dect
/
libpcap
Archived
13
0
Fork 0
Commit Graph

877 Commits

Author SHA1 Message Date
guy 7fb15ab846 Add "pppoed" and "pppoes" keywords, for PPPoE Discovery and Session
packets (based on the Ethernet type).  "pppoes" has the side-effect that
subsequent filter expressions will test the PPP header and headers
in the PPP payload, not the link-layer header and headers in the
link-layer payload.
2005-09-05 09:06:58 +00:00
risso a8302b7a2b Added a missing check on the return value of PacketGetAdapterNames() 2005-09-01 22:14:32 +00:00
guy 3410839c5d Today is Tuesday, not Monday. 2005-08-31 06:51:46 +00:00
guy 0e2413c634 When checking for VLAN packets, check the type field in the Ethernet
header, not the VLAN header.
2005-08-31 06:51:05 +00:00
guy 1e5fb25e2c Add another magic number (we'd have used the Navtel one, except that
nobody from Navtel has ever said whether their format differs from the
standard one anywhere other than the time stamp).
2005-08-29 21:05:05 +00:00
guy e7639013b4 Add some more fixes to the list of changes.
Remove trailing white space.
2005-08-23 03:48:35 +00:00
guy 4b8835513e Propagate updates from x.9 branch. 2005-08-23 03:09:41 +00:00
guy c166082296 From Mike "Dragorn" Kershaw: add support for the new ARPHRD_ value for
802.11 with a radiotap header (used by the madwifi driver, and in the
pipeline to be officially assigned).
2005-08-16 04:18:32 +00:00
guy de054a43c1 From Don Ebright: clean out *uerror in recv_ack() before doing anything,
so that it's not EBUSY if we didn't get an EBUSY in a
DL_ERROR_ACK/DL_SYSERR reply, and our checks for EBUSY only catch that
case.

If we *did* get EBUSY on all the SAPs we tried, supply an error.

Make "dl_dohpuxbind()" always return a value, so we don't fall off the
end and return an error indication by accident.
2005-08-13 23:14:24 +00:00
hannes 9ab067e012 allocate 4 new DLTs on behalf of Juniper Networks, Inc. for
prepending meta-information like interface index, interface name
before a standard Ethernet, PPP, Frame Relay, C-HDLC Frame
2005-08-12 19:23:30 +00:00
guy 88389e4834 Add another test program, based on the test program for
pcap_findalldevs() from Scott Gifford.
2005-08-10 06:19:05 +00:00
guy 8da5ed28e5 We're building with the current version of libpcap, so we know we have
"pcap_lib_version()"; use it.
2005-08-08 17:50:13 +00:00
guy 9415d150b0 Add a test program for the BPF code generator (not built by default, and
not installed; built with the version of libpcap in this directory, not
the installed version).
2005-08-08 17:44:25 +00:00
guy b2b10cab4e The "is_mpls" Boolean isn't necessary - we can just check the MPLS label
stack depth to see whether we're processing MPLS-encapsulated packets or
not.
2005-08-08 07:24:53 +00:00
guy c6b5551a8b When we're processing MPLS-encapsulated packets, don't set off_linktype
to -1, set a "we're doing MPLS" flag, and check that flag rather than
checking for an off_linktype of -1; off_linktype can be -1 for reasons
having nothing to do with MPLS (e.g., a DLT_ of DLT_RAW), and those
should be handled as they have traditionally been.

Rename "gen_null()" to "gen_mpls_linktype()" to make it clearer what it
does (it checks the MPLS stack as well as the IP header).
2005-08-08 02:38:29 +00:00
guy 638626c0d8 Propagate from main branch the change:
revision 1.59.2.3
	date: 2005/07/11 20:09:47;  author: mcr;  state: Exp;  lines: +2 -2
	   adjusted version
2005-08-05 23:05:37 +00:00
guy 4cfab3417f Most in-kernel BPF interpreters have the constant field of an
instruction as an unsigned value, and, at least for comparisons, the
value is converted to unsigned anyway, as the A and X registers are
unsigned, and the Usual Arithmetic Conversions of C89 apply to
comparisons.  Make ours unsigned as well.  (On two's complement machines
- which means all machines we support - that won't be an issue for using
the constant field as an offset, either, as arithmetic in the BPF
virtual machine is 32-bit two's complement.)
2005-08-01 01:13:53 +00:00
guy 0eadd018f7 From OpenBSD: fix a comment. 2005-07-31 19:01:14 +00:00
guy c8714e05b0 Add another optimization, now that 0.9[.x] is out (having fixed several
optimizer bugs in 0.9[.x], I didn't want to add more potentially-buggy
optimizations).
2005-07-31 17:58:24 +00:00
risso a0f5f72985 Added a definition for SIZEOF_LONG_LONG for Cygnus compilation (win32). 2005-07-21 18:12:41 +00:00
hannes f0ca0272f5 add basic support for DLT_JUNIPER_MFR 2005-07-20 15:25:09 +00:00
hannes be02452be7 add basic support for DLT_JUNIPER_MFR 2005-07-20 15:18:07 +00:00
hannes d0bf1c55eb per suggestion from Paolo Lucente <paolo.lucente@ic.cnr.it>:
centralize the MPLS check into gen_linktype() and backout the
  specific checks in gen_proto_abrev(), gen_proto(), gen_host()

