Patch from Marcus Felipe Pereira <[email protected]> to map ARPHRD_HDLC

to DLT_C_HDLC.

Arrange that if "map_arphrd_to_dlt()" supplies DLT_LINUX_SLL as the
link-layer DLT_ value, we capture in cooked mode.

Return DLT_LINUX_SLL for ARPHRD_PPP, as some PPP code in the kernel
supplies no link-layer header whatsoever to PF_PACKET sockets, other PPP
code supplies PPP link-layer headers ("syncppp.c"), and PPP-over-ISDN
appears to supply random link-layer headers (there's code in Ethereal,
for example, to cope with PPP-over-ISDN captures with which the Ethereal
developers have had to cope, heuristically trying to determine which of
the oddball link-layer headers particular packets have).

diff --git a/CREDITS b/CREDITS
index ffa91ef30f6c91e773c597b29c7499e7051c9b7c..8f2da760fe8a7cd2cfed4b8daecd68d0aa7f978b 100644 (file)
--- a/CREDITS
+++ b/CREDITS
@@ -25,6 +25,7 @@ Additional people who have contributed patches:
        Klaus Klein                     <[email protected]>
        Lorenzo Cavallaro               <[email protected]>
        Love Hörnquist-Åstrand          <[email protected]>
        Klaus Klein                     <[email protected]>
        Lorenzo Cavallaro               <[email protected]>
        Love Hörnquist-Åstrand          <[email protected]>

+       Marcus Felipe Pereira           <[email protected]>

        Monroe Williams                 <[email protected]>
        Olaf Kirch                      <[email protected]>
        Onno van der Linden             <[email protected]>
        Monroe Williams                 <[email protected]>
        Olaf Kirch                      <[email protected]>
        Onno van der Linden             <[email protected]>

diff --git a/pcap-linux.c b/pcap-linux.c
index ca132df3b45b5fa06e6bd2d966b52c93b72dab7e..5f1c35b50e4bfcfbbe442c2e29ba66956db42942 100644 (file)
--- a/pcap-linux.c
+++ b/pcap-linux.c
@@ -26,7 +26,7 @@
  */
 #ifndef lint
 static const char rcsid[] =
  */
 #ifndef lint
 static const char rcsid[] =

-    "@(#) $Header: /tcpdump/master/libpcap/pcap-linux.c,v 1.56 2001-03-20 05:50:33 guy Exp $ (LBL)";
+    "@(#) $Header: /tcpdump/master/libpcap/pcap-linux.c,v 1.57 2001-04-09 05:55:40 guy Exp $ (LBL)";

 #endif
 
 /*
 #endif
 
 /*


@@ -657,6 +657,27 @@ static int map_arphrd_to_dlt(pcap_t *handle, int arptype)
                break;
 
        case ARPHRD_PPP:
                break;
 
        case ARPHRD_PPP:

+               /*
+                * Some PPP code in the kernel supplies no link-layer
+                * header whatsoever to PF_PACKET sockets; other PPP
+                * code supplies PPP link-layer headers ("syncppp.c");
+                * some PPP code might supply random link-layer
+                * headers (PPP over ISDN - there's code in Ethereal,
+                * for example, to cope with PPP-over-ISDN captures
+                * with which the Ethereal developers have had to cope,
+                * heuristically trying to determine which of the
+                * oddball link-layer headers particular packets have).
+                *
+                * As such, we just punt, and run all PPP interfaces
+                * in cooked mode.
+                */
+               handle->linktype = DLT_LINUX_SLL;
+               break;
+
+       case ARPHRD_HDLC:
+               handle->linktype = DLT_C_HDLC;
+               break;
+

        /* Not sure if this is correct for all tunnels, but it
         * works for CIPE */
        case ARPHRD_TUNNEL:
        /* Not sure if this is correct for all tunnels, but it
         * works for CIPE */
        case ARPHRD_TUNNEL:


@@ -669,6 +690,10 @@ static int map_arphrd_to_dlt(pcap_t *handle, int arptype)
        case ARPHRD_CSLIP6:
        case ARPHRD_ADAPT:
        case ARPHRD_SLIP:
        case ARPHRD_CSLIP6:
        case ARPHRD_ADAPT:
        case ARPHRD_SLIP:

+               /*
+                * XXX - should some of those be mapped to DLT_LINUX_SLL
+                * instead?  Should we just map all of them to DLT_LINUX_SLL?
+                */

                handle->linktype = DLT_RAW;
                break;
 
                handle->linktype = DLT_RAW;
                break;
 


@@ -746,19 +771,18 @@ live_open_new(pcap_t *handle, char *device, int promisc,
                        if (arptype == -1) 
                                break;
                        if (map_arphrd_to_dlt(handle, arptype) == -1 ||
                        if (arptype == -1) 
                                break;
                        if (map_arphrd_to_dlt(handle, arptype) == -1 ||

+                           handle->linktype == DLT_LINUX_SLL ||

                            (handle->linktype == DLT_EN10MB &&
                             (strncmp("isdn", device, 4) == 0 ||
                            (handle->linktype == DLT_EN10MB &&
                             (strncmp("isdn", device, 4) == 0 ||

-                             strncmp("isdY", device, 4) == 0)) ||
-                           (handle->linktype == DLT_RAW &&
-                            (strncmp("ippp", device, 4) == 0))) {
+                             strncmp("isdY", device, 4) == 0))) {

                                /*
                                /*

-                                * Unknown interface type (-1), or an ISDN
-                                * device (whose link-layer type we
-                                * can only determine by using APIs
-                                * that may be different on different
+                                * Unknown interface type (-1), or a
+                                * device we explicitly chose to run
+                                * in cooked mode (e.g., PPP devices),
+                                * or an ISDN device (whose link-layer
+                                * type we can only determine by using
+                                * APIs that may be different on different

                                 * kernels) - reopen in cooked mode.
                                 * kernels) - reopen in cooked mode.

-                                *
-                                * XXX - do that with DLT_RAW as well?

                                 */
                                if (close(sock_fd) == -1) {
                                        snprintf(ebuf, PCAP_ERRBUF_SIZE,
                                 */
                                if (close(sock_fd) == -1) {
                                        snprintf(ebuf, PCAP_ERRBUF_SIZE,