Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-09 18:18:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Use better data structure for storing BPF filters.

Browse source
This commit is contained in:
Robin Sommer 2015-11-23 19:55:02 -08:00
parent 17bc615467
commit c22a6f67d2
3 changed files with 22 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

9
src/iosource/pcap/functions.bif
View file

@ -21,6 +21,15 @@ module Pcap;
## pcap_error
function precompile_pcap_filter%(id: PcapFilterID, s: string%): bool
%{
if ( id->AsEnum() >= 100 )
{
// We use a vector as underlying data structure for fast
// lookups and limit the ID space so that that doesn't grow too
// large.
builtin_error(fmt("PCAP filter ids must remain below 100 (is %ld)", id->AsInt()));
return new Val(false, TYPE_BOOL);
}
bool success = true;
const iosource::Manager::PktSrcList& pkt_srcs(iosource_mgr->GetPktSrcs());