Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-17 14:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Finishing changes from code review.

Browse source
This commit is contained in:
Seth Hall 2020-10-13 08:35:45 -04:00
parent 5d6800f6bd
commit 92eb7c10da
2 changed files with 15 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

10
scripts/base/init-bare.zeek
View file

@ -4989,12 +4989,10 @@ export {
## of ``127.0.0.1`` or ``[::1]`` are used by loopback interfaces. ## of ``127.0.0.1`` or ``[::1]`` are used by loopback interfaces.
is_loopback: bool; is_loopback: bool;
extended_flags: bool &default=F; ## Whether the device is up. Not set when that info is unavailable.
# If the "extended_flags" field is set to T, then these next two is_up: bool &optional;
# flags will have valid settings. Otherwise, the following ## Whether the device is running. Not set when that info is unavailable.
# two fields are explicitly false. is_running: bool &optional;
is_up: bool &default=F;
is_running: bool &default=F;
}; };
type Interfaces: set[Pcap::Interface]; type Interfaces: set[Pcap::Interface];

16
src/iosource/pcap/pcap.bif
View file

@ -111,11 +111,17 @@ function findalldevs%(%): Pcap::Interfaces
pcap_if_t *alldevs, *d; pcap_if_t *alldevs, *d;
char errbuf[PCAP_ERRBUF_SIZE]; char errbuf[PCAP_ERRBUF_SIZE];
int ret = pcap_findalldevs(&alldevs, errbuf);
static auto ifaces_type = id::find_type<TableType>("Pcap::Interfaces"); static auto ifaces_type = id::find_type<TableType>("Pcap::Interfaces");
auto pcap_interfaces = make_intrusive<TableVal>(ifaces_type); auto pcap_interfaces = make_intrusive<TableVal>(ifaces_type);
int ret = pcap_findalldevs(&alldevs, errbuf);
if ( ret == PCAP_ERROR )
{
emit_builtin_error(util::fmt("Error calling pcap_findalldevs: %s", errbuf));
// Return an empty set in case of failure.
return pcap_interfaces;
}
static auto iface_type = id::find_type<RecordType>("Pcap::Interface"); static auto iface_type = id::find_type<RecordType>("Pcap::Interface");
for ( d=alldevs; d; d=d->next ) for ( d=alldevs; d; d=d->next )
{ {
@ -142,9 +148,9 @@ function findalldevs%(%): Pcap::Interfaces
r->Assign(2, addrs->ToSetVal()); r->Assign(2, addrs->ToSetVal());
r->Assign(3, val_mgr->Bool(d->flags & PCAP_IF_LOOPBACK)); r->Assign(3, val_mgr->Bool(d->flags & PCAP_IF_LOOPBACK));
#ifdef PCAP_IF_UP #ifdef PCAP_IF_UP
r->Assign(4, val_mgr->True()); // <-- "extended" vals set. // These didn't become available until libpcap 1.6.1
r->Assign(5, val_mgr->Bool(d->flags & PCAP_IF_UP)); r->Assign(4, val_mgr->Bool(d->flags & PCAP_IF_UP));
r->Assign(6, val_mgr->Bool(d->flags & PCAP_IF_RUNNING)); r->Assign(5, val_mgr->Bool(d->flags & PCAP_IF_RUNNING));
#endif #endif
pcap_interfaces->Assign(std::move(r), nullptr); pcap_interfaces->Assign(std::move(r), nullptr);