[tcpdump-workers] BPF_COP support for libpcap

Mindaugas Rasiukevicius rmind at noxt.eu
Thu May 7 15:52:52 EDT 2015


A while ago NetBSD gained support for BPF_COP instruction, see [1] for
more details.  However, now there are use cases of it outside the NetBSD
kernel, e.g. standalone NPF packet filter running as a program on Linux.
Hence I would like to add the support for the BPF_COP instruction to the
pcap_compile() and pcap_dump() of the libpcap library.

Here is the preliminary patch:


- Is that something we could include into the mainstream repository?
  Please note that it does not add BPF coprocessor support to the
  byte-code interpreter itself.  If that seems desirable, I can easily
  add NetBSD's bpf_filter_ext() API.

- As there are users who want to pcap_compile() an expression with BPF_COP
  on Linux, can we expose BPF_COP or make it otherwise available for the
  systems where this instruction would not be in the net/bpf.h header?


[1] http://mail-index.netbsd.org/tech-net/2013/08/22/msg004197.html


More information about the tcpdump-workers mailing list