remove unused variables

more ansi function decls
ok deraadt@

ANSI functions; ok tb

spelling fixes; from paul tagliamonte
any changes not taken noted on tech, but chiefly here i did not take the
cancelation - cancellation changes;

clear cur_membag so that pcap can be used more than once

Do not walk off the end of the array performing frees
crash found by daharmasterkor

tweak the pflog ifname filter to include the terminating nul.

without this the code effectively just compares the start of the
string, which means you can get a prefix match unexpectedly. including

tweak the pflog ifname filter to include the terminating nul.

without this the code effectively just compares the start of the
string, which means you can get a prefix match unexpectedly. including
the nul in the comparison means it only works for whole interface
names, as it was originally intended.

reported by Aner Perez on misc@
ok deraadt@ (who also dug through the history behind this)

show more ...

Handle the case in freechunks where not a single allocation has happened.
ok deraadt@

libpcap parser uses a memory tracker to only free all objects at the end.
this code was slicing up large mallocs with sys/param.h ALIGN(). such a
scheme loses the many overflow/damage checking benef

libpcap parser uses a memory tracker to only free all objects at the end.
this code was slicing up large mallocs with sys/param.h ALIGN(). such a
scheme loses the many overflow/damage checking benefits of malloc per object.
Change the code to track independent allocations, rather than slicing.
ok gnezdo claudio

show more ...

we do not need 'struct mbuf; struct rtentry;' to satisfy some ancient unix
variant that made a header file mistake.
ok jsg

support PCAP_NETMASK_UNKNOWN, adapted from an old commit in upstream
libpcap, ok dlg@

https://github.com/the-tcpdump-group/libpcap/commit/74b2de364f3443fc2414d0160b0b942f347c6fd4
https://github.com/

support PCAP_NETMASK_UNKNOWN, adapted from an old commit in upstream
libpcap, ok dlg@

https://github.com/the-tcpdump-group/libpcap/commit/74b2de364f3443fc2414d0160b0b942f347c6fd4
https://github.com/the-tcpdump-group/libpcap/commit/117cb5eb2eb4fe212d3851f1205bb0b8f57873c6

show more ...

Fix byte order handling for DLT_LOOP links

Fixing filters on DLT_LOOP revealed that we treat DLT_NULL, DLT_ENC and
DLT_LOOP the same way even though DLT_LOOP stores the AF value in network
not byte

Fix byte order handling for DLT_LOOP links

Fixing filters on DLT_LOOP revealed that we treat DLT_NULL, DLT_ENC and
DLT_LOOP the same way even though DLT_LOOP stores the AF value in network
not byte order like the rest.

This amends the missing conversion which ought to land with the recent
commit exposing the byte order mismatch:

revision 1.53
date: 2020/07/21 22:44:55; author: dlg; state: Exp; lines: +2 -2;
DLT_LOOP does have a link header, so tell pcap-filter so it can use it.
...
debugged with and ok kn@

Discussed with bluhm who reported src/regress/sys/netinet6/rip6cksum/
failing on i386 after above commit.

The comment in this commit is taken from libpcap upstream as is modulo
additional file-save related byte-order handling which we don't seem to do.

OK bluhm

show more ...

add "sample NUM" so you can ask to capture 1/NUM packets from a filter.

the use of the sample keyword matches similar config in other
products.

NUM can be a number between 2 and 1048576, and is use

add "sample NUM" so you can ask to capture 1/NUM packets from a filter.

the use of the sample keyword matches similar config in other
products.

NUM can be a number between 2 and 1048576, and is used to divide
0x100000000 into a threshold that is then compared against a randomly
generated number produced by a load of BPF_RND.

having sampling as part of the grammar means you can write things
like "icmp or sample 128". this lets you capture all icmp traffic
and a sample of the rest of the traffic.

ok jmatthew@ kn@ tb@

show more ...

add support for handling loads from BPF_RND.

this adds "rnd" and "random" as keywords in the grammar, and handles
them as an arithmetic operator. the decoder recognises the load,
so tcpdump can prin

add support for handling loads from BPF_RND.

this adds "rnd" and "random" as keywords in the grammar, and handles
them as an arithmetic operator. the decoder recognises the load,
so tcpdump can print it as 'ld #random'. most of the handling is
copied from the "len"/"length" keywoard handling that generates and
decodes a load of the actual wire length of the packet.

ok jmatthew@ tb@ kn@

show more ...

DLT_LOOP does have a link header, so tell pcap-filter so it can use it.

matthieu@ reported that asking tcpdump to look at ip or ip6 traffic
on a wg(4) interface caused all packets to be captured. th

DLT_LOOP does have a link header, so tell pcap-filter so it can use it.

matthieu@ reported that asking tcpdump to look at ip or ip6 traffic
on a wg(4) interface caused all packets to be captured. this is
because pcap assumes that if your link type doesn't have a link
header then it is always ip or ip6 (which is weird anyway) and
captures everything.

there was already code to generate a filter for the DLT_LOOP link
header, it was just bypassed cos earlier code said that there wasn't
one.

debugged with and ok kn@

show more ...

add basic MPLS filtering support

OK claudio@ jca@

unbreak VLAN filtering

OK dlg@

fix a typo

OK jca@ (from a long time ago...)

Change some libpcap functions which use pointers as arguments and
returns to const pointers:

- the prefix argument to pcap_perror();
- the return value of pcap_strerror();
- the filter expression ar

Change some libpcap functions which use pointers as arguments and
returns to const pointers:

- the prefix argument to pcap_perror();
- the return value of pcap_strerror();
- the filter expression argument to pcap_compile() and pcap_compile_nopcap();
- the BPF filter program argument to bpf_image().

Matches changes made earlier in tcpdump.org's version of libpcap.
From Guy Harris, ok tb@, been through a bulk ports build.

show more ...

recognise DLT_PPP_SERIAL.

shlib version doesnt need a bump before no new symbols were added
or removed.

part of a larger diff that was ok sthen@

Simple USBPcap parser for tcpdump(8). Raw dumps can be nicely analysed
in wireshark.

ok deraadt@, dlg@

Extend the DLT_OPENFLOW header to include the switch datapath id.

OK rzalamena@

Add new DLT_OPENFLOW link-type to allow using tcpdump to debug switch(4),
eg. tcpdump -y openflow -i switch0

Includes a minor bump for libpcap.

Feedback and OK rzalamena@

remove NULL-checks before free()

Remove register keyword.

ok deraadt@