Improve 'inbound'/'outbound' capture filters under Linux.

[libpcap] / pcap-linux.c

diff --git a/pcap-linux.c b/pcap-linux.c
index d4f50b7d16e323df0e8afc438eb7a2f37482ece8..c722badf5704b45021ac65c915ba3f164345a3aa 100644 (file)
--- a/pcap-linux.c
+++ b/pcap-linux.c
@@ -5403,13 +5403,19 @@ fix_offset(struct bpf_insn *p)
                 * header.
                 */
                p->k -= SLL_HDR_LEN;
+       } else if (p->k == 0) {
+               /*
+                * It's the packet type field; map it to the special magic
+                * kernel offset for that field.
+                */
+               p->k = SKF_AD_OFF + SKF_AD_PKTTYPE;
        } else if (p->k == 14) {
                /*
                 * It's the protocol field; map it to the special magic
                 * kernel offset for that field.
                 */
                p->k = SKF_AD_OFF + SKF_AD_PROTOCOL;
-       } else {
+       } else if ((bpf_int32)(p->k) > 0) {
                /*
                 * It's within the header, but it's not one of those
                 * fields; we can't do that in the kernel, so punt