summaryrefslogtreecommitdiff
path: root/tcpdump.c
Commit message (Collapse)AuthorAgeFilesLines
* Do case-insensitive comparisons assuming ASCII strings.Guy Harris2015-06-111-20/+20
| | | | | | | | Do the case-insensitive comparisons in a locale-independent fashion that only maps ASCII letters, in the standard English-language fashion; that way, we don't get bitten by, for example, Turkish having separate "i with dot" and "i without dot" letters, with lower-case "i with dot" being mapped to upper-case "I with dot" rather than being mapped to "I".
* Merge pull request #455 from brooksdavis/gndo-cleanupGuy Harris2015-05-201-137/+148
|\ | | | | Remove global netdissect_object and remove non-dissection related fields
| * Allocate the netdissect_object on the stack.Brooks Davis2015-04-271-4/+3
| |
| * Rename gndo to ndo now that it isn't global.Brooks Davis2015-04-271-84/+85
| | | | | | | | Allocate ndo on the heap.
| * Pass an ndo to the print API rather than using gndo.Brooks Davis2015-04-271-6/+6
| | | | | | | | Since gndo is only referenced in main() move it there.
| * Remove non-dissection related flags from struct netdissect_options.Brooks Davis2015-04-271-53/+64
| |
* | Remove "capability mode sandbox enabled" message.Brooks Davis2015-05-051-2/+0
|/ | | | | We have removed all instances of these messages in FreeBSD as they serve little purpose and break some comsumers.
* Get rid of unused variable.Guy Harris2015-04-151-1/+0
|
* Disentangle packet dissection functionally in tcpdump from the internalBrooks Davis2015-04-151-410/+8
| | | | | libnetdissect. This greatly narrows the public interface and allows libnetdissect to be more easily sandboxed.
* For -L, print the DLTs in order, not reverse order.Guy Harris2015-03-271-6/+6
| | | | Reverse order puts the default DLT last, which is a bit weird.
* fix compiling after the last changeDenis Ovsienko2015-03-221-2/+2
| | | | Mind the HAVE_CAPSICUM and USE_LIBSMI cases.
* dismiss NETDISSECT_REWORKED macroDenis Ovsienko2015-03-221-103/+103
| | | | | | | The purpose of this macro was to enable the file-by-file switch to NDO, after which only tcpdump.c had a use of it and the definitions guarded by it. Update tcpdump.c not to require them any more and dismiss the unused definitions.
* remove unused function default_print()Denis Ovsienko2015-03-221-6/+0
|
* Get rid of unused variable.Guy Harris2015-03-101-3/+0
|
* Get rid of support for non-NDOified printers.Guy Harris2015-03-101-50/+13
| | | | | | Remove the TTEST{2}/TCHECK{2} macros. Rename all "ndo_printer" routines, structures, and structure members to just "printer", and get rid of the old routines/structures/structure members with those names.
* Clean up Capsicum rights setting a bit.Guy Harris2015-03-091-4/+5
| | | | | | | | Rename set_dump_fd_capsicum_rights() to set_dumper_capsicum_rights() and have it take a pcap_dumper_t * as an argument and extract the file descriptor itself, rather than having the caller do so. This fixes a syntax error in one of the calls.
* Add a #define for the short options and put it above the long options.Guy Harris2015-03-081-1/+12
| | | | | | | That puts all the option lists together; hopefully this encourages developers who want to add a new flag to read the big "don't use these options, other tcpdumps use them for their own purposes" command and thus *dis*courages them from using one of those options.
* Do the dump file Capsicum stuff in a common routine.Guy Harris2015-03-051-23/+72
| | | | | | | | | | We were doing the same stuff in two places and *almost* the same stuff in a third place, which should have been doing the same stuff. Put that stuff into a common routine and just use that. (What a mess. If you pour a bottle of Capsicum on your OS, it seeps all throughout the system; might as well admit it and, at least, extend the standard I/O library to handle it a bit better.)
