From patchwork Thu Dec 6 21:20:11 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ani Sinha X-Patchwork-Id: 204323 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 267042C00AC for ; Fri, 7 Dec 2012 08:20:17 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1423038Ab2LFVUN (ORCPT ); Thu, 6 Dec 2012 16:20:13 -0500 Received: from mail-vc0-f174.google.com ([209.85.220.174]:43690 "EHLO mail-vc0-f174.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1422781Ab2LFVUM (ORCPT ); Thu, 6 Dec 2012 16:20:12 -0500 Received: by mail-vc0-f174.google.com with SMTP id d16so6473265vcd.19 for ; Thu, 06 Dec 2012 13:20:11 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type:x-gm-message-state; bh=D0Wbgh6+eX10Ba/kywDT1+FRoYdcH3rKKtQ9dVO2WfU=; b=eoVFPYaJ46ihSmty+GOcTk3OixgtQ7zMmbbMdknC9rwxWsBhauonIRIvjgxScm+tOY JQcTCkCGTVTAxyRX9c05Uh7BITtkrXXzBwHCDARmksFGbiCbLJEiiQl01CuC8RP36XDt h/peR0PdD0CRADWVFzMXXVi9XLrT1qsK0SCjD/Y/4MskE+RWH/W+qkOtDgeK5qZRyOQg MgqtywSCRnrtMCZC8q3agEhHVLB0kwe1msnvLRlUNGEZPs5/wJADa1NnnqSJ5Po2kGTA 8SWHGu5l88ZqeHjlXxHdJb11wdhF6DzTVgyd4OFTQXM8XraC+hmzDm3v6xVISpDyDix5 HBlA== MIME-Version: 1.0 Received: by 10.58.48.231 with SMTP id p7mr2516971ven.11.1354828811456; Thu, 06 Dec 2012 13:20:11 -0800 (PST) Received: by 10.58.249.240 with HTTP; Thu, 6 Dec 2012 13:20:11 -0800 (PST) In-Reply-To: References: <3246.1351717319@obiwan.sandelman.ca> <5422DBB2-EABF-4C9F-B0CD-8C77E91F9FF8@alum.mit.edu> Date: Thu, 6 Dec 2012 13:20:11 -0800 Message-ID: Subject: Re: [tcpdump-workers] vlan tagged packets and libpcap breakage From: Ani Sinha To: Guy Harris Cc: netdev@vger.kernel.org, Francesco Ruggeri , tcpdump-workers@lists.tcpdump.org X-Gm-Message-State: ALoCoQnfE8ko4l49XKpw+1wlzTNzy1Z7AtLIQ52VBr2arfP8AJ6mQIHnrGUN6hbN+1B2Uojp1wYS Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org On Wed, Oct 31, 2012 at 5:50 PM, Guy Harris wrote: > > On Oct 31, 2012, at 3:35 PM, Ani Sinha wrote: > >> yes but if the packet is passed to the filter within libpcap (when we >> are not using the kernel filter) before the reinsertion, > > ...that would be a bug. > > Currently, that bug doesn't exist in the recvfrom() code path, but *does* appear to exist in the tpacket code path - and that code path also runs the filter before the SLL header is constructed. That should be fixed. Something like this? --- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Index: libpcap-1.1.1/pcap-linux.c =================================================================== --- libpcap-1.1.1.orig/pcap-linux.c +++ libpcap-1.1.1/pcap-linux.c @@ -132,6 +132,7 @@ static const char rcsid[] _U_ = #include #include #include +#include #include #include #include @@ -3469,23 +3476,6 @@ pcap_read_linux_mmap(pcap_t *handle, int return -1; } - /* run filter on received packet - * If the kernel filtering is enabled we need to run the - * filter until all the frames present into the ring - * at filter creation time are processed. - * In such case md.use_bpf is used as a counter for the - * packet we need to filter. - * Note: alternatively it could be possible to stop applying - * the filter when the ring became empty, but it can possibly - * happen a lot later... */ - bp = (unsigned char*)h.raw + tp_mac; - run_bpf = (!handle->md.use_bpf) || - ((handle->md.use_bpf>1) && handle->md.use_bpf--); - if (run_bpf && handle->fcode.bf_insns && - (bpf_filter(handle->fcode.bf_insns, bp, - tp_len, tp_snaplen) == 0)) - goto skip; - /* * Do checks based on packet direction. */ @@ -3582,6 +3576,23 @@ pcap_read_linux_mmap(pcap_t *handle, int } #endif + /* run filter on received packet + * If the kernel filtering is enabled we need to run the + * filter until all the frames present into the ring + * at filter creation time are processed. + * In such case md.use_bpf is used as a counter for the + * packet we need to filter. + * Note: alternatively it could be possible to stop applying + * the filter when the ring became empty, but it can possibly + * happen a lot later... */ + bp = (unsigned char*)h.raw + tp_mac; + run_bpf = (!handle->md.use_bpf) || + ((handle->md.use_bpf>1) && handle->md.use_bpf--); + if (run_bpf && handle->fcode.bf_insns && + (bpf_filter(handle->fcode.bf_insns, bp, + tp_len, tp_snaplen) == 0)) + goto skip; + /* * The only way to tell the kernel to cut off the * packet at a snapshot length is with a filter program;