Changeset 5a70a80 for lib/format_pcap.c

Timestamp:

02/15/18 17:59:50 (3 years ago)

Author:

Shane Alcock <salcock@…>

Branches:

cachetimestamps, develop, etsilive, master, rc-4.0.3, rc-4.0.4, ringdecrementfix, ringperformance

Children:

9375d2e

Parents:

a857389

git-author:

Anthony Coddington <anthony.coddington@…> (02/15/18 13:44:38)

git-committer:

Shane Alcock <salcock@…> (02/15/18 17:59:50)

Message:

Silently discard ERF provenance records when writing PCAP.

Doesn't include other formats for now, which tend to only check for TRACE_TYPE_NONDATA. More thought is needed on genericizing these non-data linktype checks vs the IS_LIBTRACE_META_PACKET check in trace_write_packet() which is currently false for provenance records.
Make pcapfile, pcap and pcapint do the same checks.

File:

• lib/format_pcap.c (modified) (2 diffs)

lib/format_pcap.c

@@ -498 +498 @@
         link = trace_get_packet_buffer(packet,&linktype,&remaining);
 
+        /* Silently discard RT metadata packets and packets with an
+         * unknown linktype. */
+        if (linktype == TRACE_TYPE_NONDATA || linktype == TRACE_TYPE_UNKNOWN || linktype == TRACE_TYPE_ERF_META) {
+                return 0;
+        }
+
         /* We may have to convert this packet into a suitable PCAP packet */
 
@@ -581 +587 @@
 {
         int err;
-
-        if (trace_get_link_type(packet) == TRACE_TYPE_NONDATA)
+        libtrace_linktype_t linktype = trace_get_link_type(packet);
+
+        /* Silently discard RT metadata packets and packets with an
+         * unknown linktype. */
+        if (linktype == TRACE_TYPE_NONDATA || linktype == TRACE_TYPE_UNKNOWN || linktype == TRACE_TYPE_ERF_META) {
                 return 0;
+        }
 
         if (!OUTPUT.trace.pcap) {