* Add CAP_FCNTL and use cap_fcntls_limit().Wesley Shields2015-02-181-2/+14
| | | | | | | | | | | | | | Without these changes pcap_dump_ftell() will return -1 and set errno to ENOTCAPABLE. This allows you to do: tcpdump -C 1 -W 5 -w foo.pcap Without these changes it will never rotate to foo.pcap1 and continue writing to foo.pcap0 forever. Discussed at: http://unix.derkeiler.com/Mailing-Lists/FreeBSD/current/2014-09/msg00142.html
* Check for pcap_dump_ftell() failing.Guy Harris2015-02-181-47/+54
| | | | | That way, we don't just keep writing if it fails (which it can when using Capsicum, for example).
* Fix issues with the setting of libcap-ng capabilities.Tommy Beadle2015-02-181-21/+44
| | | | | | | | | | | | | | - Only set the SETUID/SETGID capabilities if required (i.e. we'll be changing the effective UID). - Only set the CAP_DAC_OVERRIDE capability if writing out to a file (i.e. the -w flag was provided). - Fix the calls to capng_clear to pass CAPNG_SELECT_BOTH so that the traditional and bounding capabilities are set. - Only remove CAP_DAC_OVERRIDE from the permitted set after opening the write file if neither -G nor -C flag was provided. We always drop it from the effective set immediately after opening the write file. During file rotation, we reacquire it immediately before and drop it immediately after opening the file.
* configure: add support for cap-ng packageFrancois-Xavier Le Bail2015-02-151-12/+21
| | | | It uses '--with-cap-ng', for using libcap-ng [default=yes, if available]
* Use immediate mode if available.Guy Harris2015-02-101-0/+34
| | | | | | If libpcap has pcap_set_immediate_mode(), then default to immediate mode if we're printing packets to a terminal, and use immediate mode if --immediate-mode is specified.
* droproot(): always print to stderr (GH #425)Denis Ovsienko2015-02-091-2/+2
| | | | Otherwise it interferes with the output of "tcpdump -w -".
* Make sure to init capng before dropping root.Tommy Beadle2015-01-271-20/+18
| | | | | | | | capng_clear needs to be called before capng_change_id can be called within droproot. Otherwise, an (unusable) error message is output: "error : ret -1". This also fixes the dropping of the CAP_SETGID capability. Previously, CAP_SETUID was being dropped twice.
* fix compilation on FreeBSD 10.1Denis Ovsienko2014-12-291-6/+10
| | | | | | | | | | | | | | | | | | | | | | | Commit 05d7191 fixed detection of Capsicum availability and the Capsicum-specific code in tcpdump made it into the compilation process on respective FreeBSD systems. However, it would fail to compile at least on FreeBSD 10.1-RELEASE as quoted below. This commit fixes it. In file included from ./tcpdump.c:89: /usr/include/net/bpf.h:65:8: error: redefinition of 'bpf_program' struct bpf_program { ^ ../libpcap/pcap/bpf.h:106:8: note: previous definition is here struct bpf_program { ^ In file included from ./tcpdump.c:89: /usr/include/net/bpf.h:1206:8: error: redefinition of 'bpf_insn' struct bpf_insn { ^ ../libpcap/pcap/bpf.h:1466:8: note: previous definition is here struct bpf_insn { ^ 2 errors generated.
* Fix some typosFrancois-Xavier Le Bail2014-12-171-1/+1
|
* Undefine HAVE_PCAP_FINDALLDEVS, if appropriate, before it's used.Guy Harris2014-11-051-6/+11
|
* Don't run past the snapshot length when doing hex/ASCII dumps.Guy Harris2014-10-231-1/+7
|
* Clarify what abort_on_misalignment() does.Guy Harris2014-09-031-0/+7
| | | | | | | | It doesn't request byte misalignment repair, it requests that byte misalignment kill the program with SIGBUS; on platforms that don't support aligned loads, we should be fetching possibly-misaligned data using some safe instruction sequence, not by doing misaligned loads and relying on them to trap to the kernel and be (slowly) emulated.
* Clean up configure check for libsmi.Guy Harris2014-08-311-4/+4
| | | | | | | | | | | | | | | | | First, check for smi.h. If we don't have it, don't check for anything else. If we do have it, check for libsmi containing smiInit. If we don't have it, don't check for anything else. If we do have it, check, with our test program, whether we can use it. If that succeeds, prepend -lsmi to LIBS, and set USE_LIBSMI. Otherwise, don't do either of those. Check, in source, *only* for USE_LIBSMI. If it's set, use libsmi, otherwise don't - don't even include smi.h, even if we happened to have found it, and don't print the libsmi version string.
