X-Git-Url: https://git.tcpdump.org/tcpdump/blobdiff_plain/568927a2bce300035cf25e9cd387986f4a72b10c..6df4852ec38a5f7342f35e8d62918f33ace103f8:/tcpdump.c diff --git a/tcpdump.c b/tcpdump.c index fe9864f5..8ea49251 100644 --- a/tcpdump.c +++ b/tcpdump.c @@ -25,12 +25,6 @@ * Seth Webster */ -#ifndef lint -static const char copyright[] _U_ = - "@(#) Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000\n\ -The Regents of the University of California. All rights reserved.\n"; -#endif - /* * tcpdump - dump traffic on a network * @@ -40,7 +34,7 @@ The Regents of the University of California. All rights reserved.\n"; */ #ifdef HAVE_CONFIG_H -#include "config.h" +#include #endif /* @@ -55,7 +49,17 @@ The Regents of the University of California. All rights reserved.\n"; #endif #endif -#include +#include "netdissect-stdinc.h" + +/* + * This must appear after including netdissect-stdinc.h, so that _U_ is + * defined. + */ +#ifndef lint +static const char copyright[] _U_ = + "@(#) Copyright (c) 1988, 1989, 1990, 1991, 1992, 1993, 1994, 1995, 1996, 1997, 2000\n\ +The Regents of the University of California. All rights reserved.\n"; +#endif #include @@ -138,12 +142,16 @@ The Regents of the University of California. All rights reserved.\n"; #define PATH_MAX 1024 #endif -#ifdef SIGINFO +#if defined(SIGINFO) #define SIGNAL_REQ_INFO SIGINFO -#elif SIGUSR1 +#elif defined(SIGUSR1) #define SIGNAL_REQ_INFO SIGUSR1 #endif +#if defined(HAVE_PCAP_DUMP_FLUSH) && defined(SIGUSR2) +#define SIGNAL_FLUSH_PCAP SIGUSR2 +#endif + static int Bflag; /* buffer size */ #ifdef HAVE_PCAP_DUMP_FTELL64 static int64_t Cflag; /* rotate dump files after this many bytes */ @@ -188,7 +196,9 @@ static int Uflag; /* "unbuffered" output of dump files */ static int Wflag; /* recycle output files after this number of files */ static int WflagChars; static char *zflag = NULL; /* compress each savefile using a specified command (like gzip or bzip2) */ +#ifdef HAVE_PCAP_SET_IMMEDIATE_MODE static int immediate_mode; +#endif static int infodelay; static int infoprint; @@ -223,11 +233,15 @@ static void dump_packet(u_char *, const struct pcap_pkthdr *, const u_char *); static void droproot(const char *, const char *); #ifdef SIGNAL_REQ_INFO -void requestinfo(int); +static void requestinfo(int); +#endif + +#ifdef SIGNAL_FLUSH_PCAP +static void flushpcap(int); #endif #ifdef _WIN32 - static HANDLE timer_handle = INVALID_HANDLE; + static HANDLE timer_handle = INVALID_HANDLE_VALUE; static void CALLBACK verbose_stats_dump(PVOID param, BOOLEAN timer_fired); #else /* _WIN32 */ static void verbose_stats_dump(int sig); @@ -245,11 +259,15 @@ static const struct tok status_flags[] = { { PCAP_IF_RUNNING, "Running" }, #endif { PCAP_IF_LOOPBACK, "Loopback" }, +#ifdef PCAP_IF_WIRELESS + { PCAP_IF_WIRELESS, "Wireless" }, +#endif { 0, NULL } }; #endif static pcap_t *pd; +static pcap_dumper_t *pdd = NULL; static int supports_monitor_mode; @@ -261,7 +279,7 @@ struct dump_info { char *WFileName; char *CurrentFileName; pcap_t *pd; - pcap_dumper_t *p; + pcap_dumper_t *pdd; netdissect_options *ndo; #ifdef HAVE_CAPSICUM int dirfd; @@ -334,7 +352,7 @@ error(const char *fmt, ...) if (fmt[-1] != '\n') (void)fputc('\n', stderr); } - exit_tcpdump(1); + exit_tcpdump(S_ERR_HOST_PROGRAM); /* NOTREACHED */ } @@ -378,7 +396,7 @@ show_tstamp_types_and_exit(pcap_t *pc, const char *device) if (n_tstamp_types == 0) { fprintf(stderr, "Time stamp type cannot be set for %s\n", device); - exit_tcpdump(0); + exit_tcpdump(S_SUCCESS); } fprintf(stderr, "Time stamp types for %s (use option -j to set):\n", device); @@ -392,7 +410,7 @@ show_tstamp_types_and_exit(pcap_t *pc, const char *device) } } pcap_free_tstamp_types(tstamp_types); - exit_tcpdump(0); + exit_tcpdump(S_SUCCESS); } #endif @@ -445,7 +463,7 @@ show_dlts_and_exit(pcap_t *pc, const char *device) #ifdef HAVE_PCAP_FREE_DATALINKS pcap_free_datalinks(dlts); #endif - exit_tcpdump(0); + exit_tcpdump(S_SUCCESS); } #ifdef HAVE_PCAP_FINDALLDEVS @@ -462,12 +480,54 @@ show_devices_and_exit(void) printf("%d.%s", i+1, dev->name); if (dev->description != NULL) printf(" (%s)", dev->description); - if (dev->flags != 0) - printf(" [%s]", bittok2str(status_flags, "none", dev->flags)); + if (dev->flags != 0) { + printf(" ["); + printf("%s", bittok2str(status_flags, "none", dev->flags)); +#ifdef PCAP_IF_WIRELESS + if (dev->flags & PCAP_IF_WIRELESS) { + switch (dev->flags & PCAP_IF_CONNECTION_STATUS) { + + case PCAP_IF_CONNECTION_STATUS_UNKNOWN: + printf(", Association status unknown"); + break; + + case PCAP_IF_CONNECTION_STATUS_CONNECTED: + printf(", Associated"); + break; + + case PCAP_IF_CONNECTION_STATUS_DISCONNECTED: + printf(", Not associated"); + break; + + case PCAP_IF_CONNECTION_STATUS_NOT_APPLICABLE: + break; + } + } else { + switch (dev->flags & PCAP_IF_CONNECTION_STATUS) { + + case PCAP_IF_CONNECTION_STATUS_UNKNOWN: + printf(", Connection status unknown"); + break; + + case PCAP_IF_CONNECTION_STATUS_CONNECTED: + printf(", Connected"); + break; + + case PCAP_IF_CONNECTION_STATUS_DISCONNECTED: + printf(", Disconnected"); + break; + + case PCAP_IF_CONNECTION_STATUS_NOT_APPLICABLE: + break; + } + } +#endif + printf("]"); + } printf("\n"); } pcap_freealldevs(devlist); - exit_tcpdump(0); + exit_tcpdump(S_SUCCESS); } #endif /* HAVE_PCAP_FINDALLDEVS */ @@ -491,7 +551,7 @@ show_remote_devices_and_exit(void) printf("\n"); } pcap_freealldevs(devlist); - exit_tcpdump(0); + exit_tcpdump(S_SUCCESS); } #endif /* HAVE_PCAP_FINDALLDEVS */ @@ -503,22 +563,22 @@ show_remote_devices_and_exit(void) * only use them for the same purposes that the other versions of tcpdump * use them: * - * OS X tcpdump uses -g to force non--v output for IP to be on one + * macOS tcpdump uses -g to force non--v output for IP to be on one * line, making it more "g"repable; * - * OS X tcpdump uses -k to specify that packet comments in pcap-ng files + * macOS tcpdump uses -k to specify that packet comments in pcapng files * should be printed; * * OpenBSD tcpdump uses -o to indicate that OS fingerprinting should be done * for hosts sending TCP SYN packets; * - * OS X tcpdump uses -P to indicate that -w should write pcap-ng rather + * macOS tcpdump uses -P to indicate that -w should write pcapng rather * than pcap files. * - * OS X tcpdump also uses -Q to specify expressions that match packet + * macOS tcpdump also uses -Q to specify expressions that match packet * metadata, including but not limited to the packet direction. * The expression syntax is different from a simple "in|out|inout", - * and those expressions aren't accepted by OS X tcpdump, but the + * and those expressions aren't accepted by macOS tcpdump, but the * equivalents would be "in" = "dir=in", "out" = "dir=out", and * "inout" = "dir=in or dir=out", and the parser could conceivably * special-case "in", "out", and "inout" as expressions for backwards @@ -675,7 +735,7 @@ droproot(const char *username, const char *chroot_dir) if (chroot_dir && !username) { fprintf(stderr, "%s: Chroot without dropping root is insecure\n", program_name); - exit_tcpdump(1); + exit_tcpdump(S_ERR_HOST_PROGRAM); } pw = getpwnam(username); @@ -684,7 +744,7 @@ droproot(const char *username, const char *chroot_dir) if (chroot(chroot_dir) != 0 || chdir ("/") != 0) { fprintf(stderr, "%s: Couldn't chroot/chdir to '%.64s': %s\n", program_name, chroot_dir, pcap_strerror(errno)); - exit_tcpdump(1); + exit_tcpdump(S_ERR_HOST_PROGRAM); } } #ifdef HAVE_LIBCAP_NG @@ -704,7 +764,7 @@ droproot(const char *username, const char *chroot_dir) (unsigned long)pw->pw_uid, (unsigned long)pw->pw_gid, pcap_strerror(errno)); - exit_tcpdump(1); + exit_tcpdump(S_ERR_HOST_PROGRAM); } else { fprintf(stderr, "dropped privs to %s\n", username); @@ -714,7 +774,7 @@ droproot(const char *username, const char *chroot_dir) else { fprintf(stderr, "%s: Couldn't find user '%.32s'\n", program_name, username); - exit_tcpdump(1); + exit_tcpdump(S_ERR_HOST_PROGRAM); } #ifdef HAVE_LIBCAP_NG /* We don't need CAP_SETUID, CAP_SETGID and CAP_SYS_CHROOT any more. */ @@ -775,7 +835,7 @@ MakeFilename(char *buffer, char *orig_name, int cnt, int max_chars) if (cnt == 0 && max_chars == 0) strncpy(buffer, filename, PATH_MAX + 1); else - if (snprintf(buffer, PATH_MAX + 1, "%s%0*d", filename, max_chars, cnt) > PATH_MAX) + if (nd_snprintf(buffer, PATH_MAX + 1, "%s%0*d", filename, max_chars, cnt) > PATH_MAX) /* Report an error if the filename is too large */ error("too many output files or filename is too long (> %d)", PATH_MAX); free(filename); @@ -929,10 +989,10 @@ set_dumper_capsicum_rights(pcap_dumper_t *p) * Copy arg vector into a new buffer, concatenating arguments with spaces. */ static char * -copy_argv(register char **argv) +copy_argv(char **argv) { - register char **p; - register u_int len = 0; + char **p; + u_int len = 0; char *buf; char *src, *dst; @@ -972,8 +1032,8 @@ copy_argv(register char **argv) static char * read_infile(char *fname) { - register int i, fd, cc; - register char *cp; + int i, fd, cc; + char *cp; struct stat buf; fd = open(fname, O_RDONLY|O_BINARY); @@ -1008,9 +1068,35 @@ read_infile(char *fname) static long parse_interface_number(const char *device) { + const char *p; long devnum; char *end; + /* + * Search for a colon, terminating any scheme at the beginning + * of the device. + */ + p = strchr(device, ':'); + if (p != NULL) { + /* + * We found it. Is it followed by "//"? + */ + p++; /* skip the : */ + if (strncmp(p, "//", 2) == 0) { + /* + * Yes. Search for the next /, at the end of the + * authority part of the URL. + */ + p += 2; /* skip the // */ + p = strchr(p, '/'); + if (p != NULL) { + /* + * OK, past the / is the path. + */ + device = p + 1; + } + } + } devnum = strtol(device, &end, 10); if (device != end && *end == '\0') { /* @@ -1033,14 +1119,54 @@ parse_interface_number(const char *device) } static char * -find_interface_by_number(long devnum) +find_interface_by_number(const char *url, long devnum) { pcap_if_t *dev, *devlist; long i; char ebuf[PCAP_ERRBUF_SIZE]; char *device; +#ifdef HAVE_PCAP_FINDALLDEVS_EX + const char *endp; + char *host_url; +#endif + int status; - if (pcap_findalldevs(&devlist, ebuf) < 0) +#ifdef HAVE_PCAP_FINDALLDEVS_EX + /* + * Search for a colon, terminating any scheme at the beginning + * of the URL. + */ + endp = strchr(url, ':'); + if (endp != NULL) { + /* + * We found it. Is it followed by "//"? + */ + endp++; /* skip the : */ + if (strncmp(endp, "//", 2) == 0) { + /* + * Yes. Search for the next /, at the end of the + * authority part of the URL. + */ + endp += 2; /* skip the // */ + endp = strchr(endp, '/'); + } else + endp = NULL; + } + if (endp != NULL) { + /* + * OK, everything from device to endp is a URL to hand + * to pcap_findalldevs_ex(). + */ + endp++; /* Include the trailing / in the URL; pcap_findalldevs_ex() requires it */ + host_url = malloc(endp - url + 1); + memcpy(host_url, url, endp - url); + host_url[endp - url] = '\0'; + status = pcap_findalldevs_ex(host_url, NULL, &devlist, ebuf); + free(host_url); + } else +#endif + status = pcap_findalldevs(&devlist, ebuf); + if (status < 0) error("%s", ebuf); /* * Look for the devnum-th entry in the list of devices (1-based). @@ -1081,18 +1207,19 @@ open_interface(const char *device, netdissect_options *ndo, char *ebuf) * Yes. Open it with pcap_open(). */ *ebuf = '\0'; -fprintf(stderr, "Opening %s\n", device); pc = pcap_open(device, ndo->ndo_snaplen, pflag ? 0 : PCAP_OPENFLAG_PROMISCUOUS, 1000, NULL, ebuf); if (pc == NULL) { /* - * If this failed with "No such device", that means + * If this failed with "No such device" or "The system + * cannot find the device specified", that means * the interface doesn't exist; return NULL, so that * the caller can see whether the device name is * actually an interface index. */ - if (strstr(ebuf, "No such device") != NULL) + if (strstr(ebuf, "No such device") != NULL || + strstr(ebuf, "The system cannot find the device specified") != NULL) return (NULL); error("%s", ebuf); } @@ -1194,7 +1321,7 @@ fprintf(stderr, "Opening %s\n", device); /* * Return an error for our caller to handle. */ - snprintf(ebuf, PCAP_ERRBUF_SIZE, "%s: %s\n(%s)", + nd_snprintf(ebuf, PCAP_ERRBUF_SIZE, "%s: %s\n(%s)", device, pcap_statustostr(status), cp); pcap_close(pc); return (NULL); @@ -1208,7 +1335,7 @@ fprintf(stderr, "Opening %s\n", device); char sysctl[32]; size_t s = sizeof(parent); - snprintf(sysctl, sizeof(sysctl), + nd_snprintf(sysctl, sizeof(sysctl), "net.wlan.%d.