Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Allow pcap pktsrc to use other BPF_Program::Compile method

Browse source
This commit is contained in:
Tim Wojtulewicz 2022-05-23 17:36:09 -07:00
parent 515e5bf8a3
commit b30d5702f6
6 changed files with 60 additions and 33 deletions
Download patch file Download diff file Expand all files Collapse all files

9
src/iosource/BPF_Program.h
View file

@ -2,7 +2,8 @@
#pragma once
#include <stdint.h>
#include <cstdint>
#include <string>
extern "C"
{
@ -26,14 +27,14 @@ public:
// Creates a BPF program for the given pcap handle.
// Parameters are like in pcap_compile(). Returns true
// for successful compilation, false otherwise.
bool Compile(pcap_t* pcap, const char* filter, uint32_t netmask, char* errbuf = nullptr,
unsigned int errbuf_len = 0, bool optimize = true);
bool Compile(pcap_t* pcap, const char* filter, uint32_t netmask, std::string& errbuf,
bool optimize = true);
// Creates a BPF program when no pcap handle is around,
// similarly to pcap_compile_nopcap(). Parameters are
// similar. Returns true on success.
bool Compile(int snaplen, int linktype, const char* filter, uint32_t netmask,
char* errbuf = nullptr, unsigned int errbuf_len = 0, bool optimize = true);
std::string& errbuf, bool optimize = true);
// Returns true if this program currently contains compiled
// code, false otherwise.