blob: 1dd9373b8df9c3250c52cb0dfbad186d1fba551a (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
|
#include <doctest/doctest.h>
#include <pcap.h>
#include "wireframe/filter.hpp"
namespace {
// pcap_open_dead() creates a handle that isn't attached to any real
// interface - exactly what pcap_compile() needs (linktype + snaplen)
// without requiring root or a live device.
struct DeadHandle {
pcap_t* handle;
explicit DeadHandle(int datalink) : handle(pcap_open_dead(datalink, 65535)) {}
~DeadHandle() {
if (handle) pcap_close(handle);
}
};
} // namespace
TEST_CASE("compile_filter accepts a valid tcpdump-style expression") {
DeadHandle dead(DLT_EN10MB);
REQUIRE(dead.handle != nullptr);
bpf_program prog{};
auto err = wireframe::compile_filter(dead.handle, "tcp port 80", &prog);
CHECK_FALSE(err.has_value());
pcap_freecode(&prog);
}
TEST_CASE("compile_filter accepts a compound expression") {
DeadHandle dead(DLT_EN10MB);
REQUIRE(dead.handle != nullptr);
bpf_program prog{};
auto err = wireframe::compile_filter(dead.handle, "host 10.0.0.1 and not icmp", &prog);
CHECK_FALSE(err.has_value());
pcap_freecode(&prog);
}
TEST_CASE("compile_filter rejects invalid syntax with an error message") {
DeadHandle dead(DLT_EN10MB);
REQUIRE(dead.handle != nullptr);
bpf_program prog{};
auto err = wireframe::compile_filter(dead.handle, "this is not a valid filter !!", &prog);
REQUIRE(err.has_value());
CHECK_FALSE(err->empty());
}
TEST_CASE("compile_filter works against DLT_RAW, not just Ethernet") {
DeadHandle dead(DLT_RAW);
REQUIRE(dead.handle != nullptr);
bpf_program prog{};
auto err = wireframe::compile_filter(dead.handle, "udp", &prog);
CHECK_FALSE(err.has_value());
pcap_freecode(&prog);
}
TEST_CASE("compile_filter rejects an Ethernet-only expression against DLT_RAW") {
DeadHandle dead(DLT_RAW);
REQUIRE(dead.handle != nullptr);
bpf_program prog{};
// "ether" primitives are meaningless without a link-layer header.
auto err = wireframe::compile_filter(dead.handle, "ether host 00:11:22:33:44:55", &prog);
CHECK(err.has_value());
}
|