the-tcpdump-group/libpcap — pull request #391 by msekletar (2014-11-03 09:16:36+00:00)
Title: [RFC] Fix vlan filtering on Linux

This PR is an attempt to fix long-standing issue of vlan filtering on Linux when doing live capture.

Changes:
* Introduce ```bpf_filter1``` function
* Use BPF extensions in compiled filters

First commit introduces ```bpf_filter1``` function which implements logic previously provided by ```bpf_filter``` with additional support for BPF extensions instructions. Function takes additional argument, a pointer to ```struct bpf_aux_data``` where caller provides ancillary information needed to properly interpret BPF extensions while executing the filter in user-space. Latter function is now a wrapper for ```bpf_filter1```. Also, we make use of the new API where appropriate while at it. For now only vlan_tci and vlan_tr BPF extensions are implemented.

Second commit changes libpcap's BPF compiler in way that instead of looking up vlan information in packet we generate filter code which employs BPF extensions to implement vlan keyword. We do so only if target platform supports BPF extensions. In cases when target platform doesn't provide BPF extensions or capture device doesn't support them (i.e. savefile) we fallback to legacy approach.

Please note that this patch set wasn't well tested yet. I did some basic testing on my machine using packet generator software. tcpdump test suite is passing tough.

Also note that patch set is heavily based on prior work done by Ani Sinha