@@ -2993,6 +2993,58 @@ compress_savefile(const char *filename)
29932993}
29942994#endif /* HAVE_FORK && HAVE_VFORK */
29952995
2996+ static void
2997+ close_old_dump_file (struct dump_info * dump_info )
2998+ {
2999+ /*
3000+ * Close the current file and open a new one.
3001+ */
3002+ pcap_dump_close (dump_info -> pdd );
3003+
3004+ /*
3005+ * Compress the file we just closed, if the user asked for it.
3006+ */
3007+ if (zflag != NULL )
3008+ compress_savefile (dump_info -> CurrentFileName );
3009+ }
3010+
3011+ static void
3012+ open_new_dump_file (struct dump_info * dump_info )
3013+ {
3014+ #ifdef HAVE_CAPSICUM
3015+ FILE * fp ;
3016+ int fd ;
3017+ #endif
3018+
3019+ #ifdef HAVE_LIBCAP_NG
3020+ capng_update (CAPNG_ADD , CAPNG_EFFECTIVE , CAP_DAC_OVERRIDE );
3021+ capng_apply (CAPNG_SELECT_BOTH );
3022+ #endif /* HAVE_LIBCAP_NG */
3023+ #ifdef HAVE_CAPSICUM
3024+ fd = openat (dump_info -> dirfd , dump_info -> CurrentFileName ,
3025+ O_CREAT | O_WRONLY | O_TRUNC , 0644 );
3026+ if (fd < 0 ) {
3027+ error ("unable to open file %s" , dump_info -> CurrentFileName );
3028+ }
3029+ fp = fdopen (fd , "w" );
3030+ if (fp == NULL ) {
3031+ error ("unable to fdopen file %s" , dump_info -> CurrentFileName );
3032+ }
3033+ dump_info -> pdd = pcap_dump_fopen (dump_info -> pd , fp );
3034+ #else /* !HAVE_CAPSICUM */
3035+ dump_info -> pdd = pcap_dump_open (dump_info -> pd , dump_info -> CurrentFileName );
3036+ #endif
3037+ #ifdef HAVE_LIBCAP_NG
3038+ capng_update (CAPNG_DROP , CAPNG_EFFECTIVE , CAP_DAC_OVERRIDE );
3039+ capng_apply (CAPNG_SELECT_BOTH );
3040+ #endif /* HAVE_LIBCAP_NG */
3041+ if (dump_info -> pdd == NULL )
3042+ error ("%s" , pcap_geterr (pd ));
3043+ #ifdef HAVE_CAPSICUM
3044+ set_dumper_capsicum_rights (dump_info -> pdd );
3045+ #endif
3046+ }
3047+
29963048static void
29973049dump_packet_and_trunc (u_char * user , const struct pcap_pkthdr * h , const u_char * sp )
29983050{
@@ -3025,25 +3077,12 @@ dump_packet_and_trunc(u_char *user, const struct pcap_pkthdr *h, const u_char *s
30253077
30263078 /* If the time is greater than the specified window, rotate */
30273079 if (t - Gflag_time >= Gflag ) {
3028- #ifdef HAVE_CAPSICUM
3029- FILE * fp ;
3030- int fd ;
3031- #endif
3032-
30333080 /* Update the Gflag_time */
30343081 Gflag_time = t ;
30353082 /* Update Gflag_count */
30363083 Gflag_count ++ ;
3037- /*
3038- * Close the current file and open a new one.
