Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-06 00:28:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Allow pcap pktsrc to use other BPF_Program::Compile method

Browse source
This commit is contained in:
Tim Wojtulewicz 2022-05-23 17:36:09 -07:00
parent 515e5bf8a3
commit b30d5702f6
6 changed files with 60 additions and 33 deletions
Download patch file Download diff file Expand all files Collapse all files

39
src/iosource/PktSrc.cc
View file

@ -201,35 +201,40 @@ bool PktSrc::ExtractNextPacketInternal()
return false;
}
detail::BPF_Program* PktSrc::CompileFilter(const std::string& filter)
{
std::string errbuf;
auto code = std::make_unique<detail::BPF_Program>();
if ( ! code->Compile(BifConst::Pcap::snaplen, LinkType(), filter.c_str(), Netmask(), errbuf) )
{
std::string msg = util::fmt("cannot compile BPF filter \"%s\"", filter.c_str());
if ( ! errbuf.empty() )
msg += ": " + errbuf;
Error(msg);
return nullptr;
}
return code.release();
}
bool PktSrc::PrecompileBPFFilter(int index, const std::string& filter)
{
if ( index < 0 )
return false;
char errbuf[PCAP_ERRBUF_SIZE];
// Compile filter.
auto* code = new detail::BPF_Program();
if ( ! code->Compile(BifConst::Pcap::snaplen, LinkType(), filter.c_str(), Netmask(), errbuf,
sizeof(errbuf)) )
{
std::string msg = util::fmt("cannot compile BPF filter \"%s\"", filter.c_str());
if ( *errbuf )
msg += ": " + std::string(errbuf);
Error(msg);
delete code;
auto code = CompileFilter(filter);
if ( ! code )
return false;
}
// Store it in vector.
if ( index >= static_cast<int>(filters.size()) )
filters.resize(index + 1);
if ( auto old = filters[index] )
if ( auto* old = filters[index] )
delete old;
filters[index] = code;