NAME

LIBRARY

SYNOPSIS

BPF_STRUCTS_TYPE(linktype, compiler);

DESCRIPTION

struct structs_bpf {
    const char         *ascii;   /* ascii form of program */
    struct bpf_program bpf;      /* compiled bpf program */
    int                linktype; /* bpf link type */
    int                _refs;    /* ref count: don't touch! */
};

The linktype should be a BPF data-link level type codes, e.g., DLT_EN10MB.

The compiler is a pointer to a function having this type:

typedef int structs_bpf_compile_t(const char *string,
                struct bpf_program *bpf, int linktype,
                char *ebuf, size_t emax);

This function should compile the tcpdump(8) string string and fill out the structure pointed to by bpf. The bpf->bf_insns array should be allocated with NULL typed_mem(3) memory type (to be consistent with pcap(3)). In case of an error, compiler should return -1 with errno set appropriately, and it may also fill in ebuf, which has size emax, with a ' '-terminated error message.

If compiler is NULL, then attempts to convert from ASCII will return the error ENOTSUPP.

EXAMPLES

int
my_bpf_compiler(const char *string, struct bpf_program *bpf,
    int linktype, char *ebuf, size_t emax)
{
    pcap_t *pcap;

    memset(bpf, 0, sizeof(*bpf));
    if ((pcap = pcap_open_dead(linktype, 2048)) == NULL)
	return (-1);
    if (pcap_compile(pcap, bpf, (char *)string, 1, ~0) != 0) {
	strlcpy(ebuf, pcap_geterr(pcap), emax);
	pcap_close(pcap);
	errno = EINVAL;
	return (-1);
    }
    pcap_close(pcap);
    return (0);
}

SEE ALSO

HISTORY

AUTHORS