%%parent", atoi(device + 4)); sysctlbyname(sysctl, parent, &s, NULL, 0); strlcpy(newdev, device, sizeof(newdev)); @@ -1282,10 +1409,10 @@ fprintf(stderr, "Opening %s\n", device); int main(int argc, char **argv) { - register int cnt, op, i; + int cnt, op, i; bpf_u_int32 localnet = 0, netmask = 0; int timezone_offset = 0; - register char *cp, *infile, *cmdbuf, *device, *RFileName, *VFileName, *WFileName; + char *cp, *infile, *cmdbuf, *device, *RFileName, *VFileName, *WFileName; char *endp; pcap_handler callback; int dlt; @@ -1323,7 +1450,7 @@ main(int argc, char **argv) /* * Initialize the netdissect code. */ - if (nd_init(ebuf, sizeof ebuf) == -1) + if (nd_init(ebuf, sizeof(ebuf)) == -1) error("%s", ebuf); memset(ndo, 0, sizeof(*ndo)); @@ -1342,10 +1469,13 @@ main(int argc, char **argv) else ndo->program_name = program_name = argv[0]; -#ifdef _WIN32 +#if defined(HAVE_PCAP_WSOCKINIT) if (pcap_wsockinit() != 0) error("Attempting to initialize Winsock failed"); -#endif /* _WIN32 */ +#elif defined(HAVE_WSOCKINIT) + if (wsockinit() != 0) + error("Attempting to initialize Winsock failed"); +#endif /* * On platforms where the CPU doesn't support unaligned loads, @@ -1465,7 +1595,7 @@ main(int argc, char **argv) case 'h': print_usage(); - exit_tcpdump(0); + exit_tcpdump(S_SUCCESS); break; case 'H': @@ -1521,7 +1651,7 @@ main(int argc, char **argv) case 'm': if (nd_have_smi_support()) { - if (nd_load_smi_module(optarg, ebuf, sizeof ebuf) == -1) + if (nd_load_smi_module(optarg, ebuf, sizeof(ebuf)) == -1) error("%s", ebuf); } else { (void)fprintf(stderr, "%s: ignoring option `-m %s' ", @@ -1699,7 +1829,7 @@ main(int argc, char **argv) case OPTION_VERSION: print_version(); - exit_tcpdump(0); + exit_tcpdump(S_SUCCESS); break; #ifdef HAVE_PCAP_SET_TSTAMP_PRECISION @@ -1722,7 +1852,7 @@ main(int argc, char **argv) default: print_usage(); - exit_tcpdump(1); + exit_tcpdump(S_ERR_HOST_PROGRAM); /* NOTREACHED */ } @@ -1916,7 +2046,7 @@ main(int argc, char **argv) * find_interface_by_number() exits if it * couldn't be found. */ - device = find_interface_by_number(devnum); + device = find_interface_by_number(device, devnum); pd = open_interface(device, ndo, ebuf); if (pd == NULL) error("%s", ebuf); @@ -1995,7 +2125,7 @@ main(int argc, char **argv) pcap_close(pd); free(cmdbuf); pcap_freecode(&fcode); - exit_tcpdump(0); + exit_tcpdump(S_SUCCESS); } #ifdef HAVE_CASPER @@ -2082,7 +2212,7 @@ DIAG_ON_CLANG(assign-enum) if (pcap_setfilter(pd, &fcode) < 0) error("%s", pcap_geterr(pd)); #ifdef HAVE_CAPSICUM - if (RFileName == NULL && VFileName == NULL) { + if (RFileName == NULL && VFileName == NULL && pcap_fileno(pd) != -1) { static const unsigned long cmds[] = { BIOCGSTATS, BIOCROTZBUF }; /* @@ -2102,7 +2232,6 @@ DIAG_ON_CLANG(assign-enum) } #endif if (WFileName) { - pcap_dumper_t *p; /* Do not exceed the default PATH_MAX for files. */ dumpinfo.CurrentFileName = (char *)malloc(PATH_MAX + 1); @@ -2115,7 +2244,7 @@ DIAG_ON_CLANG(assign-enum) else MakeFilename(dumpinfo.CurrentFileName, WFileName, 0, 0); - p = pcap_dump_open(pd, dumpinfo.CurrentFileName); + pdd = pcap_dump_open(pd, dumpinfo.CurrentFileName); #ifdef HAVE_LIBCAP_NG /* Give up CAP_DAC_OVERRIDE capability. * Only allow it to be restored if the -C or -G flag have been @@ -2129,7 +2258,7 @@ DIAG_ON_CLANG(assign-enum) ); capng_apply(CAPNG_SELECT_BOTH); #endif /* HAVE_LIBCAP_NG */ - if (p == NULL) + if (pdd == NULL) error("%s", pcap_geterr(pd)); #ifdef HAVE_CAPSICUM set_dumper_capsicum_rights(p); @@ -2162,13 +2291,13 @@ DIAG_ON_CLANG(assign-enum) #endif