRELESS, "Wireless" },
+#endif
{ 0, NULL }
};
#endif
printf("%d.%s", i+1, dev->name);
if (dev->description != NULL)
printf(" (%s)", dev->description);
- if (dev->flags != 0)
- printf(" [%s]", bittok2str(status_flags, "none", dev->flags));
+ if (dev->flags != 0) {
+ printf(" [");
+ printf("%s", bittok2str(status_flags, "none", dev->flags));
+#ifdef PCAP_IF_WIRELESS
+ if (dev->flags & PCAP_IF_WIRELESS) {
+ switch (dev->flags & PCAP_IF_CONNECTION_STATUS) {
+
+ case PCAP_IF_CONNECTION_STATUS_UNKNOWN:
+ printf(", Association status unknown");
+ break;
+
+ case PCAP_IF_CONNECTION_STATUS_CONNECTED:
+ printf(", Associated");
+ break;
+
+ case PCAP_IF_CONNECTION_STATUS_DISCONNECTED:
+ printf(", Not associated");
+ break;
+
+ case PCAP_IF_CONNECTION_STATUS_NOT_APPLICABLE:
+ break;
+ }
+ } else {
+ switch (dev->flags & PCAP_IF_CONNECTION_STATUS) {
+
+ case PCAP_IF_CONNECTION_STATUS_UNKNOWN:
+ printf(", Connection status unknown");
+ break;
+
+ case PCAP_IF_CONNECTION_STATUS_CONNECTED:
+ printf(", Connected");
+ break;
+
+ case PCAP_IF_CONNECTION_STATUS_DISCONNECTED:
+ printf(", Disconnected");
+ break;
+
+ case PCAP_IF_CONNECTION_STATUS_NOT_APPLICABLE:
+ break;
+ }
+ }
+#endif
+ printf("]");
+ }
printf("\n");
}
pcap_freealldevs(devlist);
#define J_FLAG
#endif /* PCAP_ERROR_TSTAMP_TYPE_NOTSUP */
+#ifdef USE_LIBSMI
+#define m_FLAG_USAGE "[ -m module ] ..."
+#endif
+
#ifdef HAVE_PCAP_SETDIRECTION
#define Q_FLAG "Q:"
#define Q_FLAG_USAGE " [ -Q in|out|inout ]"
#define OPTION_IMMEDIATE_MODE 130
#define OPTION_PRINT 131
#define OPTION_LIST_REMOTE_INTERFACES 132
+#define OPTION_TSTAMP_MICRO 133
+#define OPTION_TSTAMP_NANO 134
static const struct option longopts[] = {
#if defined(HAVE_PCAP_CREATE) || defined(_WIN32)
{ "list-time-stamp-types", no_argument, NULL, 'J' },
#endif
#ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
+ { "micro", no_argument, NULL, OPTION_TSTAMP_MICRO},
+ { "nano", no_argument, NULL, OPTION_TSTAMP_NANO},
{ "time-stamp-precision", required_argument, NULL, OPTION_TSTAMP_PRECISION},
#endif
{ "dont-verify-checksums", no_argument, NULL, 'K' },
};
#ifdef HAVE_PCAP_FINDALLDEVS_EX
-#define LIST_REMOTE_INTERFACES_USAGE "[ --list-remote-interfaces remote-source ]"
+#define LIST_REMOTE_INTERFACES_USAGE "[ --list-remote-interfaces remote-source ]"
#else
#define LIST_REMOTE_INTERFACES_USAGE
#endif
#define IMMEDIATE_MODE_USAGE ""
#endif
-#ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
-#define TIME_STAMP_PRECISION_USAGE " [ --time-stamp-precision precision ]"
-#else
-#define TIME_STAMP_PRECISION_USAGE
-#endif
-
#ifndef _WIN32
/* Drop root privileges and chroot if necessary */
static void
{
struct passwd *pw = NULL;
- if (chroot_dir && !username) {
- fprintf(stderr, "%s: Chroot without dropping root is insecure\n",
- program_name);
- exit_tcpdump(S_ERR_HOST_PROGRAM);
- }
+ if (chroot_dir && !username)
+ error("Chroot without dropping root is insecure");
pw = getpwnam(username);
if (pw) {
if (chroot_dir) {
- if (chroot(chroot_dir) != 0 || chdir ("/") != 0) {
- fprintf(stderr, "%s: Couldn't chroot/chdir to '%.64s': %s\n",
- program_name, chroot_dir, pcap_strerror(errno));
- exit_tcpdump(S_ERR_HOST_PROGRAM);
- }
