summaryrefslogtreecommitdiff
path: root/lib/libpcap
AgeCommit message (Collapse)Author
2022-12-27spelling fixes; from paul tagliamonteJason McIntyre
any changes not taken noted on tech, but chiefly here i did not take the cancelation - cancellation changes;
2022-09-10wireless LANS -> wireless LANsJonathan Gray
2022-05-28clear cur_membag so that pcap can be used more than onceTheo de Raadt
2022-05-28Do not walk off the end of the array performing freesTheo de Raadt
crash found by daharmasterkor
2022-03-28tweak the pflog ifname filter to include the terminating nul.David Gwynne
without this the code effectively just compares the start of the string, which means you can get a prefix match unexpectedly. including the nul in the comparison means it only works for whole interface names, as it was originally intended. reported by Aner Perez on misc@ ok deraadt@ (who also dug through the history behind this)
2022-02-13Handle the case in freechunks where not a single allocation has happened.Otto Moerbeek
ok deraadt@
2021-12-05libpcap parser uses a memory tracker to only free all objects at the end.Theo de Raadt
this code was slicing up large mallocs with sys/param.h ALIGN(). such a scheme loses the many overflow/damage checking benefits of malloc per object. Change the code to track independent allocations, rather than slicing. ok gnezdo claudio
2021-12-01we do not need 'struct mbuf; struct rtentry;' to satisfy some ancient unixTheo de Raadt
variant that made a header file mistake. ok jsg
2021-09-10nothing from sys/param.h is usedTheo de Raadt
2021-09-10the SunOS lseek 4G wraparound workaround is not needed, consequentlyTheo de Raadt
pulling BSD from sys/param.h is not needed either
2021-09-07synchronize tcpdump.8 and pcap-filter.5 primitives documentationDenis Fondras
reads ok to jmc@ good enough start for deraadt@
2021-09-02Ah, I was fooled by a left over man pageTheo de Raadt
2021-09-02this is not a section 3 man page anymoreTheo de Raadt
2021-01-20typo; spotted by jmcStuart Henderson
2021-01-18support PCAP_NETMASK_UNKNOWN, adapted from an old commit in upstreamStuart Henderson
libpcap, ok dlg@ https://github.com/the-tcpdump-group/libpcap/commit/74b2de364f3443fc2414d0160b0b942f347c6fd4 https://github.com/the-tcpdump-group/libpcap/commit/117cb5eb2eb4fe212d3851f1205bb0b8f57873c6
2020-09-12Fix byte order handling for DLT_LOOP linkskn
Fixing filters on DLT_LOOP revealed that we treat DLT_NULL, DLT_ENC and DLT_LOOP the same way even though DLT_LOOP stores the AF value in network not byte order like the rest. This amends the missing conversion which ought to land with the recent commit exposing the byte order mismatch: revision 1.53 date: 2020/07/21 22:44:55; author: dlg; state: Exp; lines: +2 -2; DLT_LOOP does have a link header, so tell pcap-filter so it can use it. ... debugged with and ok kn@ Discussed with bluhm who reported src/regress/sys/netinet6/rip6cksum/ failing on i386 after above commit. The comment in this commit is taken from libpcap upstream as is modulo additional file-save related byte-order handling which we don't seem to do. OK bluhm
2020-08-03crank the major cos grammar.c has grown.David Gwynne
pointed out by tb@, who also provided the diff. maybe someone should/could add a Symbols.list here? ok tb@ deraadt@
2020-08-03add "sample NUM" so you can ask to capture 1/NUM packets from a filter.David Gwynne
the use of the sample keyword matches similar config in other products. NUM can be a number between 2 and 1048576, and is used to divide 0x100000000 into a threshold that is then compared against a randomly generated number produced by a load of BPF_RND. having sampling as part of the grammar means you can write things like "icmp or sample 128". this lets you capture all icmp traffic and a sample of the rest of the traffic. ok jmatthew@ kn@ tb@
2020-08-03add support for handling loads from BPF_RND.David Gwynne
this adds "rnd" and "random" as keywords in the grammar, and handles them as an arithmetic operator. the decoder recognises the load, so tcpdump can print it as 'ld #random'. most of the handling is copied from the "len"/"length" keywoard handling that generates and decodes a load of the actual wire length of the packet. ok jmatthew@ tb@ kn@
2020-07-21DLT_LOOP does have a link header, so tell pcap-filter so it can use it.David Gwynne
matthieu@ reported that asking tcpdump to look at ip or ip6 traffic on a wg(4) interface caused all packets to be captured. this is because pcap assumes that if your link type doesn't have a link header then it is always ip or ip6 (which is weird anyway) and captures everything. there was already code to generate a filter for the DLT_LOOP link header, it was just bypassed cos earlier code said that there wasn't one. debugged with and ok kn@
2020-05-29from edgar pettijohn: correct return type in pcap_open_live.3;Jason McIntyre
ok djm
2020-05-27add support for pcap_breakloop when reading packets from files.David Gwynne
djm pulled support in for pcap_breakloop on the bpf side of things, this makes it work when reading files too. from Caspar Schutijser lteo@ seems keen ok djm@
2019-12-17Fix bogus ".It .Cm"Jeremie Courreges-Anglas
2019-11-28Fix typo in comment in struct pcap_pkthdrakoshibe
2019-09-25the mentioned .Fn functions are in a another file, so .Xr themTheo de Raadt
ok jmc
2019-09-25pcap-filter now section 5: adjust XrJason McIntyre
2019-09-25mdoc version of pcap-filter;Jason McIntyre
conversion suggested by deraadt, as well as renaming from section 7 to section 5; ok deraadt
2019-09-03pcap-filter(3) is not a function, it is a language description. It wasTheo de Raadt
mostly cobbled together from a pre-mandoc tcpdump manual page, and desperately needs some loving. First step is to name it right. Discussed with jmc
2019-08-30there is no pcap(3) function, "man pcap" returns an incorrect result.Theo de Raadt
this page should be called by one of the functions, so i chose the first one: pcap_open_live(3)
2019-07-19add "slow" to the list of ethernet protocol names.David Gwynne
this allows "tcpdump ether proto slow", which makes looking at lacp frames a bit easier.
