X-Git-Url: https://git.tcpdump.org/tcpdump/blobdiff_plain/06c19e9b09117698d4c6e19c396eb098c4fbb33f..69cb46af9119e8b5554bcc4bf1bf36f39cb82131:/tcpdump.c diff --git a/tcpdump.c b/tcpdump.c index 49029b89..8e5994f0 100644 --- a/tcpdump.c +++ b/tcpdump.c @@ -29,8 +29,6 @@ static const char copyright[] _U_ = "@(#) Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000\n\ The Regents of the University of California. All rights reserved.\n"; -static const char rcsid[] _U_ = - "@(#) $Header: /tcpdump/master/tcpdump/tcpdump.c,v 1.283 2008-09-25 21:45:50 guy Exp $ (LBL)"; #endif /* @@ -45,10 +43,20 @@ static const char rcsid[] _U_ = #include "config.h" #endif +/* + * Mac OS X may ship pcap.h from libpcap 0.6 with a libpcap based on + * 0.8. That means it has pcap_findalldevs() but the header doesn't + * define pcap_if_t, meaning that we can't actually *use* pcap_findalldevs(). + */ +#ifdef HAVE_PCAP_FINDALLDEVS +#ifndef HAVE_PCAP_IF_T +#undef HAVE_PCAP_FINDALLDEVS +#endif +#endif + #include #ifdef WIN32 -#include "getopt.h" #include "w32_fzs.h" extern int strcasecmp (const char *__s1, const char *__s2); extern int SIZE_BUF; @@ -56,10 +64,30 @@ extern int SIZE_BUF; #define uint UINT #endif /* WIN32 */ -#ifdef HAVE_SMI_H +#ifdef USE_LIBSMI #include #endif +#ifdef HAVE_LIBCRYPTO +#include +#endif + +#ifdef HAVE_GETOPT_LONG +#include +#else +#include "getopt_long.h" +#endif +/* Capsicum-specific code requires macros from , which will fail + * to compile if has already been included; including the headers + * in the opposite order works fine. + */ +#ifdef HAVE_CAPSICUM +#include +#include +#include +#include +#include +#endif /* HAVE_CAPSICUM */ #include #include #include @@ -71,13 +99,20 @@ extern int SIZE_BUF; #include #include #include -#include #endif /* WIN32 */ -/* capabilities convinience library */ +/* capabilities convenience library */ +/* If a code depends on HAVE_LIBCAP_NG, it depends also on HAVE_CAP_NG_H. + * If HAVE_CAP_NG_H is not defined, undefine HAVE_LIBCAP_NG. + * Thus, the later tests are done only on HAVE_LIBCAP_NG. + */ +#ifdef HAVE_LIBCAP_NG #ifdef HAVE_CAP_NG_H #include +#else +#undef HAVE_LIBCAP_NG #endif /* HAVE_CAP_NG_H */ +#endif /* HAVE_LIBCAP_NG */ #include "netdissect.h" #include "interface.h" @@ -87,6 +122,8 @@ extern int SIZE_BUF; #include "gmt2local.h" #include "pcap-missing.h" +#include "print.h" + #ifndef PATH_MAX #define PATH_MAX 1024 #endif @@ -100,11 +137,15 @@ extern int SIZE_BUF; netdissect_options Gndo; netdissect_options *gndo = &Gndo; +static int Dflag; /* list available devices and exit */ static int dflag; /* print filter code */ static int Lflag; /* list available data link types and exit */ #ifdef HAVE_PCAP_SET_TSTAMP_TYPE static int Jflag; /* list available time stamp types */ #endif +#ifdef HAVE_PCAP_SETDIRECTION +int Qflag = -1; /* restrict captured packet by send/receive direction */ +#endif static char *zflag = NULL; /* compress each savefile using a specified command (like gzip or bzip2) */ static int infodelay; @@ -112,22 +153,17 @@ static int infoprint; char *program_name; -int32_t thiszone; /* seconds offset from gmt to local time */ - /* Forwards */ static RETSIGTYPE cleanup(int); static RETSIGTYPE child_cleanup(int); -static void usage(void) __attribute__((noreturn)); +static void print_version(void); +static void print_usage(void); static void show_dlts_and_exit(const char *device, pcap_t *pd) __attribute__((noreturn)); static void print_packet(u_char *, const struct pcap_pkthdr *, const u_char *); -static void ndo_default_print(netdissect_options *, const u_char *, u_int); static void dump_packet_and_trunc(u_char *, const struct pcap_pkthdr *, const u_char *); static void dump_packet(u_char *, const struct pcap_pkthdr *, const u_char *); static void droproot(const char *, const char *); -static void ndo_error(netdissect_options *ndo, const char *fmt, ...) - __attribute__ ((noreturn, format (printf, 2, 3))); -static void ndo_warning(netdissect_options *ndo, const char *fmt, ...); #ifdef SIGNAL_REQ_INFO RETSIGTYPE requestinfo(int); @@ -144,222 +180,17 @@ RETSIGTYPE requestinfo(int); static void info(int); static u_int packets_captured; -struct printer { - if_printer f; - int type; -}; - - -struct ndo_printer { - if_ndo_printer f; - int type; -}; - - -static struct printer printers[] = { - { arcnet_if_print, DLT_ARCNET }, -#ifdef DLT_ARCNET_LINUX - { arcnet_linux_if_print, DLT_ARCNET_LINUX }, -#endif - { token_if_print, DLT_IEEE802 }, -#ifdef DLT_LANE8023 - { lane_if_print, DLT_LANE8023 }, -#endif -#ifdef DLT_CIP - { cip_if_print, DLT_CIP }, -#endif -#ifdef DLT_ATM_CLIP - { cip_if_print, DLT_ATM_CLIP }, -#endif - { sl_if_print, DLT_SLIP }, -#ifdef DLT_SLIP_BSDOS - { sl_bsdos_if_print, DLT_SLIP_BSDOS }, -#endif - { ppp_if_print, DLT_PPP }, -#ifdef DLT_PPP_WITHDIRECTION - { ppp_if_print, DLT_PPP_WITHDIRECTION }, -#endif -#ifdef DLT_PPP_BSDOS - { ppp_bsdos_if_print, DLT_PPP_BSDOS }, -#endif - { fddi_if_print, DLT_FDDI }, - { null_if_print, DLT_NULL }, -#ifdef DLT_LOOP - { null_if_print, DLT_LOOP }, -#endif - { raw_if_print, DLT_RAW }, - { atm_if_print, DLT_ATM_RFC1483 }, -#ifdef DLT_C_HDLC - { chdlc_if_print, DLT_C_HDLC }, -#endif -#ifdef DLT_HDLC - { chdlc_if_print, DLT_HDLC }, -#endif -#ifdef DLT_PPP_SERIAL - { ppp_hdlc_if_print, DLT_PPP_SERIAL }, -#endif -#ifdef DLT_PPP_ETHER - { pppoe_if_print, DLT_PPP_ETHER }, -#endif -#ifdef DLT_LINUX_SLL - { sll_if_print, DLT_LINUX_SLL }, -#endif -#ifdef DLT_IEEE802_11 - { ieee802_11_if_print, DLT_IEEE802_11}, -#endif -#ifdef DLT_LTALK - { ltalk_if_print, DLT_LTALK }, -#endif -#if defined(DLT_PFLOG) && defined(HAVE_NET_PFVAR_H) - { pflog_if_print, DLT_PFLOG }, -#endif -#ifdef DLT_FR - { fr_if_print, DLT_FR }, -#endif -#ifdef DLT_FRELAY - { fr_if_print, DLT_FRELAY }, -#endif -#ifdef DLT_SUNATM - { sunatm_if_print, DLT_SUNATM }, -#endif -#ifdef DLT_IP_OVER_FC - { ipfc_if_print, DLT_IP_OVER_FC }, -#endif -#ifdef DLT_PRISM_HEADER - { prism_if_print, DLT_PRISM_HEADER }, -#endif -#ifdef DLT_IEEE802_11_RADIO - { ieee802_11_radio_if_print, DLT_IEEE802_11_RADIO }, -#endif -#ifdef DLT_ENC - { enc_if_print, DLT_ENC }, -#endif -#ifdef DLT_SYMANTEC_FIREWALL - { symantec_if_print, DLT_SYMANTEC_FIREWALL }, -#endif -#ifdef DLT_APPLE_IP_OVER_IEEE1394 - { ap1394_if_print, DLT_APPLE_IP_OVER_IEEE1394 }, -#endif -#ifdef DLT_IEEE802_11_RADIO_AVS - { ieee802_11_radio_avs_if_print, DLT_IEEE802_11_RADIO_AVS }, -#endif -#ifdef DLT_JUNIPER_ATM1 - { juniper_atm1_print, DLT_JUNIPER_ATM1 }, -#endif -#ifdef DLT_JUNIPER_ATM2 - { juniper_atm2_print, DLT_JUNIPER_ATM2 }, -#endif -#ifdef DLT_JUNIPER_MFR - { juniper_mfr_print, DLT_JUNIPER_MFR }, -#endif -#ifdef DLT_JUNIPER_MLFR - { juniper_mlfr_print, DLT_JUNIPER_MLFR }, -#endif -#ifdef DLT_JUNIPER_MLPPP - { juniper_mlppp_print, DLT_JUNIPER_MLPPP }, -#endif -#ifdef DLT_JUNIPER_PPPOE - { juniper_pppoe_print, DLT_JUNIPER_PPPOE }, -#endif -#ifdef DLT_JUNIPER_PPPOE_ATM - { juniper_pppoe_atm_print, DLT_JUNIPER_PPPOE_ATM }, -#endif -#ifdef DLT_JUNIPER_GGSN - { juniper_ggsn_print, DLT_JUNIPER_GGSN }, -#endif -#ifdef DLT_JUNIPER_ES - { juniper_es_print, DLT_JUNIPER_ES }, -#endif -#ifdef DLT_JUNIPER_MONITOR - { juniper_monitor_print, DLT_JUNIPER_MONITOR }, -#endif -#ifdef DLT_JUNIPER_SERVICES - { juniper_services_print, DLT_JUNIPER_SERVICES }, -#endif -#ifdef DLT_JUNIPER_ETHER - { juniper_ether_print, DLT_JUNIPER_ETHER }, -#endif -#ifdef DLT_JUNIPER_PPP - { juniper_ppp_print, DLT_JUNIPER_PPP }, -#endif -#ifdef DLT_JUNIPER_FRELAY - { juniper_frelay_print, DLT_JUNIPER_FRELAY }, -#endif -#ifdef DLT_JUNIPER_CHDLC - { juniper_chdlc_print, DLT_JUNIPER_CHDLC }, -#endif -#ifdef DLT_MFR - { mfr_if_print, DLT_MFR }, -#endif -#if defined(DLT_BLUETOOTH_HCI_H4_WITH_PHDR) && defined(HAVE_PCAP_BLUETOOTH_H) - { bt_if_print, DLT_BLUETOOTH_HCI_H4_WITH_PHDR}, -#endif -#ifdef HAVE_PCAP_USB_H -#ifdef DLT_USB_LINUX - { usb_linux_48_byte_print, DLT_USB_LINUX}, -#endif /* DLT_USB_LINUX */ -#ifdef DLT_USB_LINUX_MMAPPED - { usb_linux_64_byte_print, DLT_USB_LINUX_MMAPPED}, -#endif /* DLT_USB_LINUX_MMAPPED */ -#endif /* HAVE_PCAP_USB_H */ -#ifdef DLT_IPV4 - { raw_if_print, DLT_IPV4 }, -#endif -#ifdef DLT_IPV6 - { raw_if_print, DLT_IPV6 }, -#endif - { NULL, 0 }, -}; - -static struct ndo_printer ndo_printers[] = { - { ether_if_print, DLT_EN10MB }, -#ifdef DLT_IPNET - { ipnet_if_print, DLT_IPNET }, -#endif -#ifdef DLT_IEEE802_15_4 - { ieee802_15_4_if_print, DLT_IEEE802_15_4 }, -#endif -#ifdef DLT_IEEE802_15_4_NOFCS - { ieee802_15_4_if_print, DLT_IEEE802_15_4_NOFCS }, -#endif -#ifdef DLT_PPI - { ppi_if_print, DLT_PPI }, -#endif -#ifdef DLT_NETANALYZER - { netanalyzer_if_print, DLT_NETANALYZER }, +static const struct tok status_flags[] = { +#ifdef PCAP_IF_UP + { PCAP_IF_UP, "Up" }, #endif -#ifdef DLT_NETANALYZER_TRANSPARENT - { netanalyzer_transparent_if_print, DLT_NETANALYZER_TRANSPARENT }, +#ifdef PCAP_IF_RUNNING + { PCAP_IF_RUNNING, "Running" }, #endif - { NULL, 0 }, + { PCAP_IF_LOOPBACK, "Loopback" }, + { 0, NULL } }; -if_printer -lookup_printer(int type) -{ - struct printer *p; - - for (p = printers; p->f; ++p) - if (type == p->type) - return p->f; - - return NULL; - /* NOTREACHED */ -} - -if_ndo_printer -lookup_ndo_printer(int type) -{ - struct ndo_printer *p; - - for (p = ndo_printers; p->f; ++p) - if (type == p->type) - return p->f; - - return NULL; - /* NOTREACHED */ -} - static pcap_t *pd; static int supports_monitor_mode; @@ -368,20 +199,14 @@ extern int optind; extern int opterr; extern char *optarg; -struct print_info { - netdissect_options *ndo; - union { - if_printer printer; - if_ndo_printer ndo_printer; - } p; - int ndo_type; -}; - struct dump_info { char *WFileName; char *CurrentFileName; pcap_t *pd; pcap_dumper_t *p; +#ifdef HAVE_CAPSICUM + int dirfd; +#endif }; #ifdef HAVE_PCAP_SET_TSTAMP_TYPE @@ -421,7 +246,7 @@ show_tstamp_types_and_exit(const char *device, pcap_t *pd) static void show_dlts_and_exit(const char *device, pcap_t *pd) { - int n_dlts; + int n_dlts, i; int *dlts = 0; const char *dlt_name; @@ -442,27 +267,26 @@ show_dlts_and_exit(const char *device, pcap_t *pd) if (supports_monitor_mode) (void) fprintf(stderr, "Data link types for %s %s (use option -y to set):\n", device, - Iflag ? "when in monitor mode" : "when not in monitor mode"); + gndo->ndo_Iflag ? "when in monitor mode" : "when not in monitor mode"); else (void) fprintf(stderr, "Data link types for %s (use option -y to set):\n", device); - while (--n_dlts >= 0) { - dlt_name = pcap_datalink_val_to_name(dlts[n_dlts]); + for (i = 0; i < n_dlts; i++) { + dlt_name = pcap_datalink_val_to_name(dlts[i]); if (dlt_name != NULL) { (void) fprintf(stderr, " %s (%s)", dlt_name, - pcap_datalink_val_to_description(dlts[n_dlts])); + pcap_datalink_val_to_description(dlts[i])); /* * OK, does tcpdump handle that type? */ - if (lookup_printer(dlts[n_dlts]) == NULL - && lookup_ndo_printer(dlts[n_dlts]) == NULL) + if (!has_printer(dlts[i])) (void) fprintf(stderr, " (printing not supported)"); fprintf(stderr, "\n"); } else { (void) fprintf(stderr, " DLT %d (printing not supported)\n", - dlts[n_dlts]); + dlts[i]); } } #ifdef HAVE_PCAP_FREE_DATALINKS @@ -471,6 +295,61 @@ show_dlts_and_exit(const char *device, pcap_t *pd) exit(0); } +#ifdef HAVE_PCAP_FINDALLDEVS +static void +show_devices_and_exit (void) +{ + pcap_if_t *devpointer; + char ebuf[PCAP_ERRBUF_SIZE]; + int i; + + if (pcap_findalldevs(&devpointer, ebuf) < 0) + error("%s", ebuf); + else { + for (i = 0; devpointer != NULL; i++) { + printf("%d.%s", i+1, devpointer->name); + if (devpointer->description != NULL) + printf(" (%s)", devpointer->description); + if (devpointer->flags != 0) + printf(" [%s]", bittok2str(status_flags, "none", devpointer->flags)); + printf("\n"); + devpointer = devpointer->next; + } + } + exit(0); +} +#endif /* HAVE_PCAP_FINDALLDEVS */ + +/* + * Short options. + * + * Note that there we use all letters for short options except for g, k, + * o, and P, and those are used by other versions of tcpdump, and we should + * only use them for the same purposes that the other versions of tcpdump + * use them: + * + * OS X tcpdump uses -g to force non--v output for IP to be on one + * line, making it more "g"repable; + * + * OS X tcpdump uses -k tospecify that packet comments in pcap-ng files + * should be printed; + * + * OpenBSD tcpdump uses -o to indicate that OS fingerprinting should be done + * for hosts sending TCP SYN packets; + * + * OS X tcpdump uses -P to indicate that -w should write pcap-ng rather + * than pcap files. + * + * OS X tcpdump also uses -Q to specify expressions that match packet + * metadata, including but not limited to the packet direction. + * The expression syntax is different from a simple "in|out|inout", + * and those expressions aren't accepted by OS X tcpdump, but the + * equivalents would be "in" = "dir=in", "out" = "dir=out", and + * "inout" = "dir=in or dir=out", and the parser could conceivably + * special-case "in", "out", and "inout" as expressions for backwards + * compatibility, so all is not (yet) lost. + */ + /* * Set up flags that might or might not be supported depending on the * version of libpcap we're using. @@ -499,12 +378,6 @@ show_dlts_and_exit(const char *device, pcap_t *pd) #define J_FLAG #endif /* PCAP_ERROR_TSTAMP_TYPE_NOTSUP */ -#ifdef HAVE_PCAP_FINDALLDEVS -#ifndef HAVE_PCAP_IF_T -#undef HAVE_PCAP_FINDALLDEVS -#endif -#endif - #ifdef HAVE_PCAP_FINDALLDEVS #define D_FLAG "D" #else @@ -517,6 +390,80 @@ show_dlts_and_exit(const char *device, pcap_t *pd) #define U_FLAG #endif +#ifdef HAVE_PCAP_SETDIRECTION +#define Q_FLAG "Q:" +#else +#define Q_FLAG +#endif + +#define SHORTOPTS "aAb" B_FLAG "c:C:d" D_FLAG "eE:fF:G:hHi:" I_FLAG j_FLAG J_FLAG "KlLm:M:nNOpq" Q_FLAG "r:Rs:StT:u" U_FLAG "vV:w:W:xXy:Yz:Z:#" + +/* + * Long options. + * + * We do not currently have long options corresponding to all short + * options; we should probably pick appropriate option names for them. + * + * However, the short options where the number of times the option is + * specified matters, such as -v and -d and -t, should probably not + * just map to a long option, as saying + * + * tcpdump --verbose --verbose + * + * doesn't make sense; it should be --verbosity={N} or something such + * as that. + * + * For long options with no corresponding short options, we define values + * outside the range of ASCII graphic characters, make that the last + * component of the entry for the long option, and have a case for that + * option in the switch statement. + */ +#define OPTION_VERSION 128 +#define