+ if (chroot(chroot_dir) != 0 || chdir ("/") != 0)
+ error("Couldn't chroot/chdir to '%.64s': %s",
+ chroot_dir, pcap_strerror(errno));
}
#ifdef HAVE_LIBCAP_NG
{
int ret = capng_change_id(pw->pw_uid, pw->pw_gid, CAPNG_NO_FLAG);
- if (ret < 0) {
- fprintf(stderr, "error : ret %d\n", ret);
- } else {
+ if (ret < 0)
+ error("capng_change_id(): return %d\n", ret);
+ else
fprintf(stderr, "dropped privs to %s\n", username);
- }
}
#else
if (initgroups(pw->pw_name, pw->pw_gid) != 0 ||
- setgid(pw->pw_gid) != 0 || setuid(pw->pw_uid) != 0) {
- fprintf(stderr, "%s: Couldn't change to '%.32s' uid=%lu gid=%lu: %s\n",
- program_name, username,
+ setgid(pw->pw_gid) != 0 || setuid(pw->pw_uid) != 0)
+ error("Couldn't change to '%.32s' uid=%lu gid=%lu: %s",
+ username,
(unsigned long)pw->pw_uid,
(unsigned long)pw->pw_gid,
pcap_strerror(errno));
- exit_tcpdump(S_ERR_HOST_PROGRAM);
- }
else {
fprintf(stderr, "dropped privs to %s\n", username);
}
#endif /* HAVE_LIBCAP_NG */
- }
- else {
- fprintf(stderr, "%s: Couldn't find user '%.32s'\n",
- program_name, username);
- exit_tcpdump(S_ERR_HOST_PROGRAM);
- }
+ } else
+ error("Couldn't find user '%.32s'", username);
#ifdef HAVE_LIBCAP_NG
/* We don't need CAP_SETUID, CAP_SETGID and CAP_SYS_CHROOT any more. */
DIAG_OFF_CLANG(assign-enum)
if (cnt == 0 && max_chars == 0)
strncpy(buffer, filename, PATH_MAX + 1);
else
- if (nd_snprintf(buffer, PATH_MAX + 1, "%s%0*d", filename, max_chars, cnt) > PATH_MAX)
+ if (snprintf(buffer, PATH_MAX + 1, "%s%0*d", filename, max_chars, cnt) > PATH_MAX)
/* Report an error if the filename is too large */
error("too many output files or filename is too long (> %d)", PATH_MAX);
free(filename);
copy_argv(char **argv)
{
char **p;
- u_int len = 0;
+ size_t len = 0;
char *buf;
char *src, *dst;
static char *
read_infile(char *fname)
{
- int i, fd, cc;
+ int i, fd;
+ ssize_t cc;
char *cp;
struct stat buf;
if (cc < 0)
error("read %s: %s", fname, pcap_strerror(errno));
if (cc != buf.st_size)
- error("short read %s (%d != %d)", fname, cc, (int)buf.st_size);
+ error("short read %s (%zd != %d)", fname, cc, (int)buf.st_size);
close(fd);
/* replace "# comment" with spaces */
}
static char *
-find_interface_by_number(const char *url, long devnum)
+find_interface_by_number(const char *url
+#ifndef HAVE_PCAP_FINDALLDEVS_EX
+_U_
+#endif
+, long devnum)
{
pcap_if_t *dev, *devlist;
long i;
*/
endp++; /* Include the trailing / in the URL; pcap_findalldevs_ex() requires it */
host_url = malloc(endp - url + 1);
+ if (host_url == NULL && (endp - url + 1) > 0)
+ error("Invalid allocation for host");
+
memcpy(host_url, url, endp - url);
host_url[endp - url] = '\0';
status = pcap_findalldevs_ex(host_url, NULL, &devlist, ebuf);
#ifdef HAVE_PCAP_OPEN
/*
- * Prefix for rpcap URLs.
+ * Prefixes for rpcap URLs.
*/
static char rpcap_prefix[] = "rpcap://";
+static char rpcap_ssl_prefix[] = "rpcaps://";
#endif
static pcap_t *
/*
* Is this an rpcap URL?
*/
- if (strncmp(device, rpcap_prefix, sizeof(rpcap_prefix) - 1) == 0) {
+ if (strncmp(device, rpcap_prefix, sizeof(rpcap_prefix) - 1) == 0 ||
+ strncmp(device, rpcap_ssl_prefix, sizeof(rpcap_ssl_prefix) - 1) == 0) {
/*
* Yes. Open it with pcap_open().
