Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge branch 'master' of https://github.com/rdenniston/zeek

Browse source 
* 'master' of https://github.com/rdenniston/zeek:
  Add linux netfilter NFLOG capture functionality initial commit

I made modifications:

  - Formatting / code style

  - More error handling and validity checks

  - The Type and Length value of TLVs is technically host order

  - Changed / fixed the Length value padding check: it's generally
    32-bit alignment, not just aligning any TLV less than 8 bytes.
This commit is contained in:
Jon Siwek 2019-03-19 19:12:47 -07:00
commit a262ed8d9c
9 changed files with 132 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

16
src/iosource/pcap/Source.cc
View file

@ -247,10 +247,20 @@ bool PcapSource::SetFilter(int index)
return false;
}
if ( pcap_setfilter(pd, code->GetProgram()) < 0 )
if ( LinkType() == DLT_NFLOG )
{
PcapError();
return false;
// No-op, NFLOG does not support BPF filters.
// Raising a warning might be good, but it would also be noisy
// since the default scripts will always attempt to compile
// and install a default filter
}
else
{
if ( pcap_setfilter(pd, code->GetProgram()) < 0 )
{
PcapError();
return false;
}
}
#ifndef HAVE_LINUX