Report a warning for unkown link-layer header types on Linux and Windows.

That should help us fix those cases, by reporting the OS's link-layer
type value.

2 files changed, 30 insertions, 3 deletions

diff --git a/pcap-linux.c b/pcap-linux.c
index dd8795e5..0f7e47d5 100644
--- a/pcap-linux.c
+++ b/pcap-linux.c
@@ -3760,6 +3760,7 @@ activate_new(pcap_t *handle, int is_any_device)
 {
 	struct pcap_linux *handlep = handle->priv;
 	const char		*device = handle->opt.device;
+	int			status = 0;
 	int			sock_fd, arptype;
 #ifdef HAVE_PACKET_AUXDATA
 	int			val;
@@ -3863,6 +3864,10 @@ activate_new(pcap_t *handle, int is_any_device)
 			 * type we can only determine by using
 			 * APIs that may be different on different
 			 * kernels) - reopen in cooked mode.
+			 *
+			 * If the type is unknown, return a warning;
+			 * map_arphrd_to_dlt() has already set the
+			 * warning message.
 			 */
 			if (close(sock_fd) == -1) {
 				pcap_fmt_errmsg_for_errno(handle->errbuf,
@@ -3932,6 +3937,12 @@ activate_new(pcap_t *handle, int is_any_device)
 			    handle->linktype != DLT_LINUX_LAPD &&
 			    handle->linktype != DLT_NETLINK)
 				handle->linktype = DLT_LINUX_SLL;
+			if (handle->linkype == -1) {
+				pcap_snprintf(handle->errbuf, PCAP_ERRBUF_SIZE,
+				    "unknown arptype %d, defaulting to cooked mode",
+				    arptype);
+				status = PCAP_WARNING;
+			}
 		}
 
 		handlep->ifindex = iface_get_id(sock_fd, device,
@@ -4111,7 +4122,7 @@ activate_new(pcap_t *handle, int is_any_device)
 	}
 #endif /* defined(SO_BPF_EXTENSIONS) && defined(SKF_AD_VLAN_TAG_PRESENT) */
 
-	return 0;
+	return status;
 }
 
 #ifdef HAVE_PACKET_RING
diff --git a/pcap-npf.c b/pcap-npf.c
index 4c0c5db8..b6c78f89 100644
--- a/pcap-npf.c
+++ b/pcap-npf.c
@@ -883,6 +883,7 @@ pcap_activate_npf(pcap_t *p)
 	struct pcap_win *pw = p->priv;
 	NetType type;
 	int res;
+	int status = 0;
 	char errbuf[PCAP_ERRBUF_SIZE+1];
 
 	if (p->opt.rfmon) {
@@ -1023,7 +1024,22 @@ pcap_activate_npf(pcap_t *p)
 #endif
 
 	default:
-		p->linktype = DLT_EN10MB;			/*an unknown adapter is assumed to be ethernet*/
+		/*
+		 * An unknown medium type is assumed to supply Ethernet
+		 * headers; if not, the user will have to report it,
+		 * so that the medium type and link-layer header type
+		 * can be determined.  If we were to fail here, we
+		 * might get the link-layer type in the error, but
+		 * the user wouldn't get a capture, so we wouldn't
+		 * be able to determine the link-layer type; we report
+		 * a warning with the link-layer type, so at least
+		 * some programs will report the warning.
+		 */
+		p->linktype = DLT_EN10MB;
+		pcap_snprintf(p->errbuf, PCAP_ERRBUF_SIZE,
+		    "Unknown NdisMedium value %d, defaulting to DLT_EN10MB",
+		    type.LinkType);
+		status = PCAP_WARNING;
 		break;
 	}
 
@@ -1238,7 +1254,7 @@ pcap_activate_npf(pcap_t *p)
 	 */
 	p->handle = pw->adapter->hFile;
 
-	return (0);
+	return (status);
 bad:
 	pcap_cleanup_npf(p);
 	return (PCAP_ERROR);