*/
status = pcap_set_tstamp_precision(pc, ndo->ndo_tstamp_precision);
if (status != 0)
error("%s: Can't set %ssecond time stamp precision: %s",
- device,
- tstamp_precision_to_string(ndo->ndo_tstamp_precision),
- pcap_statustostr(status));
+ device,
+ tstamp_precision_to_string(ndo->ndo_tstamp_precision),
+ pcap_statustostr(status));
#endif
#ifdef HAVE_PCAP_SET_IMMEDIATE_MODE
status = pcap_set_immediate_mode(pc, 1);
if (status != 0)
error("%s: Can't set immediate mode: %s",
- device,
- pcap_statustostr(status));
+ device, pcap_statustostr(status));
}
#endif
/*
status = pcap_set_tstamp_type(pc, jflag);
if (status < 0)
error("%s: Can't set time stamp type: %s",
- device, pcap_statustostr(status));
+ device, pcap_statustostr(status));
+ else if (status > 0)
+ warning("When trying to set timestamp type '%s' on %s: %s",
+ pcap_tstamp_type_val_to_name(jflag), device,
+ pcap_statustostr(status));
}
#endif
status = pcap_activate(pc);
/*
* Return an error for our caller to handle.
*/
- nd_snprintf(ebuf, PCAP_ERRBUF_SIZE, "%s: %s\n(%s)",
+ snprintf(ebuf, PCAP_ERRBUF_SIZE, "%s: %s\n(%s)",
device, pcap_statustostr(status), cp);
pcap_close(pc);
return (NULL);
char sysctl[32];
size_t s = sizeof(parent);
- nd_snprintf(sysctl, sizeof(sysctl),
+ snprintf(sysctl, sizeof(sysctl),
"net.wlan.%d.%%parent", atoi(device + 4));
sysctlbyname(sysctl, parent, &s, NULL, 0);
strlcpy(newdev, device, sizeof(newdev));
{
int cnt, op, i;
bpf_u_int32 localnet = 0, netmask = 0;
- int timezone_offset = 0;
char *cp, *infile, *cmdbuf, *device, *RFileName, *VFileName, *WFileName;
char *endp;
pcap_handler callback;
u_char *pcap_userdata;
char ebuf[PCAP_ERRBUF_SIZE];
char VFileLine[PATH_MAX + 1];
- char *username = NULL;
- char *chroot_dir = NULL;
+ const char *username = NULL;
+#ifndef _WIN32
+ const char *chroot_dir = NULL;
+#endif
char *ret = NULL;
char *end;
#ifdef HAVE_PCAP_FINDALLDEVS
break;
case 's':
- ndo->ndo_snaplen = strtol(optarg, &end, 0);
+ ndo->ndo_snaplen = (int)strtol(optarg, &end, 0);
if (optarg == end || *end != '\0'
|| ndo->ndo_snaplen < 0 || ndo->ndo_snaplen > MAXIMUM_SNAPLEN)
- error("invalid snaplen %s", optarg);
+ error("invalid snaplen %s (must be >= 0 and <= %d)",
+ optarg, MAXIMUM_SNAPLEN);
break;
case 'S':
print = 1;
break;
+#ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
+ case OPTION_TSTAMP_MICRO:
+ ndo->ndo_tstamp_precision = PCAP_TSTAMP_PRECISION_MICRO;
+ break;
+
+ case OPTION_TSTAMP_NANO:
+ ndo->ndo_tstamp_precision = PCAP_TSTAMP_PRECISION_NANO;
+ break;
+#endif
+
default:
print_usage();
exit_tcpdump(S_ERR_HOST_PROGRAM);
switch (ndo->ndo_tflag) {
case 0: /* Default */
- case 4: /* Default + Date*/
- timezone_offset = gmt2local(0);
- break;
-
case 1: /* No time stamp */
case 2: /* Unix timeval style */
- case 3: /* Microseconds since previous packet */
- case 5: /* Microseconds since first packet */
+ case 3: /* Microseconds/nanoseconds since previous packet */
+ case 4: /* Date + Default */
+ case 5: /* Microseconds/nanoseconds since first packet */
break;
default: /* Not supported */
#endif
dlt = pcap_datalink(pd);
dlt_name = pcap_datalink_val_to_name(dlt);
+ fprintf(stderr, "reading from file %s", RFileName);
if (dlt_name == NULL) {
- fprintf(stderr, "reading from file %s, link-type %u\n",
- RFileName, dlt);
+ fprintf(stderr, ", link-type %u", dlt);
} else {
- fprintf(stderr,
- "reading from file %s, link-type %s (%s)\n",
- RFileName, dlt_name,
- pcap_datalink_val_to_description(dlt));
+ fprintf(stderr, ", link-type %s (%s)", dlt_name,
+ pcap_datalink_val_to_description(dlt));
}
+ fprintf(stderr, ", snapshot length %d\n", pcap_snapshot(pd));
+#ifdef DLT_LINUX_SLL2
+ if (dlt == DLT_LINUX_SLL2)
+ fprintf(stderr, "Warning: interface names might be incorrect\n");
+#endif
} else {
/*
* We're doing a live capture.