OPTION_TSTAMP_PRECISION 129 +#define OPTION_IMMEDIATE_MODE 130 + +static const struct option longopts[] = { +#if defined(HAVE_PCAP_CREATE) || defined(WIN32) + { "buffer-size", required_argument, NULL, 'B' }, +#endif + { "list-interfaces", no_argument, NULL, 'D' }, + { "help", no_argument, NULL, 'h' }, + { "interface", required_argument, NULL, 'i' }, +#ifdef HAVE_PCAP_CREATE + { "monitor-mode", no_argument, NULL, 'I' }, +#endif +#ifdef HAVE_PCAP_SET_TSTAMP_TYPE + { "time-stamp-type", required_argument, NULL, 'j' }, + { "list-time-stamp-types", no_argument, NULL, 'J' }, +#endif +#ifdef HAVE_PCAP_SET_TSTAMP_PRECISION + { "time-stamp-precision", required_argument, NULL, OPTION_TSTAMP_PRECISION}, +#endif + { "dont-verify-checksums", no_argument, NULL, 'K' }, + { "list-data-link-types", no_argument, NULL, 'L' }, + { "no-optimize", no_argument, NULL, 'O' }, + { "no-promiscuous-mode", no_argument, NULL, 'p' }, +#ifdef HAVE_PCAP_SETDIRECTION + { "direction", required_argument, NULL, 'Q' }, +#endif + { "snapshot-length", required_argument, NULL, 's' }, + { "absolute-tcp-sequence-numbers", no_argument, NULL, 'S' }, +#ifdef HAVE_PCAP_DUMP_FLUSH + { "packet-buffered", no_argument, NULL, 'U' }, +#endif + { "linktype", required_argument, NULL, 'y' }, +#ifdef HAVE_PCAP_SET_IMMEDIATE_MODE + { "immediate-mode", no_argument, NULL, OPTION_IMMEDIATE_MODE }, +#endif +#if defined(HAVE_PCAP_DEBUG) || defined(HAVE_YYDEBUG) + { "debug-filter-parser", no_argument, NULL, 'Y' }, +#endif + { "relinquish-privileges", required_argument, NULL, 'Z' }, + { "number", no_argument, NULL, '#' }, + { "version", no_argument, NULL, OPTION_VERSION }, + { NULL, 0, NULL, 0 } +}; + #ifndef WIN32 /* Drop root privileges and chroot if necessary */ static void @@ -528,7 +475,7 @@ droproot(const char *username, const char *chroot_dir) fprintf(stderr, "tcpdump: Chroot without dropping root is insecure\n"); exit(1); } - + pw = getpwnam(username); if (pw) { if (chroot_dir) { @@ -538,35 +485,45 @@ droproot(const char *username, const char *chroot_dir) exit(1); } } -#ifdef HAVE_CAP_NG_H +#ifdef HAVE_LIBCAP_NG int ret = capng_change_id(pw->pw_uid, pw->pw_gid, CAPNG_NO_FLAG); if (ret < 0) { - printf("error : ret %d\n", ret); + fprintf(stderr, "error : ret %d\n", ret); + } + else { + fprintf(stderr, "dropped privs to %s\n", username); } - /* We don't need CAP_SETUID and CAP_SETGID */ - capng_update(CAPNG_DROP, CAPNG_EFFECTIVE, CAP_SETUID); - capng_update(CAPNG_DROP, CAPNG_EFFECTIVE, CAP_SETUID); - capng_update(CAPNG_DROP, CAPNG_PERMITTED, CAP_SETUID); - capng_update(CAPNG_DROP, CAPNG_PERMITTED, CAP_SETUID); - capng_apply(CAPNG_SELECT_BOTH); - #else if (initgroups(pw->pw_name, pw->pw_gid) != 0 || setgid(pw->pw_gid) != 0 || setuid(pw->pw_uid) != 0) { fprintf(stderr, "tcpdump: Couldn't change to '%.32s' uid=%lu gid=%lu: %s\n", - username, + username, (unsigned long)pw->pw_uid, (unsigned long)pw->pw_gid, pcap_strerror(errno)); exit(1); } -#endif /* HAVE_CAP_NG_H */ + else { + fprintf(stderr, "dropped privs to %s\n", username); + } +#endif /* HAVE_LIBCAP_NG */ } else { fprintf(stderr, "tcpdump: Couldn't find user '%.32s'\n", username); exit(1); } +#ifdef HAVE_LIBCAP_NG + /* We don't need CAP_SETUID and CAP_SETGID any more. */ + capng_updatev( + CAPNG_DROP, + CAPNG_EFFECTIVE | CAPNG_PERMITTED, + CAP_SETUID, + CAP_SETGID, + -1); + capng_apply(CAPNG_SELECT_BOTH); +#endif /* HAVE_LIBCAP_NG */ + } #endif /* WIN32 */ @@ -593,11 +550,11 @@ MakeFilename(char *buffer, char *orig_name, int cnt, int max_chars) error("Makefilename: malloc"); /* Process with strftime if Gflag is set. */ - if (Gflag != 0) { + if (gndo->ndo_Gflag != 0) { struct tm *local_tm; /* Convert Gflag_time to a usable format */ - if ((local_tm = localtime(&Gflag_time)) == NULL) { + if ((local_tm = localtime(&gndo->ndo_Gflag_time)) == NULL) { error("MakeTimedFilename: localtime"); } @@ -618,43 +575,6 @@ MakeFilename(char *buffer, char *orig_name, int cnt, int max_chars) free(filename); } -static int tcpdump_printf(netdissect_options *ndo _U_, - const char *fmt, ...) -{ - - va_list args; - int ret; - - va_start(args, fmt); - ret=vfprintf(stdout, fmt, args); - va_end(args); - - return ret; -} - -static struct print_info -get_print_info(int type) -{ - struct print_info printinfo; - - printinfo.ndo_type = 1; - printinfo.ndo = gndo; - printinfo.p.ndo_printer = lookup_ndo_printer(type); - if (printinfo.p.ndo_printer == NULL) { - printinfo.p.printer = lookup_printer(type); - printinfo.ndo_type = 0; - if (printinfo.p.printer == NULL) { - gndo->ndo_dltname = pcap_datalink_val_to_name(type); - if (gndo->ndo_dltname != NULL) - error("packet printing is not supported for link type %s: use -w", - gndo->ndo_dltname); - else - error("packet printing is not supported for link type %d: use -w", type); - } - } - return (printinfo); -} - static char * get_next_file(FILE *VFile, char *ptr) { @@ -670,11 +590,112 @@ get_next_file(FILE *VFile, char *ptr) return ret; } +#ifdef HAVE_PCAP_SET_TSTAMP_PRECISION +static int +tstamp_precision_from_string(const char *precision) +{ + if (strncmp(precision, "nano", strlen("nano")) == 0) + return PCAP_TSTAMP_PRECISION_NANO; + + if (strncmp(precision, "micro", strlen("micro")) == 0) + return PCAP_TSTAMP_PRECISION_MICRO; + + return -EINVAL; +} + +static const char * +tstamp_precision_to_string(int precision) +{ + switch (precision) { + + case PCAP_TSTAMP_PRECISION_MICRO: + return "micro"; + + case PCAP_TSTAMP_PRECISION_NANO: + return "nano"; + + default: + return "unknown"; + } +} +#endif + +#ifdef HAVE_CAPSICUM +/* + * Ensure that, on a dump file's descriptor, we have all the rights + * necessary to make the standard I/O library work with an fdopen()ed + * FILE * from that descriptor. + * + * A long time ago, in a galaxy far far away, AT&T decided that, instead + * of providing separate APIs for getting and setting the FD_ flags on a + * descriptor, getting and setting the O_ flags on a descriptor, and + * locking files, they'd throw them all into a kitchen-sink fcntl() call + * along the lines of ioctl(), the fact that ioctl() operations are + * largely specific to particular character devices but fcntl() operations + * are either generic to all descriptors or generic to all descriptors for + * regular files nonwithstanding. + * + * The Capsicum people decided that fine-grained control of descriptor + * operations was required, so that you need to grant permission for + * reading, writing, seeking, and fcntl-ing. The latter, courtesy of + * AT&T's decision, means that "fcntl-ing" isn't a thing, but a motley + * collection of things, so there are *individual* fcntls for which + * permission needs to be granted. + * + * The FreeBSD standard I/O people implemented some optimizations that + * requires that the standard I/O routines be able to determine whether + * the descriptor for the FILE * is open append-only or not; as that + * descriptor could have come from an open() rather than an fopen(), + * that requires that it be able to do an F_GETFL fcntl() to read + * the O_ flags. + * + * Tcpdump uses ftell() to determine how much data has been written + * to a file in order to, when used with -C, determine when it's time + * to rotate capture files. ftell() therefore needs to do an lseek() + * to