[RFC] USBdump patches

[Andrew Thompson]

On 24 November 2010 18:46, Weongyo Jeong <weongyo.jeong at gmail.com> wrote:
> On Wed, Nov 24, 2010 at 01:59:47PM +1300, Andrew Thompson wrote:
>> On 24 November 2010 13:36, Jung-uk Kim <jkim at freebsd.org> wrote:
>> > On Tuesday 23 November 2010 07:18 pm, Weongyo Jeong wrote:
>> >>    - BPF was normally for ethernet frames (most operations were
>> >> based on mbuf including the machine filter and there were a lot of
>> >> assumptions the input buffer is mbuf type.  For example, handling
>> >> BPF_LD|BPF_W|BPF_ABS).  However the USB packet isn't like mbuf
>> >> style that it's just a linear buffer.  So the most important code
>> >> or assumption wasn't compatible.
>> >
>> > BPF can deal with linear buffer just fine.  For example, ng_bpf(4)
>> > does it.  Please see sys/netgraph/ng_bpf.c.
>> >
>> >>    - Just making the patch for BPF code, it looked like a trick or
>> >> a hack to me because I couldn't define what BPF should be.
>> >
>> > If you don't want to touch bpf.c for some reason, netgraph(4) (->
>> > ng_bpf) may be an alternate solution for you.
>> >
>> >>    - I could not define BPF exactly myself that what BPF should
>> >> cover. I agreed with that BPF is for ethernet packet filtering but
>> >> could not make sure myself that BPF could cover USB packets.
>> >
>> > BPF is a generic packet filter machine, i.e., bytecode is generic
>> > enough for any type of data stream.
>>
>> I agree that this is the best way forward, if it can be achieved.
>
> Attached is what I really wanted to do.  USB pf is greatly simplified
> and perfectly satisfy me.  It'll fully benefit from changes of BPF code.
>
> I'll commit this version into HEAD if no objections.

Looks good. Is this compatible with the wireshark pcap format?


Andrew