Bug#573365: dsniff: urlsnarf always shows the current time, even when reading from a pcap file.

[Hilko Bengen]

* William Vera:

> Hello Hilko!
> I'm trying to apply your patch at the source unsuccessfully
> Can you please confirm if it still valid with the 2.4b1+debian-19.1 version?
> or maybe I'm doing something wrong.

I just tried the patch with version 2.4b1+debian-20. Works for me, the
trick is to apply all the other patches first. This is what I did after
remembering how to fight and beat dpatch:

$ dpatch-edit-patch patch --add2list --description="urlsnarf: use timestamps 
from pcap file if available. Closes: #573365" 23_urlsnarf_timestamp 22_handlepp

In the temporary directory, I just applied my patch that I had posted to
the BTS:

$ patch -p1 urlsnarf.c < ~/src/deb/dsniff/dsniff.patch 
$ exit

I have attached the patch file
(debian/patches/23_urlsnarf_timestamp.dpatch) that was generated. Note
that it also needs to be added to debian/patches/00list.

I hope this helps.

Cheers,
-Hilko

#! /bin/sh /usr/share/dpatch/dpatch-run
## 23_urlsnarf_timestamp.dpatch by Hilko Bengen <ben...@debian.org>
##
## All lines beginning with `## DP:' are a description of the patch.
## DP: urlsnarf: use timestamps from pcap file if available. Closes: #573365

@DPATCH@
diff -urNad '--exclude=CVS' '--exclude=.svn' '--exclude=.git' '--exclude=.arch' '--exclude=.hg' '--exclude=_darcs' '--exclude=.bzr' dsniff-git~/urlsnarf.c dsniff-git/urlsnarf.c
--- dsniff-git~/urlsnarf.c	2011-06-19 18:23:24.000000000 +0200
+++ dsniff-git/urlsnarf.c	2011-06-19 18:23:32.000000000 +0200
@@ -36,6 +36,7 @@
 u_short		Opt_dns = 1;
 int		Opt_invert = 0;
 regex_t	       *pregex = NULL;
+time_t          tt = 0;
 
 static void
 usage(void)
@@ -57,9 +58,12 @@
 {
 	static char tstr[32], sign;
 	struct tm *t, gmt;
-	time_t tt = time(NULL);
 	int days, hours, tz, len;
 	
+	if (!nids_params.filename) {
+		tt = time(NULL);
+	}
+	
 	gmt = *gmtime(&tt);
 	t = localtime(&tt);
 	
@@ -287,14 +291,33 @@
 	
 	nids_register_tcp(sniff_http_client);
 
+	pcap_t *p;
+	char pcap_errbuf[PCAP_ERRBUF_SIZE];
         if (nids_params.pcap_filter != NULL) {
                 if (nids_params.filename == NULL) {
                         warnx("listening on %s [%s]", nids_params.device,
                               nids_params.pcap_filter);
+			p = pcap_open_offline(nids_params.filename, 
+					      pcap_errbuf);
+			if (!p) {
+				fprintf(stderr, "pcap_open_offline(%s): %s\n",
+					nids_params.filename, pcap_errbuf);
+			}
                 }
                 else {
                         warnx("using %s [%s]", nids_params.filename,
                               nids_params.pcap_filter);
+			/* adapted from libnids.c:open_live() */
+			if (strcmp(nids_params.device, "all") == 0)
+				nids_params.device = "any";
+			p = pcap_open_live(nids_params.device, 16384, 
+					   (nids_params.promisc != 0),
+					   0, pcap_errbuf);
+			if (!p) {
+				fprintf(stderr, "pcap_open_live(): %s\n",
+					pcap_errbuf);
+				exit(1);
+			}
                 }
         }
         else {
@@ -312,9 +335,24 @@
 
         nids_register_chksum_ctl(&chksum_ctl, 1);
 
-	nids_run();
-	
-	/* NOTREACHED */
+	struct pcap_pkthdr *h;
+	u_char *d;
+	int rc;
+	while ((rc = pcap_next_ex(p, &h, &d)) == 1) {
+		tt = h->ts.tv_sec;
+		nids_pcap_handler(NULL, h, d);
+	}
+	switch (rc) {
+	case(-2): /* end of pcap file */
+	case(0):  /* timeout on live capture */
+		break;
+	case(-1):
+	default:
+		fprintf(stderr, "rc = %i\n", rc);
+		pcap_perror(p, "pcap_read_ex()");
+		exit(1);
+		break;
+	}
 	
 	exit(0);
 }