Changeset c681e86

Timestamp:

06/22/04 17:23:07 (17 years ago)

Author:

Daniel Lawson <dlawson@…>

Branches:

4.0.1-hotfixes, cachetimestamps, develop, dpdk-ndag, etsilive, getfragoff, help, libtrace4, master, ndag_format, pfring, rc-4.0.1, rc-4.0.2, rc-4.0.3, rc-4.0.4, ringdecrementfix, ringperformance, ringtimestampfixes

Children:

a9d9fd6

Parents:

c792590

Message:

updated to allow bpf filters on arbitrary data

Location:

lib

Files:

• Makefile (modified) (1 diff)
• libtrace.h (modified) (3 diffs)
• trace.c (modified) (4 diffs)

lib/Makefile

@@ -10 +10 @@
 
 CURRENT=1
-REVISION=2
+REVISION=3
 AGE=0
 

lib/libtrace.h

@@ -261 +261 @@
  * @author Perry Lorier
  * @note Due to this being a header capture, or anonymisation, this may not
- * be the same size as the original packet.  See getLen() for the original
+ * be the same size as the original packet.  See get_wire_length() for the original
  * size of the packet.
  * @note This can (and often is) different for different packets in a trace!
@@ -305 +305 @@
                 struct libtrace_t *libtrace,
                 void *buffer,
-                int buflen);
+                int buflen);    
 
 /** Get the destination MAC addres
@@ -347 +347 @@
                         void *buffer, int *size);
 
+/** setup a BPF filter
+ * @param libtrace the libtrace opaque pointer
+ * @param filterstring a char * containing the bpf filter string
+ * @returns null
+ * @author Daniel Lawson
+ */
+void libtrace_bpf_setfilter(struct libtrace_t *trace, char *filterstring);
+
+/** apply a BPF filter
+ * @param libtrace the libtrace opaque pointer
+ * @param buffer a pointer to a filled buffer
+ * @param buflen the length of the buffer
+ * @returns the return value from bpf_filter
+ * @author Daniel Lawson
+ */
+int libtrace_bpf_filter(struct libtrace_t *trace, 
+                        void *buffer, 
+                        int buflen);
+
+
 #endif // _LIBTRACE_H_

lib/trace.c

@@ -28 +28 @@
 #include "libtrace.h"
 #include "fifo.h"
+
+#include <net/bpf.h>
+#include <pcap.h>
 
 #include "dagformat.h"
@@ -61 +64 @@
                 int size;
         } packet;
+        struct bpf_insn *filter;
+        char * filterstring;
         double last_ts;
         double start_ts;
@@ -687 +692 @@
         struct pcap_pkthdr *pcapptr = 0;
         uint64_t ts;
-        uint32_t seconds;
+        //uint32_t seconds;
         switch (libtrace->format) {
                 case PCAPINT:
@@ -994 +999 @@
         assert(0);
 }
+
+/** apply a BPF filter
+ * @param libtrace the libtrace opaque pointer
+ * @param filterstring a char * containing the bpf filter string
+ * @returns null
+ * 
+ * @author Daniel Lawson
+ */
+void libtrace_bpf_setfilter(struct libtrace_t *trace, char *filterstring) {
+        trace->filterstring = strdup(filterstring);
+}
+
+/** apply a BPF filter
+ * @param libtrace the libtrace opaque pointer
+ * @param buffer a pointer to a filled buffer
+ * @param buflen the length of the buffer
+ * @returns 0 if the filter fails, 1 if it succeeds
+ * @author Daniel Lawson
+ */
+int libtrace_bpf_filter(struct libtrace_t *trace, 
+                        void *buffer, 
+                        int buflen) {
+        
+        int linktype = get_link_type(trace,buffer,buflen);
+        void *linkptr = get_link(trace,buffer,buflen);  
+        int clen = get_capture_length(trace,buffer,buflen);
+
+        if (trace->filterstring && ! trace->filter) {
+                pcap_t *pcap;
+                struct bpf_program bpfprog;
+
+                switch (linktype) {
+                        case TYPE_ETH:
+                                pcap = pcap_open_dead(DLT_EN10MB, 1500);
+                                break;
+                        default:
+                                printf("only works for ETH at the moment\n");
+                                assert(0);
+                }               
+
+                // build filter
+                if (pcap_compile( pcap, &bpfprog, trace->filterstring, 1, 0)) {
+                        printf("bpf compilation error: %s\n", 
+                                pcap_geterr(pcap));
+                        assert(0);
+                }
+                pcap_close(pcap);
+                trace->filter = bpfprog.bf_insns;       
+        }
+
+        return bpf_filter(trace->filter, linkptr, clen, clen);
+}
+
+