Enum BpfExpr 

pub enum BpfExpr {
    And(Box<Self>, Box<Self>),
    Or(Box<Self>, Box<Self>),
    Not(Box<Self>),
    IpProto(u8),
    Ip,
    Ip6,
    Arp,
    Host {
        dir: Dir,
        net: IpNet,
    },
    Net {
        dir: Dir,
        net: IpNet,
    },
    Port {
        dir: Dir,
        range: PortRange,
    },
    Len {
        op: CmpOp,
        val: u32,
    },
}

A compiled BPF expression tree.

Construct with parse and evaluate per-packet with BpfExpr::eval.

Variants

And(Box<Self>, Box<Self>)

Both sub-expressions must match.

Or(Box<Self>, Box<Self>)

Either sub-expression must match.

Not(Box<Self>)

Sub-expression must not match.

IpProto(u8)

IP protocol number (tcp=6, udp=17, icmp=1, icmp6=58, proto N).

Ip

IPv4 packet (ip keyword).

Ip6

IPv6 packet (ip6 keyword).

Arp

ARP frame (arp keyword). Best-effort: matches any non-IP packet (i.e. packets for which etherparse produces no flow key).

Host

Exact host or prefix match on one or both endpoints.

Fields

dir: Dir

net: IpNet

Net

Network prefix (CIDR) match on one or both endpoints.

Fields

dir: Dir

net: IpNet

Port

Port or port-range match (TCP/UDP only; silently passes other protocols).

Fields

dir: Dir

range: PortRange

Len

Captured-length comparison (len > N, len <= N, …).

Fields

op: CmpOp

val: u32

Implementations

impl BpfExpr

pub fn eval(&self, meta: &PacketMeta) -> bool

Evaluate this expression against packet metadata.

Returns true if the packet passes the filter.

Trait Implementations

impl Clone for BpfExpr

fn clone(&self) -> BpfExpr

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for BpfExpr

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.