find out the file offset and must, thanks to the aforementioned + * optimization, also know whether the descriptor is open append-only + * or not. + * + * The net result of all the above is that we need to grant CAP_SEEK, + * CAP_WRITE, and CAP_FCNTL with the CAP_FCNTL_GETFL subcapability. + * + * Perhaps this is the universe's way of saying that either + * + * 1) there needs to be an fopenat() call and a pcap_dump_openat() call + * using it, so that Capsicum-capable tcpdump wouldn't need to do + * an fdopen() + * + * or + * + * 2) there needs to be a cap_fdopen() call in the FreeBSD standard + * I/O library that knows what rights are needed by the standard + * I/O library, based on the open mode, and assigns them, perhaps + * with an additional argument indicating, for example, whether + * seeking should be allowed, so that tcpdump doesn't need to know + * what the standard I/O library happens to require this week. + */ +static void +set_dumper_capsicum_rights(pcap_dumper_t *p) +{ + int fd = fileno(pcap_dump_file(p)); + cap_rights_t rights; + + cap_rights_init(&rights, CAP_SEEK, CAP_WRITE, CAP_FCNTL); + if (cap_rights_limit(fd, &rights) < 0 && errno != ENOSYS) { + error("unable to limit dump descriptor"); + } + if (cap_fcntls_limit(fd, CAP_FCNTL_GETFL) < 0 && errno != ENOSYS) { + error("unable to limit dump descriptor fcntls"); + } +} +#endif + int main(int argc, char **argv) { register int cnt, op, i; - bpf_u_int32 localnet, netmask; + bpf_u_int32 localnet =0 , netmask = 0; + int timezone_offset = 0; register char *cp, *infile, *cmdbuf, *device, *RFileName, *VFileName, *WFileName; pcap_handler callback; int type; @@ -700,20 +721,23 @@ main(int argc, char **argv) #endif int status; FILE *VFile; +#ifdef HAVE_CAPSICUM + cap_rights_t rights; + int cansandbox; +#endif /* HAVE_CAPSICUM */ + #ifdef WIN32 if(wsockinit() != 0) return 1; #endif /* WIN32 */ - jflag=-1; /* not set */ + gndo->ndo_jflag=-1; /* not set */ gndo->ndo_Oflag=1; gndo->ndo_Rflag=1; gndo->ndo_dlt=-1; - gndo->ndo_default_print=ndo_default_print; - gndo->ndo_printf=tcpdump_printf; - gndo->ndo_error=ndo_error; - gndo->ndo_warning=ndo_warning; + ndo_set_function_pointers(gndo); gndo->ndo_snaplen = DEFAULT_SNAPLEN; - + gndo->ndo_immediate = 0; + cnt = -1; device = NULL; infile = NULL; @@ -727,15 +751,22 @@ main(int argc, char **argv) else program_name = argv[0]; + /* + * On platforms where the CPU doesn't support unaligned loads, + * force unaligned accesses to abort with SIGBUS, rather than + * being fixed up (slowly) by the OS kernel; on those platforms, + * misaligned accesses are bugs, and we want tcpdump to crash so + * that the bugs are reported. + */ if (abort_on_misalignment(ebuf, sizeof(ebuf)) < 0) error("%s", ebuf); -#ifdef LIBSMI +#ifdef USE_LIBSMI smiInit("tcpdump"); #endif while ( - (op = getopt(argc, argv, "aAb" B_FLAG "c:C:d" D_FLAG "eE:fF:G:hHi:" I_FLAG j_FLAG J_FLAG "KlLm:M:nNOpqr:Rs:StT:u" U_FLAG "V:vw:W:xXy:Yz:Z:")) != -1) + (op = getopt_long(argc, argv, SHORTOPTS, longopts, NULL)) != -1) switch (op) { case 'a': @@ -743,17 +774,17 @@ main(int argc, char **argv) break; case 'A': - ++Aflag; + ++gndo->ndo_Aflag; break; case 'b': - ++bflag; + ++gndo->ndo_bflag; break; #if defined(HAVE_PCAP_CREATE) || defined(WIN32) case 'B': - Bflag = atoi(optarg)*1024; - if (Bflag <= 0) + gndo->ndo_Bflag = atoi(optarg)*1024; + if (gndo->ndo_Bflag <= 0) error("invalid packet buffer size %s", optarg); break; #endif /* defined(HAVE_PCAP_CREATE) || defined(WIN32) */ @@ -765,8 +796,8 @@ main(int argc, char **argv) break; case 'C': - Cflag = atoi(optarg) * 1000000; - if (Cflag < 0) + gndo->ndo_Cflag = atoi(optarg) * 1000000; + if (gndo->ndo_Cflag < 0) error("invalid file size %s", optarg); break; @@ -774,28 +805,16 @@ main(int argc, char **argv) ++dflag; break; -#ifdef HAVE_PCAP_FINDALLDEVS case 'D': - if (pcap_findalldevs(&devpointer, ebuf) < 0) - error("%s", ebuf); - else { - for (i = 0; devpointer != 0; i++) { - printf("%d.%s", i+1, devpointer->name); - if (devpointer->description != NULL) - printf(" (%s)", devpointer->description); - printf("\n"); - devpointer = devpointer->next; - } - } - return 0; -#endif /* HAVE_PCAP_FINDALLDEVS */ + Dflag++; + break; case 'L': Lflag++; break; case 'e': - ++eflag; + ++gndo->ndo_eflag; break; case 'E': @@ -806,7 +825,7 @@ main(int argc, char **argv) break; case 'f': - ++fflag; + ++gndo->ndo_fflag; break; case 'F': @@ -814,32 +833,33 @@ main(int argc, char **argv) break; case 'G': - Gflag = atoi(optarg); - if (Gflag < 0) + gndo->ndo_Gflag = atoi(optarg); + if (gndo->ndo_Gflag < 0) error("invalid number of seconds %s", optarg); /* We will create one file initially. */ - Gflag_count = 0; + gndo->ndo_Gflag_count = 0; /* Grab the current time for rotation use. */ - if ((Gflag_time = time(NULL)) == (time_t)-1) { + if ((gndo->ndo_Gflag_time = time(NULL)) == (time_t)-1) { error("main: can't get current time: %s", pcap_strerror(errno)); } break; case 'h': - usage(); + print_usage(); + exit(0); break; case 'H': - ++Hflag; + ++gndo->ndo_Hflag; break; case 'i': if (optarg[0] == '0' && optarg[1] == 0) error("Invalid adapter index"); - + #ifdef HAVE_PCAP_FINDALLDEVS /* * If the argument is a number, treat it as @@ -880,14 +900,14 @@ main(int argc, char **argv) #ifdef HAVE_PCAP_CREATE case 'I': - ++Iflag; + ++gndo->ndo_Iflag; break; #endif /* HAVE_PCAP_CREATE */ #ifdef HAVE_PCAP_SET_TSTAMP_TYPE case 'j': - jflag = pcap_tstamp_type_name_to_val(optarg); - if (jflag < 0) + gndo->ndo_jflag = pcap_tstamp_type_name_to_val(optarg); + if (gndo->ndo_jflag < 0) error("invalid time stamp type %s", optarg); break; @@ -918,15 +938,15 @@ main(int argc, char **argv) break; case 'K': - ++Kflag; + ++gndo->ndo_Kflag; break; case 'm': -#ifdef LIBSMI +#ifdef USE_LIBSMI if (smiLoadModule(optarg) == 0) { error("could not load MIB module %s", optarg); } - sflag = 1; + gndo->ndo_sflag = 1; #else (void)fprintf(stderr, "%s: ignoring option `-m %s' ", program_name, optarg); @@ -939,94 +959,117 @@ main(int argc, char **argv) #ifndef HAVE_LIBCRYPTO warning("crypto code not compiled in"); #endif - sigsecret = optarg; + gndo->ndo_sigsecret = optarg; break; case 'n': - ++nflag; + ++gndo->ndo_nflag; break; case 'N': - ++Nflag; + ++gndo->ndo_Nflag; break; case 'O': - Oflag = 0; + gndo->ndo_Oflag = 0; break; case 'p': - ++pflag; + ++gndo->ndo_pflag; break; case 'q': - ++qflag; - ++suppress_default_print; + ++gndo->ndo_qflag; + ++gndo->ndo_suppress_default_print; + break; + +#ifdef HAVE_PCAP_SETDIRECTION + case 'Q': + if (strcasecmp(optarg, "in") == 0) + Qflag = PCAP_D_IN; + else if (strcasecmp(optarg, "out") == 0) + Qflag = PCAP_D_OUT; + else if (strcasecmp(optarg, "inout") == 0) + Qflag = PCAP_D_INOUT; + else + error("unknown capture direction `%s'", optarg); break; +#endif /* HAVE_PCAP_SETDIRECTION */ case 'r': RFileName = optarg; break; case 'R': - Rflag = 0; + gndo->ndo_Rflag = 0; break; case 's': - snaplen = strtol(optarg, &end, 0); + gndo->ndo_snaplen = strtol(optarg, &end, 0); if (optarg == end || *end != '\0' - || snaplen < 0 || snaplen > MAXIMUM_SNAPLEN) + || gndo->ndo_snaplen < 0 || gndo->ndo_snaplen > MAXIMUM_SNAPLEN) error("invalid snaplen %s", optarg); - else if (snaplen == 0) - snaplen = MAXIMUM_SNAPLEN; + else if (gndo->ndo_snaplen == 0) + gndo->ndo_snaplen = MAXIMUM_SNAPLEN; break; case 'S': - ++Sflag; + ++gndo->ndo_Sflag; break; case 't': - ++tflag; + ++gndo->ndo_tflag; break; case 'T': if (strcasecmp(optarg, "vat") == 0) - packettype = PT_VAT; + gndo->ndo_packettype = PT_VAT; else if (strcasecmp(optarg, "wb") == 0) - packettype = PT_WB; + gndo->ndo_packettype = PT_WB; else if (strcasecmp(optarg, "rpc") == 0) - packettype = PT_RPC; + gndo->ndo_packettype = PT_RPC; else if (strcasecmp(optarg, "rtp") == 0) - packettype = PT_RTP; + gndo->ndo_packettype = PT_RTP; else if (strcasecmp(optarg, "rtcp") == 0) - packettype = PT_RTCP; + gndo->ndo_packettype = PT_RTCP; else if (strcasecmp(optarg, "snmp") == 0) - packettype = PT_SNMP; + gndo->ndo_packettype = PT_SNMP; else if (strcasecmp(optarg, "cnfp") == 0) - packettype = PT_CNFP; + gndo->ndo_packettype = PT_CNFP; else if (strcasecmp(optarg, "tftp") == 0) - packettype = PT_TFTP; + gndo->ndo_packettype = PT_TFTP; else if (strcasecmp(optarg, "aodv") == 0) - packettype = PT_AODV; + gndo->ndo_packettype = PT_AODV; else if (strcasecmp(optarg, "carp") == 0) - packettype = PT_CARP; + gndo->ndo_packettype = PT_CARP; else if (strcasecmp(optarg, "radius") == 0) - packettype = PT_RADIUS; + gndo->ndo_packettype = PT_RADIUS; + else if (strcasecmp(optarg, "zmtp1") == 0) + gndo->ndo_packettype = PT_ZMTP1; + else if (strcasecmp(optarg, "vxlan") == 0) + gndo->ndo_packettype = PT_VXLAN; + else if (strcasecmp(optarg, "pgm") == 0) + gndo->ndo_packettype = PT_PGM; + else if (strcasecmp(optarg, "pgm_zmtp1") == 0) + gndo->ndo_packettype = PT_PGM_ZMTP1; + else if (strcasecmp(optarg, "lmp") == 0) + gndo->ndo_packettype = PT_LMP; else error("unknown packet type `%s'", optarg); break; case 'u': - ++uflag; + ++gndo->ndo_uflag; break; #ifdef HAVE_PCAP_DUMP_FLUSH case 'U': - ++Uflag; + ++gndo->ndo_Uflag; break; #endif case 'v': - ++vflag; + ++gndo->ndo_vflag; break; case 'V': @@ -1038,20 +1081,20 @@ main(int argc, char **argv) break; case 'W': - Wflag = atoi(optarg); - if (Wflag < 0) + gndo->ndo_Wflag = atoi(optarg); + if (gndo->ndo_Wflag < 0) error("invalid number of output files %s", optarg); - WflagChars = getWflagChars(Wflag); + gndo->ndo_WflagChars = getWflagChars(gndo->ndo_Wflag); break; case 'x': - ++xflag; - ++suppress_default_print; + ++gndo->ndo_xflag; + ++gndo->ndo_suppress_default_print; break; case 'X': - ++Xflag; - ++suppress_default_print; + ++gndo->ndo_Xflag; + ++gndo->ndo_suppress_default_print; break; case 'y': @@ -1077,34 +1120,52 @@ main(int argc, char **argv) break; #endif case 'z': - if (optarg) { - zflag = strdup(optarg); - } else { - usage(); - /* NOTREACHED */ - } + zflag = strdup(optarg); break; case 'Z': - if (optarg) { - username = strdup(optarg); - } - else { - usage(); - /* NOTREACHED */ - } + username = strdup(optarg); + break; + + case '#': + gndo->ndo_packet_number = 1; break; + case OPTION_VERSION: + print_version(); + exit(0); + break; + +#ifdef HAVE_PCAP_SET_TSTAMP_PRECISION + case OPTION_TSTAMP_PRECISION: + gndo->ndo_tstamp_precision = tstamp_precision_from_string(optarg); + if (gndo->ndo_tstamp_precision < 0) + error("unsupported time stamp precision"); + break; +#endif + +#ifdef HAVE_PCAP_SET_IMMEDIATE_MODE + case OPTION_IMMEDIATE_MODE: + gndo->ndo_immediate = 1; + break; +#endif + default: - usage(); + print_usage(); + exit(1); /* NOTREACHED */ } - switch (tflag) { +#ifdef HAVE_PCAP_FINDALLDEVS + if (Dflag) + show_devices_and_exit(); +#endif + + switch (gndo->ndo_tflag) { case 0: /* Default */ case 4: /* Default + Date*/ - thiszone = gmt2local(0); + timezone_offset = gmt2local(0); break; case 1: /* No time stamp */ @@ -1118,12 +1179,23 @@ main(int argc, char **argv) break; } - if (fflag != 0 && (VFileName != NULL || RFileName != NULL)) + if (gndo->ndo_fflag != 0 && (VFileName != NULL || RFileName != NULL)) error("-f can not be used with -V or -r"); if (VFileName != NULL && RFileName != NULL) error("-V and -r are mutually exclusive."); +#ifdef HAVE_PCAP_SET_IMMEDIATE_MODE + /* + * If we're printing dissected packets to the standard output + * rather than saving raw packets to a file, and the standard + * output is a terminal, use immediate mode, as the user's + * probably expecting to see packets pop up immediately. + */ + if (WFileName == NULL && isatty(1)) + gndo->ndo_immediate = 1; +#endif + #ifdef WITH_CHROOT /* if run as root, prepare for chrooting */ if (getuid() == 0 || geteuid() == 0) { @@ -1136,7 +1208,7 @@ main(int argc, char **argv) #ifdef WITH_USER /* if run as root, prepare for dropping root privileges */ if (getuid() == 0 || geteuid() == 0) { - /* Run with '-Z root' to restore old behaviour */ + /* Run with '-Z root' to restore old behaviour */ if (!username) username = WITH_USER; } @@ -1180,9 +1252,22 @@ main(int argc, char **argv) RFileName = VFileLine; } +#ifdef HAVE_PCAP_SET_TSTAMP_PRECISION + pd = pcap_open_offline_with_tstamp_precision(RFileName, + gndo->ndo_tstamp_precision, ebuf); +#else pd = pcap_open_offline(RFileName, ebuf); +#endif + if (pd == NULL) error("%s", ebuf); +#ifdef HAVE_CAPSICUM + cap_rights_init(&rights, CAP_READ); + if (cap_rights_limit(fileno(pcap_file(pd)), &rights) < 0 && + errno != ENOSYS) { + error("unable to limit pcap descriptor"); + } +#endif dlt = pcap_datalink(pd); dlt_name = pcap_datalink_val_to_name(dlt); if (dlt_name == NULL) { @@ -1194,8 +1279,6 @@ main(int argc, char **argv) RFileName, dlt_name, pcap_datalink_val_to_description(dlt)); } - localnet = 0; - netmask = 0; } else { /* * We're doing a live capture. @@ -1210,8 +1293,8 @@ main(int argc, char **argv) * Print a message to the standard error on Windows. * XXX - why do it here, with a different message? */ - if(strlen(device) == 1) //we assume that an ASCII string is always longer than 1 char - { //a Unicode string has a \0 as second byte (so strlen() is 1) + if(strlen(device) == 1) /* we assume that an ASCII string is always longer than 1 char */ + { /* a Unicode string has a \0 as second byte (so strlen() is 1) */ fprintf(stderr, "%s: listening on %ws\n", program_name, device); } else @@ -1219,7 +1302,7 @@ main(int argc, char **argv) fprintf(stderr, "%s: listening on %s\n", program_name, device); } - fflush(stderr); + fflush(stderr); #endif /* WIN32 */ #ifdef HAVE_PCAP_CREATE pd = pcap_create(device, ebuf); @@ -1228,6 +1311,24 @@ main(int argc, char **argv) #ifdef HAVE_PCAP_SET_TSTAMP_TYPE if (Jflag) show_tstamp_types_and_exit(device, pd); +#endif +#ifdef HAVE_PCAP_SET_TSTAMP_PRECISION + status = pcap_set_tstamp_precision(pd, gndo->ndo_tstamp_precision); + if (status != 0) + error("%s: Can't set %ssecond time stamp precision: %s", + device, + tstamp_precision_to_string(gndo->ndo_tstamp_precision), + pcap_statustostr(status)); +#endif + +#ifdef HAVE_PCAP_SET_IMMEDIATE_MODE + if (gndo->ndo_immediate) { + status = pcap_set_immediate_mode(pd, 1); + if (status != 0) + error("%s: Can't set immediate mode: %s", + device, + pcap_statustostr(status)); + } #endif /* * Is this an interface that supports monitor mode? @@ -1236,15 +1337,15 @@ main(int argc, char **argv) supports_monitor_mode = 1; else supports_monitor_mode = 0; - status = pcap_set_snaplen(pd, snaplen); + status = pcap_set_snaplen(pd, gndo->ndo_snaplen); if (status != 0) error("%s: Can't set snapshot length: %s", device, pcap_statustostr(status)); - status = pcap_set_promisc(pd, !pflag); + status = pcap_set_promisc(pd, !gndo->ndo_pflag); if (status != 0) error("%s: Can't set promiscuous mode: %s", device, pcap_statustostr(status)); - if (Iflag) { + if (gndo->ndo_Iflag) { status = pcap_set_rfmon(pd, 1); if (status != 0) error("%s: Can't set monitor mode: %s", @@ -1254,18 +1355,18 @@ main(int argc, char **argv) if (status != 0) error("%s: pcap_set_timeout failed: %s", device, pcap_statustostr(status)); - if (Bflag != 0) { - status = pcap_set_buffer_size(pd, Bflag); + if (gndo->ndo_Bflag != 0) { + status = pcap_set_buffer_size(pd, gndo->ndo_Bflag); if (status != 0) error("%s: Can't set buffer size: %s", device, pcap_statustostr(status)); } #ifdef HAVE_PCAP_SET_TSTAMP_TYPE - if (jflag != -1) { - status = pcap_set_tstamp_type(pd, jflag); + if (gndo->ndo_jflag != -1) { + status = pcap_set_tstamp_type(pd, gndo->ndo_jflag); if (status < 0) error("%s: Can't set time stamp type: %s", - device, pcap_statustostr(status)); + device, pcap_statustostr(status)); } #endif status = pcap_activate(pd); @@ -1300,6 +1401,14 @@ main(int argc, char **argv) warning("%s: %s", device, pcap_statustostr(status)); } +#ifdef HAVE_PCAP_SETDIRECTION + if (Qflag != -1) { + status = pcap_setdirection(pd, Qflag); + if (status != 0) + error("%s: pcap_setdirection() failed: %s", + device, pcap_geterr(pd)); + } +#endif /* HAVE_PCAP_SETDIRECTION */ #else *ebuf = '\0'; pd = pcap_open_live(device, snaplen, !pflag, 1000, ebuf); @@ -1343,22 +1452,23 @@ main(int argc, char **argv) (void)fflush(stderr); } i = pcap_snapshot(pd); - if (snaplen < i) { - warning("snaplen raised from %d to %d", snaplen, i); - snaplen = i; - } - if (pcap_lookupnet(device, &localnet, &netmask, ebuf) < 0) { - localnet = 0; - netmask = 0; - warning("%s", ebuf); + if (gndo->ndo_snaplen < i) { + warning("snaplen raised from %d to %d", gndo->ndo_snaplen, i); + gndo->ndo_snaplen = i; } + if(gndo->ndo_fflag != 0) { + if (pcap_lookupnet(device, &localnet, &netmask, ebuf) < 0) { + warning("foreign (-f) flag used but: %s", ebuf); + } + } + } if (infile) cmdbuf = read_infile(infile); else cmdbuf = copy_argv(&argv[optind]); - if (pcap_compile(pd, &fcode, cmdbuf, Oflag, netmask) < 0) + if (pcap_compile(pd, &fcode, cmdbuf, gndo->ndo_Oflag, netmask) < 0) error("%s", pcap_geterr(pd)); if (dflag) { bpf_dump(&fcode, dflag); @@ -1366,10 +1476,9 @@ main(int argc, char **argv) free(cmdbuf); exit(0); } - init_addrtoname(localnet, netmask); - init_checksum(); + init_print(localnet, netmask, timezone_offset); -#ifndef WIN32 +#ifndef WIN32 (void)setsignal(SIGPIPE, cleanup); (void)setsignal(SIGTERM, cleanup); (void)setsignal(SIGINT, cleanup); @@ -1378,7 +1487,7 @@ main(int argc, char **argv) (void)setsignal(SIGCHLD, child_cleanup); #endif /* Cooperate with nohup(1) */ -#ifndef WIN32 +#ifndef WIN32 if ((oldhandler = setsignal(SIGHUP, cleanup)) != SIG_DFL) (void)setsignal(SIGHUP, oldhandler); #endif /* WIN32 */ @@ -1402,27 +1511,28 @@ main(int argc, char **argv) * savefile doesn't handle the general case. */ -#ifdef HAVE_CAP_NG_H - /* We are running as root and we will be writing to savefile */ - if ((getuid() == 0 || geteuid() == 0) && WFileName) { + if (getuid() == 0 || geteuid() == 0) { +#ifdef HAVE_LIBCAP_NG + /* Initialize capng */ + capng_clear(CAPNG_SELECT_BOTH); if (username) { - /* Drop all capabilities from effective set */ - capng_clear(CAPNG_EFFECTIVE); - /* Add capabilities we will need*/ - capng_update(CAPNG_ADD, CAPNG_PERMITTED, CAP_SETUID); - capng_update(CAPNG_ADD, CAPNG_PERMITTED, CAP_SETGID); - capng_update(CAPNG_ADD, CAPNG_PERMITTED, CAP_DAC_OVERRIDE); - - capng_update(CAPNG_ADD, CAPNG_EFFECTIVE, CAP_SETUID); - capng_update(CAPNG_ADD, CAPNG_EFFECTIVE, CAP_SETGID); - capng_update(CAPNG_ADD, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE); - - capng_apply(CAPNG_SELECT_BOTH); + capng_updatev( + CAPNG_ADD, + CAPNG_PERMITTED | CAPNG_EFFECTIVE, + CAP_SETUID, + CAP_SETGID, + -1); } - } -#endif /* HAVE_CAP_NG_H */ - if (getuid() == 0 || geteuid() == 0) { + if (WFileName) { + capng_update( + CAPNG_ADD, + CAPNG_PERMITTED | CAPNG_EFFECTIVE, + CAP_DAC_OVERRIDE + ); + } + capng_apply(CAPNG_SELECT_BOTH); +#endif /* HAVE_LIBCAP_NG */ if (username || chroot_dir) droproot(username, chroot_dir); @@ -1431,6 +1541,21 @@ main(int argc, char **argv) if (pcap_setfilter(pd, &fcode) < 0) error("%s", pcap_geterr(pd)); +#ifdef HAVE_CAPSICUM + if (RFileName == NULL && VFileName == NULL) { + static const unsigned long cmds[] = { BIOCGSTATS }; + + cap_rights_init(&rights, CAP_IOCTL, CAP_READ); + if (cap_rights_limit(pcap_fileno(pd), &rights) < 0 && + errno != ENOSYS) { + error("unable to limit pcap descriptor"); + } + if (cap_ioctls_limit(pcap_fileno(pd), cmds, + sizeof(cmds) / sizeof(cmds[0])) < 0 && errno != ENOSYS) { + error("unable to limit ioctls on pcap descriptor"); + } + } +#endif if (WFileName) { pcap_dumper_t *p; /* Do not exceed the default PATH_MAX for files. */ @@ -1440,21 +1565,53 @@ main(int argc, char **argv) error("malloc of dumpinfo.CurrentFileName"); /* We do not need numbering for dumpfiles if Cflag isn't set. */ - if (Cflag != 0) - MakeFilename(dumpinfo.CurrentFileName, WFileName, 0, WflagChars); + if (gndo->ndo_Cflag != 0) + MakeFilename(dumpinfo.CurrentFileName, WFileName, 0, gndo->ndo_WflagChars); else MakeFilename(dumpinfo.CurrentFileName, WFileName, 0, 0); p = pcap_dump_open(pd, dumpinfo.CurrentFileName); -#ifdef HAVE_CAP_NG_H - /* Give up capabilities, clear Effective set */ - capng_clear(CAPNG_EFFECTIVE); -#endif +#ifdef HAVE_LIBCAP_NG + /* Give up CAP_DAC_OVERRIDE capability. + * Only allow it to be restored if the -C or -G flag have been + * set since we may need to create more files later on. + */ + capng_update( + CAPNG_DROP, + (gndo->ndo_Cflag || gndo->ndo_Gflag ? 0 : CAPNG_PERMITTED) + | CAPNG_EFFECTIVE, + CAP_DAC_OVERRIDE + ); + capng_apply(CAPNG_SELECT_BOTH); +#endif /* HAVE_LIBCAP_NG */ if (p == NULL) error("%s", pcap_geterr(pd)); - if (Cflag != 0 || Gflag != 0) { - callback = dump_packet_and_trunc; +#ifdef HAVE_CAPSICUM + set_dumper_capsicum_rights(p); +#endif + if (gndo->ndo_Cflag != 0 || gndo->ndo_Gflag != 0) { +#ifdef HAVE_CAPSICUM + dumpinfo.WFileName = strdup(basename(WFileName)); + dumpinfo.dirfd = open(dirname(WFileName), + O_DIRECTORY | O_RDONLY); + if (dumpinfo.dirfd < 0) { + error("unable to open directory %s", + dirname(WFileName)); + } + cap_rights_init(&rights, CAP_CREATE, CAP_FCNTL, + CAP_FTRUNCATE, CAP_LOOKUP, CAP_SEEK, CAP_WRITE); + if (cap_rights_limit(dumpinfo.dirfd, &rights) < 0 && + errno != ENOSYS) { + error("unable to limit directory rights"); + } + if (cap_fcntls_limit(dumpinfo.dirfd, CAP_FCNTL_GETFL) < 0 && + errno != ENOSYS) { + error("unable to limit dump descriptor fcntls"); + } +#else /* !HAVE_CAPSICUM */ dumpinfo.WFileName = WFileName; +#endif + callback = dump_packet_and_trunc; dumpinfo.pd = pd; dumpinfo.p = p; pcap_userdata = (u_char *)&dumpinfo; @@ -1463,7 +1620,7 @@ main(int argc, char **argv) pcap_userdata = (u_char *)p; } #ifdef HAVE_PCAP_DUMP_FLUSH - if (Uflag) + if (gndo->ndo_Uflag) pcap_dump_flush(p); #endif } else { @@ -1482,7 +1639,7 @@ main(int argc, char **argv) (void)setsignal(SIGNAL_REQ_INFO, requestinfo); #endif - if (vflag > 0 && WFileName) { + if (gndo->ndo_vflag > 0 && WFileName) { /* * When capturing to a file, "-v" means tcpdump should, * every 10 secodns, "v"erbosely report the number of @@ -1505,7 +1662,7 @@ main(int argc, char **argv) * to a file from the -V file). Print a message to * the standard error on UN*X. */ - if (!vflag && !WFileName) { + if (!gndo->ndo_vflag && !WFileName) { (void)fprintf(stderr, "%s: verbose output suppressed, use -v or -vv for full protocol decode\n", program_name); @@ -1515,15 +1672,24 @@ main(int argc, char **argv) dlt_name = pcap_datalink_val_to_name(dlt); if (dlt_name == NULL) { (void)fprintf(stderr, "listening on %s, link-type %u, capture size %u bytes\n", - device, dlt, snaplen); + device, dlt, gndo->ndo_snaplen); } else { (void)fprintf(stderr, "listening on %s, link-type %s (%s), capture size %u bytes\n", device, dlt_name, - pcap_datalink_val_to_description(dlt), snaplen); + pcap_datalink_val_to_description(dlt), gndo->ndo_snaplen); } (void)fflush(stderr); } #endif /* WIN32 */ + +#ifdef HAVE_CAPSICUM + cansandbox = (gndo->ndo_nflag && VFileName == NULL && zflag == NULL); + if (cansandbox && cap_enter() < 0 && errno != ENOSYS) + error("unable to enter the capability mode"); + if (cap_sandboxed()) + fprintf(stderr, "capability mode sandbox enabled\n"); +#endif /* HAVE_CAPSICUM */ + do { status = pcap_loop(pd, cnt, callback, pcap_userdata); if (WFileName == NULL) { @@ -1541,6 +1707,14 @@ main(int argc, char **argv) } (void)fflush(stdout); } + if (status == -2) { + /* + * We got interrupted. If we are reading multiple + * files (via -V) set these so that we stop. + */ + VFileName = NULL; + ret = NULL; + } if (status == -1) { /* * Error. Report it. @@ -1563,6 +1737,13 @@ main(int argc, char **argv) pd = pcap_open_offline(RFileName, ebuf); if (pd == NULL) error("%s", ebuf); +#ifdef HAVE_CAPSICUM + cap_rights_init(&rights, CAP_READ); + if (cap_rights_limit(fileno(pcap_file(pd)), + &rights) < 0 && errno != ENOSYS) { + error("unable to limit pcap descriptor"); + } +#endif new_dlt = pcap_datalink(pd); if (WFileName && new_dlt != dlt) error("%s: new dlt does not match original", RFileName); @@ -1577,7 +1758,7 @@ main(int argc, char **argv) RFileName, dlt_name, pcap_datalink_val_to_description(new_dlt)); } - if (pcap_compile(pd, &fcode, cmdbuf, Oflag, netmask) < 0) + if (pcap_compile(pd, &fcode, cmdbuf, gndo->ndo_Oflag, netmask) < 0) error("%s", pcap_geterr(pd)); if (pcap_setfilter(pd, &fcode) < 0) error("%s", pcap_geterr(pd)); @@ -1746,7 +1927,7 @@ dump_packet_and_trunc(u_char *user, const struct pcap_pkthdr *h, const u_char *s * first thereby cancelling the Cflag boundary (since the file should * be 0). */ - if (Gflag != 0) { + if (gndo->ndo_Gflag != 0) { /* Check if it is time to rotate */ time_t t; @@ -1758,11 +1939,16 @@ dump_packet_and_trunc(u_char *user, const struct pcap_pkthdr *h, const u_char *s /* If the time is greater than the specified window, rotate */ - if (t - Gflag_time >= Gflag) { + if (t - gndo->ndo_Gflag_time >= gndo->ndo_Gflag) { +#ifdef HAVE_CAPSICUM + FILE *fp; + int fd; +#endif + /* Update the Gflag_time */ - Gflag_time = t; + gndo->ndo_Gflag_time = t; /* Update Gflag_count */ - Gflag_count++; + gndo->ndo_Gflag_count++; /* * Close the current file and open a new one. */ @@ -1778,9 +1964,9 @@ dump_packet_and_trunc(u_char *user, const struct pcap_pkthdr *h, const u_char *s * Check to see if we've exceeded the Wflag (when * not using Cflag). */ - if (Cflag == 0 && Wflag > 0 && Gflag_count >= Wflag) { + if (gndo->ndo_Cflag == 0 && gndo->ndo_Wflag > 0 && gndo->ndo_Gflag_count >= gndo->ndo_Wflag) { (void)fprintf(stderr, "Maximum file limit reached: %d\n", - Wflag); + gndo->ndo_Wflag); exit(0); /* NOTREACHED */ } @@ -1790,28 +1976,54 @@ dump_packet_and_trunc(u_char *user, const struct pcap_pkthdr *h, const u_char *s dump_info->CurrentFileName = (char *)malloc(PATH_MAX + 1); if (dump_info->CurrentFileName == NULL) error("dump_packet_and_trunc: malloc"); + /* + * Gflag was set otherwise we wouldn't be here. Reset the count + * so multiple files would end with 1,2,3 in the filename. + * The counting is handled with the -C flow after this. + */ + gndo->ndo_Cflag_count = 0; + /* * This is always the first file in the Cflag * rotation: e.g. 0 * We also don't need numbering if Cflag is not set. */ - if (Cflag != 0) + if (gndo->ndo_Cflag != 0) MakeFilename(dump_info->CurrentFileName, dump_info->WFileName, 0, - WflagChars); + gndo->ndo_WflagChars); else MakeFilename(dump_info->CurrentFileName, dump_info->WFileName, 0, 0); -#ifdef HAVE_CAP_NG_H +#ifdef HAVE_LIBCAP_NG capng_update(CAPNG_ADD, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE); - capng_apply(CAPNG_EFFECTIVE); -#endif /* HAVE_CAP_NG_H */ + capng_apply(CAPNG_SELECT_BOTH); +#endif /* HAVE_LIBCAP_NG */ +#ifdef HAVE_CAPSICUM + fd = openat(dump_info->dirfd, + dump_info->CurrentFileName, + O_CREAT | O_WRONLY | O_TRUNC, 0644); + if (fd < 0) { + error("unable to open file %s", + dump_info->CurrentFileName); + } + fp = fdopen(fd, "w"); + if (fp == NULL) { + error("unable to fdopen file %s", + dump_info->CurrentFileName); + } + dump_info->p = pcap_dump_fopen(dump_info->pd, fp); +#else /* !HAVE_CAPSICUM */ dump_info->p = pcap_dump_open(dump_info->pd, dump_info->CurrentFileName); -#ifdef HAVE_CAP_NG_H +#endif +#ifdef HAVE_LIBCAP_NG capng_update(CAPNG_DROP, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE); - capng_apply(CAPNG_EFFECTIVE); -#endif /* HAVE_CAP_NG_H */ + capng_apply(CAPNG_SELECT_BOTH); +#endif /* HAVE_LIBCAP_NG */ if (dump_info->p == NULL) error("%s", pcap_geterr(pd)); +#ifdef HAVE_CAPSICUM + set_dumper_capsicum_rights(dump_info->p); +#endif } } @@ -1820,37 +2032,75 @@ dump_packet_and_trunc(u_char *user, const struct pcap_pkthdr *h, const u_char *s * larger than Cflag - the last packet written to the * file could put it over Cflag. */ - if (Cflag != 0 && pcap_dump_ftell(dump_info->p) > Cflag) { - /* - * Close the current file and open a new one. - */ - pcap_dump_close(dump_info->p); + if (gndo->ndo_Cflag != 0) { + long size = pcap_dump_ftell(dump_info->p); - /* - * Compress the file we just closed, if the user asked for it - */ - if (zflag != NULL) - compress_savefile(dump_info->CurrentFileName); + if (size == -1) + error("ftell fails on output file"); + if (size > gndo->ndo_Cflag) { +#ifdef HAVE_CAPSICUM + FILE *fp; + int fd; +#endif + + /* + * Close the current file and open a new one. + */ + pcap_dump_close(dump_info->p); + + /* + * Compress the file we just closed, if the user + * asked for it. + */ + if (zflag != NULL) + compress_savefile(dump_info->CurrentFileName); - Cflag_count++; - if (Wflag > 0) { - if (Cflag_count >= Wflag) - Cflag_count = 0; + gndo->ndo_Cflag_count++; + if (gndo->ndo_Wflag > 0) { + if (gndo->ndo_Cflag_count >= gndo->ndo_Wflag) + gndo->ndo_Cflag_count = 0; + } + if (dump_info->CurrentFileName != NULL) + free(dump_info->CurrentFileName); + dump_info->CurrentFileName = (char *)malloc(PATH_MAX + 1); + if (dump_info->CurrentFileName == NULL) + error("dump_packet_and_trunc: malloc"); + MakeFilename(dump_info->CurrentFileName, dump_info->WFileName, gndo->ndo_Cflag_count, gndo->ndo_WflagChars); +#ifdef HAVE_LIBCAP_NG + capng_update(CAPNG_ADD, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE); + capng_apply(CAPNG_SELECT_BOTH); +#endif /* HAVE_LIBCAP_NG */ +#ifdef HAVE_CAPSICUM + fd = openat(dump_info->dirfd, dump_info->CurrentFileName, + O_CREAT | O_WRONLY | O_TRUNC, 0644); + if (fd < 0) { + error("unable to open file %s", + dump_info->CurrentFileName); + } + fp = fdopen(fd, "w"); + if (fp == NULL) { + error("unable to fdopen file %s", + dump_info->CurrentFileName); + } + dump_info->p = pcap_dump_fopen(dump_info->pd, fp); +#else /* !HAVE_CAPSICUM */ + dump_info->p = pcap_dump_open(dump_info->pd, dump_info->CurrentFileName); +#endif +#ifdef HAVE_LIBCAP_NG + capng_update(CAPNG_DROP, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE); + capng_apply(CAPNG_SELECT_BOTH); +#endif /* HAVE_LIBCAP_NG */ + if (dump_info->p == NULL) + error("%s", pcap_geterr(pd)); +#ifdef HAVE_CAPSICUM + set_dumper_capsicum_rights(dump_info->p); +#endif } - if (dump_info->CurrentFileName != NULL) - free(dump_info->CurrentFileName); - dump_info->CurrentFileName = (char *)malloc(PATH_MAX + 1); - if (dump_info->CurrentFileName == NULL) - error("dump_packet_and_trunc: malloc"); - MakeFilename(dump_info->CurrentFileName, dump_info->WFileName, Cflag_count, WflagChars); - dump_info->p = pcap_dump_open(dump_info->pd, dump_info->CurrentFileName); - if (dump_info->p == NULL) - error("%s", pcap_geterr(pd)); } pcap_dump((u_char *)dump_info->p, h, sp); #ifdef HAVE_PCAP_DUMP_FLUSH - if (Uflag) + if (gndo->ndo_Uflag) pcap_dump_flush(dump_info->p); #endif @@ -1868,7 +2118,7 @@ dump_packet(u_char *user, const struct pcap_pkthdr *h, const u_char *sp) pcap_dump(user, h, sp); #ifdef HAVE_PCAP_DUMP_FLUSH - if (Uflag) + if (gndo->ndo_Uflag) pcap_dump_flush((pcap_dumper_t *)user); #endif @@ -1881,87 +2131,14 @@ static void print_packet(u_char *user, const struct pcap_pkthdr *h, const u_char *sp) { struct print_info *print_info; - u_int hdrlen; ++packets_captured; ++infodelay; - ts_print(&h->ts); print_info = (struct print_info *)user; - /* - * Some printers want to check that they're not walking off the - * end of the packet. - * Rather than pass it all the way down, we set this global. - */ - snapend = sp + h->caplen; - - if(print_info->ndo_type) { - hdrlen = (*print_info->p.ndo_printer)(print_info->ndo, h, sp); - } else { - hdrlen = (*print_info->p.printer)(h, sp); - } - - if (Xflag) { - /* - * Print the raw packet data in hex and ASCII. - */ - if (Xflag > 1) { - /* - * Include the link-layer header. - */ - hex_and_ascii_print("\n\t", sp, h->caplen); - } else { - /* - * Don't include the link-layer header - and if - * we have nothing past the link-layer header, - * print nothing. - */ - if (h->caplen > hdrlen) - hex_and_ascii_print("\n\t", sp + hdrlen, - h->caplen - hdrlen); - } - } else if (xflag) { - /* - * Print the raw packet data in hex. - */ - if (xflag > 1) { - /* - * Include the link-layer header. - */ - hex_print("\n\t", sp, h->caplen); - } else { - /* - * Don't include the link-layer header - and if - * we have nothing past the link-layer header, - * print nothing. - */ - if (h->caplen > hdrlen) - hex_print("\n\t", sp + hdrlen, - h->caplen - hdrlen); - } - } else if (Aflag) { - /* - * Print the raw packet data in ASCII. - */ - if (Aflag > 1) { - /* - * Include the link-layer header. - */ - ascii_print(sp, h->caplen); - } else { - /* - * Don't include the link-layer header - and if - * we have nothing past the link-layer header, - * print nothing. - */ - if (h->caplen > hdrlen) - ascii_print(sp + hdrlen, h->caplen - hdrlen); - } - } - - putchar('\n'); + pretty_print_packet(print_info, h, sp, packets_captured); --infodelay; if (infoprint) @@ -1987,29 +2164,14 @@ print_packet(u_char *user, const struct pcap_pkthdr *h, const u_char *sp) * version number of the Packet.dll code, to supply the * "Wpcap_version" information on Windows. */ - char WDversion[]="current-cvs.tcpdump.org"; + char WDversion[]="current-git.tcpdump.org"; #if !defined(HAVE_GENERATED_VERSION) - char version[]="current-cvs.tcpdump.org"; + char version[]="current-git.tcpdump.org"; #endif - char pcap_version[]="current-cvs.tcpdump.org"; + char pcap_version[]="current-git.tcpdump.org"; char Wpcap_version[]="3.1"; #endif -/* - * By default, print the specified data out in hex and ASCII. - */ -static void -ndo_default_print(netdissect_options *ndo _U_, const u_char *bp, u_int length) -{ - hex_and_ascii_print("\n\t", bp, length); /* pass on lf and identation string */ -} - -void -default_print(const u_char *bp, u_int length) -{ - ndo_default_print(gndo, bp, length); -} - #ifdef SIGNAL_REQ_INFO RETSIGTYPE requestinfo(int signo _U_) { @@ -2043,8 +2205,9 @@ static void verbose_stats_dump(int sig _U_) } #endif +USES_APPLE_DEPRECATED_API static void -usage(void) +print_version(void) { extern char version[]; #ifndef HAVE_PCAP_LIB_VERSION @@ -2071,55 +2234,50 @@ usage(void) (void)fprintf(stderr, "libpcap version %s\n", pcap_version); #endif /* WIN32 */ #endif /* HAVE_PCAP_LIB_VERSION */ + +#if defined(HAVE_LIBCRYPTO) && defined(SSLEAY_VERSION) + (void)fprintf (stderr, "%s\n", SSLeay_version(SSLEAY_VERSION)); +#endif + +#ifdef USE_LIBSMI + (void)fprintf (stderr, "SMI-library: %s\n", smi_version_string); +#endif +} +USES_APPLE_RST + +static void +print_usage(void) +{ + print_version(); (void)fprintf(stderr, -"Usage: %s [-aAbd" D_FLAG "efhH" I_FLAG J_FLAG "KlLnNOpqRStu" U_FLAG "vxX]" B_FLAG_USAGE " [ -c count ]\n", program_name); +"Usage: %s [-aAbd" D_FLAG "efhH" I_FLAG J_FLAG "KlLnNOpqRStu" U_FLAG "vxX#]" B_FLAG_USAGE " [ -c count ]\n", program_name); (void)fprintf(stderr, "\t\t[ -C file_size ] [ -E algo:secret ] [ -F file ] [ -G seconds ]\n"); (void)fprintf(stderr, -"\t\t[ -i interface ]" j_FLAG_USAGE " [ -M secret ]\n"); +"\t\t[ -i interface ]" j_FLAG_USAGE " [ -M secret ] [ --number ]\n"); +#ifdef HAVE_PCAP_SETDIRECTION (void)fprintf(stderr, -"\t\t[ -r file ] [ -s snaplen ] [ -T type ] [ -V file ] [ -w file ]\n"); +"\t\t[ -Q in|out|inout ]\n"); +#endif (void)fprintf(stderr, -"\t\t[ -W filecount ] [ -y datalinktype ] [ -z command ]\n"); +"\t\t[ -r file ] [ -s snaplen ] "); +#ifdef HAVE_PCAP_SET_TSTAMP_PRECISION + (void)fprintf(stderr, "[ --time-stamp-precision precision ]\n"); + (void)fprintf(stderr, +"\t\t"); +#endif +#ifdef HAVE_PCAP_SET_IMMEDIATE_MODE + (void)fprintf(stderr, "[ --immediate-mode ] "); +#endif + (void)fprintf(stderr, "[ -T type ] [ --version ] [ -V file ]\n"); + (void)fprintf(stderr, +"\t\t[ -w file ] [ -W filecount ] [ -y datalinktype ] [ -z command ]\n"); (void)fprintf(stderr, "\t\t[ -Z user ] [ expression ]\n"); - exit(1); -} - - - -/* VARARGS */ -static void -ndo_error(netdissect_options *ndo _U_, const char *fmt, ...) -{ - va_list ap; - - (void)fprintf(stderr, "%s: ", program_name); - va_start(ap, fmt); - (void)vfprintf(stderr, fmt, ap); - va_end(ap); - if (*fmt) { - fmt += strlen(fmt); - if (fmt[-1] != '\n') - (void)fputc('\n', stderr); - } - exit(1); - /* NOTREACHED */ -} - -/* VARARGS */ -static void -ndo_warning(netdissect_options *ndo _U_, const char *fmt, ...) -{ - va_list ap; - - (void)fprintf(stderr, "%s: WARNING: ", program_name); - va_start(ap, fmt); - (void)vfprintf(stderr, fmt, ap); - va_end(ap); - if (*fmt) { - fmt += strlen(fmt); - if (fmt[-1] != '\n') - (void)fputc('\n', stderr); - } } +/* + * Local Variables: + * c-style: whitesmith + * c-basic-offset: 8 + * End: + */