|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
the code was confusing around how it dealt with packets in mbufs
vs plain memory buffers with a lenght.
this renames bpf_filter to _bpf_filter, and changes it so the packet
memory is referred to by an opaque pointer, and callers have to
provide a set of operations to extra values from that opaque pointer.
bpf_filter is now provided as a wrapper around _bpf_filter. it
provides a set of operators that work on a straight buffer with a
lenght.
this also adds a bpf_mfilter function which takes an mbuf instead
of a buffer, and it provides explicit operations for extracting
values from mbufs.
if we want to use bpf filters against other data structures (usb
or scsi packets maybe?) we are able to provide functions for
extracting payloads from them and use _bpf_filter as is.
ok canacar@
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
local changes: strncpy() -> strlcpy(), malloc(x * y) -> calloc(x, y),
exclude cross-platform cruft, etc.
The new functions are pcap_create(), pcap_set_snaplen(),
pcap_set_promisc(), pcap_can_set_rfmon(), pcap_set_rfmon(),
pcap_set_timeout(), pcap_set_buffer_size(), pcap_activate(), and
pcap_statustostr().
This diff was tested on amd64, i386, macppc, and sparc64, where
regression tests were done on various pcap-based ports (especially amd64
and i386 where regression tests were run on all pcap-based ports).
Testers also tried running pcap-based ports that they are familiar with
to ensure that there is no behavioral change. tcpdump and pflogd in
base were also tested by different testers. The new pcap_* functions
were tested with a proof-of-concept Snort 2.9 port for many months.
Thank you to everyone who helped test this diff and provided feedback:
haesbaert@, sthen@, matthew@, gonzalo@, brett@, Rodolfo Gouveia,
Aaron Bieber, Markus Lude, and Ray Percival.
ok haesbaert sthen henning
|