Fix a hairy optimizer bug that causes the expression:
'ip and ((icmp and dst host 1.1.1.1 and not host 2.2.2.2) or (host 1.1.1.1 and src host 3.3.3.3))'
to compile incorrectly. Details about to be mailed to LBL.
as DLT_ values are defined with decimal values in "net/bpf.h".
Cast the last argument to "gen_cmp()" to "bpf_int32", not "long", as
it's a "bpf_int32".
#5228, to correctly check for Appletalk for EtherTalk phase II - they
use 802.3 with LLC SNAP packets, rather than D/I/X Ethernet packets.
His patch made "atalk" check for Appletalk ARP as well as other
Appletalk packets; I've instead added a separate "aarp" packet type,
leaving "atalk" checking only for ETHERTYPE_ATALK, so you can check for
ETHERTYPE_ATALK, ETHERTYPE_AARP, or both.
counting any extra jumps required by a flowgraph node (the conditional
jump instructions have an 8-bit offset; if the target is more than 256
instructions away, we generate a nearby "jump always" to the target, and
jump to that instead).
filter, always attach a copy, as "pcap-linux.c" does; that way, after a
program uses "pcap_setfilter()", it can safely use "pcap_freecode()" to
free up the BPF instructions allocated by "pcap_compile()". Also,
always free it up when the "pcap_t" is closed.
Get rid of the "pcap_t *" argument to "pcap_freecode()", as it's not
necessary.
Document "pcap_freecode()", for the benefit of programs that might
repeatedly compile filter programs and attach them, so that they can
free them up after attaching them and avoid leaking memory for them.
interface index of the interface for the packet is the interface index
of the loopback interface and, if it is, check if the packet is an
outgoing packet; if so, ignore it, as we'll also be seeing that packet
as a received packet.
If we don't handle the arphrd type of an interface, and fall back on
cooked mode, report the arphrd type, so we know what type we should
consider supporting (if that type can't be supported well, e.g. if you
don't get any link-layer header, as happens with PPP, we'd be silent).
"pcap_compile()", not just if we return with an error, so that we don't
leak memory by allocating a Flex buffer for the expression to be parsed
but not freeing it.
filter.
It appears that "recvfrom()", in 2.2 and later kernels, doesn't check
whether the starting buffer address plus the byte count goes into an
unmapped region of the address space - it (or code it calls) presumably
only checks the locations into which it's actually copying data - so
there doesn't appear to be, on systems with 2.2 and later kernels, any
need to ensure that the buffer size is at least large as the snapshot
length. We therefore only do so if we're using the old
PF_INET/SOCK_PACKET mechanism; if we're using PF_PACKET, we're on a
2.2 or later kernel, so we don't do it there.
letting you filter based on the VLAN to which a packet belongs, and an
improvement to the printing of VLAN packets (adding an extra space to
separate the VLAN priority and flags from the next stuff printed).
when compiling on Linux, as we extracted from those copies the
definitions and declarations we need in order to dissect packets, and
put them into our own header files in the regular source directory.
"HAVE_NETPACKET_PACKET_H" isn't defined, as we won't define them if it's
not defined.
If the packet buffer size, as computed from the MTU of the interface, is
less than the user's requested snapshot length, set it to the user's
requested snapshot length; otherwise, the "recvfrom()" call will fail,
as the length specified in the call is the user's requested snapshot
length, and the kernel checks whether the buffer is big enough for that
much data and rejects the "recvfrom()" call if it's not.
header without getting a new magic number from us, tell them not to
change the interpretation of any fields in the header without getting a
new magic number from us.
application won't build with any other version of libpcap, which means
that a lot of applications won't use them. In addition,
"pcap_linktype()" needs to return DLT_ values, so that platforms that
build libpcap as a shared library won't break binary compatibility if
they update to this version of libpcap.
Instead, we map from DLT_ values to LINKTYPE_ values when writing
savefiles, and map from LINKTYPE_ values to DLT_ values when reading
savefiles, so that savefiles don't have platform-dependent DLT_ values
in the header as the link type, they have platform-independent LINKTYPE_
values.
This means we don't need to make DLT_ATM_RFC1483, DLT_RAW, etc. have
platform-independent values starting at 100 - only the values in the
savefile header need to be like that.
application won't build with any other version of libpcap, which means
that a lot of applications won't use them. In addition,
"pcap_linktype()" needs to return DLT_ values, so that platforms that
build libpcap as a shared library won't break binary compatibility if
they update to this version of libpcap.
Instead, we map from DLT_ values to LINKTYPE_ values when writing
savefiles, and map from LINKTYPE_ values to DLT_ values when reading
savefiles, so that savefiles don't have platform-dependent DLT_ values
in the header as the link type, they have platform-independent LINKTYPE_
values.
This means we don't need to make DLT_ATM_RFC1483, DLT_RAW, etc. have
platform-independent values starting at 100 - only the values in the
savefile header need to be like that.
the declaration of "utimes()" collides with the declaration that SunOS
5.5.1 and later, at least, *do* have. (5.5.1 doesn't declare
"snprintf()", even though it has "snprintf()", so we declare it here; we
declare some others that don't cause problems.)
"linux-includes/netinet/if_ether.h" to "ethertype.h", and remove
includes of <netinet/if_ether.h> from files that only include it to get
ETHERTYPE_ values defined.
change the directory mode to 755 after making the directory, so that the
directory is publicly readable and searchable even if the user doing the
"make install" has a umask that takes away public read and search
permissions. (I think that's been a problem at least once - somebody
had trouble configuring and building Ethereal, probably because
"/usr/local/include/net" wasn't publicly readable and searchable, and my
suspicion is that somebody did "make install-incl" or "make install" of
libpcap when their umask was 027.)
Fix the check for directory existence done before making
"$(DESTDIR)$(includedir)" and "$(DESTDIR)$(includedir)/net" to check for
the existence of those directories, not for the existence of
"$(DESTDIR)$(libdir)".
names, e.g. "alphaev56", rather than just "alpha", so, in
"AC_LBL_UNALIGNED_ACCESS", we should check for "alpha*", rather than
"alpha", in our test for platforms we *know* shouldn't do unaligned
accesses (Digital^H^H^H^H^H^H^HTru64 UNIX, by default, may just catch
the alignment trap, complain on the console, and then simulate the
unaligned access, but that's slow - and, in one test, didn't appear to
prevent all the faults from unaligned accesses).
FDDI headers to align the payload on a 4-byte boundary; for example,
Linux/Alpha doesn't appear to do so, which causes filter expressions not
to work correctly on FDDI on Linux/Alpha.
The "__alpha" test was really intended to check for DEC
OSF/1^H^H^H^H^H^H^H^H^HDigital UNIX^H^H^H^H^H^H^H^H^H^H^H^H Tru64 UNIX,
so test "__osf__" instead.
on the asbestos suit). As we don't have a bug tracking system or
task manager we need some way to record a list of tasks. I think this
is the easiest way. Discussion on -workers please.
the equivalent PCAP_ENCAP_ codes to the corresponding PCAP_ENCAP_ code
so that the code generator need check only the PCAP_ENCAP_ codes.
Handle PCAP_ENCAP_PPP_HDLC just like PCAP_ENCAP_PPP.
DLT_NULL in OpenBSD's libpcap, and I'm not sure what the right way to
handle it is yet - for now, this lets the OpenBSD folk merge their
DLT_LOOP support in if, as, and when they pick up the next version of
libpcap.
itojun