Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-09 18:18:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Minor cleanup in BPF filtering code

Browse source
This commit is contained in:
Tim Wojtulewicz 2022-08-12 09:13:26 -07:00
parent 072158d4b6
commit 767c83ede8
3 changed files with 33 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

6
src/iosource/BPF_Program.cc
View file

@ -71,7 +71,7 @@ static bool filter_matches_anything(const char* filter)
return (! filter) || strlen(filter) == 0 || strcmp(filter, "ip or not ip") == 0; return (! filter) || strlen(filter) == 0 || strcmp(filter, "ip or not ip") == 0;
} }
BPF_Program::BPF_Program() : m_compiled(), m_matches_anything(false), m_program() { } BPF_Program::BPF_Program() : m_program() { }
BPF_Program::~BPF_Program() BPF_Program::~BPF_Program()
{ {
@ -98,7 +98,7 @@ bool BPF_Program::Compile(pcap_t* pcap, const char* filter, uint32_t netmask, st
return true; return true;
} }
bool BPF_Program::Compile(int snaplen, int linktype, const char* filter, uint32_t netmask, bool BPF_Program::Compile(zeek_uint_t snaplen, int linktype, const char* filter, uint32_t netmask,
std::string& errbuf, bool optimize) std::string& errbuf, bool optimize)
{ {
FreeCode(); FreeCode();
@ -122,7 +122,7 @@ bool BPF_Program::Compile(int snaplen, int linktype, const char* filter, uint32_
if ( err < 0 ) if ( err < 0 )
errbuf = std::string(my_error); errbuf = std::string(my_error);
#else #else
int err = pcap_compile_nopcap(snaplen, linktype, &m_program, (char*)filter, optimize, netmask); int err = pcap_compile_nopcap(static_cast<int>(snaplen), linktype, &m_program, (char*)filter, optimize, netmask);
if ( err < 0 ) if ( err < 0 )
errbuf.clear(); errbuf.clear();

45
src/iosource/BPF_Program.h
View file

@ -4,6 +4,7 @@
#include <cstdint> #include <cstdint>
#include <string> #include <string>
#include "zeek/util.h"
extern "C" extern "C"
{ {
@ -20,32 +21,44 @@ namespace zeek::iosource::detail
class BPF_Program class BPF_Program
{ {
public: public:
// Creates an empty, uncompiled BPF program. /**
* Creates an empty, uncompiled BPF program.
*/
BPF_Program(); BPF_Program();
~BPF_Program(); ~BPF_Program();
// Creates a BPF program for the given pcap handle. /**
// Parameters are like in pcap_compile(). Returns true * Creates a BPF program for a given pcap handle. The parameters match the usage
// for successful compilation, false otherwise. * described in the documentation for pcap_compile().
*
* @return true on successful compilation, false otherwise.
*/
bool Compile(pcap_t* pcap, const char* filter, uint32_t netmask, std::string& errbuf, bool Compile(pcap_t* pcap, const char* filter, uint32_t netmask, std::string& errbuf,
bool optimize = true); bool optimize = true);
// Creates a BPF program when no pcap handle is around, /**
// similarly to pcap_compile_nopcap(). Parameters are * Creates a BPF program when no pcap handle is available. The parameters match the usage
// similar. Returns true on success. * described in the documentation for pcap_compile_nopcap().
bool Compile(int snaplen, int linktype, const char* filter, uint32_t netmask, *
* @return true on successful compilation, false otherwise.
*/
bool Compile(zeek_uint_t snaplen, int linktype, const char* filter, uint32_t netmask,
std::string& errbuf, bool optimize = true); std::string& errbuf, bool optimize = true);
// Returns true if this program currently contains compiled /**
// code, false otherwise. * Returns true if this program currently contains compiled code, false otherwise.
*/
bool IsCompiled() { return m_compiled; } bool IsCompiled() { return m_compiled; }
// Returns true if this program matches any packets. This is not /**
// comprehensive, but can identify a few cases where it does. * Returns true if this program matches any packets. This is not comprehensive, but can
* identify a few cases where it does.
*/
bool MatchesAnything() { return m_matches_anything; } bool MatchesAnything() { return m_matches_anything; }
// Accessor to the compiled program. Returns nil when /**
// no program is currently compiled. * Returns the compiled program, or nullptr if no program is currently compiled.
*/
bpf_program* GetProgram(); bpf_program* GetProgram();
protected: protected:
@ -53,8 +66,8 @@ protected:
// (I like to prefix member variables with m_, makes it clear // (I like to prefix member variables with m_, makes it clear
// in the implementation whether it's a global or not. --ck) // in the implementation whether it's a global or not. --ck)
bool m_compiled; bool m_compiled = false;
bool m_matches_anything; bool m_matches_anything = false;
struct bpf_program m_program; struct bpf_program m_program;
}; };

2
src/iosource/PktSrc.h
View file

@ -24,7 +24,7 @@ class BPF_Program;
class PktSrc : public IOSource class PktSrc : public IOSource
{ {
public: public:
static const int NETMASK_UNKNOWN = 0xffffffff; static const uint32_t NETMASK_UNKNOWN = 0xffffffff;
/** /**
* Struct for returning statistics on a packet source. * Struct for returning statistics on a packet source.