On 06/19/2015 10:58 PM, Vadim Kochan wrote:
On Fri, Jun 19, 2015 at 10:47:49PM +0200, Daniel Borkmann wrote:
...
@@ -737,6 +837,24 @@ static inline void pcap_validate_header(const struct pcap_filehdr *hdr) if (unlikely(hdr->version_minor != PCAP_VERSION_MINOR) && ___constant_swab16(hdr->version_minor) != PCAP_VERSION_MINOR) panic("This file has an invalid pcap minor version (must be %d)\n", PCAP_VERSION_MINOR); + + /* Remap to internal *_LL types in case of LINKTYPE_LINUX_SLL. */ + if (linktype == LINKTYPE_LINUX_SLL) {should not link_has_sll_hdr() be used here ?
Why? At this point, when reading a pcap file, basic validation has already been done and linktype is in host endianess. In netsniff-ng, we write out the pcap header as LINKTYPE_LINUX_SLL in case of Netlink. In case some other source doesn't use LINKTYPE_LINUX_SLL but LINKTYPE_NETLINK, we actually need not to assume cooked format. -- You received this message because you are subscribed to the Google Groups "netsniff-ng" group. To unsubscribe from this group and stop receiving emails from it, send an email to netsniff-ng+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
