Skip to content

Show the libpcap error when a BPF filter fails to compile#5022

Merged
gpotter2 merged 1 commit into
secdev:masterfrom
eugen-goebel:fix-bpf-filter-error-message
Jun 22, 2026
Merged

Show the libpcap error when a BPF filter fails to compile#5022
gpotter2 merged 1 commit into
secdev:masterfrom
eugen-goebel:fix-bpf-filter-error-message

Conversation

@eugen-goebel

Copy link
Copy Markdown
Contributor

Description

compile_filter() reported Failed to compile filter expression <filter> (-1), which gave no indication of why the filter was rejected: a syntax error (such as the not arpand not port 22 typo from the issue), or a filter incompatible with the interface link-layer type (such as a wlan filter on an Ethernet link).

Both compilation paths now go through a pcap handle and, on failure, retrieve the underlying libpcap message via pcap_geterr(). The linktype path uses pcap_open_dead(), so it still needs neither an interface nor root privileges. The exception now reads, for example:

  • Failed to compile filter expression 'wlan type mgt subtype deauth' (802.11 link-layer types supported only on 802.11)
  • Failed to compile filter expression 'not arpand not port 22' (can't parse filter expression: syntax error)

A regression test is added in test/regression.uts.

fixes #4587

Closes secdev#4587.

compile_filter() reported "Failed to compile filter expression X (-1)",
giving no hint why the filter was rejected: a syntax error, or a filter
incompatible with the link-layer type (for example a wlan filter on an
Ethernet interface).

Compile through a pcap handle in both the linktype and interface paths
(pcap_open_dead needs neither an interface nor root) and, on failure,
retrieve the message from pcap_geterr(). The exception now reads e.g.
"... (802.11 link-layer types supported only on 802.11)" or
"... (can't parse filter expression: syntax error)".

Adds a regression test in test/regression.uts.

AI-Assisted: yes (Claude Opus 4.8)
@codecov

codecov Bot commented Jun 22, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 83.33333% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 80.34%. Comparing base (14cc726) to head (e52dcb8).
⚠️ Report is 2 commits behind head on master.

Files with missing lines Patch % Lines
scapy/arch/common.py 83.33% 1 Missing ⚠️
Additional details and impacted files
@@           Coverage Diff           @@
##           master    #5022   +/-   ##
=======================================
  Coverage   80.34%   80.34%           
=======================================
  Files         386      386           
  Lines       96012    96015    +3     
=======================================
+ Hits        77137    77140    +3     
  Misses      18875    18875           
Files with missing lines Coverage Δ
scapy/arch/common.py 72.72% <83.33%> (+2.88%) ⬆️

... and 2 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@gpotter2 gpotter2 left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the PR !

@gpotter2 gpotter2 merged commit 6ba0390 into secdev:master Jun 22, 2026
22 of 25 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Incorrect Exception when linktype conflict with filter

2 participants