capdns = capdns_setup();
#endif /* HAVE_CASPER */
- init_print(ndo, localnet, netmask, timezone_offset);
+ init_print(ndo, localnet, netmask);
#ifndef _WIN32
(void)setsignal(SIGPIPE, cleanup);
if (pdd == NULL)
error("%s", pcap_geterr(pd));
#ifdef HAVE_CAPSICUM
- set_dumper_capsicum_rights(p);
+ set_dumper_capsicum_rights(pdd);
#endif
if (Cflag != 0 || Gflag != 0) {
#ifdef HAVE_CAPSICUM
(void)fprintf(stderr, "%s: ", program_name);
dlt = pcap_datalink(pd);
dlt_name = pcap_datalink_val_to_name(dlt);
+ (void)fprintf(stderr, "listening on %s", device);
if (dlt_name == NULL) {
- (void)fprintf(stderr, "listening on %s, link-type %u, capture size %u bytes\n",
- device, dlt, ndo->ndo_snaplen);
+ (void)fprintf(stderr, ", link-type %u", dlt);
} else {
- (void)fprintf(stderr, "listening on %s, link-type %s (%s), capture size %u bytes\n",
- device, dlt_name,
- pcap_datalink_val_to_description(dlt), ndo->ndo_snaplen);
+ (void)fprintf(stderr, ", link-type %s (%s)", dlt_name,
+ pcap_datalink_val_to_description(dlt));
}
+ (void)fprintf(stderr, ", snapshot length %d bytes\n", ndo->ndo_snaplen);
(void)fflush(stderr);
}
* Report the new file.
*/
dlt_name = pcap_datalink_val_to_name(dlt);
+ fprintf(stderr, "reading from file %s", RFileName);
if (dlt_name == NULL) {
- fprintf(stderr, "reading from file %s, link-type %u\n",
- RFileName, dlt);
+ fprintf(stderr, ", link-type %u", dlt);
} else {
- fprintf(stderr,
- "reading from file %s, link-type %s (%s)\n",
- RFileName, dlt_name,
- pcap_datalink_val_to_description(dlt));
+ fprintf(stderr, ", link-type %s (%s)",
+ dlt_name,
+ pcap_datalink_val_to_description(dlt));
}
+ fprintf(stderr, ", snapshot length %d\n", pcap_snapshot(pd));
}
}
}
}
#ifdef SIGNAL_REQ_INFO
-void requestinfo(int signo _U_)
+static void
+requestinfo(int signo _U_)
{
if (infodelay)
++infoprint;
#endif
#ifdef SIGNAL_FLUSH_PCAP
-void flushpcap(int signo _U_)
+static void
+flushpcap(int signo _U_)
{
if (pdd != NULL)
pcap_dump_flush(pdd);
#ifdef HAVE_PCAP_FINDALLDEVS_EX
(void)fprintf(stderr,
"\t\t" LIST_REMOTE_INTERFACES_USAGE "\n");
+#endif
+#ifdef USE_LIBSMI
+ (void)fprintf(stderr,
+"\t\t" m_FLAG_USAGE "\n");
#endif
(void)fprintf(stderr,
"\t\t[ -M secret ] [ --number ] [ --print ]" Q_FLAG_USAGE "\n");
(void)fprintf(stderr,
-"\t\t[ -r file ] [ -s snaplen ]" TIME_STAMP_PRECISION_USAGE "\n");
+"\t\t[ -r file ] [ -s snaplen ] [ -T type ] [ --version ]\n");
(void)fprintf(stderr,
-"\t\t[ -T type ] [ --version ] [ -V file ] [ -w file ]\n");
+"\t\t[ -V file ] [ -w file ] [ -W filecount ] [ -y datalinktype ]\n");
+#ifdef HAVE_PCAP_SET_TSTAMP_PRECISION
(void)fprintf(stderr,
-"\t\t[ -W filecount ] [ -y datalinktype ]\n");
+"\t\t[ --time-stamp-precision precision ] [ --micro ] [ --nano ]\n");
+#endif
(void)fprintf(stderr,
"\t\t[ -z postrotate-command ] [ -Z user ] [ expression ]\n");
}
projects / tcpdump / blobdiff