pcap-common: Fix several serious ENCAP_ERF extension header writing issues
authorAnthony Coddington <anthony.coddington@endace.com>
Tue, 5 Apr 2016 06:19:59 +0000 (18:19 +1200)
committerGuy Harris <guy@alum.mit.edu>
Thu, 12 May 2016 01:46:31 +0000 (01:46 +0000)
commit5b61e9e4846971655c475b15d4e662b4d59c1f16
treea5bbbd9bc9c7589809c9d9b56076b7c5fadbb296
parent790dab15681ed75f21f470be693aad831a6af768
pcap-common: Fix several serious ENCAP_ERF extension header writing issues

Write ERF subheader after extension headers, especially important for Ethernet
(other types predate extension headers for the most part).
Add missing ERF_TYPE_MC_AAL2 and ERF_TYPE_COLOR_HASH_ETH.

Truncate final ERF extension header when too many. Rlen is not currently
adjusted so may be incorrect (see followup patch). Existing tools generally
check against PCAP incl_len anyway as there are other scenarios where this can
happen like naive snapping or Wireshark ERF-to-PCAP.
Properly fixing this will involve getting rid of the ERF pseudoheader.
Consistent with the ERF wiretap (except for different padding behaviour).

Bug: 3606
Change-Id: I6086cbc3fef948586fbad6f585f648d99adfff4f
Reviewed-on: https://code.wireshark.org/review/15358
Reviewed-by: Michael Mann <mmann78@netscape.net>
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Guy Harris <guy@alum.mit.edu>
wiretap/pcap-common.c