2019-06-28When system calls indicate an error they return -1, not some arbitraryTheo de Raadt
value < 0. errno is only updated in this case. Change all (most?) callers of syscalls to follow this better, and let's see if this strictness helps us in the future.
2018-12-13further document pcap_dump; from jan staryJason McIntyre
text tweaked and ok djm
2018-12-12some pcap_setdirection details; from jan staryJason McIntyre
ok djm
2018-12-09add basic MPLS filtering supportdenis
OK claudio@ jca@
2018-11-10unbreak VLAN filteringdenis
OK dlg@
2018-11-09fix a typodenis
OK jca@ (from a long time ago...)
2018-06-03Sync manual with the const changes introduced in pcap.h rev 1.20.Theo Buehler
2018-06-03Change some libpcap functions which use pointers as arguments andStuart Henderson
returns to const pointers: - the prefix argument to pcap_perror(); - the return value of pcap_strerror(); - the filter expression argument to pcap_compile() and pcap_compile_nopcap(); - the BPF filter program argument to bpf_image(). Matches changes made earlier in tcpdump.org's version of libpcap. From Guy Harris, ok tb@, been through a bulk ports build.
2018-04-26Convert a format string variable to a static const char[] to reduce warningsPhilip Guenther
ok tb@ millert@ krw@
2018-04-05Import pcap_set_immediate_mode() from mainline libpcap which allows aLawrence Teo
libpcap-based program to process packets as soon as they arrive. feedback from jasper@ ok jca@ (a long time ago)
2018-02-06recognise DLT_PPP_SERIAL.David Gwynne
shlib version doesnt need a bump before no new symbols were added or removed. part of a larger diff that was ok sthen@
2018-02-03Simple USBPcap parser for tcpdump(8). Raw dumps can be nicely analysedMartin Pieuchot
in wireshark. ok deraadt@, dlg@
2018-01-01Fix wrong ETHERTYPE_IPV6denis
OK jca@ kettenis@ job@
2017-07-09use working boilerplate for yacc/lex instead of homemade rules.Marc Espie
okay millert@ (forgot the obvious scanner.l tweak in my diff)
2017-04-27Remove the "volatile" attribute from bpf_error(). The "volatile"Todd C. Miller
attribute is an obsolete way of saying "noreturn". clang doesn't recognize it and the function is already marked __dead so it is superfluous anyway.
2017-04-19Switch base tools from /dev/bpf0 to /dev/bpf. Now that /dev/bpf has beenMartin Natano
around for two releases, it should be safe to do so. ok bluhm deraadt sthen tb yasuoka
2016-12-02add "lldp" to the ether protocol name db.David Gwynne
this lets me go "tcpdump ether proto lldp" to easily read lldp packets off the wire without other noise getting in the way. ok deraadt@ jca@ sthen@
2016-11-29Stop exporting the eproto_db array, export a pointer to it instead.Jeremie Courreges-Anglas
tcpdump directly uses eproto_db even though it is not part of the libpcap API. This means that we can't freely add members to this array, else ld.so complains about size mismatches. Keep the data in a static array instead and make it usable by tcpdump through a pointer whose size won't change in the future. A minor bump is enough here for ld.so to stop complaining. While here, mark _eproto_db and llc_db as const, as they are meant to be. Suggested by and ok deraadt@
2016-11-20Extend the DLT_OPENFLOW header to include the switch datapath id.Reyk Floeter
OK rzalamena@
2016-11-16Add new DLT_OPENFLOW link-type to allow using tcpdump to debug switch(4),Reyk Floeter
eg. tcpdump -y openflow -i switch0 Includes a minor bump for libpcap. Feedback and OK rzalamena@
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-28 01:40:04 +0000