callback = dump_packet_and_trunc; dumpinfo.pd = pd; - dumpinfo.p = p; + dumpinfo.pdd = pdd; pcap_userdata = (u_char *)&dumpinfo; } else { callback = dump_packet; dumpinfo.WFileName = WFileName; dumpinfo.pd = pd; - dumpinfo.p = p; + dumpinfo.pdd = pdd; pcap_userdata = (u_char *)&dumpinfo; } if (print) { @@ -2180,7 +2309,7 @@ DIAG_ON_CLANG(assign-enum) #ifdef HAVE_PCAP_DUMP_FLUSH if (Uflag) - pcap_dump_flush(p); + pcap_dump_flush(pdd); #endif } else { dlt = pcap_datalink(pd); @@ -2197,6 +2326,9 @@ DIAG_ON_CLANG(assign-enum) if (RFileName == NULL) (void)setsignal(SIGNAL_REQ_INFO, requestinfo); #endif +#ifdef SIGNAL_FLUSH_PCAP + (void)setsignal(SIGNAL_FLUSH_PCAP, flushpcap); +#endif if (ndo->ndo_vflag > 0 && WFileName && !print) { /* @@ -2214,7 +2346,7 @@ DIAG_ON_CLANG(assign-enum) * that printing the stats could be a "long wait". */ CreateTimerQueueTimer(&timer_handle, NULL, - verbose_stats_dump, NULL, 1000, 1000 + verbose_stats_dump, NULL, 1000, 1000, WT_EXECUTEDEFAULT|WT_EXECUTELONGFUNCTION); setvbuf(stderr, NULL, _IONBF, 0); #else /* _WIN32 */ @@ -2414,10 +2546,10 @@ static void cleanup(int signo _U_) { #ifdef _WIN32 - if (timer_handle != INVALID_HANDLE) { + if (timer_handle != INVALID_HANDLE_VALUE) { DeleteTimerQueueTimer(NULL, timer_handle, NULL); CloseHandle(timer_handle); - timer_handle = INVALID_HANDLE; + timer_handle = INVALID_HANDLE_VALUE; } #else /* _WIN32 */ struct itimerval timer; @@ -2454,7 +2586,7 @@ cleanup(int signo _U_) (void)fflush(stdout); info(1); } - exit_tcpdump(0); + exit_tcpdump(S_SUCCESS); #endif } @@ -2471,7 +2603,7 @@ child_cleanup(int signo _U_) #endif /* HAVE_FORK && HAVE_VFORK */ static void -info(register int verbose) +info(int verbose) { struct pcap_stat stats; @@ -2554,9 +2686,9 @@ compress_savefile(const char *filename) filename, pcap_strerror(errno)); #ifdef HAVE_FORK - exit(1); + exit(S_ERR_HOST_PROGRAM); #else - _exit(1); + _exit(S_ERR_HOST_PROGRAM); #endif } #else /* HAVE_FORK && HAVE_VFORK */ @@ -2612,7 +2744,7 @@ dump_packet_and_trunc(u_char *user, const struct pcap_pkthdr *h, const u_char *s /* * Close the current file and open a new one. */ - pcap_dump_close(dump_info->p); + pcap_dump_close(dump_info->pdd); /* * Compress the file we just closed, if the user asked for it @@ -2628,7 +2760,7 @@ dump_packet_and_trunc(u_char *user, const struct pcap_pkthdr *h, const u_char *s (void)fprintf(stderr, "Maximum file limit reached: %d\n", Wflag); info(1); - exit_tcpdump(0); + exit_tcpdump(S_SUCCESS); /* NOTREACHED */ } if (dump_info->CurrentFileName != NULL) @@ -2672,18 +2804,18 @@ dump_packet_and_trunc(u_char *user, const struct pcap_pkthdr *h, const u_char *s error("unable to fdopen file %s", dump_info->CurrentFileName); } - dump_info->p = pcap_dump_fopen(dump_info->pd, fp); + dump_info->pdd = pcap_dump_fopen(dump_info->pd, fp); #else /* !HAVE_CAPSICUM */ - dump_info->p = pcap_dump_open(dump_info->pd, dump_info->CurrentFileName); + dump_info->pdd = pcap_dump_open(dump_info->pd, dump_info->CurrentFileName); #endif #ifdef HAVE_LIBCAP_NG capng_update(CAPNG_DROP, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE); capng_apply(CAPNG_SELECT_BOTH); #endif /* HAVE_LIBCAP_NG */ - if (dump_info->p == NULL) + if (dump_info->pdd == NULL) error("%s", pcap_geterr(pd)); #ifdef HAVE_CAPSICUM - set_dumper_capsicum_rights(dump_info->p); + set_dumper_capsicum_rights(dump_info->pdd); #endif } } @@ -2695,7 +2827,7 @@ dump_packet_and_trunc(u_char *user, const struct pcap_pkthdr *h, const u_char *s */ if (Cflag != 0) { #ifdef HAVE_PCAP_DUMP_FTELL64 - int64_t size = pcap_dump_ftell64(dump_info->p); + int64_t size = pcap_dump_ftell64(dump_info->pdd); #else /* * XXX - this only handles a Cflag value > 2^31-1 on @@ -2703,7 +2835,7 @@ dump_packet_and_trunc(u_char *user, const struct pcap_pkthdr *h, const u_char *s * Windows) or LLP64 (64-bit Windows) would require * a version of libpcap with pcap_dump_ftell64(). */ - long size = pcap_dump_ftell(dump_info->p); + long size = pcap_dump_ftell(dump_info->pdd); #endif if (size == -1) @@ -2717,7 +2849,7 @@ dump_packet_and_trunc(u_char *user, const struct pcap_pkthdr *h, const u_char *s /* * Close the current file and open a new one. */ - pcap_dump_close(dump_info->p); + pcap_dump_close(dump_info->pdd); /* * Compress the file we just closed, if the user @@ -2753,26 +2885,26 @@ dump_packet_and_trunc(u_char *user, const struct pcap_pkthdr *h, const u_char *s error("unable to fdopen file %s", dump_info->CurrentFileName); } - dump_info->p = pcap_dump_fopen(dump_info->pd, fp); + dump_info->pdd = pcap_dump_fopen(dump_info->pd, fp); #else /* !HAVE_CAPSICUM */ - dump_info->p = pcap_dump_open(dump_info->pd, dump_info->CurrentFileName); + dump_info->pdd = pcap_dump_open(dump_info->pd, dump_info->CurrentFileName); #endif #ifdef HAVE_LIBCAP_NG capng_update(CAPNG_DROP, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE); capng_apply(CAPNG_SELECT_BOTH); #endif /* HAVE_LIBCAP_NG */ - if (dump_info->p == NULL) + if (dump_info->pdd == NULL) error("%s", pcap_geterr(pd)); #ifdef HAVE_CAPSICUM - set_dumper_capsicum_rights(dump_info->p); + set_dumper_capsicum_rights(dump_info->pdd); #endif } } - pcap_dump((u_char *)dump_info->p, h, sp); + pcap_dump((u_char *)dump_info->pdd, h, sp); #ifdef HAVE_PCAP_DUMP_FLUSH if (Uflag) - pcap_dump_flush(dump_info->p); + pcap_dump_flush(dump_info->pdd); #endif if (dump_info->ndo != NULL) @@ -2794,10 +2926,10 @@ dump_packet(u_char *user, const struct pcap_pkthdr *h, const u_char *sp) dump_info = (struct dump_info *)user; - pcap_dump((u_char *)dump_info->p, h, sp); + pcap_dump((u_char *)dump_info->pdd, h, sp); #ifdef HAVE_PCAP_DUMP_FLUSH if (Uflag) - pcap_dump_flush(dump_info->p); + pcap_dump_flush(dump_info->pdd); #endif if (dump_info->ndo != NULL) @@ -2823,7 +2955,8 @@ print_packet(u_char *user, const struct pcap_pkthdr *h, const u_char *sp) } #ifdef SIGNAL_REQ_INFO -void requestinfo(int signo _U_) +static void +requestinfo(int signo _U_) { if (infodelay) ++infoprint; @@ -2832,6 +2965,15 @@ void requestinfo(int signo _U_) } #endif +#ifdef SIGNAL_FLUSH_PCAP +static void +flushpcap(int signo _U_) +{ + if (pdd != NULL) + pcap_dump_flush(pdd); +} +#endif + static void print_packets_captured (void) { @@ -2926,9 +3068,3 @@ print_usage(void) (void)fprintf(stderr, "\t\t[ -z postrotate-command ] [ -Z user ] [ expression ]\n"); } -/* - * Local Variables: - * c-style: whitesmith - * c-basic-offset: 8 - * End: - */