1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
|
Patch by David Holmes <dholmesf5@users.sourceforge.net> for ssldump >= 0.9b3 which
adds a filter to include traffic with or without the 802.1Q VLAN header.
--- ssldump-0.9b3/base/pcap-snoop.c 2014-05-04 02:20:21.000000000 +0200
+++ ssldump-0.9b3/base/pcap-snoop.c.pcap-vlan 2014-05-04 05:22:43.000000000 +0200
@@ -385,6 +385,30 @@
if(filter){
struct bpf_program fp;
+ /* (F5 patch)
+ * reformat filter to include traffic with or without the 802.1q
+ * vlan header. for example, "port 80" becomes:
+ * "( port 80 ) or ( vlan and port 80 )".
+ * note that if the filter includes the literals vlan, tagged, or
+ * untagged, then it is assumed that the user knows what she is
+ * doing, and the filter is not reformatted.
+ */
+ if ((pcap_datalink(p) == DLT_EN10MB) &&
+ (filter != NULL) &&
+ (strstr(filter,"vlan") == NULL)) {
+ char *tmp_filter;
+ char *fmt = "( (not ether proto 0x8100) and (%s) ) or ( vlan and (%s) )";
+
+ tmp_filter = (char *)malloc((strlen(filter) * 2) + strlen(fmt) + 1);
+ if (tmp_filter == NULL) {
+ fprintf(stderr,"PCAP: malloc failed\n");
+ err_exit("Aborting",-1);
+ }
+
+ sprintf(tmp_filter,fmt,filter,filter);
+ filter = tmp_filter;
+ }
+
if(pcap_compile(p,&fp,filter,0,netmask)<0)
verr_exit("PCAP: %s\n",pcap_geterr(p));
|
