Skip to content

pcap_lookupnet doesn't know about rpcap devices #1550

@johnthacker

Description

@johnthacker
  • This is not a security issue (See first line).

pcap_lookupnet has special handling for a number of device names to just silently return 0, but doesn't have any handling for rpcap devices. This causes a spurious warning message with the tcpdump -f flag, and possibly could cause errors elsewhere:

$ ./build/tcpdump -d -i "rpcap://127.0.0.1/enp6s0" "vlan" -f
tcpdump: WARNING: foreign (-f) flag used but: SIOCGIFADDR: rpcap://127.0.0.1/enp6s0: No such device
(000) ldh      [12]
(001) jeq      #0x8100          jt 4	jf 2
(002) jeq      #0x88a8          jt 4	jf 3
(003) jeq      #0x9100          jt 4	jf 5
(004) ret      #262144
(005) ret      #0

A remote device that doesn't actually exist fails earlier as expected:

$ ./build/tcpdump -d -i "rpcap://127.0.0.1/nosuchdev" "vlan" -f
tcpdump: enp6s0sds: No such device exists (No such device exists)

(I suppose it could somehow query the device if possible, or succeed with a warning that the function isn't supported on remote devices, instead of silently returning 0.)

$ pcap-config --version
1.11.0-PRE-GIT

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No fields configured for Bug.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions