Fix packets with Linktype_RAW (101) not being recognized by the BPF filters correctly. (#2222)

* Fix packets with Linktype_RAW (101) not being recognized by the BPF filters correctly.

This fixes a regression during the transition to a non-libpcap parser described in #2221, where filters would stop working for packets of type RAW.
The change also restores a test to keep track of the behaviour, with the change being that the packets are now reported as platform agnostic type (LINKTYPE_RAW) instead of the platform specific type (LINKTYPE_DLT_RAW), and only perform the conversion internally.

* Add suppression for unused function warning.

* Fix typos.

* Fix attribute definition.

* Update patch to be under use pcap macro.

* Fix comment wording.

Author: Dimi1010

Pcap++/src/PcapFilter.cpp

@@ -17,7 +17,6 @@
 
 namespace pcpp
 {
-
 	static const int DEFAULT_SNAPLEN = 9000;
 
 	namespace internal
@@ -131,13 +130,42 @@ namespace pcpp
 #endif
 	}
 
+	namespace
+	{
+#ifdef USE_PCAP
+		/// @brief Applies linktype patches to ensure compatibility with BPF filters.
+		/// @param linktype The original link layer type.
+		/// @return The patched link layer type suitable for BPF filters.
+		LinkLayerType patchLinktype2dlt(LinkLayerType linktype)
+		{
+			switch (linktype)
+			{
+			// NOTE: Issue #2221
+			// Libpcap maps LINKTYPE_RAW to the old DLT_RAW. LINKTYPE_RAW is not that well supported for BPF filters.
+			// https://github.com/the-tcpdump-group/libpcap/blob/720fb235648dd06eaa5b0fc0e7b6bac84bf2bf28/pcap-common.c#L1559-L1560
+			case LinkLayerType::LINKTYPE_RAW:
+			{
+#	ifdef __OpenBSD__
+				return LinkLayerType::LINKTYPE_DLT_RAW2;  // OpenBSD uses a different DLT_RAW value.
+#	else
+				return LinkLayerType::LINKTYPE_DLT_RAW1;
+#	endif  // !__OpenBSD__
+			}
+			default:
+				return linktype;
+			}
+		}
+#endif  // USE_PCAP
+	}  // namespace
+
 	BpfFilterWrapper::BpfProgramUPtr BpfFilterWrapper::compileFilter(std::string const& filter, LinkLayerType linkType)
 	{
 		if (filter.empty())
 			return nullptr;
 
 #ifdef USE_PCAP
-		auto pcap = std::unique_ptr<pcap_t, internal::PcapCloseDeleter>(pcap_open_dead(linkType, DEFAULT_SNAPLEN));
+		auto pcap = std::unique_ptr<pcap_t, internal::PcapCloseDeleter>(
+		    pcap_open_dead(patchLinktype2dlt(linkType), DEFAULT_SNAPLEN));
 		if (pcap == nullptr)
 		{
 			return nullptr;

Tests/Pcap++Test/Tests/FilterTests.cpp

@@ -836,25 +836,69 @@ PTF_TEST_CASE(TestPcapFilters_LinkLayer)
 	// check if GeneralFilter::matches(...) work properly for packets with different LinkLayerType
 
 	// pcpp::LINKTYPE_NULL layer
-	pcpp::PcapFileReaderDevice fileReaderDev1(NULL_LOOPBACK_PCAP_PATH);
-	PTF_ASSERT_TRUE(fileReaderDev1.open());
-	pcpp::RawPacketVector rawPacketVec;
-	fileReaderDev1.getNextPackets(rawPacketVec);
-	fileReaderDev1.close();
+	{
+		pcpp::PcapFileReaderDevice fileReaderDev1(NULL_LOOPBACK_PCAP_PATH);
+		PTF_ASSERT_TRUE(fileReaderDev1.open());
+		pcpp::RawPacketVector rawPacketVec;
+		fileReaderDev1.getNextPackets(rawPacketVec);
+		fileReaderDev1.close();
+
+		int validCounter = 0;
+		for (auto* rawPacketPtr : rawPacketVec)
+		{
+			pcpp::BPFStringFilter bpfStringFilter(
+			    "len = " +
+			    std::to_string(rawPacketPtr->getRawDataLen()));  // checking against real filter, not the "" filter
+			if (bpfStringFilter.matches(*rawPacketPtr) && rawPacketPtr->getLinkLayerType() == pcpp::LINKTYPE_NULL)
+			{
+				++validCounter;
+			}
+		}
+		PTF_ASSERT_EQUAL(validCounter, 3);
+		rawPacketVec.clear();
+	}
 
+	pcpp::RawPacketVector rawPacketVec;
 	int validCounter = 0;
-	for (auto* rawPacketPtr : rawPacketVec)
+	// pcpp::LINKTYPE_RAW layer
 	{
-		pcpp::BPFStringFilter bpfStringFilter(
-		    "len = " +
-		    std::to_string(rawPacketPtr->getRawDataLen()));  // checking against real filter, not the "" filter
-		if (bpfStringFilter.matches(*rawPacketPtr) && rawPacketPtr->getLinkLayerType() == pcpp::LINKTYPE_NULL)
+		pcpp::PcapFileReaderDevice fileReaderDev1(RAW_IP_PCAP_PATH);
+		PTF_ASSERT_TRUE(fileReaderDev1.open());
+		fileReaderDev1.getNextPackets(rawPacketVec);
+		for (auto* rawPacketPtr : rawPacketVec)
 		{
-			++validCounter;
+			pcpp::Packet packet(rawPacketPtr);
+			if (pcpp::IPv4Layer* ip4layer = packet.getLayerOfType<pcpp::IPv4Layer>())
+			{
+				pcpp::BPFStringFilter bpfStringFilter(
+				    "host " +
+				    ip4layer->getDstIPAddress().toString());  // checking against real filter, not the "" filter
+				if (bpfStringFilter.matches(*rawPacketPtr))
+				{
+					if (rawPacketPtr->getLinkLayerType() == pcpp::LINKTYPE_RAW)
+					{
+						++validCounter;
+					}
+				}
+			}
 		}
+		PTF_ASSERT_EQUAL(validCounter, 50);
+		rawPacketVec.clear();
+	}
+
+	// pcpp::LINKTYPE_RAW layer with device integrated filter
+	{
+		pcpp::PcapFileReaderDevice dev(RAW_IP_PCAP_PATH);
+		PTF_ASSERT_TRUE(dev.open());
+
+		PTF_ASSERT_TRUE(dev.setFilter("ip"));
+
+		dev.getNextPackets(rawPacketVec);
+		PTF_ASSERT_EQUAL(validCounter, rawPacketVec.size());
 	}
-	PTF_ASSERT_EQUAL(validCounter, 3);
+
 	rawPacketVec.clear();
+	validCounter = 0;
 
 	// pcpp::LINKTYPE_LINUX_SLL layer
 	pcpp::PcapFileReaderDevice fileReaderDev2(SLL_PCAP_PATH);