  this adds as a by-product support for IPv6
2005-07-14 15:59:24 +00:00
hannes bb20233f41 bugreport from Paolo Lucente <paolo.lucente@ic.cnr.it>:
-catch the case where the expression is "mpls && vlan" or a similar mutation
   and generate an error - contrary "vlan && mpls" is perfectly fine;
2005-07-11 13:56:01 +00:00
guy d8d2d19c98 Stephen Donnely says MTP3 and SCCP don't belong in the list of DLT_
values for an HDLC link (MTP2 is what's usually run on those links, with
MTP3 atop it); remove them.  Also, boost dlt_count to match the number
of DLT_ values.
2005-07-10 22:09:16 +00:00
risso 34023facce Added a missing initialization of pcap_t::timeout when an adapter is opened
with pcap_open_live. This bug caused pcap_setnonblock to misbehave when
the adapter was set to blocking mode.
2005-07-10 17:53:08 +00:00
guy d9d1f9154e select() should work on BPF devices on Tiger; it's poll() and kqueues
that don't work.
2005-07-10 10:54:45 +00:00
hannes e821a5221b fix MPLS code generation:
if we have a MPLS label stack deeper > 1 then generate a match
  for a cleared bottom-of-stack-bit of the previous MPLS shim header
  rather than just incrementing the offset;

if there is a compined expression of MPLS and IP like e.g.
  "mpls && ip" | "mpls && ip host" | "mpls && ip src net"
  then poison the linkoffset to make sure that other code generators
  do not try to match link-layer protos like Q_ARP, Q_RARP etc.

introduce a new function gen_null() that matches against the first nibble
  of the IP header and matches if the bottom-of-stack bit is set;

TODO: IPv6 stuff i.e. gen_host6() etc.
2005-07-08 15:18:59 +00:00
guy 7f34968ee3 From Stephen Donnelly: updates to the DAG support, to support their
updated API if available.
2005-07-07 06:55:19 +00:00
guy 75b14d240d OK, we'll be putting out 0.9.2 soon, so add the API changes back in
again.
2005-07-07 01:57:00 +00:00
guy 5e92dec088 0.9's already been released, so, for better or worse, we're stuck with
the old names.
2005-07-05 22:31:57 +00:00
guy 727beef298 Rename "direction_t" to "pcap_direction_t", and rename "D_IN" and
"D_OUT" to "PCAP_D_IN" and "PCAP_D_OUT", to avoid potential namespace
collisions, as per a suggestion by Dean Gaudet.
2005-07-05 22:12:17 +00:00
mcr 746c2edea7 changes for 3.9. 2005-07-05 21:03:26 +00:00
guy 409a1a06be Rebuild with autoconf 2.57, to minimize changes. 2005-06-29 06:48:06 +00:00
guy 819e96c769 Checking whether the amount of data returned by SIOCGIFCONF is less than
the size of the buffer we handed to it is insufficient to determine
whether we have the entire list of interfaces or not - if the amount of
space left in the buffer after adding an entry is non-zero but less
than the amount of space required by the next entry, the ioctl will stop
before adding the next entry, and not necessarily return an error.

The only way to ensure that we got all the data is to pass a buffer
large enough that the amount of space in the buffer *not* filled in
is greater than the largest possible entry.

