Under what conditions are shifts defined in the filter language?

[kbara]

Optimization breaks matching on these filters: 2147483648 >> 11 = 1048576 and 1 << 31 = 2147483648 and 4294967295 << 31 = 2147483648

1 == 1 and 1 << 31 = 0x80000000 and 3 << 31 = 0x80000000

The second is a minimized version of the first. Further minimization, by removing any clause or by making the 3 << 31 smaller, appear to make the problem disappear.

3 << 31 is valid C, assuming unsigned 32-bit types. Is it valid libpcap filter language?

[kbara]

libpcap version 1.5.3

% tcpdump  -ntr ../tests/data/tcp-ack-66-bytes.pcap '1 == 1 and 1 << 31 = 0x80000000 and 3 << 31 = 0x80000000'
reading from file ../tests/data/tcp-ack-66-bytes.pcap, link-type EN10MB (Ethernet)
% 

% tcpdump -O -ntr ../tests/data/tcp-ack-66-bytes.pcap '1 == 1 and 1 << 31 = 0x80000000 and 3 << 31 = 0x80000000' 
reading from file ../tests/data/tcp-ack-66-bytes.pcap, link-type EN10MB (Ethernet)
IP 149.174.156.93.54192 > 178.79.150.233.80: Flags [.], ack 3209860838, win 31, options [nop,nop,TS val 2756387939 ecr 4173199779], length 0
`` 

[infrastation]

This reproduces as described on the current master branch.

[tenarchits]

The optimizer bug is fixed by #972.

[guyharris]

#972 merged.