netsniff-ng: Add command line option to disable hardware time stamping

Allow to disable hardware time stamping using the command line switch
(-N/--no-hwtimestamp). This might be useful in situations where hardware
time stamps are skewed somehow.

Reference: #129
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
netsniff 0.5.9-rc3

Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
netsniff-ng: Restore tpacket v2 capturing

Some older systems (e.g. RHEL 6) don't have tpacket v3 available, but
only tpacket v2. However, since commit d8cdc6a ("ring: netsniff-ng:
migrate capture only to TPACKET_V3") we solely rely on tpacket v3 for
capturing packets.

This patch restores the possibility to capture using tpacket v2. For now
this is just a fallback if the configure script doesn't detect tpacket
v3 (and thus HAVE_TPACKET3 isn't set). Thus, on most modern systems this
shouldn't change anything and they will continue using tpacket v3.

For now this fix contains quite a bit of ugly #ifdefery which should be
cleaned up in the future.

Fixes #76

Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
dissector: check for correct netlink linktype

It's supposed to be LINKTYPE_NETLINK, not AF_NETLINK as otherwise
the pkt_type fixup cannot be done correctly.

Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
netsniff-ng: Only use TPACKET_V3 if HAVE_TPACKET3 is defined

TPACKET_V3 is not defined if tpacket v3 is not available, thus make its
use conditional on HAVE_TPACKET3. Wrap the check for TPACKET_V3 in
ring_rx in an inline function which always returns false if
HAVE_TPACKET3 is not defined.

Reported-by: Mike Reeves <luke@geekempire.com>
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
netsniff-ng: Clean up HAVE_TPACKET3 #ifdefs

Instead of having #ifdef HAVE_TPACKET3 spread all over the code,
encapsulate the functionality depending on it inside inline functions:
the existing is_tpacket_v3() introduced in commit 5bc19d0b84d0
("netsniff-ng: Only use TPACKET_V3 if HAVE_TPACKET3 is defined") and the
newly introduced get_ring_layout_size() to get the ring layout size
depending on the tpacket version available and the version actually in
use.

Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
netsniff-ng: Properly wrap usage of all tpacket v3 structs

Mike Reeves reports the following compilation error if tpacket v3 is not
available:

>  CC   ring_rx.c
> ring_rx.c: In function 'alloc_rx_ring_frames':
> ring_rx.c:143: error: 'struct ring' has no member named 'layout3'
> ring_rx.c:144: error: 'struct ring' has no member named 'layout3'
> ring_rx.c: In function 'sock_rx_net_stats':
> ring_rx.c:172: error: field 'k3' has incomplete type
> make: *** [netsniff-ng/ring_rx.o] Error 1

The layout3 member of struct ring is only available for HAVE_TPACKET3.
Thus, wrap all access to it into inline functions defined depending on
wheter HAVE_TPACKET3 is defined.

Reported-by: Mike Reeves <luke@geekempire.com>
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
netsniff-ng: Use correct parameters to show_frame_hdr()

Commit edca6174b09 ("dissector: Restore paket type if capturing from
nlmon device") changed the signature of show_frame_hdr(). The call to
this function was not updated in the !HAVE_TPACKET3 part of netsniff-ng
introduced in commit 97e6f994785c ("netsniff-ng: Restore tpacket v2
capturing"), causing a compile error. Fix this by providing the correct
parameters to show_frame_hdr() also in this case.

Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
netsniff-ng: Protect all access to tpacket v3 structs and constants (this time for real)

Commit 0fab564a98d1 ("netsniff-ng: Properly wrap usage of all tpacket v3
structs") took care of protecting _some_ tpacket v3 structures with
compile error when building with !HAVE_TPACKET3 (reported by Mike
Reeves):

>   CC  ring_rx.c
> ring_rx.c: In function 'setup_rx_ring_layout':
> ring_rx.c:124: warning: implicit declaration of function 'set_sockopt_tpacket_v3'
> ring_rx.c: In function 'sock_rx_net_stats':
> ring_rx.c:194: error: field 'k3' has incomplete type
> make: *** [netsniff-ng/ring_rx.o] Error 1

Many thanks to Mike for helping me sort out these problems.

Reported-by: Mike Reeves <luke@geekempire.com>
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
dissectors: Remove unnecessary includes of dissector_eth.h

dissector_eth.h is only used in dissectors which need to manipulate the
eth_lay2 and eth_lay3 hash tables. Remove the include from all
dissectors that don't access them.

Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
build: Add build flag to enable sparse checking of C source files

Similar to the 'make C=1' for the Linux kernel, wire up the sparse
command for our build system in a similar fashion. Use 'make C=1 [tool]'
to check the source files using sparse. Of course, the sparse tool needs
to be installed and available in your $PATH for this to work.

Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
netsniff-ng: Conditionally define POLLRDNORM where it is used

Instead of defining POLLRDNORM in built_in.h if it isn't provided by
system/kernel headers, define it in ring.h where its only user is. This
way we make sure that <poll.h> is included before checking #ifndef
POLLRDNORM. This fixes the following sparse warning:

/usr/include/bits/poll.h:32:10: warning: preprocessor token POLLRDNORM redefined
built_in.h:378:10: this was the original definition

Also remove the defines for POLLWRNORM and POLLRDHUP which are not used
anywhere in the code.

Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
geoip: Use NULL instead of integer to initialize pointers

Fixes the following sparse warnings:

geoip.c:76:30: warning: Using plain integer as NULL pointer
geoip.c:78:30: warning: Using plain integer as NULL pointer

Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
conf: oui: update oui.conf

Update oui.conf using oui-update.py

Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
dissectors: Include protos.h in some dissectors for protocol ops declaration

Fixes sparse warnings like the following in some dissectors:

proto_arp.c:158:17: warning: symbol 'arp_ops' was not declared. Should it be static?

Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
Merge remote-tracking branch 'upstream/master'