We assume that's "sizeof(ifreq.ifr_name)" plus 255, under the assumption
that no address is more than 255 bytes (on systems where the "sa_len"
field in a "struct sockaddr" is 1 byte, e.g. newer BSDs, that's the
case, and addresses are unlikely to be bigger than that in any case).
2005-06-29 06:41:39 +00:00
guy 959719860d The data link layer isn't settable, so get rid of
"septel_set_datalink()".

It's also always the same, so get rid of "septel_get_datalink()".

Add an inject routine that just returns an error.

Get rid of a malloc() whose result was neither used nor freed.

Clean up indentation.
2005-06-21 01:03:03 +00:00
guy 32234cde86 Don't dump core if the user uses "sio", "opc", "dpc", or "sls" on a
non-SS7 device or capture; report an error.
2005-06-20 21:52:33 +00:00
guy 45767ee2d4 Cleanups to help for --with-dag and --with-septel. 2005-06-20 21:36:57 +00:00
guy a0a4852137 From Gilbert Hoyek <gil_hoyek@hotmail.com>: support for capturing SS7
traffic on Intel Septel cards, and for filtering on SS7 MTP3 fields.

Clean up indentation.
2005-06-20 21:27:07 +00:00
risso b1a06c1017 Fixed a leak in pcap_open_live (win32): the pcap_t handle was not freed
if PacketOpenAdapter fails.
[The previous fix was in the wrong place].
2005-06-10 03:52:19 +00:00
risso 5636631e58 Fixed a leak in pcap_open_live (win32): the pcap_t handle was not freed
if PacketOpenAdapter fails.
2005-06-10 03:49:19 +00:00
hannes c8df74b581 bugreport from Paolo Lucente <paolo.lucente@ic.cnr.it>:
the mpls stack processing is broken:
for example "mpls 10000 && mpls 20000" does produce

reading from file ppp.pcap, link-type PPP (PPP)
(000) ldh      [2]
(001) jeq      #0x00000281      jt 2    jf 11
(002) ld       [4]
(003) and      #0xfffff000
(004) jeq      #0x02710000      jt 5    jf 11
(005) ldh      [6]
(006) jeq      #0x00000281      jt 7    jf 11
(007) ld       [8]
(008) and      #0xfffff000
(009) jeq      #0x04e20000      jt 10   jf 11
(010) ret      #1514
(011) ret      #0

the extra match for 0x281 at instruction #6 is broken and
a copy&paste artifact from the vlan code generator, which
in contrast does require the VLAN tag 0x8100 at every instance
inside a VLAN stack;

correct code should be:

(000) ldh      [2]
(001) jeq      #0x281           jt 2    jf 9
(002) ld       [4]
(003) and      #0xfffff000
(004) jeq      #0x2710000       jt 5    jf 9
(005) ld       [8]
(006) and      #0xfffff000
(007) jeq      #0x4e20000       jt 8    jf 9
(008) ret      #1514
(009) ret      #0
2005-06-06 14:10:58 +00:00
guy da6c782f50 Sigh. In OS X 10.4 (and 10.4.1), "select()" and "poll()" don't work on
any character devices, including BPF devices.
2005-06-04 02:51:45 +00:00
guy 98bddc1384 Add a "pcap_dump_ftell()" routine, to fetch the current offset of a
pcap_dumper_t.  (Just doing an "ftell()" on the result of
"pcap_dump_file()" won't necessarily work on Windows, as Microsoft, in
their infinite wisdom, have multiple different versions of the C library
runtime, and if a DLL is built using one version, and another DLL or an
executable is built with another version, file descriptors and FILE *'s
opened in one of them cannot be used in the other.)
2005-06-03 20:36:19 +00:00
guy 3a1174ec74 Put in a note about ISO-over-LLC, PPPoA (which is "PPP-over-LLC using
the ISO NLPID for PPP"), and PPPoE.
2005-05-28 00:29:49 +00:00
guy 4d9af0710d RFC 1483 handles more than just IP and more than just SNAP. 2005-05-27 23:32:20 +00:00
guy e503864143 Note that "pcap_setdirection()" isn't supported on savefiles. 2005-05-23 20:37:30 +00:00
guy 9c2ab752b2 Give a more correct error if you try to set the direction when reading
from a savefile.
2005-05-23 20:30:44 +00:00
hannes 18bb7676da add basic support for DLT_JUNIPER_{GGSN,ES,MONITOR,SERVICES} 2005-05-19 09:33:20 +00:00
hannes ddf0f5f8d9 add basic support for DLT_JUNIPER_PPPOE_ATM 2005-05-12 07:04:22 +00:00