* Merge git://github.com/the-tcpdump-group/tcpdumpGuy Harris2014-07-101-7/+6
|\
| * add a short option '#', same as long option '--number' (print a packet number)Francois-Xavier Le Bail2014-07-101-7/+6
| |
* | Add support for FreeBSD capsicum sandboxing.Loganaden Velvindron2014-07-101-1/+135
|/
* Allow builds if libpcap doesn't have pcap_set_tstamp_precision().Guy Harris2014-06-251-14/+46
| | | | | | Check for pcap_set_tstamp_precision() in the configure script and, if it's not there, don't include the code that allows time stamp precisions to be set.
* Merge pull request #377 from msekletar/masterGuy Harris2014-06-251-1/+32
|\ | | | | timestamps: make possible to request high precision timestamps
| * Introduce --time-stamp-precisionMichal Sekletar2014-05-141-1/+32
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A while ago we introduced new API in libpcap which made possible to request time stamps with higher precision (nanoseconds). This commit aims to move things forward and implement missing bits. It introduces new long option --time-stamp-precision. Note that there is no equivalent short option. When used for a live capture tcpdump will ask the kernel for time stamp with desired precision and tcpdump will print fraction part of the time stamp using respective format. We currently support only microsecond and nanosecond precision. In the future we might support even more granular time stamp precision, but we should be fine to support only microseconds and nanoseconds for now. libpcap doesn't provide anything else at the moment anyway. When used in combination with -r/-w options then we obtain time stamps appropriately scaled up or down from libpcap. Also note that distinct magic number is used for savefiles containing nanosecond time stamps.
* | Make the table of long options const.Guy Harris2014-06-201-1/+1
| |
* | Print priv drop msg here too.Wesley Shields2014-06-151-0/+3
| |
* | Make droproot say something when successful.Wesley Shields2014-06-151-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | I've seen people run into situations where they were using a command like this: tcpdump -i eth0 -G 500 -w /root/%H%M%S.pcap The first file would be created successfully but the second file would not because their version of tcpdump was dropping privs. It was unclear to them that this was going on and was causing confusion. At least with this message in there it should become more evident that privs are being altered and aid in debugging these kinds of problems.
* | tcpdump.c: error message must use stderrFrancois-Xavier Le Bail2014-05-171-1/+1
|/
* Squelch warnings on OS X.Guy Harris2014-05-071-0/+2
|
* also tell OpenSSL and libsmi versionsGisle Vanem2014-05-071-0/+12
|
* Add --version to the usage message.Guy Harris2014-05-061-2/+2
|
* Add a --version option, to print just version information.Guy Harris2014-05-061-12/+28
| | | | | | | Also, use #defines starting at 128 (outside the ASCII range) for long options having no short-option equivalent, and have -h/--help exit with an exit status of 0 (you just asked for usage information, and you got it - no fault, no error).
* Print an optional packet number in the beginning of lineFrancois-Xavier Le Bail2014-05-061-1/+10
| | | | The new option is '--number'.
* Include <errno.h> on both Windows and UN*X.Guy Harris2014-05-041-1/+0
| | | | | | | We need <errno.h> on UN*X in some files that include tcpdump-stdinc.h, such as missing/inet_pton.c. Remove includes of <errno.h> from files that include tcpdump-stdinc.h.
* Add some long options.Guy Harris2014-05-021-69/+63
| | | | | | | | | Currently, they're all aliases for existing short options, but we're out of letters, so we'll be adding some that won't have short options. This means we can't have entries in the options table corresponding to short options with no long options, as an entry in the long options table with a null option name terminates the table.
* Sort options and put in notes for unusable option letters.Guy Harris2014-05-011-2/+20
| | | | | | Sort the options alphabetically, and put in comments for the options we're *currently* not using, to note that other versions of tcpdump use them and that we should only use them for the same purposes.
* Rename our getopt.h to getopt_long.h.Guy Harris2014-05-011-1/+1
| | | | | That way, if we *do* have getopt_long(), we don't end up including our getopt.h rather than the system's getopt.h.
View Lorry Controller Status