Class: Caper::BPFProgram

Inherits:
FFI::Struct
  • Object
show all
Includes:
FFI::DRY::StructHelper
Defined in:
lib/caper/bpf.rb

Overview

Structure for pcap_compile(), pcap_setfilter(), etc.

See bpf_program struct in pcap-bpf.h

Class Method Summary collapse

Instance Method Summary collapse

Class Method Details

.compile(expr, opts = {}) ⇒ BPFProgram

Compiles a bpf filter without a pcap device being open. Downside is no error messages are available, whereas they are when you use open_dead() and use compile() on the resulting Dead.

Parameters:

  • opts (Hash) (defaults to: {}) —

    Additional options for compile

Options Hash (opts):

  • :datalink (optional, DataLink, Integer, String, Symbol) —

    DataLink layer type. The argument type will be resolved to a DataLink value if possible. Defaults to data-link layer type NULL.

  • :snaplen (optional, Integer) —

    The snapshot length for the filter. Defaults to SNAPLEN

  • :optimize (optional, Integer) —

    Optimization flag. 0 means don’t optimize. Defaults to 1.

  • :netmask (optional, Integer) —

    A 32-bit number representing the IPv4 netmask of the network on which packets are being captured. It is only used when checking for IPv4 broadcast addresses in the filter program. Default: 0 (unspecified netmask)

Returns:

  • (BPFProgram) —

    If no errors occur, a compiled BPFProgram is returned.

Raises:



79
80
81
82
83
84
85
86
87
88
89
 
# File 'lib/caper/bpf.rb', line 79

def self.compile(expr, opts={})
  datalink = (opts[:datalink] || 1)
  dl = datalink.kind_of?(DataLink) ? datalink : DataLink.new(datalink)
  slen     = (opts[:snaplen] || DEFAULT_SNAPLEN)
  optimize = (opts[:optimize] || 1)
  mask     = (opts[:netmask] || 0)
  code = BPFProgram.new()
  r = Caper.pcap_compile_nopcap(slen, dl.value, code, expr, optimize, mask)
  raise(LibError, "pcap_compile_nopcap(): unspecified error") if r < 0
  return code
end

Instance Method Details

#free! ⇒ Object 



42
43
44
45
46
47
 
# File 'lib/caper/bpf.rb', line 42

def free!
  unless @closed
    @freed = true
    Caper.pcap_freecode(self)
  end
end

#freed? ⇒ Boolean

Returns:

  • (Boolean) 


49
50
51
 
# File 'lib/caper/bpf.rb', line 49

def freed?
  return @freed == true
end

#instructions ⇒ Object 



32
33
34
35
36
37
38
39
40
 
# File 'lib/caper/bpf.rb', line 32

def instructions
  i = 0
  sz = BPFInstruction.size()
  Array.new(self.bf_len) do 
    ins = BPFInstruction.new( self[:bf_insn] + i )
    i += sz
    ins
  end
end