STRUCTS_TYPE_BPF(3)

NAME
structs_type_bpf - structs types for BPF programs

LIBRARY
PDEL Library (libpdel, -lpdel)

SYNOPSIS
#include <sys/types.h>
#include <sys/time.h>
#include <net/bpf.h>
#include <pdel/structs/structs.h>
#include <pdel/structs/type/bpf.h>
BPF_STRUCTS_TYPE(linktype, compiler);

DESCRIPTION
The BPF_STRUCTS_TYPE() macro defines a structs(3) type for BPF programs. The data structure described by the type is a struct structs_bpf:

    struct structs_bpf {
        const char         *ascii;   /* ascii form of program */
        struct bpf_program bpf;      /* compiled bpf program */
        int                linktype; /* bpf link type */
        int                _refs;    /* ref count: don't touch! */
    };

The linktype should be a BPF data-link level type codes, e.g., DLT_EN10MB.

The compiler is a pointer to a function having this type:

    typedef int structs_bpf_compile_t(const char *string,
                    struct bpf_program *bpf, int linktype,
                    char *ebuf, size_t emax);

This function should compile the tcpdump(8) string string and fill out the structure pointed to by bpf. The bpf->bf_insns array should be allocated with NULL typed_mem(3) memory type (to be consistent with pcap(3)). In case of an error, compiler should return -1 with errno set appropriately, and it may also fill in ebuf, which has size emax, with a ' '-terminated error message.

If compiler is NULL, then attempts to convert from ASCII will return the error ENOTSUPP.

EXAMPLES
Here is a sample compiler function using pcap(3):

    int
    my_bpf_compiler(const char *string, struct bpf_program *bpf,
        int linktype, char *ebuf, size_t emax)
    {
        pcap_t *pcap;
        memset(bpf, 0, sizeof(*bpf));
        if ((pcap = pcap_open_dead(linktype, 2048)) == NULL)
    	return (-1);
        if (pcap_compile(pcap, bpf, (char *)string, 1, ~0) != 0) {
    	strlcpy(ebuf, pcap_geterr(pcap), emax);
    	pcap_close(pcap);
    	errno = EINVAL;
    	return (-1);
        }
        pcap_close(pcap);
        return (0);
    }

SEE ALSO
libpdel(3), pcap(3), structs(3), structs_type(3), typed_mem(3)

HISTORY
The PDEL library was developed at Packet Design, LLC. http://www.packetdesign.com/

AUTHORS
Archie Cobbs <archie@packetdesign.com>