mcr/libpcap — pull request #15 by markyosti (2012-11-25 02:45:31+00:00)
Title: pcap_compile abort()s when called on DLT_NFLOG interface

Anything using libpcap calling pcap_compile() on an interface like 'nflog:10' will end up abort()ed rather than receiving a meaningful error message. This patch changes gen_linktype() in gencode.c to return an error instead.

This came up while trying to use -i nflog:X with p0f, the stack trace follows:

#0 0xb7fe1424 in __kernel_vsyscall ()
#1 0xb7e8b941 in *__GI_raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#2 0xb7e8ed72 in *__GI_abort () at abort.c:92
#3 0x8002af0b in gen_linktype (proto=2048) at ./gencode.c:3409
#4 0x8002ef9d in gen_proto (v=6, proto=2, dir=0) at ./gencode.c:5819
#5 0x8002cf43 in gen_proto_abbrev (proto=6) at ./gencode.c:4758
#6 0x8003d336 in pcap_parse () at grammar.y:418
#7 0x80027daa in pcap_compile (p=0x801e00d8, program=0xbfffece4, buf=0x80049409 "tcp", optimize=1, mask=0) at ./gencode.c:457
#8 0x80006770 in prepare_bpf () at p0f.c:579
#9 0x8000914e in main (argc=3, argv=0xbfffedf4) at p0f.c:1205