3039- */
3040- pcap_dump_close (dump_info -> pdd );
30413084
3042- /*
3043- * Compress the file we just closed, if the user asked for it
3044- */
3045- if (zflag != NULL )
3046- compress_savefile (dump_info -> CurrentFileName );
3085+ close_old_dump_file (dump_info );
30473086
30483087 /*
30493088 * Check to see if we've exceeded the Wflag (when
@@ -3080,36 +3119,7 @@ dump_packet_and_trunc(u_char *user, const struct pcap_pkthdr *h, const u_char *s
30803119 else
30813120 MakeFilename (dump_info -> CurrentFileName , dump_info -> WFileName , 0 , 0 );
30823121
3083- #ifdef HAVE_LIBCAP_NG
3084- capng_update (CAPNG_ADD , CAPNG_EFFECTIVE , CAP_DAC_OVERRIDE );
3085- capng_apply (CAPNG_SELECT_BOTH );
3086- #endif /* HAVE_LIBCAP_NG */
3087- #ifdef HAVE_CAPSICUM
3088- fd = openat (dump_info -> dirfd ,
3089- dump_info -> CurrentFileName ,
3090- O_CREAT | O_WRONLY | O_TRUNC , 0644 );
3091- if (fd < 0 ) {
3092- error ("unable to open file %s" ,
3093- dump_info -> CurrentFileName );
3094- }
3095- fp = fdopen (fd , "w" );
3096- if (fp == NULL ) {
3097- error ("unable to fdopen file %s" ,
3098- dump_info -> CurrentFileName );
3099- }
3100- dump_info -> pdd = pcap_dump_fopen (dump_info -> pd , fp );
3101- #else /* !HAVE_CAPSICUM */
3102- dump_info -> pdd = pcap_dump_open (dump_info -> pd , dump_info -> CurrentFileName );
3103- #endif
3104- #ifdef HAVE_LIBCAP_NG
3105- capng_update (CAPNG_DROP , CAPNG_EFFECTIVE , CAP_DAC_OVERRIDE );
3106- capng_apply (CAPNG_SELECT_BOTH );
3107- #endif /* HAVE_LIBCAP_NG */
3108- if (dump_info -> pdd == NULL )
3109- error ("%s" , pcap_geterr (pd ));
3110- #ifdef HAVE_CAPSICUM
3111- set_dumper_capsicum_rights (dump_info -> pdd );
3112- #endif
3122+ open_new_dump_file (dump_info );
31133123 }
31143124 }
31153125
@@ -3134,22 +3144,7 @@ dump_packet_and_trunc(u_char *user, const struct pcap_pkthdr *h, const u_char *s
31343144 if (size == -1 )
31353145 error ("ftell fails on output file" );
31363146 if (size > Cflag ) {
3137- #ifdef HAVE_CAPSICUM
3138- FILE * fp ;
3139- int fd ;
3140- #endif
3141-
3142- /*
3143- * Close the current file and open a new one.
3144- */
3145- pcap_dump_close (dump_info -> pdd );
3146-
3147- /*
3148- * Compress the file we just closed, if the user
3149- * asked for it.
3150- */
3151- if (zflag != NULL )
3152- compress_savefile (dump_info -> CurrentFileName );
3147+ close_old_dump_file (dump_info );
31533148
31543149 Cflag_count ++ ;
31553150 if (Wflag > 0 ) {
@@ -3162,35 +3157,8 @@ dump_packet_and_trunc(u_char *user, const struct pcap_pkthdr *h, const u_char *s
31623157 if (dump_info -> CurrentFileName == NULL )
31633158 error ("%s: malloc" , __func__ );
31643159 MakeFilename (dump_info -> CurrentFileName , dump_info -> WFileName , Cflag_count , WflagChars );
3165- #ifdef HAVE_LIBCAP_NG
3166- capng_update (CAPNG_ADD , CAPNG_EFFECTIVE , CAP_DAC_OVERRIDE );
3167- capng_apply (CAPNG_SELECT_BOTH );
3168- #endif /* HAVE_LIBCAP_NG */
3169- #ifdef HAVE_CAPSICUM
3170- fd = openat (dump_info -> dirfd , dump_info -> CurrentFileName ,
3171- O_CREAT | O_WRONLY | O_TRUNC , 0644 );
3172- if (fd < 0 ) {
3173- error ("unable to open file %s" ,
3174- dump_info -> CurrentFileName );
3175- }
3176- fp = fdopen (fd , "w" );
3177- if (fp == NULL ) {
3178- error ("unable to fdopen file %s" ,
3179- dump_info -> CurrentFileName );
3180- }
3181- dump_info -> pdd = pcap_dump_fopen (dump_info -> pd , fp );
3182- #else /* !HAVE_CAPSICUM */
3183- dump_info -> pdd = pcap_dump_open (dump_info -> pd , dump_info -> CurrentFileName );
3184- #endif
3185- #ifdef HAVE_LIBCAP_NG
3186- capng_update (CAPNG_DROP , CAPNG_EFFECTIVE , CAP_DAC_OVERRIDE );
3187- capng_apply (CAPNG_SELECT_BOTH );
3188- #endif /* HAVE_LIBCAP_NG */
3189- if (dump_info -> pdd == NULL )
3190- error ("%s" , pcap_geterr (pd ));
3191- #ifdef HAVE_CAPSICUM
3192- set_dumper_capsicum_rights (dump_info -> pdd );
3193- #endif
3160+
3161+ open_new_dump_file (dump_info );
31943162 }
31953163 }
31963164
0 commit comments