[feature] Support for gzip compressed files in pcap source #31
Conversation
| @@ -248,13 +262,13 @@ func testCaptureMethods(t *testing.T, fn func(t *testing.T, src *Source)) { | |||
| } | |||
| } | |||
|
|
|||
| //go:embed testdata/* | |||
| var pcaps embed.FS | |||
There was a problem hiding this comment.
@els0r Don't know if you ever used this, but I stumbled across it while doing mock test extension on goProbe. It's a really nice and easy way to embed test files from the repository (e.g. pcap files) inside the test binary (which makes it portable) without having to rely on crude mechanisms like base-64 embedding in .go files: https://pkg.go.dev/embed
| // Parse the main header | ||
| if err := obj.read(obj.buf); err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| // If required, swap endianess as defined here: | ||
| // https://wiki.wireshark.org/Development/LibpcapFileFormat | ||
| obj.header = *(*Header)(unsafe.Pointer(&obj.buf[0])) | ||
| obj.header = *(*Header)(unsafe.Pointer(&obj.buf[0])) // #nosec G103 |
There was a problem hiding this comment.
Unrelated, but I started to audit the unsafe use as suggested by the Linter (basically telling it "I know what I'm doing here"), will do the same everywhere else soon.
| obj := Source{ | ||
| Reader: r, | ||
| reader: bufio.NewReader(r), |
There was a problem hiding this comment.
Wrapped the "normal" io.Reader in a buffered one in order to support peeking ahead (probably also increasing performance for large files).
Closes #30