On Sat, Jun 20, 2015 at 12:27:41AM +0200, Daniel Borkmann wrote:
> On 06/20/2015 12:16 AM, Vadim Kochan wrote:
> >On Sat, Jun 20, 2015 at 01:12:06AM +0300, Vadim Kochan wrote:
> >>On Fri, Jun 19, 2015 at 11:59:32PM +0200, Daniel Borkmann wrote:
> >>>On 06/19/2015 11:37 PM, Vadim Kochan wrote:
> ...
> >>by adding "|| linktype == LINKTYPE_LINUX_SLL)" I got dissected Netlink
> >>messages.
> >>
> >>Also may be it is better to get this 'switch' out from validation
> >>function, just but semantic meaning of this function which should just
> >>validate but not change something valuable.
> >
> >Sorry .... I meant I added LINKTYPE_NETLINK checking too, and it fixed
> >dissecting.
>
> Ok, good point, thanks! I have pushed it out for now. If you have any
> further cleanups on top of this, feel free to submit.
>
> I also applied your sll dissector patch.
>
> Thanks for your patience,
> Daniel
Regarding cleanups ... what do you think about change pcap_pkthdr_t to:
typedef struct {
union {
struct pcap_pkthdr ppo;
struct pcap_pkthdr_ns ppn;
struct pcap_pkthdr_ll ppo_ll;
struct pcap_pkthdr_ns_ll ppn_ll;
struct pcap_pkthdr_kuz ppk;
struct pcap_pkthdr_bkm ppb;
uint8_t raw;
} h;
pcap_type_t type;
} pcap_pkthdr_t;
which will allow to remove 'type' argument from I/O & other pcap functions ...
and
makes calling of these functions shorter ...
--
You received this message because you are subscribed to the Google Groups
"netsniff-ng" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
