Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-07 00:58:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Minor cleanup in BPF filtering code

Browse source
This commit is contained in:
Tim Wojtulewicz 2022-08-12 09:13:26 -07:00
parent 072158d4b6
commit 767c83ede8
3 changed files with 33 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

45
src/iosource/BPF_Program.h
View file

@ -4,6 +4,7 @@
#include <cstdint>
#include <string>
#include "zeek/util.h"
extern "C"
{
@ -20,32 +21,44 @@ namespace zeek::iosource::detail
class BPF_Program
{
public:
// Creates an empty, uncompiled BPF program.
/**
* Creates an empty, uncompiled BPF program.
*/
BPF_Program();
~BPF_Program();
// Creates a BPF program for the given pcap handle.
// Parameters are like in pcap_compile(). Returns true
// for successful compilation, false otherwise.
/**
* Creates a BPF program for a given pcap handle. The parameters match the usage
* described in the documentation for pcap_compile().
*
* @return true on successful compilation, false otherwise.
*/
bool Compile(pcap_t* pcap, const char* filter, uint32_t netmask, std::string& errbuf,
bool optimize = true);
// Creates a BPF program when no pcap handle is around,
// similarly to pcap_compile_nopcap(). Parameters are
// similar. Returns true on success.
bool Compile(int snaplen, int linktype, const char* filter, uint32_t netmask,
/**
* Creates a BPF program when no pcap handle is available. The parameters match the usage
* described in the documentation for pcap_compile_nopcap().
*
* @return true on successful compilation, false otherwise.
*/
bool Compile(zeek_uint_t snaplen, int linktype, const char* filter, uint32_t netmask,
std::string& errbuf, bool optimize = true);
// Returns true if this program currently contains compiled
// code, false otherwise.
/**
* Returns true if this program currently contains compiled code, false otherwise.
*/
bool IsCompiled() { return m_compiled; }
// Returns true if this program matches any packets. This is not
// comprehensive, but can identify a few cases where it does.
/**
* Returns true if this program matches any packets. This is not comprehensive, but can
* identify a few cases where it does.
*/
bool MatchesAnything() { return m_matches_anything; }
// Accessor to the compiled program. Returns nil when
// no program is currently compiled.
/**
* Returns the compiled program, or nullptr if no program is currently compiled.
*/
bpf_program* GetProgram();
protected:
@ -53,8 +66,8 @@ protected:
// (I like to prefix member variables with m_, makes it clear
// in the implementation whether it's a global or not. --ck)
bool m_compiled;
bool m_matches_anything;
bool m_compiled = false;
bool m_matches_anything = false;
struct bpf_program m_program;
};