On Sep 28, 2012, at 1:48 PM, Jakub Zawadzki <darkjames-ws@xxxxxxxxxxxx> wrote:
> On Fri, Sep 28, 2012 at 01:23:16PM -0700, Gilbert Ramirez wrote:
>> Libpcap (...) has a wonderful BPF optimizing engine.
>
> With lot of bugs...
>
> http://sourceforge.net/tracker/?func=detail&aid=3054909&group_id=53067&atid=469577
> http://seclists.org/tcpdump/2011/q4/83
> http://permalink.gmane.org/gmane.network.tcpdump.devel/2265 (this one might have been fixed?)
That one might be "fixed" by not generating incorrect un-optimized code; the current code generates
(008) ldb [0]
rather than
(008) ldb [1]
when looking at the "type" subfield of the Frame Control field - that subfield is in the first octet. There might still be an underlying optimizer bug (there certainly have been ones in the past that have been fixed).