Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-03 23:28:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Reformat the world

Browse source
This commit is contained in:
Tim Wojtulewicz 2021-09-16 15:35:39 -07:00
parent 194cb24547
commit b2f171ec69
714 changed files with 35149 additions and 35203 deletions
Download patch file Download diff file Expand all files Collapse all files

29
src/iosource/BPF_Program.h
View file

@ -4,17 +4,20 @@
#include <stdint.h>
extern "C" {
extern "C"
{
#include <pcap.h>
}
}
namespace zeek::iosource::detail {
namespace zeek::iosource::detail
{
// BPF_Programs are an abstraction around struct bpf_program,
// to create a clean facility for creating, compiling, and
// freeing such programs.
class BPF_Program {
class BPF_Program
{
public:
// Creates an empty, uncompiled BPF program.
BPF_Program();
@ -23,24 +26,22 @@ public:
// Creates a BPF program for the given pcap handle.
// Parameters are like in pcap_compile(). Returns true
// for successful compilation, false otherwise.
bool Compile(pcap_t* pcap, const char* filter, uint32_t netmask,
char* errbuf = nullptr, unsigned int errbuf_len = 0,
bool optimize = true);
bool Compile(pcap_t* pcap, const char* filter, uint32_t netmask, char* errbuf = nullptr,
unsigned int errbuf_len = 0, bool optimize = true);
// Creates a BPF program when no pcap handle is around,
// similarly to pcap_compile_nopcap(). Parameters are
// similar. Returns true on success.
bool Compile(int snaplen, int linktype, const char* filter,
uint32_t netmask, char* errbuf = nullptr, unsigned int errbuf_len = 0,
bool optimize = true);
bool Compile(int snaplen, int linktype, const char* filter, uint32_t netmask,
char* errbuf = nullptr, unsigned int errbuf_len = 0, bool optimize = true);
// Returns true if this program currently contains compiled
// code, false otherwise.
bool IsCompiled() { return m_compiled; }
bool IsCompiled() { return m_compiled; }
// Returns true if this program matches any packets. This is not
// comprehensive, but can identify a few cases where it does.
bool MatchesAnything() { return m_matches_anything; }
bool MatchesAnything() { return m_matches_anything; }
// Accessor to the compiled program. Returns nil when
// no program is currently compiled.
@ -54,6 +55,6 @@ protected:
bool m_compiled;
bool m_matches_anything;
struct bpf_program m_program;
};
};
} // namespace zeek::iosource::detail
} // namespace zeek::iosource::detail