-
Notifications
You must be signed in to change notification settings - Fork 0
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[feature] Support for gzip compressed files in pcap source #31
[feature] Support for gzip compressed files in pcap source #31
Conversation
@@ -248,13 +262,13 @@ func testCaptureMethods(t *testing.T, fn func(t *testing.T, src *Source)) { | |||
} | |||
} | |||
|
|||
//go:embed testdata/* | |||
var pcaps embed.FS |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@els0r Don't know if you ever used this, but I stumbled across it while doing mock test extension on goProbe. It's a really nice and easy way to embed test files from the repository (e.g. pcap files) inside the test binary (which makes it portable) without having to rely on crude mechanisms like base-64 embedding in .go
files: https://pkg.go.dev/embed
// Parse the main header | ||
if err := obj.read(obj.buf); err != nil { | ||
return nil, err | ||
} | ||
|
||
// If required, swap endianess as defined here: | ||
// https://wiki.wireshark.org/Development/LibpcapFileFormat | ||
obj.header = *(*Header)(unsafe.Pointer(&obj.buf[0])) | ||
obj.header = *(*Header)(unsafe.Pointer(&obj.buf[0])) // #nosec G103 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Unrelated, but I started to audit the unsafe
use as suggested by the Linter (basically telling it "I know what I'm doing here"), will do the same everywhere else soon.
obj := Source{ | ||
Reader: r, | ||
reader: bufio.NewReader(r), |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Wrapped the "normal" io.Reader
in a buffered one in order to support peeking ahead (probably also increasing performance for large files).
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🚀
Closes #30