Bug#573365: dsniff: urlsnarf always shows the current time, even when reading from a pcap file.

[Hilko Bengen]

Package: dsniff
Version: 2.4b1+debian-18
Severity: normal
Tags: patch

Although timestamps are available in pcap files, urlsnarf always uses
the current time for its output. Please apply the included patch that
fixes the behavior.

(The patch should apply cleanly on top of the dpatch stack that is part
of 2.4b1+debian-18.)

Cheers,
-Hilko

-- System Information:
Debian Release: squeeze/sid
  APT prefers unstable
  APT policy: (500, 'unstable')
Architecture: amd64 (x86_64)

Kernel: Linux 2.6.32-3-amd64 (SMP w/2 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages dsniff depends on:
ii  libc6                         2.10.2-6   Embedded GNU C Library: Shared lib
ii  libdb4.6                      4.6.21-16  Berkeley v4.6 Database Libraries [
ii  libnet1                       1.1.4-2    library for the construction and h
ii  libnids1.21                   1.23-1.1   IP defragmentation TCP segment rea
ii  libpcap0.8                    1.0.0-6    system interface for user-level pa
ii  libssl0.9.8                   0.9.8m-2   SSL shared libraries
ii  openssl                       0.9.8m-2   Secure Socket Layer (SSL) binary a

Versions of packages dsniff recommends:
ii  libx11-6                      2:1.3.3-1  X11 client-side library

dsniff suggests no packages.

-- no debconf information

--- urlsnarf.c.orig	2010-03-10 21:40:46.000000000 +0100
+++ urlsnarf.c	2010-03-10 21:43:52.000000000 +0100
@@ -36,6 +36,7 @@
 u_short		Opt_dns = 1;
 int		Opt_invert = 0;
 regex_t	       *pregex = NULL;
+time_t          tt = 0;
 
 static void
 usage(void)
@@ -57,9 +58,12 @@
 {
 	static char tstr[32], sign;
 	struct tm *t, gmt;
-	time_t tt = time(NULL);
 	int days, hours, tz, len;
 	
+	if (!nids_params.filename) {
+		tt = time(NULL);
+	}
+	
 	gmt = *gmtime(&tt);
 	t = localtime(&tt);
 	
@@ -287,14 +291,33 @@
 	
 	nids_register_tcp(sniff_http_client);
 
+	pcap_t *p;
+	char pcap_errbuf[PCAP_ERRBUF_SIZE];
         if (nids_params.pcap_filter != NULL) {
                 if (nids_params.filename == NULL) {
                         warnx("listening on %s [%s]", nids_params.device,
                               nids_params.pcap_filter);
+			p = pcap_open_offline(nids_params.filename, 
+					      pcap_errbuf);
+			if (!p) {
+				fprintf(stderr, "pcap_open_offline(%s): %s\n",
+					nids_params.filename, pcap_errbuf);
+			}
                 }
                 else {
                         warnx("using %s [%s]", nids_params.filename,
                               nids_params.pcap_filter);
+			/* adapted from libnids.c:open_live() */
+			if (strcmp(nids_params.device, "all") == 0)
+				nids_params.device = "any";
+			p = pcap_open_live(nids_params.device, 16384, 
+					   (nids_params.promisc != 0),
+					   0, pcap_errbuf);
+			if (!p) {
+				fprintf(stderr, "pcap_open_live(): %s\n",
+					pcap_errbuf);
+				exit(1);
+			}
                 }
         }
         else {
@@ -312,9 +335,24 @@
 
         nids_register_chksum_ctl(&chksum_ctl, 1);
 
-	nids_run();
-	
-	/* NOTREACHED */
+	struct pcap_pkthdr *h;
+	u_char *d;
+	int rc;
+	while ((rc = pcap_next_ex(p, &h, &d)) == 1) {
+		tt = h->ts.tv_sec;
+		nids_pcap_handler(NULL, h, d);
+	}
+	switch (rc) {
+	case(-2): /* end of pcap file */
+	case(0):  /* timeout on live capture */
+		break;
+	case(-1):
+	default:
+		fprintf(stderr, "rc = %i\n", rc);
+		pcap_perror(p, "pcap_read_ex()");
+		exit(1);
+		break;
+	}
 	
 	exit(0);
 }