Handle pcapng version 1.2.

Some programs wrote it, even though the only "difference" is that some
new sysdig block types were added.  Any program that can read version
1.2 and its new block types should be able to read 1.0 files with the
same block types, so that wasn't a reason to bump the minor version
number.

(cherry picked from commit 1e0e97eb443874b8286547d39bf88af82d3312c7)

diff --git a/CHANGES b/CHANGES
index 3128854a8b6cb2ee2aeb1134268cec7ec745323d..0b09fe634743ae402343690e8bb61c8be455b704 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -13,6 +13,12 @@ Monthday, Month DD, YYYY
       Refine Markdown in README.md.
       Improve the description of portrange in filters.
       README.linux.md isn't Markdown, rename it just README.linux.
+    pcapng:
+      Support reading version 1.2, which some writers produce, and which
+          is the same as 1.0 (some new block types were added, but
+          that's not sufficient reason to bump the minor version number,
+          as code that understands those new block types can handle them
+          in a 1.0 file)
     Linux:
       Drop support for text-mode USB captures, as we require a 2.6.27
           or later kernel (credit to Chaoyuan Peng for noting the

diff --git a/sf-pcapng.c b/sf-pcapng.c
index f7f413d31fc002681ea6dafe54b6cdd844712e02..9330af433d30009384e5c3e534d0136ffe748a24 100644 (file)
--- a/sf-pcapng.c
+++ b/sf-pcapng.c
@@ -101,7 +101,8 @@ struct section_header_block {
 
 /*
  * Current version number.  If major_version isn't PCAP_NG_VERSION_MAJOR,
- * that means that this code can't read the file.
+ * or if minor_version isn't PCAP_NG_VERSION_MINOR or 2, that means that
+ * this code can't read the file.
  */
 #define PCAP_NG_VERSION_MAJOR  1
 #define PCAP_NG_VERSION_MINOR  0
@@ -962,9 +963,23 @@ pcap_ng_check_header(const uint8_t *magic, FILE *fp, u_int precision,
                 * XXX - we don't care about the section length.
                 */
        }
-       /* currently only SHB version 1.0 is supported */
+       /* Currently only SHB versions 1.0 and 1.2 are supported;
+          version 1.2 is treated as being the same as version 1.0.
+          See the current version of the pcapng specification.
+
+          Version 1.2 is written by some programs that write additional
+          block types (which can be read by any code that handles them,
+          regarless of whether the minor version if 0 or 2, so that's
+          not a reason to change the minor version number).
+
+          XXX - the pcapng specification says that readers should
+          just ignore sections with an unsupported version number;
+          presumably they can also report an error if they skip
+          all the way to the end of the file without finding
+          any versions that they support. */
        if (! (shbp->major_version == PCAP_NG_VERSION_MAJOR &&
-              shbp->minor_version == PCAP_NG_VERSION_MINOR)) {
+              (shbp->minor_version == PCAP_NG_VERSION_MINOR ||
+               shbp->minor_version == 2))) {
                snprintf(errbuf, PCAP_ERRBUF_SIZE,
                    "unsupported pcapng savefile version %u.%u",
                    shbp->major_version, shbp->minor_version);