Received-SPF: pass (google.com: domain of linux-kernel+bounces-95296-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.80.249 as permitted sender) client-ip=147.75.80.249;
Message-ID: <463be980baf66b967031e3294c3b9745b07aa058.camel@sipsolutions.net>
Subject: Re: pcap-dbus.o:undefined reference to `dbus_message_demarshal'
From: Johannes Berg <johannes@sipsolutions.net>
To: Anton Ivanov <anton.ivanov@cambridgegreys.com>, Waqar Hameed
	 <waqar.hameed@axis.com>, Ingo Molnar <mingo@kernel.org>
Cc: oe-kbuild-all@lists.linux.dev, linux-kernel@vger.kernel.org, 
	kernel@axis.com, Richard Weinberger <richard@nod.at>, 
	linux-um@lists.infradead.org
Date: Thu, 07 Mar 2024 11:03:32 +0100
In-Reply-To: <87cfca1e-3f53-4935-a274-0920bce86373@cambridgegreys.com>
References: <202403052336.y6DkUd8a-lkp@intel.com> <pndzfvbibgm.fsf@axis.com>
	 <87cfca1e-3f53-4935-a274-0920bce86373@cambridgegreys.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
User-Agent: Evolution 3.50.4 (3.50.4-1.fc39) 
Precedence: bulk
MIME-Version: 1.0

On Thu, 2024-03-07 at 09:54 +0000, Anton Ivanov wrote:
>=20
> PCAP is not feasible to incorporate into the build system at present.
> It has grown all kinds of warts over the years and brings a lot of depend=
encies.
> IMHO we should remove it from the tree. It has reached a point where it c=
annot
> be built on a modern system.

I suppose it might be possible to call pcap-config? But agree that it
doesn't seem really worth investing in.

> The users who need the same functionality can produce a bpf filter using =
tcpdump
> and load it as "firmware" into the vector/raw driver.
>=20
> I am working on a pure python bpf compiler which takes the same syntax as=
 PCAP.
> It is showing signs of life and it can do some of the simpler use cases. =
Once
> that is ready, it should be possible to use that instead of pcap/tcpdump.

How's that required to be formatted and loaded? tcpdump itself can also
dump the filter in BPF format, with -d/-ddd (-dd is a C representation,
so probably not useful). Perhaps we could even automatically call
'tcpdump' at runtime?

johannes