Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-10 10:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Minor cleanup in BPF filtering code

Browse source
This commit is contained in:
Tim Wojtulewicz 2022-08-12 09:13:26 -07:00
parent 072158d4b6
commit 767c83ede8
3 changed files with 33 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

6
src/iosource/BPF_Program.cc
View file

@ -71,7 +71,7 @@ static bool filter_matches_anything(const char* filter)
return (! filter) || strlen(filter) == 0 || strcmp(filter, "ip or not ip") == 0;
}
BPF_Program::BPF_Program() : m_compiled(), m_matches_anything(false), m_program() { }
BPF_Program::BPF_Program() : m_program() { }
BPF_Program::~BPF_Program()
{
@ -98,7 +98,7 @@ bool BPF_Program::Compile(pcap_t* pcap, const char* filter, uint32_t netmask, st
return true;
}
bool BPF_Program::Compile(int snaplen, int linktype, const char* filter, uint32_t netmask,
bool BPF_Program::Compile(zeek_uint_t snaplen, int linktype, const char* filter, uint32_t netmask,
std::string& errbuf, bool optimize)
{
FreeCode();
@ -122,7 +122,7 @@ bool BPF_Program::Compile(int snaplen, int linktype, const char* filter, uint32_
if ( err < 0 )
errbuf = std::string(my_error);
#else
int err = pcap_compile_nopcap(snaplen, linktype, &m_program, (char*)filter, optimize, netmask);
int err = pcap_compile_nopcap(static_cast<int>(snaplen), linktype, &m_program, (char*)filter, optimize, netmask);
if ( err < 0 )
errbuf.clear();

45
src/iosource/BPF_Program.h
View file

@ -4,6 +4,7 @@
#include <cstdint>
#include <string>
#include "zeek/util.h"
extern "C"
{
@ -20,32 +21,44 @@ namespace zeek::iosource::detail
class BPF_Program
{
public:
// Creates an empty, uncompiled BPF program.
/**
* Creates an empty, uncompiled BPF program.
*/
BPF_Program();
~BPF_Program();
// Creates a BPF program for the given pcap handle.
// Parameters are like in pcap_compile(). Returns true
// for successful compilation, false otherwise.
/**
* Creates a BPF program for a given pcap handle. The parameters match the usage
* described in the documentation for pcap_compile().
*
* @return true on successful compilation, false otherwise.
*/
bool Compile(pcap_t* pcap, const char* filter, uint32_t netmask, std::string& errbuf,
bool optimize = true);
// Creates a BPF program when no pcap handle is around,
// similarly to pcap_compile_nopcap(). Parameters are
// similar. Returns true on success.
bool Compile(int snaplen, int linktype, const char* filter, uint32_t netmask,
/**
* Creates a BPF program when no pcap handle is available. The parameters match the usage
* described in the documentation for pcap_compile_nopcap().
*
* @return true on successful compilation, false otherwise.
*/
bool Compile(zeek_uint_t snaplen, int linktype, const char* filter, uint32_t netmask,
std::string& errbuf, bool optimize = true);
// Returns true if this program currently contains compiled
// code, false otherwise.
/**
* Returns true if this program currently contains compiled code, false otherwise.
*/
bool IsCompiled() { return m_compiled; }
// Returns true if this program matches any packets. This is not
// comprehensive, but can identify a few cases where it does.
/**
* Returns true if this program matches any packets. This is not comprehensive, but can
* identify a few cases where it does.
*/
bool MatchesAnything() { return m_matches_anything; }
// Accessor to the compiled program. Returns nil when
// no program is currently compiled.
/**
* Returns the compiled program, or nullptr if no program is currently compiled.
*/
bpf_program* GetProgram();
protected:
@ -53,8 +66,8 @@ protected:
// (I like to prefix member variables with m_, makes it clear
// in the implementation whether it's a global or not. --ck)
bool m_compiled;
bool m_matches_anything;
bool m_compiled = false;
bool m_matches_anything = false;
struct bpf_program m_program;
};

2
src/iosource/PktSrc.h
View file

@ -24,7 +24,7 @@ class BPF_Program;
class PktSrc : public IOSource
{
public:
static const int NETMASK_UNKNOWN = 0xffffffff;
static const uint32_t NETMASK_UNKNOWN = 0xffffffff;
/**
* Struct for returning statistics on a packet source.