NAME

structs_type_bpf — structs types for BPF programs

LIBRARY

PDEL Library (libpdel, -lpdel)

SYNOPSIS

#include <sys/types.h>
#include <sys/time.h>
#include <net/bpf.h>
#include <pdel/structs/structs.h>
#include <pdel/structs/type/bpf.h>

BPF_STRUCTS_TYPE(linktype, compiler);

DESCRIPTION

The BPF_STRUCTS_TYPE() macro defines a structs(3) type for BPF programs. The data structure described by the type is a struct structs_bpf:

struct structs_bpf {
    const char         *ascii;   /* ascii form of program */
    struct bpf_program bpf;      /* compiled bpf program */
    int                linktype; /* bpf link type */
    int                _refs;    /* ref count: don't touch! */
};

The linktype should be a BPF data-link level type codes, e.g., DLT_EN10MB.

The compiler is a pointer to a function having this type:

typedef int structs_bpf_compile_t(const char *string,
                struct bpf_program *bpf, int linktype,
                char *ebuf, size_t emax);

This function should compile the tcpdump(8) string string and fill out the structure pointed to by bpf. The bpf->bf_insns array should be allocated with NULL typed_mem(3) memory type (to be consistent with pcap(3)). In case of an error, compiler should return -1 with errno set appropriately, and it may also fill in ebuf, which has size emax, with a ' '-terminated error message.

If compiler is NULL, then attempts to convert from ASCII will return the error ENOTSUPP.

EXAMPLES

Here is a sample compiler function using pcap(3):

int
my_bpf_compiler(const char *string, struct bpf_program *bpf,
    int linktype, char *ebuf, size_t emax)
{
    pcap_t *pcap;

    memset(bpf, 0, sizeof(*bpf));
    if ((pcap = pcap_open_dead(linktype, 2048)) == NULL)
	return (-1);
    if (pcap_compile(pcap, bpf, (char *)string, 1, ~0) != 0) {
	strlcpy(ebuf, pcap_geterr(pcap), emax);
	pcap_close(pcap);
	errno = EINVAL;
	return (-1);
    }
    pcap_close(pcap);
    return (0);
}

SEE ALSO

libpdel(3), pcap(3), structs(3), structs_type(3), typed_mem(3)

HISTORY

The PDEL library was developed at Packet Design, LLC. http://www.packetdesign.com/

AUTHORS

Archie Cobbs ⟨archie@freebsd.org⟩