If the kernel supports an older version of BPF than we do, install the

userland filter before setting the "filtering is being done in the
kernel" flag to 0, and note in a comment that we've already handed the
BPF program to the older BPF interpreter in the kernel.

diff --git a/pcap-pf.c b/pcap-pf.c
index 1df621918fc6ff9f0f312b5bd0733dac0f02538f..c8b32999e180a56830e35bf94e1c1bb76b400f5a 100644 (file)
--- a/pcap-pf.c
+++ b/pcap-pf.c
@@ -24,7 +24,7 @@
 
 #ifndef lint
 static const char rcsid[] _U_ =
-    "@(#) $Header: /tcpdump/master/libpcap/pcap-pf.c,v 1.82 2003-11-21 10:19:35 guy Exp $ (LBL)";
+    "@(#) $Header: /tcpdump/master/libpcap/pcap-pf.c,v 1.83 2003-11-21 23:28:27 guy Exp $ (LBL)";
 #endif
 
 #ifdef HAVE_CONFIG_H
@@ -483,7 +483,16 @@ pcap_setfilter_pf(pcap_t *p, struct bpf_program *fp)
                "requires bpf language %d.%d or higher; kernel is %d.%d",
                                BPF_MAJOR_VERSION, BPF_MINOR_VERSION,
                              bv.bv_major, bv.bv_minor);
-                       /* don't give up, just be inefficient */
+                       /*
+                        * Don't give up, just be inefficient.
+                        * XXX - we *did* hand a program to the kernel;
+                        * what will happen to it?  Should we do the
+                        * check *before* installing the filter?
+                        * What should we do if BIOCVERSION fails -
+                        * just do filtering in userland?
+                        */
+                       if (install_bpf_program(p, fp) < 0)
+                               return (-1);
                        p->md.use_bpf = 0;
                }
        } else {